Who was sanctioned, and for what?

The three sharing providers made it difficult for holders of a Metrebus annual pass to access the free-ride passes promised when the concessions were awarded, through inadequate organisation, cumbersome activation and long waiting times, which shortened the usable time; Bird also deactivated accounts without prior notice. The AGCM imposed fines totalling 2.675 million EUR in three proceedings (Lime 1.4 million, Dott 525,000, Bird 750,000 EUR).

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Codice del Consumo (pratiche commerciali scorrette), Verfahren PS13028, PS13029, PS13030

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

6 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

The car rental company charged customers an "administration fee" of 33.88 to 45 EUR when a rental car incurred a traffic offence – even though naming the driver is a statutory obligation of the rental company. Spain's Ministry of Social Rights, Consumer Affairs and 2030 Agenda classified this as a very serious infringement and imposed the maximum fine of 1 million EUR; a court had already declared the clause void in 2020.

Authority / court

Ministerio de Derechos Sociales, Consumo y Agenda 2030

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Artt. 82, 87.5 y 87.6 TRLGDCU (Real Decreto Legislativo 1/2007)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Repeat case

yes

Published

29 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

For refunds in the event of delays of 60 minutes or more or cancellations, Trenitalia required prior written confirmation from the call centre or ticket office. The AGCM accepted binding commitments: abolition of the confirmation requirement, strengthened refund channels, an information page on disruptions and an implementation report within three months; no infringement was found.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Codice del Consumo (impegni); EU-Fahrgastrechte im Eisenbahnverkehr

Action

Order

Status of proceedings

final

Sector

Transport, logistics and shipping

Mitigating circumstances

Binding commitments, no finding of an infringement.

Published

30 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The data protection authority had prohibited a company from tracking its three company vehicles continuously by GPS and ordered the data to be erased; narrow purposes such as theft protection while parked remained permitted. The Upravno sodišče Republike Slovenije (Administrative Court of the Republic of Slovenia) upheld this and clarified that employee consent bundled with other declarations is invalid.

Authority / court

Upravno sodišče Republike Slovenije (bekanntgemacht durch den Informacijski pooblaščenec)

Area of law

Data protection · Employee data

Legal basis

Art. 6 Abs. 1 lit. f, Art. 7 Abs. 2 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

7 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Sanctions Committee of the FSMA (Belgian Financial Services and Markets Authority) found that the shipping company Exmar NV, listed on Euronext Brussels, had not disclosed as soon as possible inside information it held on 19 May and 18 June 2020; the information related to a customer's missing payments for the charter of a floating LNG facility. It imposed a fine of 350,000 EUR and ordered publication by name for one year. Exmar has lodged an appeal with the Market Court.

Authority / court

Autoriteit voor Financiële Diensten en Markten / Autorité des services et marchés financiers (FSMA) – Sanctiecommissie

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 17 Verordnung (EU) Nr. 596/2014 (MAR); Art. 36 § 2 und Art. 72 § 3 Gesetz vom 2. August 2002 über die Aufsicht über den Finanzsektor

Action

Fine

Status of proceedings

under appeal

Sector

Transport, logistics and shipping

Checked against the official source on 2 Oct 2026 · Direct link

A processor of Berlin's public transport operator BVG, which had sent customer letters in early 2025, was hacked; around 180,000 customer records were affected, although they should long since have been deleted after the end of the contract. BVG had never checked the deletion, had not agreed any procedure for data breaches in the data processing agreement and reported the incident only after the 72-hour deadline had expired; the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI) issued a reprimand.

Authority / court

Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI)

Area of law

Data protection · Data processors

Legal basis

Art. 5 Abs. 2 i. V. m. Abs. 1 lit. c, e, f, Art. 28 Abs. 3 S. 2 lit. f, Art. 32 Abs. 1, Art. 33 DSGVO

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Mitigating circumstances

BVG has announced measures against similar incidents.

Published

4 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

In 2023 PostNL delivered only 89.48% of letters with a five-day delivery obligation under the universal postal service on time, instead of the statutory 95%. The ACM (Autoriteit Consument & Markt, Dutch competition and consumer authority) rejected the force majeure argument based on the tight labour market and imposed a fine of 6,923,000 EUR.

Authority / court

Autoriteit Consument & Markt (ACM)

Area of law

Other

Legal basis

Art. 16 Abs. 6 Postwet 2009 i. V. m. Art. 4a Postbesluit 2009

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

12 May 2026

Checked against the official source on 2 Oct 2026 · Direct link

Amsterdam-based Ridetech offered the ride-hailing app Yango in Finland and Norway and transferred data of drivers and customers to the group companies Yandex.Taxi LLC and Yandex LLC in Russia without demonstrating appropriate safeguards. The Autoriteit Persoonsgegevens (Dutch Data Protection Authority, AP) imposed 100 million EUR on the legal successor and prohibited further transfers to Russia.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection · International data transfers

Legal basis

Art. 44, Art. 46 iVm Art. 5 Abs. 1 lit. a und Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Checked against the official source on 25 Sep 2026 · Direct link

In February 2023 there was external, unauthorised access to a system operated by a processor containing data on users and employees. As lead authority, the AEPD imposed 650,000 EUR for breaching Art. 5(1)(f) GDPR, dropped the charges under Art. 32 and 34 and ordered appropriate security measures within six months. The amount and the facts have not been confirmed against the primary source.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Checked against the official source on 7 Oct 2026 · Version 2 · Direct link

During an inspection at the Passo Corese logistics centre (around 1,800 employees), the Garante (Italian data protection authority) found that, after return-to-work interviews, information on illnesses, participation in strikes, trade union activities and family circumstances of employees – irrelevant to their professional aptitude – was recorded in free-text fields of a platform linked to time recording and accessible to many managers. With immediate effect it ordered the definitive restriction of processing of these entries – also at all other sites using the platform – and of four cameras at the entrances to toilets and break areas; the investigation was continuing.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a, c und e, Art. 6, 9 und 88 DSGVO; Art. 113 Codice privacy (D.Lgs. 196/2003); Maßnahme nach Art. 58 Abs. 2 lit. f DSGVO

Action

Order

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Employees

10,000 or more

Published

24 Feb 2026

Checked against the official source on 28 Sep 2026 · Direct link

The UODO (Urząd Ochrony Danych Osobowych, Polish data protection authority) fined the parcel carrier DPD Polska sp. z o.o. a total of PLN 11,461,030. PLN 6,251,471 relates to the company using external hauliers for shipments between its depots without a data processing agreement under Art. 28(3) GDPR, although they had access to the address labels during loading and unloading; PLN 5,209,559 relates to staff not being given effective authorisations to process data and the company's own data protection policy not being implemented (Art. 24, 29, 32 GDPR). The authority classed both infringements as intentional and treated earlier reprimands against the company as aggravating. The decision is not final.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection · Data processors

Legal basis

Art. 28 Abs. 3 i. V. m. Art. 5 Abs. 1 lit. a und Abs. 2 DSGVO; Art. 24 Abs. 1 und 2, Art. 29, Art. 32 Abs. 1 und 4 i. V. m. Art. 5 Abs. 1 lit. f und Abs. 2 DSGVO; Art. 83 Abs. 4 lit. a und Abs. 5 lit. a DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Culpability

intentional

Repeat case

yes

Mitigating circumstances

It was treated as mitigating that, after the proceedings were opened, DPD amended its contracts with the hauliers to include data processing terms and changed its procedure for granting authorisations.

Liability of senior managers

No personal liability was established.

Published

23 Feb 2026

Original amount 11,461,030 PLN, converted at the ECB reference rate of 5 Feb 2026.

Checked against the official source on 28 Sep 2026 · Direct link

Between June and December 2023, a logistics and transport business withheld a total of around 2,000 EUR in minimum wages from several employees, breached reporting and immediate notification obligations, and in July/August 2023 employed a foreign national without a residence permit. The fines: 5,231 EUR (minimum wage), 750 EUR each (reporting obligations) and 7,000 EUR (unauthorised employment of foreign nationals), totalling 13,731 EUR (date = publication).

Authority / court

Hauptzollamt Karlsruhe (Finanzkontrolle Schwarzarbeit)

Area of law

Health and safety and employment law · Minimum wage and undeclared work

Legal basis

§ 21 Abs. 1 Nr. 11 MiLoG; § 111 Abs. 1 Nr. 2 SGB IV; § 404 Abs. 2 Nr. 3 SGB III

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

22 Jan 2026

Checked against the official source on 25 Sep 2026 · Direct link

The function of data protection officer was performed by a manager who was at the same time responsible for security and protection of classified information and thus monitored their own activities; there was no conflict analysis. Poland’s data protection authority (UODO) imposed 978,128 PLN and referred to numerous previous reprimands and orders against the company.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection

Legal basis

Art. 38 Abs. 3 und 6 DSGVO (DKN.5131.4.2025)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Employees

10,000 or more

Repeat case

yes

Mitigating circumstances

During the proceedings the function was made independent and placed directly under the management board.

Published

26 Jan 2026

Original amount 978,128 PLN, converted at the ECB reference rate of 2 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

From April 2023 until at least April 2025, Ryanair obstructed travel agencies from buying Ryanair flights in combination with other services, for example through facial recognition procedures, account deletions, blocking of means of payment and restrictive partner agreements. The AGCM considered this to be an abuse of a dominant position and imposed fines of 255,761,692 EUR on a joint and several basis.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 102 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Employees

10,000 or more

Published

23 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

In 2023, the French data protection authority (CNIL) had imposed 32 million EUR for the real-time monitoring of warehouse staff through scanner metrics. France's supreme administrative court (Conseil d'État) held that three metrics (‘Stow Machine Gun’, ‘Idle Time’, ‘Latency’) were covered by legitimate interest, but upheld the findings on the 31-day retention of all metrics, information deficiencies and security flaws in the video surveillance, and reduced the fine to 15 million EUR.

Authority / court

Conseil d'État

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. c, Art. 12, 13, 32 DSGVO

Action

Fine

Status of proceedings

reduced

Sector

Transport, logistics and shipping

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

For years the cameras at stations and stops of the Budapest suburban railway HÉV also recorded sound; the NAIH (Nemzeti Adatvédelmi és Információszabadság Hatóság, Hungarian data protection authority) found breaches of transparency, data minimisation, lawfulness, storage limitation and the duty to carry out a data protection impact assessment. It imposed HUF 50,000,000 on the operator's legal successor and at the same time warned it against future audio recording without demonstrated necessity.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, c, e, Art. 6 Abs. 1, Art. 12 Abs. 1, Art. 13 Abs. 1 lit. e, Art. 35 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Culpability

negligent

Published

19 Dec 2025

Original amount 50,000,000 HUF, converted at the ECB reference rate of 19 Dec 2025.

Checked against the official source on 28 Sep 2026 · Direct link

On appeal by the Verbraucherzentrale Bundesverband (Federation of German Consumer Organisations), the Oberlandesgericht Düsseldorf (Düsseldorf Higher Regional Court) prohibited Eurowings from advertising a €9 CO2 offset during online booking in a way that makes customers believe they travel climate-neutrally; it was not mentioned that other climate-damaging emissions are not offset. By contrast, the court did not consider the 'Sustainable Aviation Fuel' advertising misleading; it did not grant leave to appeal on points of law.

Authority / court

Oberlandesgericht Düsseldorf, 20. Zivilsenat

Area of law

Environment and sustainability · Misleading environmental and sustainability claims

Legal basis

UWG (irreführende Werbung); Az. I-20 U 38/25

Action

Order

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

5 Dec 2025

Checked against the official source on 2 Oct 2026 · Direct link

Following several complaints, the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) examined how the parking operator collects contractual penalties: invoices were sent to previous rather than current registered addresses, claims were handed over to debt collection services and entered in the database of Kredītinformācijas Birojs. The authority found breaches of the principles of lawfulness, data minimisation and confidentiality and of the accountability obligation and imposed 25,000 EUR (previous year’s turnover according to the decision: 8,323,178 EUR).

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection

Legal basis

Art. 5 Abs. 1 lit. a, c, f und Abs. 2, Art. 83 Abs. 5 lit. a DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Culpability

intentional

Mitigating circumstances

Practice changed after the proceedings began; contracts concluded with the population and vehicle registers (PMLP, CSDD)

Checked against the official source on 25 Sep 2026 · Direct link

The Naturvårdsverket (Swedish Environmental Protection Agency) imposed a penalty of 142,757,565 SEK on the airline Braathens International Airways because it had not surrendered emission allowances for 99,707 tonnes of CO2 equivalent from 2024 by the deadline of 30 September 2025. The inflation-adjusted penalty amounts to 129.69 EUR per tonne (12,930,939 EUR) and does not release the company from the obligation to surrender allowances; the company had been declared bankrupt on 30 September 2025. A separate penalty was imposed on its sister company Braathens Regional Airways AB.

Authority / court

Naturvårdsverket

Area of law

Environment and sustainability · Emissions and permits

Legal basis

10 kap. 5 § förordningen (2020:1180) om vissa utsläpp av växthusgaser; 16 § 3 lagen om vissa utsläpp av växthusgaser; Art. 12 Abs. 3 Richtlinie 2003/87/EG (EU-Emissionshandel)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Mitigating circumstances

None: EU rules allow no exception from the surrender obligation regardless of the company's financial situation.

Published

10 Nov 2025

Original amount 142,757,565 SEK, converted at the ECB reference rate of 6 Nov 2025.

Checked against the official source on 28 Sep 2026 · Direct link

The airport operator AENA used a biometric facial recognition system for access, transit and boarding at several airports without presenting a data protection impact assessment meeting the legal requirements. The AEPD imposed 10,043,002 EUR for breaching Art. 35 GDPR and confirmed the provisional suspension of all biometric processing until a proper impact assessment is in place.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection

Legal basis

Art. 35 DSGVO (Art. 83 Abs. 4 lit. a DSGVO)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Employees

1,000 to 9,999

Published

20 Mar 2026

Checked against the official source on 28 Sep 2026 · Direct link