Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Data Protection Commission (DPC) €3.27bn 87 % · 16 cases
- Data Protection Commission (DPC); Streitbeilegung durch den Europäischen Datenschutzausschuss (Art. 65 DSGVO) €345m 9 % · 1 case
- Central Bank of Ireland €130.1m 3 % · 10 cases
- Letterkenny Circuit Criminal Court (Anklage: Health and Safety Authority) €1.2m 0 % · 1 case
- Limerick Circuit Criminal Court (Anklage: Health and Safety Authority) €400,000 0 % · 1 case
- Sligo Circuit Criminal Court (Anklage: Director of Public Prosecutions nach Ermittlungen der Environmental Protection Agency) €200,000 0 % · 1 case
- Dublin District Court (Anklage: Competition and Consumer Protection Commission, CCPC) €1,000 0 % · 1 case
- Coimisiún na Meán (irische Medien- und Online-Sicherheitsaufsicht) – 0 % · 2 cases
What for?
by area of lawAll areas of law
- Data protection €3.62bn 96 % · 17 cases
- Consumer protection and online retail €100.5m 3 % · 2 cases
- Money laundering and terrorist financing €23.3m 1 % · 3 cases
- Capital markets and financial supervision €6.23m 0 % · 6 cases
- Health and safety and employment law €1.6m 0 % · 2 cases
- Environment and sustainability €200,000 0 % · 1 case
- AI and digital regulation – 0 % · 2 cases
Who?
by sectorAll sectors
- Media and online platforms €3.61bn 96 % · 12 cases
- Financial services and insurance €131.1m 3 % · 12 cases
- Public sector €1.29m 0 % · 3 cases
- Construction and real estate €1.2m 0 % · 1 case
- Healthcare €760,000 0 % · 2 cases
- Manufacturing and mechanical engineering €400,000 0 % · 1 case
- Food and agriculture €200,000 0 % · 1 case
- Retail and e-commerce €1,000 0 % · 1 case
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 6 | €986m |
| 2023 | 6 | €1.55bn |
| 2024 | 7 | €653.9m |
| 2025 | 8 | €552.8m |
| 2026 | 6 | €2.82m |
33 cases
25 Aug 2026 Health Service Executive (HSE)Irish health service HSE: 645,000 EUR for neglected paper patient records €645,000
In 2023, intruders gained access to two former psychiatric hospitals and posted videos of the patient records stored there online. An inspection of twelve sites found records with mould, water and animal damage in unsuitable rooms, up to and including shipping containers. Ireland's Data Protection Commission (DPC) imposed a fine of 645,000 EUR, issued a reprimand and ordered audits and the relocation of records.
Data protection also applies to paper archives in disused buildings – retention requires an inventory, erasure periods and physical security.
Physical security and retention of paper records
- Authority / court
- Data Protection Commission (DPC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- DSGVO Art. 5 Abs. 1 lit. e und f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1
- Action
- Fine
- Status of proceedings
- final
- Sector
- Public sector
- Employees
- 10,000 or more
- Published
- 2 Sep 2026
- Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE) Press release of an authority
- EDPB – DPC announces Final Decision following Inquiry into the HSE Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
31 Jul 2026 Whitemountain Quarries Limited€1.2m fine for Whitemountain Quarries after fatal roadworks incident €1.2m
At roadworks on the R238 in Donegal in August 2020, one wheel of a car dropped onto the unfinished hard shoulder; when the driver steered back, the car slid on the freshly laid surface and went into Lough Foyle; three occupants drowned and one was injured, and appropriate temporary traffic management was lacking. The company pleaded guilty to breaching its duties towards non-employees under s. 12 of the Safety, Health and Welfare at Work Act 2005 and was fined €1,200,000.
Employers at roadworks in public spaces are also liable for the safety of third parties; signage and guidance measures must remain adequate until the works are finished.
- Authority / court
- Letterkenny Circuit Criminal Court (Anklage: Health and Safety Authority)
- Area of law
- Health and safety and employment law · Workplace safety and accidents
- Legal basis
- s. 12 i. V. m. s. 77(9)(a) Safety, Health and Welfare at Work Act 2005
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Construction and real estate
- Published
- 31 Jul 2026
- HSA: Whitemountain Quarries Limited fined €1.2 million after fatal roadworks incident claimed three lives (31.07.2026) Press release of an authority
Checked against the official source on 2 Oct 2026 · Direct link
Report an error
27 Jul 2026 Dairymaster Unlimited Company€400,000 fine for Dairymaster after fatal incident involving milking parlour gate €400,000
In July 2020 a farmer on a dairy farm in County Limerick was fatally injured by a pneumatically operated milking parlour gate designed and manufactured by Dairymaster. The company pleaded guilty to six counts; the court imposed €200,000 each for breaches of s. 16(3) and s. 16(1)(a) of the Safety, Health and Welfare at Work Act 2005 (duties of designers and manufacturers), totalling €400,000, with the remaining counts taken into consideration.
Manufacturers of work equipment are criminally liable for safe design, testing and adequate safety information.
- Authority / court
- Limerick Circuit Criminal Court (Anklage: Health and Safety Authority)
- Area of law
- Health and safety and employment law · Workplace safety and accidents
- Legal basis
- s. 16(1)(a), 16(3) i. V. m. s. 77(2)(a), 77(9)(a) Safety, Health and Welfare at Work Act 2005
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Manufacturing and mechanical engineering
- Published
- 28 Jul 2026
- HSA: Dairymaster Unlimited Company fined €400,000 following a fatal workplace incident (28.07.2026) Press release of an authority
Checked against the official source on 2 Oct 2026 · Direct link
Report an error
10 Jun 2026 Health Service Executive (HSE)DPC: €300,000 fine against HSE after ransomware attack on hospital laboratory in Tullamore €300,000
In November 2018 attackers encrypted patient data in the laboratory information system of Midlands Regional Hospital Tullamore. The DPC found that the HSE had infringed Art. 5(1)(f), 28, 30, 32(1) and 34 GDPR (including insufficient security, deficient processor contracts and record of processing, and incomplete notification of affected persons), issued a reprimand, imposed €300,000 for the security failings (Art. 5(1)(f) and 32(1)) and ordered it to introduce specified policies and procedures for secure processing.
Laboratory and other specialist hospital systems also belong in security and supplier management; contracts with processors must contain the GDPR safeguards.
Ransomware protection of clinical systems
- Authority / court
- Data Protection Commission (DPC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 5(1)(f), 28, 30, 32(1), 34 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Healthcare
- DPC: Inquiry into Midlands Regional Hospital Tullamore (IN-19-9-4) Decision of an authority
Checked against the official source on 2 Oct 2026 · Direct link
Report an error
8 May 2026 Permanent TSB plcDPC: 277,500 EUR against Permanent TSB after account takeovers via call centre calls €277,500
Fraudsters in possession of customer data posed as customers at the bank's ‘Open24’ call centre, had account details changed and obtained further information because security protocols were not followed; those affected had to close accounts, and some suffered losses. Ireland's Data Protection Commission (DPC) imposed 250,000 EUR for inadequate security and 27,500 EUR for late breach notification (decision served in the week before the press release).
Call centre staff must adhere to identity checks without exception – callers with ‘matching’ data are not automatically authorised.
Identity verification by telephone (vishing)
- Authority / court
- Data Protection Commission (DPC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1, Art. 33 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Published
- 8 May 2026
- Data Protection Commission Publishes Final Decision Following Inquiry into Permanent TSB Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
20 Mar 2026 Brown Thomas Arnotts LimitedCCPC: Brown Thomas Arnotts admits incorrect prior prices online – charity donation ordered €1,000
The CCPC found that the retailer had not stated the correct prior price for price reductions on brownthomas.com and arnotts.ie during the 2024/2025 winter sales. The company pleaded guilty in January 2026; in March 2026 the court ordered a donation of €1,000 to a charity and struck out the charges without conviction.
In discount promotions the stated prior price must be the lowest price in the prescribed reference period – online shops included.
- Authority / court
- Dublin District Court (Anklage: Competition and Consumer Protection Commission, CCPC)
- Area of law
- Consumer protection and online retail · Misleading advertising and pricing
- Legal basis
- Regulation 5A European Communities (Requirements to Indicate Product Prices) Regulations 2002 (S.I. No. 639/2002), geändert durch S.I. No. 597/2022
- Action
- Other
- Status of proceedings
- final
- Sector
- Retail and e-commerce
- Published
- 5 Jul 2026
- CCPC Consumer Protection Enforcement: Prosecution – Brown Thomas Arnotts Limited Enforcement database of an authority
Checked against the official source on 2 Oct 2026 · Direct link
Report an error
10 Dec 2025 University of LimerickDPC: €98,000 fine against University of Limerick after phishing of staff mailboxes €98,000
Between 2018 and 2020 the university notified twelve personal data breaches, six of which involved unauthorised persons gaining access to staff email accounts through phishing and in some cases setting up forwarding rules. The DPC found infringements of Art. 5(1)(f), 30(1), 32(1), 33(1) and 34(1) GDPR, issued a reprimand and imposed fines of €45,000, €3,000, €35,000 and €15,000, totalling €98,000.
Phishing protection for mailboxes and clear internal reporting channels determine whether data breaches are reported to the authority and affected persons on time.
Recognising phishing and reporting data breaches within 72 hours
Missing or inadequate training played a role in the decision.
- Authority / court
- Data Protection Commission (DPC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 5(1)(f), 30(1), 32(1), 33(1), 34(1) DSGVO; ss. 110–111 Data Protection Act 2018
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
- Mitigating circumstances
- The university accepted most of the findings, acknowledged responsibility and improved its systems, training and policies; the fines are well below those in the draft and no remedial order was made.
- DPC: Inquiry concerning the University of Limerick (IN-19-7-1) Decision of an authority
Checked against the official source on 2 Oct 2026 · Direct link
Report an error
5 Nov 2025 Coinbase Europe LimitedIreland: 21.5 million EUR against Coinbase Europe – 30 million transactions unchecked €21.5m
In a settlement of 5 November 2025, the Central Bank of Ireland imposed a reprimand and 21,464,734 EUR (after a 30% discount on 30,663,906 EUR) for breaches of transaction monitoring obligations between April 2021 and March 2025: because of configuration errors in the monitoring system, more than 30 million transactions worth over 176 billion EUR – around 31% of all transactions – were not properly monitored over a period of twelve months. The subsequent review took almost three years and led to 2,708 suspicious transaction reports; the High Court confirmed the sanction on 12 January 2026, and it is the Central Bank's first enforcement action in the crypto sector.
Test monitoring rules regularly for complete coverage – a silent configuration error can go undetected for years.
- Authority / court
- Central Bank of Ireland
- Area of law
- Money laundering and terrorist financing · Internal controls
- Legal basis
- Criminal Justice (Money Laundering and Terrorist Financing) Act 2010
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Mitigating circumstances
- 30% settlement discount
- Published
- 6 Nov 2025
- Enforcement Action against Coinbase Europe Limited Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
17 Oct 2025 WhatsApp Ireland Limited (Dienst „Channels“) und PinterestWhatsApp (Channels) and Pinterest: designated as ‘exposed to terrorist content’ Order
After both hosting services had received at least two final removal orders from EU authorities within twelve months, Coimisiún na Meán (Ireland’s media and online safety regulator) designated them as exposed to terrorist content under the TCO Regulation. They must take specific protective measures and report on them within three months; the regulator assesses their effectiveness.
Repeated removal orders trigger additional, monitored prevention obligations for platforms – content moderation must be prepared for this.
- Authority / court
- Coimisiún na Meán (irische Medien- und Online-Sicherheitsaufsicht)
- Area of law
- AI and digital regulation · Platform obligations
- Legal basis
- Verordnung (EU) 2021/784 (Terrorist Content Online Regulation): Einstufung als exponiert, spezifische Maßnahmen
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Coimisiún na Meán: Further determinations made under Terrorist Content Online Regulation (TCOR) (17.10.2025) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
2 Jul 2025 Swilly Mulroy Credit Union LimitedIreland: small credit union accepted cash from non-members without checks €36,273
Between 2014 and 2021, the credit union solicited cash from persons without an account and accepted 2,329 cash deposits totalling 8.75 million EUR without the required anti-money laundering checks; the board had known about the risk since 2015, and there was no self-reporting. The Central Bank of Ireland imposed a reprimand and 36,273 EUR (after a 30% discount on 51,819 EUR).
Even small cooperative banks must identify cash from non-customers – and would do better to self-report known risks.
Identification for cash deposits by non-customers
- Authority / court
- Central Bank of Ireland
- Area of law
- Money laundering and terrorist financing · Customer due diligence
- Legal basis
- Criminal Justice (Money Laundering and Terrorist Financing) Act 2010; Credit Union Act 1997
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Mitigating circumstances
- 30% settlement discount
- Liability of senior managers
- The board had known about the risks since 2015 without taking remedial action
- Published
- 2 Jul 2025
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
12 Jun 2025 Department of Social Protection (DSP)DPC: 550,000 EUR against Irish social protection ministry over facial matching without legal basis €550,000
For registration for the Public Services Card, the ministry created biometric facial templates of a large part of the population without a sufficiently clear legal basis, with deficient information and an incomplete data protection impact assessment. Ireland's Data Protection Commission (DPC) issued a reprimand, imposed 550,000 EUR and ordered the biometric processing to be stopped within nine months if no valid legal basis is found.
Biometric procedures require a precise statutory basis and a complete impact assessment before they are rolled out widely.
- Authority / court
- Data Protection Commission (DPC)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- Art. 5 Abs. 1 lit. a und e, Art. 6 Abs. 1, Art. 9 Abs. 1, Art. 13, Art. 35 Abs. 7 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
- Mitigating circumstances
- No deficiencies were found in the technical and organisational security measures.
- Published
- 12 Jun 2025
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
2 May 2025 TikTok Technology LimitedDPC: 530 million EUR against TikTok over data access from China €530m
TikTok allowed employees in China to access European users' data remotely without assessing and demonstrating that standard contractual clauses and supplementary measures ensured an equivalent level of protection against access by Chinese authorities; it also informed users inadequately. Ireland's Data Protection Commission (DPC) imposed 530 million EUR and ordered that the transfers be brought into compliance or suspended within six months.
Even mere remote access from a third country is a transfer – without a documented transfer impact assessment, fines and a suspension order loom.
- Authority / court
- Data Protection Commission (DPC)
- Area of law
- Data protection · International data transfers
- Legal basis
- Art. 46 Abs. 1, Art. 13 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Published
- 2 May 2025
- Irish Data Protection Commission fines TikTok €530 million and orders corrective measures Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
27 Mar 2025 Aurivo Dairy Ingredients LimitedAurivo Dairy Ingredients: EUR 200,000 in fines for odour and wastewater offences €200,000
The company pleaded guilty to repeatedly breaching conditions of its industrial emissions licence at its Ballaghaderreen plant in 2022: odour nuisance, exceedance of limits for effluent and cooling water, impairment of the River Lung and late incident notifications to the EPA and Inland Fisheries Ireland. The court imposed fines totalling €200,000 for the two notification breaches and additionally ordered €150,000 to be paid over ten years to local community groups and Inland Fisheries Ireland for the river , plus investigation costs. Only the fines of EUR 200,000 are recorded as the amount.
Environmental incidents must be reported to the authority immediately through the prescribed channels; here it was the late notifications that proved most costly.
- Authority / court
- Sligo Circuit Criminal Court (Anklage: Director of Public Prosecutions nach Ermittlungen der Environmental Protection Agency)
- Area of law
- Environment and sustainability · Emissions and permits
- Legal basis
- Bedingungen 5.1, 5.3, 11.3 und 11.5 der Industrieemissionsgenehmigung P0802-03
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Food and agriculture
- Published
- 27 Mar 2025
- EPA: DPP Prosecutes Aurivo Dairy Ingredients Limited (P0802-03) Enforcement database of an authority
Checked against the official source on 2 Oct 2026 · Direct link
Report an error
25 Feb 2025 Cantor Fitzgerald Ireland LimitedCentral Bank: €452,790 fine against Cantor Fitzgerald for failing to report suspicions €452,790
Between March 2017 and June 2023 the investment firm on several occasions failed to report identified suspicious transactions to the Central Bank, did not consistently document its assessments and did not reliably escalate suspicions internally. For breaching Art. 16(2) MAR, the Central Bank imposed €452,790 after a 30% settlement discount (base amount €646,840); the breach was admitted.
Front-office brokers must document and escalate suspicions, and the firm must actually report identified suspicious transactions.
Recognising and escalating suspicious orders by traders and brokers
- Authority / court
- Central Bank of Ireland
- Area of law
- Capital markets and financial supervision · Market abuse and insider dealing
- Legal basis
- Art. 16(2) Verordnung (EU) Nr. 596/2014 (MAR); European Union (Market Abuse) Regulations 2016 (S.I. No. 349 of 2016)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Mitigating circumstances
- 30% settlement discount; breach admitted.
- Published
- 27 Feb 2025
Checked against the official source on 2 Oct 2026 · Direct link
Report an error
17 Dec 2024 Meta Platforms Ireland LimitedIreland: 251 million EUR against Meta over data breach and deficient notification €251m
In 2018, attackers exploited a flaw in the ‘View As’ feature and gained access to around 29 million accounts, of which around 3 million were in the EEA. Ireland's Data Protection Commission (DPC) imposed 8 million EUR (Art. 33(3)) and 3 million EUR (Art. 33(5)) for incomplete notification and documentation, as well as 130 million EUR and 110 million EUR for infringements of data protection by design (Art. 25(1) and (2)).
Make data breach notifications complete, and document every breach internally in a traceable manner.
- Authority / court
- Data Protection Commission (DPC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- DSGVO Art. 33 Abs. 3 und 5, Art. 25 Abs. 1 und 2
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Published
- 17 Dec 2024
- Irish Data Protection Commission fines Meta €251 Million Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 3 · Direct link
Report an error
21 Nov 2024 BlueSnap Payment Services Ireland LimitedCentral Bank of Ireland: BlueSnap commingled customer funds – 324,240 EUR and reprimand €324,240
From January 2021 to December 2022, the payment service provider did not deposit customer funds in the designated safeguarding account but commingled them with other funds, and informed the Central Bank of Ireland late after becoming aware of this. According to the supervisor, the causes were a lack of regulatory awareness and inadequate oversight of the safeguarding processes provided by the group; the fine of 463,200 EUR was reduced by 30% to 324,240 EUR owing to the settlement.
Keep customer funds traceably segregated at all times – if the group performs your safeguarding processes, you remain responsible and must report deviations promptly.
Segregation of customer funds and reporting obligations towards the supervisor
- Authority / court
- Central Bank of Ireland
- Area of law
- Capital markets and financial supervision · Organisational requirements
- Legal basis
- European Union (Payment Services) Regulations 2018, Regulations 17(2) und 27
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
- Mitigating circumstances
- 30% discount for settlement based on undisputed facts; deficiencies fully remedied.
- Published
- 21 Nov 2024
- The Central Bank takes enforcement action against BlueSnap Payment Services Ireland Limited for safeguarding failures Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
13 Nov 2024 TikTok, X und Meta (Instagram)TikTok, X and Instagram: Irish regulator requires measures against terrorist content Order
Coimisiún na Meán (Ireland’s media and online safety regulator) determined that the services of TikTok, X and Meta (Instagram) are exposed to terrorist content after they had received at least two final removal orders from EU authorities within twelve months. The providers must take specific measures against the dissemination of terrorist content and report on them.
Platforms should record removal orders centrally – from the second within twelve months, additional obligations monitored by the regulator loom.
- Authority / court
- Coimisiún na Meán (irische Medien- und Online-Sicherheitsaufsicht)
- Area of law
- AI and digital regulation · Platform obligations
- Legal basis
- Verordnung (EU) 2021/784 (Terrorist Content Online Regulation): Einstufung als exponiert, spezifische Maßnahmen
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Coimisiún na Meán: Determination made under Terrorist Content Online Regulation (TCOR) (13.11.2024) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
6 Nov 2024 Waystone Fund Management (IE) LimitedCentral Bank: €393,512 fine against Waystone for deficient oversight of a fund's investment manager €393,512
As manager of an alternative investment fund, the company carried out little due diligence on the appointed investment manager, which in 2018/2019 invested €17.7m in hard-to-value loan notes; when the fund was suspended in August 2020, €10.2m remained outstanding. The Central Bank found breaches including in due diligence, conflicts of interest, oversight of delegates, risk management and valuation and, by settlement, imposed a reprimand and €393,512 (€562,160 less 30%), confirmed by the High Court on 31 March 2025.
Anyone who delegates investment decisions remains responsible and must continuously check the delegate's experience and investments, even with long-standing business partners.
- Authority / court
- Central Bank of Ireland
- Area of law
- Capital markets and financial supervision · Organisational requirements
- Legal basis
- European Union (Alternative Investment Fund Managers) Regulations 2013 (S.I. No. 257 of 2013); s. 33BC Central Bank Act 1942
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Mitigating circumstances
- Settlement under the undisputed facts procedure with a 30% discount; breaches admitted; investors recovered their investment in the loan notes through a settlement.
- Published
- 8 Nov 2024
- Central Bank of Ireland, Enforcement Actions (Übersicht) (Entscheidung 2024) Enforcement database of an authority
Checked against the official source on 7 Oct 2026 · Version 2 · Direct link
Report an error
22 Oct 2024 LinkedIn Ireland Unlimited CompanyDPC: 310 million EUR against LinkedIn over behavioural advertising without a legal basis €310m
LinkedIn analysed data of its members, including data obtained from third parties, for behavioural analysis and targeted advertising without valid consent; legitimate interests and contractual necessity did not apply either. The Data Protection Commission (DPC, the Irish data protection authority) found infringements of the principles of lawfulness, fairness and transparency, issued a reprimand, ordered the processing to be brought into compliance and imposed fines totalling 310 million EUR.
Obtain genuine consent for profiling for advertising purposes – neither “legitimate interests” nor the user contract can serve as the legal basis.
- Authority / court
- Data Protection Commission (DPC)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- DSGVO Art. 5 Abs. 1 lit. a, Art. 6, Art. 13 Abs. 1 lit. c, Art. 14 Abs. 1 lit. c
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Published
- 24 Oct 2024
- Irish Data Protection Commission fines LinkedIn Ireland €310 million Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
26 Sep 2024 an Ireland-based social network operatorIreland: 91 million EUR against social network operator over plaintext passwords €91m
The platform operator stored users' passwords unencrypted in plaintext in internal systems and reported this to Ireland's Data Protection Commission (DPC) in March 2019. The DPC found infringements of the security obligations (Art. 5(1)(f), Art. 32(1)) and of the notification and documentation obligations (Art. 33(1) and (5)), and additionally issued a reprimand.
Never store or log passwords in plaintext – not even in internal systems.
- Authority / court
- Data Protection Commission (DPC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- DSGVO Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1, Art. 33 Abs. 1 und 5
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Mitigating circumstances
- According to the DPC, the passwords were not disclosed to external third parties.
- Published
- 27 Sep 2024
- DPC, Pressemitteilungen (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 26 Sep 2026 · Direct link