Who was sanctioned, and for what?

From January 2013 to March 2022, the distributor of premium pet food and pet supplies imposed minimum resale prices on its retailers and threatened sanctions if they were undercut. In a settlement procedure, the Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) imposed 36.438 million CZK; the company ended the conduct after the inspection and introduced a compliance programme.

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Competition law · Cartels and collusion

Legal basis

Verbot vertikaler Preisbindung (tschechisches Wettbewerbsgesetz, Art. 101 AEUV)

Action

Fine

Status of proceedings

final

Sector

Retail and e-commerce

Culpability

intentional

Mitigating circumstances

Termination immediately after the inspection, information of customers about free pricing, full cooperation, settlement and newly introduced compliance programme.

Published

24 Sep 2026

Original amount 36,438,000 CZK, converted at the ECB reference rate of 24 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The provider of web-based systems for sickness reporting, rehabilitation and occupational safety incidents was hacked in August 2025; the stolen personal data appeared on the dark web shortly afterwards. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) found that, despite the high need for protection, there were no adequate security measures and no automatic real-time monitoring for attacks, assessed this as negligent and imposed 1,800,000 SEK.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Published

22 Sep 2026

Original amount 1,800,000 SEK, converted at the ECB reference rate of 22 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

On a total of 249 days, the Portuguese branch of the energy supplier failed to hold the mandatory natural gas security reserves, did not correctly show network charges on invoices, did not publish, or published late, mandatory information and its quality report, and failed to meet the standards for hotline waiting times. In a settlement procedure, the Entidade Reguladora dos Serviços Energéticos (Portuguese Energy Services Regulatory Authority, ERSE) set a fine of 44,000 EUR and reduced it to 22,000 EUR.

Authority / court

Entidade Reguladora dos Serviços Energéticos (ERSE)

Area of law

Other

Legal basis

Regime Sancionatório do Setor Energético (RSSE), Art. 28, 29; Decreto-Lei n.º 62/2020, Art. 96; RRC; RQS

Action

Fine

Status of proceedings

final

Sector

Energy and utilities

Culpability

negligent

Mitigating circumstances

Settlement (transação) with full admission, remediation of all infringements

Checked against the official source on 25 Sep 2026 · Direct link

From July 2021 to July 2024, the state forestry company contractually prohibited a customer from actively and passively exporting wood chips and logging residues and secured the ban with a right of termination. The Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) considered this a restriction of competition by object under Czech and EU law and imposed 17.268 million CZK (first instance, not final).

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Competition law · Cartels and collusion

Legal basis

Tschechisches Wettbewerbsgesetz, Art. 101 AEUV (Exportverbot)

Action

Fine

Status of proceedings

unknown

Sector

Food and agriculture

Mitigating circumstances

Voluntary termination immediately after proceedings were opened.

Published

17 Sep 2026

Original amount 17,268,000 CZK, converted at the ECB reference rate of 17 Sep 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

As a so-called fund hotel, the company had its funds managed by other firms, but examined these delegation agreements only insufficiently, did not take the related decisions properly and did not monitor the funds’ returns in relation to risk closely enough. The Swedish financial supervisory authority Finansinspektionen (FI) issued a remark and imposed 2 million SEK; no damage to investors was established.

Authority / court

Finansinspektionen (FI)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Schwedisches Fondsrecht – Regeln zur Delegation der Fondsverwaltung und deren Überwachung

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

No established damage to investors; remedial measures already taken during the investigation.

Published

16 Sep 2026

Original amount 2,000,000 SEK, converted at the ECB reference rate of 16 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Following an on-site inspection, the Finantsinspektsioon (Estonian Financial Supervision Authority) issued an order requiring the payment institution Wallester to remedy, by 31 December, deficiencies in governance and control functions (separation of the lines of defence, internal rules), in safeguarding customer funds and in the staffing of its anti-money laundering and counter-terrorist financing function. Date = publication of the press release.

Authority / court

Finantsinspektsioon (Estnische Finanzaufsicht)

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Aufsichtsrechtliche Anordnung (ettekirjutus) der Finantsinspektsioon

Action

Order

Status of proceedings

unknown

Sector

Financial services and insurance

Published

16 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

In an insurance tender in 2024 worth around 200 million CZK, the ministry had parts of the tender documents drawn up by a broker who could later receive commissions from the winning insurer. As the contracting authority took no measures against the conflict of interest, the Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) imposed a final fine of 300,000 CZK.

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Other

Legal basis

Gesetz über die Vergabe öffentlicher Aufträge (Pflicht zur Vermeidung von Interessenkonflikten)

Action

Fine

Status of proceedings

final

Sector

Public sector

Culpability

negligent

Published

15 Sep 2026

Original amount 300,000 CZK, converted at the ECB reference rate of 15 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

For seven months (October 2025 to May 2026), the bank continued to send a customer advertising via its app, although he had objected several times. The Italian data protection authority (Garante per la protezione dei dati personali) also found deficient systems for implementing objections and inaccurate information about the processing, and imposed 5,508,000 EUR (Provvedimento No. 613).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. a, Art. 12, 21, 24 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Hospital staff opened a colleague's electronic health record to organise duty rosters during Covid rather than for treatment purposes. Technical barriers limiting access to treating staff were lacking; the Italian data protection authority (Garante per la protezione dei dati personali) imposed 24,000 EUR (Provvedimento No. 616).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a, b, c, f, Art. 9, 25, 32 DSGVO; Art. 75 Codice privacy; Linee guida dossier sanitario

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Since 2007, the municipal sports facilities operator had had cameras in the changing rooms of a swimming pool that recorded the locker area. The Italian data protection authority (Garante per la protezione dei dati personali) found no sound legal basis, incomplete notices and a 72-hour retention period not justified by a necessity assessment, and imposed 8,000 EUR (Provvedimento No. 619); the cameras were removed during the proceedings.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1 lit. c und e DSGVO; Art. 2-ter Codice privacy

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The financial institution did not deliver on time the data due every seven days to the Centralised Bank Account Register (CBAR). The Financial Intelligence Analysis Unit (FIAU) set a fine of 162,704 EUR, which was reduced by 40% to 97,622 EUR under a settlement pursuant to its 2026 settlement policy.

Authority / court

Financial Intelligence Analysis Unit (FIAU)

Area of law

Money laundering and terrorist financing

Legal basis

Reg. 4(2), 8, 9 CBAR Regulations (S.L. 373.03)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Settlement with 40% reduction

Published

4 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

At the payment institution, the customer risk assessment had only been introduced after business had started, some customers remained unassessed, and customer profiles were based on transaction thresholds rather than on risk. The Financial Intelligence Analysis Unit (FIAU) set a fine of 266,833 EUR and a follow-up directive; under a settlement, the fine was reduced by 40% to 160,099 EUR.

Authority / court

Financial Intelligence Analysis Unit (FIAU)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Reg. 2(1), 5(5)(a)(ii), 7(1)(c), 7(2)(a), 21, 22 PMLFTR

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Settlement with 40% reduction; remediation demonstrated

Published

2 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

A lily and tulip grower with an average of around 50 (at peak 75) employees, where Polish migrant workers are employed (anonymised in the judgment), was unable to produce sufficient records of hours worked and wages paid for 18 employees for September 2020 to February 2021. The Dutch Minister of Social Affairs and Employment (Minister van Sociale Zaken en Werkgelegenheid) imposed 118,000 EUR in 2024 (112,100 EUR after objection); the North Netherlands District Court (Rechtbank Noord-Nederland) reduced the fine to 95,587.50 EUR, partly because of measures taken and excessively long proceedings.

Authority / court

Rechtbank Noord-Nederland (Bußgeld: Minister van Sociale Zaken en Werkgelegenheid / Nederlandse Arbeidsinspectie)

Area of law

Health and safety and employment law · Minimum wage and undeclared work

Legal basis

Art. 18b Abs. 2 Wet minimumloon en minimumvakantiebijslag (Wml)

Action

Fine

Status of proceedings

reduced

Sector

Food and agriculture

Employees

50 to 249

Mitigating circumstances

Reduction of 12.5 % for appropriate measures, 5 % for delay and 2,500 EUR for exceeding the reasonable length of proceedings.

Checked against the official source on 25 Sep 2026 · Direct link

From December 2012 to June 2022, the two companies allocated customers for vehicle tracking and electronic logbook services between themselves and coordinated bids, including in public tenders. At first instance, the Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) fined O2 262.32 million CZK and SHERLOG 18.357 million CZK and imposed a six-month ban on public contracts; for O2, the fine was increased instead of a procurement ban.

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Competition law · Cartels and collusion

Legal basis

Tschechisches Wettbewerbsgesetz, Art. 101 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

intentional

Published

26 Aug 2026

Original amount 280,677,000 CZK, converted at the ECB reference rate of 26 Aug 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In 2022–2024, the delivery service used a standard clause to prohibit restaurants from being cheaper on their own channels than on Wolt, while at the same time being able to grant discounts without consultation and to compensate customers up to 400 DKK at the restaurants’ expense. The Konkurrencerådet (Danish Competition Council) ordered the practice to cease, required Wolt to inform all restaurants and intends to enforce a fine through the courts.

Authority / court

Konkurrencerådet (Danish Competition Council)

Area of law

Competition law · Abuse of market power

Legal basis

Konkurrenceloven; AEUV Art. 102

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Published

26 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

In 2023, intruders gained access to two former psychiatric hospitals and posted videos of the patient records stored there online. An inspection of twelve sites found records with mould, water and animal damage in unsuitable rooms, up to and including shipping containers. Ireland's Data Protection Commission (DPC) imposed a fine of 645,000 EUR, issued a reprimand and ordered audits and the relocation of records.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. e und f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1

Action

Fine

Status of proceedings

final

Sector

Public sector

Employees

10,000 or more

Published

2 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

As a buyer with significant bargaining power, the company from Solin purchased agricultural and food products from two suppliers without written contracts. The Agencija za zaštitu tržišnog natjecanja (Croatian Competition Agency, AZTN) considered this an unfair trading practice and, taking mitigating circumstances into account, imposed 10,000 EUR (date = publication).

Authority / court

Agencija za zaštitu tržišnog natjecanja (AZTN)

Area of law

Competition law · Abuse of market power

Legal basis

Zakon o zabrani nepoštenih trgovačkih praksi u lancu opskrbe hranom (ZNTP)

Action

Fine

Status of proceedings

unknown

Sector

Food and agriculture

Mitigating circumstances

Several mitigating circumstances taken into account

Published

25 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Banque nationale de Belgique (National Bank of Belgium) found serious anti-money laundering due diligence failures at Wise Europe SA, including in identifying and verifying customers and beneficial owners, ongoing monitoring of business relationships, analysis of atypical transactions and intra-group information sharing. It made public that Wise Europe had not complied with an order of 8 July 2025 to meet these obligations by 31 March 2026, and ordered full compliance by 31 January 2027 at the latest; no fine was published.

Authority / court

Banque nationale de Belgique / Nationale Bank van België (BNB/NBB)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Art. 13 § 1, 23, 26, 27, 35 § 1 und 45 Gesetz vom 18. September 2017 zur Verhinderung von Geldwäsche; Anordnung nach Art. 93 § 1 1°, Veröffentlichung nach Art. 93 § 2 1° und Art. 98/1 i. V. m. 135 § 3

Action

Order

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

yes

Published

25 Aug 2026

Checked against the official source on 2 Oct 2026 · Direct link

The Nederlandse Arbeidsinspectie (Netherlands Labour Authority) imposed fines totalling 316,875 EUR on a gym chain in Amsterdam that is not named in the release. For 25 foreign workers the required work permit or combined residence and work permit was missing, and for three people identity had not been established (Wav, Foreign Nationals Employment Act, 234,375 EUR); because of deficient records it could not be verified whether the minimum wage had been paid for all hours worked (WML, Minimum Wage and Minimum Holiday Allowance Act, 60,000 EUR), plus a breach of the Arbeidstijdenwet (Working Hours Act, 22,500 EUR). The company also received two warnings that work may be preventively halted if the same or similar breaches recur.

Authority / court

Nederlandse Arbeidsinspectie

Area of law

Health and safety and employment law · Minimum wage and undeclared work

Legal basis

Wet arbeid vreemdelingen (Wav); Wet minimumloon en minimumvakantiebijslag (WML); Arbeidstijdenwet (ATW)

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

24 Aug 2026

Checked against the official source on 2 Oct 2026 · Direct link

Attackers obtained the credentials of a user account with administrator rights through phishing and accessed customer data. The Romanian data protection authority (ANSPDCP) criticised the lack of technical and organisational measures and of regular effectiveness testing, imposed 15,728 lei (3,000 EUR) and ordered regular employee training, including on recognising phishing e-mails. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 lit. b und Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

19 Aug 2026

Original amount 15,728 RON, converted at the ECB reference rate of 19 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

From 2004 to 2018, the three issuers of paper meal vouchers coordinated with retail chains how many vouchers would be accepted per purchase. The President of the Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) dismissed the appeals against the recalculation of the fines: Pluxee 132.271 million, Edenred 101.94 million and Up 44.941 million CZK, a total of 279.152 million CZK.

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Competition law · Cartels and collusion

Legal basis

Tschechisches Wettbewerbsgesetz, Art. 101 AEUV

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

intentional

Published

17 Aug 2026

Original amount 279,152,000 CZK, converted at the ECB reference rate of 17 Aug 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In 2021, the operators of the online retailer eMAG had committed to a support programme for Hungarian businesses, but once again implemented it only partially and not with the prescribed content. In the follow-up review, the Gazdasági Versenyhivatal (Hungarian Competition Authority, GVH) imposed 225 million HUF; in total, the operators have already received fines of 710 million HUF.

Authority / court

Gazdasági Versenyhivatal (GVH)

Area of law

Consumer protection and online retail

Legal basis

Nachprüfungsverfahren zu verbindlichen Zusagen

Action

Fine

Status of proceedings

final

Sector

Retail and e-commerce

Repeat case

yes

Mitigating circumstances

The companies acknowledged the failures and waived legal remedies.

Published

13 Aug 2026

Original amount 225,000,000 HUF, converted at the ECB reference rate of 13 Aug 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The Nederlandse Arbeidsinspectie (Netherlands Labour Authority) imposed fines totalling 153,300 EUR on a platform for freelancers and nine companies that used it to deploy foreign workers without a right to work in hospitality and education: 146,500 EUR under the Wav (Foreign Nationals Employment Act) (platform 66,000 EUR, the nine hirers 4,000 to 27,000 EUR each, together 80,500 EUR) and 6,800 EUR under the Waadi (Placement of Personnel by Intermediaries Act) (platform 3,400 EUR, two hirers 2,000 and 1,400 EUR). The platform regarded itself merely as an intermediary; based on how it actually operated, the Labour Authority classed it as an employer under the broad Wav definition.

Authority / court

Nederlandse Arbeidsinspectie

Area of law

Health and safety and employment law · Minimum wage and undeclared work

Legal basis

Wet arbeid vreemdelingen (Wav); Wet allocatie arbeidskrachten door intermediairs (Waadi)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

13 Aug 2026

Checked against the official source on 2 Oct 2026 · Direct link

The Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) found a cartel in public tenders for mining and construction machinery (price fixing and market sharing, Art. 15 ZZK – Bulgarian Protection of Competition Act, Art. 101 TFEU). Inzhkonsult and Zemekop, as a single undertaking, were exempted from the fine; O-Rent received a sanction of 2,403.07 EUR. All three companies must introduce a competition law compliance programme within 60 days and report on it.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 15 Abs. 1 Nr. 1 und 2 ZZK; Art. 101 Abs. 1 lit. a und c AEUV

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Mitigating circumstances

Immunity from fines for two participants (leniency programme)

Published

20 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Bundeskartellamt (Federal Cartel Office) declared binding commitments by Apple on its App Tracking Transparency Framework (ATTF), closing its proceedings under Section 19a(2) of the German Competition Act (GWB) and Article 102 TFEU. According to the preliminary assessment, third-party apps had to obtain, for personalised advertising, an additional and more off-putting consent prompt prescribed by Apple, while Apple used a prompt of its own for its own services; in future the prompts will be aligned so that content, wording and design are neutral, and app providers will be able to combine the required prompts more easily.

Authority / court

Bundeskartellamt

Area of law

Competition law · Abuse of market power

Legal basis

§ 19a Abs. 2 GWB, Art. 102 AEUV (Verpflichtungszusagen, Az. B7-54/25)

Action

Order

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

17 Aug 2026

Checked against the official source on 2 Oct 2026 · Direct link

In 2018–2022, the distributor of professional hairdressing products (Alfaparf, Yellow) determined the prices at which its territorial representatives were allowed to sell to salons and retailers and restricted passive sales outside the territories. Under a settlement and with a commitment to a compliance programme, the Gazdasági Versenyhivatal (Hungarian Competition Authority, GVH) imposed 68.5 million HUF.

Authority / court

Gazdasági Versenyhivatal (GVH)

Area of law

Competition law · Cartels and collusion

Legal basis

Ungarisches Wettbewerbsgesetz, Verbot wettbewerbsbeschränkender Vereinbarungen

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

intentional

Mitigating circumstances

Cooperation, acknowledgement in the settlement and commitment to a comprehensive compliance programme.

Published

7 Aug 2026

Original amount 68,500,000 HUF, converted at the ECB reference rate of 7 Aug 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

From around 2010 to September 2019, six suppliers of thin cold-laid asphalt surface layers (Dünne Asphaltdeckschichten in Kaltbauweise, DSK) allocated customers – primarily public contracting authorities – and contracts among themselves nationwide and coordinated prices. Germany's Federal Cartel Office (Bundeskartellamt) imposed fines of around 60.3 million EUR; all proceedings ended in settlements.

Authority / court

Bundeskartellamt

Area of law

Competition law · Cartels and collusion

Legal basis

§ 1 GWB, Art. 101 AEUV

Action

Fine

Status of proceedings

final

Sector

Construction and real estate

Mitigating circumstances

Leniency bonus for Possehl/VSI, Bitunova, Kutter and AS; settlement

Published

6 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

Following several complaints, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (Romanian data protection authority, ANSPDCP) found that current and former employees, untrained and without procedural rules, had access to extensive data (including health, family and income data), that data subjects were not informed under Art. 14 GDPR, that excessive data were collected and that automated advertising calls were made without consent. Fines: 78,465 lei (15,000 EUR, Art. 32(4)), 52,310 lei (10,000 EUR, Art. 14), 104,620 lei (20,000 EUR, Art. 5/9 GDPR) and 50,000 lei (Law 506/2004); in addition, an order to provide regular employee training. Date = publication of the press release; according to the authority, the investigation was concluded in June 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. c i. V. m. Art. 9, Art. 14, Art. 32 Abs. 4 DSGVO; Art. 12 Abs. 1 Gesetz 506/2004

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

6 Aug 2026

Original amount 285,395 RON, converted at the ECB reference rate of 6 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

From May 2024, in social media videos (campaign ‘Създавай! Не копирай!’), the company falsely accused a competing family business for hot chillies of having stolen its business, ideas and concept, and promoted the clips partly through paid advertising. The Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) regarded this as unfair damage to reputation (Art. 30 ZZK – Bulgarian Protection of Competition Act), imposed 4% of 2025 net turnover (500,555 EUR), i.e. 20,022 EUR, and ordered immediate cessation. Appeals have been lodged against the decision.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Competition law

Legal basis

Art. 30 ZZK (Schädigung des guten Rufs eines Wettbewerbers)

Action

Fine

Status of proceedings

under appeal

Sector

Food and agriculture

Published

19 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

In several months of 2023 and 2024, the gas supplier did not hold the natural gas security reserves and did not name the competent alternative dispute resolution bodies in customer contracts. The Entidade Reguladora dos Serviços Energéticos (Portuguese Energy Services Regulatory Authority, ERSE) accepted the settlement proposal, set a fine of 24,000 EUR and reduced it to 12,000 EUR.

Authority / court

Entidade Reguladora dos Serviços Energéticos (ERSE)

Area of law

Other

Legal basis

RSSE, Art. 29; Decreto-Lei n.º 62/2020, Art. 57, 96; Portaria n.º 59/2022; RRC Art. 22

Action

Fine

Status of proceedings

final

Sector

Energy and utilities

Culpability

negligent

Mitigating circumstances

Settlement with admission and remediation

Checked against the official source on 25 Sep 2026 · Direct link

The KNF imposed five fines totalling PLN 47,500,000 on PKO BP in connection with structured deposits: PLN 26m for failing to inform clients of existing conflicts of interest, PLN 8m each for not analysing costs and charges and for an imprecise definition of the risk category and target market, PLN 4m for selling without checking target-market suitability and PLN 1.5m for misleading sales material on two products. The decision is not final.

Authority / court

Komisja Nadzoru Finansowego (KNF)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Art. 88c Abs. 1 und 2, Art. 88m Abs. 5 und 9 Prawo bankowe i. V. m. Verordnung des Finanzministers vom 21.01.2019 über Dienstleistungen der Banken bei strukturierten Einlagen

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Original amount 47,500,000 PLN, converted at the ECB reference rate of 5 Aug 2026.

Checked against the official source on 28 Sep 2026 · Direct link

The Oberlandesgericht (OLG, Higher Regional Court) Linz added a forfeiture of 375,000 EUR to the conviction of a limited company under the Verbandsverantwortlichkeitsgesetz (VbVG, Austrian Corporate Criminal Liability Act) for intentionally handling and moving waste in a way that endangered the environment; the suspended corporate fine of 30 daily rates of 500 EUR (15,000 EUR) imposed by the Landesgericht (Regional Court) Salzburg remained in place. From May 2021 to May 2024 and again from May 2025 to February 2026, contrary to the AWG 2002 (Waste Management Act) and partly to an official decision, the company had excavated soil, construction waste, asphalt and concrete rubble accepted for payment and deposited on a plot; removal costs were put at around 3.24 million EUR. Only the forfeiture of EUR 375,000 is recorded as the amount; the corporate fine of EUR 15,000 was conditionally suspended.

Authority / court

Oberlandesgericht Linz (Berufung gegen Urteil des Landesgerichts Salzburg vom 06.03.2026)

Area of law

Environment and sustainability · Waste and hazardous substances

Legal basis

§ 181b Abs. 1 und 2 StGB; §§ 3, 4 Abs. 1 und 3, § 6 Abs. 1, § 14 Abs. 1 VbVG; § 20 Abs. 3 StGB; AWG 2002

Action

Disgorgement of profits

Status of proceedings

final

Sector

Other

Culpability

intentional

Repeat case

no

Mitigating circumstances

No previous convictions of the company; rather low environmental risk. Further circumstances taken into account by the court concern a natural person and are not reported here.

Liability of senior managers

Under the VbVG, the company's liability is linked to the conduct of its managing director.

Checked against the official source on 2 Oct 2026 · Direct link

From 2020 to April 2026, on the basis of old long-term logging contracts, the state forestry group supplied six wood processors with guaranteed quantities of roundwood outside public auctions, while all others could only buy through auctions. In its first decision on the competitive neutrality of public undertakings, the Konkurences padome (Latvian Competition Council) imposed 7,859,606.89 EUR and required equal sales conditions for all qualified bidders.

Authority / court

Konkurences padome (Lettischer Wettbewerbsrat)

Area of law

Competition law

Legal basis

Art. 14.1 Konkurences likums (Wettbewerbsneutralität)

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

13 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

The three sharing providers made it difficult for holders of a Metrebus annual pass to access the free-ride passes promised when the concessions were awarded, through inadequate organisation, cumbersome activation and long waiting times, which shortened the usable time; Bird also deactivated accounts without prior notice. The AGCM imposed fines totalling 2.675 million EUR in three proceedings (Lime 1.4 million, Dott 525,000, Bird 750,000 EUR).

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Codice del Consumo (pratiche commerciali scorrette), Verfahren PS13028, PS13029, PS13030

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

6 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

At roadworks on the R238 in Donegal in August 2020, one wheel of a car dropped onto the unfinished hard shoulder; when the driver steered back, the car slid on the freshly laid surface and went into Lough Foyle; three occupants drowned and one was injured, and appropriate temporary traffic management was lacking. The company pleaded guilty to breaching its duties towards non-employees under s. 12 of the Safety, Health and Welfare at Work Act 2005 and was fined €1,200,000.

Authority / court

Letterkenny Circuit Criminal Court (Anklage: Health and Safety Authority)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

s. 12 i. V. m. s. 77(9)(a) Safety, Health and Welfare at Work Act 2005

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Published

31 Jul 2026

Checked against the official source on 2 Oct 2026 · Direct link

The car rental company charged customers an "administration fee" of 33.88 to 45 EUR when a rental car incurred a traffic offence – even though naming the driver is a statutory obligation of the rental company. Spain's Ministry of Social Rights, Consumer Affairs and 2030 Agenda classified this as a very serious infringement and imposed the maximum fine of 1 million EUR; a court had already declared the clause void in 2020.

Authority / court

Ministerio de Derechos Sociales, Consumo y Agenda 2030

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Artt. 82, 87.5 y 87.6 TRLGDCU (Real Decreto Legislativo 1/2007)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Repeat case

yes

Published

29 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

In the programme ‘Sport aktuell’ on ORF 1 on 29 July 2025, a logo wall was visible as product placement without being labelled. The Austrian Communications Authority (Kommunikationsbehörde Austria, KommAustria) found, with final effect, a violation of the ORF Act (ORF-Gesetz).

Authority / court

Kommunikationsbehörde Austria (KommAustria)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

§ 16 Abs. 5 Z 4 ORF-G

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Published

29 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

A large-scale breach affected EETAA information systems used to implement programmes of the Ministry of Social Cohesion and Family; identification, contact, financial and health data of a large number of people were affected. The Archi Prostasias Dedomenon (Hellenic Data Protection Authority) attributed the success of the attack to outdated systems and inadequate security measures and criticised the absence of a data processing agreement. In Decision 15/2026 it imposed a total of EUR 350,000 (ministry EUR 150,000 under Art. 5(1)(f)/Art. 32 and EUR 50,000 under Art. 28(3) GDPR; EETAA EUR 100,000 under Art. 32 and EUR 50,000 under Art. 28(3) GDPR) and ordered the agreement to be concluded and the planned security measures implemented within one month.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 28 Abs. 3, Art. 32 Abs. 1, Art. 58 Abs. 2 lit. d und i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

According to the authority, the ministry met its breach notification and communication obligations.

Checked against the official source on 28 Sep 2026 · Direct link

For refunds in the event of delays of 60 minutes or more or cancellations, Trenitalia required prior written confirmation from the call centre or ticket office. The AGCM accepted binding commitments: abolition of the confirmation requirement, strengthened refund channels, an information page on disruptions and an implementation report within three months; no infringement was found.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Codice del Consumo (impegni); EU-Fahrgastrechte im Eisenbahnverkehr

Action

Order

Status of proceedings

final

Sector

Transport, logistics and shipping

Mitigating circumstances

Binding commitments, no finding of an infringement.

Published

30 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

In July 2020 a farmer on a dairy farm in County Limerick was fatally injured by a pneumatically operated milking parlour gate designed and manufactured by Dairymaster. The company pleaded guilty to six counts; the court imposed €200,000 each for breaches of s. 16(3) and s. 16(1)(a) of the Safety, Health and Welfare at Work Act 2005 (duties of designers and manufacturers), totalling €400,000, with the remaining counts taken into consideration.

Authority / court

Limerick Circuit Criminal Court (Anklage: Health and Safety Authority)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

s. 16(1)(a), 16(3) i. V. m. s. 77(2)(a), 77(9)(a) Safety, Health and Welfare at Work Act 2005

Action

Fine

Status of proceedings

unknown

Sector

Manufacturing and mechanical engineering

Published

28 Jul 2026

Checked against the official source on 2 Oct 2026 · Direct link

On 24 July 2026 Arcom imposed a fine of EUR 200,000 on Société d'exploitation d'un service d'information (SESI), the operator of the news channel CNews. In Arcom's view, two programmes broadcast in June and September 2025 contained statements about people of (presumed) immigrant background and Muslims, without sufficient context or challenge, that were capable of inciting hatred and discrimination; Arcom considered this a breach of Article 15 of Law No 86-1067 and of the channel's contractual obligations on non-discrimination and control of its programming. In setting the amount, Arcom took into account earlier sanctions against SESI for breaches of the same obligations in 2021 and 2024. Arcom did not sanction a third programme it examined. Whether the decision has been appealed is not known here.

Authority / court

Autorité de régulation de la communication audiovisuelle et numérique (Arcom)

Area of law

Other

Legal basis

Art. 15, 42-1 und 42-2 Loi n° 86-1067 du 30 septembre 1986 (liberté de communication); Art. 2-2-1 und 2-3-2 der Vereinbarungen vom 27. November 2019 und 10. Dezember 2024

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

yes

Published

29 Jul 2026

Checked against the official source on 2 Oct 2026 · Direct link

The Bundesnetzagentur (Federal Network Agency) imposed fines totalling 34,327 EUR on a call centre that mainly marketed telecoms products: 32,000 EUR for unlawful telephone advertising and 2,327 EUR because consents to sales calls had not been fully documented. The campaign continued despite the gaps and requests to stop calling were sometimes ignored; the company has appealed.

Authority / court

Bundesnetzagentur (BNetzA)

Area of law

Data protection · Marketing and consent

Legal basis

UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern; § 7a UWG (Dokumentation und Aufbewahrung von Einwilligungen)

Action

Fine

Status of proceedings

under appeal

Sector

Other

Checked against the official source on 2 Oct 2026 · Direct link

In two decisions, the European Commission found that Google favours its own services in search (460 million EUR) and prevents app developers on Google Play from steering customers to alternative offers (430 million EUR). Google was ordered to bring the infringements to an end.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2022/1925 (DMA), Selbstbevorzugungsverbot und Anti-Steering-Pflicht

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

23 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Garante (Italian data protection authority) fined TIM 9,516,000 EUR because call centres outside the official sales network made promotional calls on the company's behalf using numbers not recorded in the operators' register ROC or falsified numbers (spoofing), often to lines entered in the do-not-call register, and the contacts obtained in this way reached its systems as apparently lawful leads via fictitious call-back requests on sales partners' web forms. The authority found that TIM had selected and supervised its sales partners inadequately and had systematically failed to answer, or answered late, requests for access, erasure and objection. In addition, TIM must secure its lead process, strengthen oversight of the sales chain and adapt its procedures for data subject rights.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5, 6, 7, 12, 15–22, 24, 25, 28 und 32 DSGVO; Art. 130 Codice in materia di protezione dei dati personali (D.Lgs. 196/2003)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Culpability

negligent

Repeat case

yes

Mitigating circumstances

Taken into account as mitigating: short period and limited number of data subjects, measures taken during the proceedings (including checks on and termination of contracts with partners), a high level of cooperation, no special categories of personal data, adherence to the telemarketing code of conduct and substantial investment in controlling the sales chain.

Published

31 Jul 2026

Checked against the official source on 28 Sep 2026 · Direct link

In summer 2025, an attacker gained access to the private hospital's electronic patient record system and obtained data on 524,867 patients and 202,246 trusted persons. There was no VPN or multi-factor authentication for external users, no appropriate access control and no detection of suspicious activity; the trusted persons were not notified. France's data protection authority (Commission nationale de l'informatique et des libertés, CNIL) imposed a fine of 500,000 EUR (SAN-2026-009).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32, Art. 34

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

3 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The CNIL (French data protection authority) fined the IT and engineering consultancy EXTIA EUR 300,000 because, of 265 erasure requests received in 2024 – mostly from job applicants, occasionally from former employees – 12 were not processed at all and 166 applicants were not told of the outcome; 27 received their reply only after the one-month deadline. The CNIL regarded this as particularly negligent, especially as the company had already been reminded of its obligations by the CNIL twice in 2024 (Art. 12 and 17 GDPR).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12 und 17 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

1,000 to 9,999

Culpability

negligent

Repeat case

yes

Mitigating circumstances

During the proceedings the company deleted the data concerned and informed the applicants retrospectively.

Published

9 Sep 2026

Checked against the official source on 2 Oct 2026 · Direct link

Maxxis guaranteed wholesalers fixed margins per tyre sold of the Maxxis and CST brands, monitored prices in particular on the Tyre24 platform and intervened when prices were too low. Germany's Federal Cartel Office (Bundeskartellamt) imposed fines on Maxxis and two tyre wholesalers that had pushed for the margin guarantees; at the time of publication the decisions were not final (an objection to the Higher Regional Court of Düsseldorf was possible).

Authority / court

Bundeskartellamt

Area of law

Competition law · Cartels and collusion

Legal basis

§ 1 GWB (vertikale Preisbindung)

Action

Fine

Status of proceedings

unknown

Sector

Automotive

Mitigating circumstances

Settlement with Maxxis and Reifen Müller

Published

21 Jul 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

AliExpress did not diligently assess the risks posed by illegal, unsafe and counterfeit products (including insufficient moderation capacity, recommender and advertising systems) and did not take effective countermeasures (including deficient enforcement of sanctions against traders, product checks that could be circumvented). The European Commission imposed 550 million EUR under the Digital Services Act (DSA) and required an action plan by 20 October 2026.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2022/2065 (DSA), Risikobewertung und Risikominderung

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Mitigating circumstances

Novelty of the Digital Services Act (taken into account by the Commission when setting the fine)

Published

20 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

In a settlement procedure the energy regulator ordered electricity and gas supplier Enforcesco to pay 107,920 EUR in total: 90,000 EUR (halved from 180,000 EUR) under the energy-sector sanctions regime and 17,920 EUR in voluntarily paid fines for economic administrative offences. The breaches included taking over 6,853 customers without explicit consent, failing to hold the required natural gas security reserves from January 2023 to February 2025, incorrect invoices, an unlawful disconnection and a call-centre answer rate of only 57.8% in 2023.

Authority / court

Entidade Reguladora dos Serviços Energéticos (ERSE)

Area of law

Consumer protection and online retail

Legal basis

Lei n.º 9/2013 (RSSE), Art. 28 und 29, i. V. m. RRC 2020 und geltendem RRC, RQS, Diretivas ERSE n.º 1/2018 und 22/2022, Portaria n.º 59/2022; RJCE

Action

Fine

Status of proceedings

final

Sector

Energy and utilities

Culpability

negligent

Mitigating circumstances

Full admission, cooperation, remedying of all breaches, the company's financial situation and compensation of three customers (150 EUR in total) were taken into account in the settlement procedure.

Checked against the official source on 28 Sep 2026 · Direct link

A synchronisation error between two applications allowed a customer to retrieve other customers’ invoices in the mobile app; in addition, the ticketing platform, which was publicly accessible without VPN, MFA or IP restriction, was attacked and a very large data set (including copies of identity documents, card data, IBANs) was exfiltrated. The Romanian data protection authority (ANSPDCP) imposed fines of 104,780 lei (20,000 EUR, Art. 25) and 419,120 lei (80,000 EUR, Art. 32), a total of 523,900 lei, and ordered test and change management. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 25 Abs. 1, Art. 32 Abs. 1 lit. b und d, Abs. 2 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

17 Jul 2026

Original amount 523,900 RON, converted at the ECB reference rate of 17 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Germany's Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, BaFin) imposed a fine of 240,000 EUR on the software company because it had not disclosed the information about a cyberattack it had suffered as inside information without delay. The fine notice is final.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 17 Abs. 1 UAbs. 1 MAR (EU) Nr. 596/2014

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Published

20 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

On the confirmation page of its online cancellation process, a gym operator displayed a highlighted notice with the button "Pause contract via self-service"; in addition, the confirmation button was labelled "Find contract", which the defendant had already acknowledged. In an action brought by the Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband), the BGH ruled that the confirmation page may only contain the information required for the cancellation and the confirmation button, set aside the judgment of the Higher Regional Court of Düsseldorf (OLG Düsseldorf) dismissing the action to that extent and ordered the operator to cease and desist.

Authority / court

Bundesgerichtshof (I. Zivilsenat), Az. I ZR 200/25

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

§ 312k Abs. 1 Satz 1, Abs. 2 BGB (Kündigungsbutton)

Action

Order

Status of proceedings

final

Sector

Other

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

From 2016 to 2022, three distributors of test and measuring equipment coordinated discounts as essential price components and informed each other of customer contacts, usually with a request for "restraint". This was evidenced by more than 400 emails; the proceedings ended in settlements.

Authority / court

Bundeskartellamt

Area of law

Competition law · Cartels and collusion

Legal basis

§ 1 GWB

Action

Fine

Status of proceedings

final

Sector

Manufacturing and mechanical engineering

Mitigating circumstances

Settlement; cooperation by Elektronik-Kontor Messtechnik taken into account

Published

15 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The 2022 examination revealed that for more than two years the remote gaming operator had had no proper customer risk assessment for almost its entire player base; the assessments submitted had been prepared specifically for the examination. In addition, once players reached the deposit threshold of 2,000 EUR, it did not check in good time whether they were politically exposed persons. The Financial Intelligence Analysis Unit (FIAU) imposed 80,907 EUR; the fine was still open to appeal at the time of publication.

Authority / court

Financial Intelligence Analysis Unit (FIAU)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Reg. 5(5)(a)(ii), 11(5), 21 PMLFTR; FIAU Implementing Procedures Part I und II (Remote Gaming)

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Germany's Federal Financial Supervisory Authority (BaFin) imposed fines totalling 210,000 EUR on the cooperative bank: business relationships were not monitored on an ongoing basis or with enhanced scrutiny, additional information was not obtained and suspicious activity reports were not filed or were filed late. The function of the money laundering reporting officer had been outsourced to an external service provider with several clients.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

§ 56 Abs. 1 S. 1 Nr. 20, 36, 38 und 69 GwG; Bekanntmachung nach § 57 GwG

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

17 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Baltimore-based US asset manager had not submitted voting rights notifications to the issuer and BaFin in time; the deadline is four trading days after reaching a notifiable threshold. BaFin imposed a fine of 187,500 EUR; the notice is final.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

§ 33 Abs. 1 Satz 1 WpHG

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

22 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

At the request of the press association Alliance de la Presse d’Information Générale (APIG), the Autorité de la concurrence (French Competition Authority) imposed interim measures on Meta because its conduct in negotiations on remuneration for press publishers’ neighbouring rights could amount to an abuse of a dominant position. Meta must negotiate in good faith on remuneration for all Meta services from 1 February 2025, provide the information needed for the assessment within 15 days, must not degrade the display of press content during the negotiations and must report to the authority monthly. On the same day a similar decision (26-MC-02) was issued at the request of the collective management organisation DVP.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Abuse of market power

Legal basis

Art. L. 464-1 Code de commerce (mesures conservatoires); vorläufige Würdigung nach Art. L. 420-2 Code de commerce und Art. 102 AEUV; Art. L. 218-4 Code de la propriété intellectuelle

Action

Order

Status of proceedings

under appeal

Sector

Media and online platforms

Employees

10,000 or more

Published

8 Jul 2026

Checked against the official source on 2 Oct 2026 · Direct link

From May to the end of August 2024, the public hospital accidentally published on its website a surgery list containing patients' telephone numbers, illnesses and planned procedures; a member of the public found the document via Google. The Hellenic Data Protection Authority imposed a total of 25,000 EUR: 10,000 EUR for inadequate security, 2,000 EUR for the late notification, 10,000 EUR for failing to notify the data subjects and 3,000 EUR for missing contact details of the data protection officer (DPO).

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1, 12, 13 i. V. m. 37 (Entscheidung 13/2026)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

The data protection authority had prohibited a company from tracking its three company vehicles continuously by GPS and ordered the data to be erased; narrow purposes such as theft protection while parked remained permitted. The Upravno sodišče Republike Slovenije (Administrative Court of the Republic of Slovenia) upheld this and clarified that employee consent bundled with other declarations is invalid.

Authority / court

Upravno sodišče Republike Slovenije (bekanntgemacht durch den Informacijski pooblaščenec)

Area of law

Data protection · Employee data

Legal basis

Art. 6 Abs. 1 lit. f, Art. 7 Abs. 2 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

7 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Garante (Italian data protection authority) fined the US operator of the generative AI service Character.AI, on which users – including minors – chat with virtual characters, 158,000 EUR, among other things for deficient privacy information, a data protection impact assessment prepared late and the late appointment of a representative in the EU. It also criticised weaknesses in the protection of minors and in age verification; within 120 days the company must ensure working age verification, an effective cooling-off period preventing blocked minors from re-registering and private-by-default profiles for minors.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 2, 12 Abs. 1, 13 Abs. 1 und 2, 14 Abs. 1 und 2, 24 Abs. 1, 25 Abs. 2, 27 Abs. 1 und 35 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Repeat case

no

Mitigating circumstances

Mitigating: progressively strengthened age checks (a dedicated service for minors, age verification by a third-party provider), no previous relevant infringements, cooperation and amendments to the privacy policy during the proceedings.

Published

9 Jul 2026

Checked against the official source on 28 Sep 2026 · Direct link

At the request of a third party and outside the scope of his duties, a bank employee retrieved account statements of a data subject (name, IBAN, transactions, balances). The Romanian data protection authority (ANSPDCP) found insufficient technical and organisational measures and imposed 26,172 lei (5,000 EUR); the bank has paid the fine. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1, 2 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

2 Jul 2026

Original amount 26,172 RON, converted at the ECB reference rate of 2 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

In a targeted inspection of cookies on company websites, the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) found fault with the site 4mebeles.lv. After a reprimand in February 2026, the company claimed that the deficiencies had been remedied, which a further inspection disproved; further requests for information went unanswered. The DVI imposed 1,000 EUR for failure to cooperate and requested the missing information by 3 August 2026.

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

intentional

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link

The credit rating agency did not submit up-to-date rating information to the European Securities and Markets Authority (ESMA), did not provide complete historical performance data to the central repository and lacked adequate procedures and internal control mechanisms. ESMA found negligent infringements and imposed fines totalling 2,145,000 EUR.

Authority / court

Europäische Wertpapier- und Marktaufsichtsbehörde (ESMA)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Verordnung (EG) Nr. 1060/2009 (CRA-Verordnung), Art. 24, 36a, Anhang III

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Culpability

negligent

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link

Because Paysera did not comply with the order to submit its 2024 annual financial statements by 30 September 2025, the Lietuvos bankas (Bank of Lithuania, financial supervisor) first imposed 20,000 EUR in November 2025 and then a daily fine of 1,000 EUR (rising to 2,000 and 3,000 EUR respectively). As the infringement was only remedied after 6 May 2026, the daily fine added up to 362,000 EUR. Source: archived copy of the press release.

Authority / court

Lietuvos bankas (Litauische Zentralbank, Finanzaufsicht)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Aufsichtsrechtliche Anordnung und Berichtspflichten nach litauischem E-Geld-Recht

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

yes

Published

30 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

In stock option plans for employees of client companies (2018–2023), the bank did not fully inform the beneficiaries about costs, had initially not recorded the conflicts of interest in this business and assessed clients’ knowledge only with a yes/no question. The Autorité des services et marchés financiers (Belgian Financial Services and Markets Authority, FSMA) accepted a settlement of 1 million EUR with publication by name and commitments on cost information.

Authority / court

Autorité des services et marchés financiers (FSMA)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Loi du 2 août 2002; Wohlverhaltensregeln (Loyalität, Kostentransparenz, bestmögliche Ausführung, Interessenkonflikte, Kundenkenntnis)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Repeat case

yes

Mitigating circumstances

Remediation of all deficiencies (appropriateness test, conflicts policy, cost disclosure, waiver of CVA/KVA discounts).

Published

26 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

On its Allegro account, the electronics retailer promised dispatch within 24 hours even for goods not in stock and did not inform customers in good time of delays or unavailability. UOKiK imposed a fine of 3,043,000 PLN; the decision is not final.

Authority / court

Urząd Ochrony Konkurencji i Konsumentów (UOKiK)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Verletzung kollektiver Verbraucherinteressen

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Published

26 Jun 2026

Original amount 3,043,000 PLN, converted at the ECB reference rate of 26 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

On application by a competitor, the Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) established that the laboratory had offered packages of medical laboratory tests free of charge nationwide over extended periods (only against a fee of 2 leva for taking blood) – conduct shown by no other market participant outside joint campaigns. It found an infringement of the general clause of unfair competition law (Art. 29 ZZK – Bulgarian Protection of Competition Act) and imposed 0.3% of 2024 turnover, i.e. 52,096.55 EUR. Appeals have been lodged against the decision.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Competition law

Legal basis

Art. 29 ZZK (Generalklausel unlauterer Wettbewerb)

Action

Fine

Status of proceedings

under appeal

Sector

Healthcare

Published

2 Jul 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In an action brought by Notre Affaire à Tous, Sherpa, ZEA, France Nature Environnement and the City of Paris, the Paris Judicial Court (Tribunal judiciaire de Paris, 34th chamber) ruled that climate risks fall under the French duty of vigilance law and that Scope 3 emissions are part of the oil and gas group's activities. The vigilance plan without Scope 3 is incomplete, the court held; TotalEnergies must supplement it within six months, with provisional enforceability, and implementation will be reviewed by the court in January 2027.

Authority / court

Tribunal judiciaire de Paris (34. Kammer)

Area of law

Supply chain and human rights · Supply chain due diligence

Legal basis

Art. L.225-102-1 und L.225-102-2 Code de commerce (Loi n° 2017-399, devoir de vigilance); Art. 1252 Code civil

Action

Order

Status of proceedings

unknown

Sector

Energy and utilities

Employees

10,000 or more

Published

25 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

The company had stored statistically calculated ‘party affinities’ for around 2.2 million people and in some cases sold them to advertising clients – special categories of personal data without consent; in addition, parcel frequency data was further processed for incompatible purposes. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) had imposed 18 million EUR in 2019 and the Federal Administrative Court (Bundesverwaltungsgericht, BVwG) 16 million EUR in 2024; Austria's Supreme Administrative Court (Verwaltungsgerichtshof, VwGH) has now set the fine with final effect at 13 million EUR (plus 100,000 EUR in procedural costs).

Authority / court

Verwaltungsgerichtshof (Ausgangsbescheid: Datenschutzbehörde)

Area of law

Data protection · Marketing and consent

Legal basis

DSGVO Art. 5 Abs. 1 lit. a und b, Art. 6 Abs. 4, Art. 9 Abs. 1 (VwGH Ro 2025/04/0007)

Action

Fine

Status of proceedings

reduced

Sector

Other

Culpability

negligent

Mitigating circumstances

Comprehensive cooperation, deletion of the party affinities, settlements with data subjects, long duration of proceedings (5 years, 10 months).

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Sanctions Committee of the FSMA (Belgian Financial Services and Markets Authority) found that the shipping company Exmar NV, listed on Euronext Brussels, had not disclosed as soon as possible inside information it held on 19 May and 18 June 2020; the information related to a customer's missing payments for the charter of a floating LNG facility. It imposed a fine of 350,000 EUR and ordered publication by name for one year. Exmar has lodged an appeal with the Market Court.

Authority / court

Autoriteit voor Financiële Diensten en Markten / Autorité des services et marchés financiers (FSMA) – Sanctiecommissie

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 17 Verordnung (EU) Nr. 596/2014 (MAR); Art. 36 § 2 und Art. 72 § 3 Gesetz vom 2. August 2002 über die Aufsicht über den Finanzsektor

Action

Fine

Status of proceedings

under appeal

Sector

Transport, logistics and shipping

Checked against the official source on 2 Oct 2026 · Direct link

The Agencija za zaštitu tržišnog natjecanja (Croatian Competition Agency, AZTN) found that Kaufland Hrvatska charged food suppliers fees for services not provided and for advertising not commissioned, and paid for perishable goods only after more than 30 days. For these unfair trading practices, and with repeat offending as an aggravating factor (final penalty already in 2020), it imposed 300,000 EUR (date = publication).

Authority / court

Agencija za zaštitu tržišnog natjecanja (AZTN)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 4, 11, 12 Zakon o zabrani nepoštenih trgovačkih praksi u lancu opskrbe hranom (ZNTP)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Repeat case

yes

Published

24 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

After the Facebook page of the Danish fashion retailer Clothing By Ros ApS was hacked in 2023, Meta failed to respond appropriately for almost two years, gave no reasons for the de facto suspension and offered no effective complaint-handling procedure. The Konkurrencerådet (Danish Competition Council) found infringements of the P2B Regulation and ordered Meta to comply with the rules on statements of reasons and complaint handling in future.

Authority / court

Konkurrencerådet (Danish Competition Council)

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2019/1150 (P2B) Art. 4, Art. 11

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

24 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

From January 2024 to December 2025, the online retailer advertised time-limited discounts with countdown timers which, once they had expired, restarted with a new timer on identical terms. The AGCM classified this artificial scarcity as a particularly insidious dark pattern and imposed a fine of 2 million EUR.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Codice del Consumo (pratiche commerciali scorrette)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Published

25 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

According to the AMF (Autorité des marchés financiers, French financial markets authority) Enforcement Committee, the online broker Bourse Direct did not properly submit its transaction reports under Art. 26 MiFIR between January 2021 and November 2023 and did not maintain an adequate system to detect and report suspicious orders and transactions under Art. 16(2) MAR. The company received EUR 800,000. The amount covers only the sanction imposed on the company.

Authority / court

Autorité des marchés financiers (AMF), Commission des sanctions

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 26 Verordnung (EU) Nr. 600/2014 (MiFIR); Art. 15 Delegierte Verordnung (EU) 2017/590; Art. 16 Abs. 2 Verordnung (EU) Nr. 596/2014 (MAR); Art. 2, 3 Delegierte Verordnung (EU) 2016/957

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Employees

50 to 249

Published

25 Jun 2026

Checked against the official source on 2 Oct 2026 · Direct link

BaFin imposed fines on the battery manufacturer because it had not disclosed inside information without delay and had not published the half-yearly financial report for the 2024 financial year.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 17 Abs. 1 UAbs. 1 MAR; § 115 Abs. 1 Satz 1 WpHG

Action

Fine

Status of proceedings

final

Sector

Manufacturing and mechanical engineering

Published

1 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Following an on-site inspection from February to April 2025, the Bank of Italy (Banca d'Italia) found deficiencies in customer due diligence, active cooperation (suspicious transaction reporting) and anti-money laundering controls, and imposed an administrative fine of 40,000 EUR. The duration of the deficiencies and the corrective measures initiated were taken into account.

Authority / court

Banca d'Italia

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Art. 62 d.lgs. 231/2007; Verstöße gegen Art. 7, 16–19, 24, 25, 35, 36 d.lgs. 231/2007

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

Corrective measures initiated

Checked against the official source on 25 Sep 2026 · Direct link

From 2 October 2023 to 22 October 2024, contrary to a 2023 ECB decision, Banque Internationale à Luxembourg did not apply the newly approved internal models for the expected loss best estimate (ELBE) of defaulted retail and corporate exposures and therefore reported an IRB shortfall to be deducted from Common Equity Tier 1 capital that was too small. The ECB regarded the breach as intentional and severe and imposed 3,255,000 EUR; remedial action was taken into account as mitigating.

Authority / court

Europäische Zentralbank (EZB), Bankenaufsicht

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Art. 18 Abs. 7 VO (EU) Nr. 1024/2013 (Verstoß gegen einen EZB-Beschluss zu internen Modellen)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

intentional

Mitigating circumstances

Remedial action to alleviate the effects and to prevent future breaches.

Published

29 Jun 2026

Checked against the official source on 28 Sep 2026 · Direct link

For the period April 2022 to May 2023, the Swedish financial supervisory authority Finansinspektionen (FI) found that the bank’s general risk assessment did not realistically assess the terrorist financing risks of its corporate products and that no enhanced due diligence measures were taken for high-risk corporate customers. FI issued a remark and imposed 140 million SEK; the bank has brought an action before the administrative court.

Authority / court

Finansinspektionen (FI)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Penningtvättslagen (2017:630)

Action

Fine

Status of proceedings

under appeal

Sector

Financial services and insurance

Published

17 Jun 2026

Original amount 140,000,000 SEK, converted at the ECB reference rate of 17 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The CONSOB (Italian securities regulator) fined Banco BPM S.p.A. 370,000 EUR, of which 170,000 EUR for late disclosure of inside information under Art. 17(1) MAR and 200,000 EUR for obstructing supervision under Art. 187-quinquiesdecies of the Consolidated Law on Finance (TUF), and fined its subsidiary Banco BPM Vita S.p.A. 200,000 EUR, 570,000 EUR in total. In connection with BPM Vita's tender offer for Anima Holding S.p.A., the bank disclosed an ECB letter of 21 March 2025 rejecting the application of the so-called Danish Compromise to CONSOB and the market only four days later, after two trading days of the acceptance period. Both companies had previously informed CONSOB only incompletely about their discussions with the ECB.

Authority / court

CONSOB (Commissione Nazionale per le Società e la Borsa)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 17 Abs. 1 Verordnung (EU) 596/2014 (MAR); Art. 187-ter.1 und Art. 187-quinquiesdecies Abs. 1 und 1-ter D.Lgs. 58/1998 (TUF)

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Culpability

negligent

Repeat case

yes

Published

23 Jun 2026

Checked against the official source on 28 Sep 2026 · Direct link

The security services provider used cameras in vehicles through which personal data was processed without any legal basis for doing so. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) issued a reprimand under Art. 58 GDPR; no fine was imposed.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Video surveillance

Legal basis

DSGVO Art. 6 Abs. 1

Action

Reprimand or warning

Status of proceedings

final

Sector

Defence and security

Checked against the official source on 25 Sep 2026 · Direct link

An employee of the service provider acting as processor for Kaufland România let a third party into a store’s video surveillance room; that person filmed the images and distributed them on social media. Kaufland reported the incident. The Romanian data protection authority (ANSPDCP) imposed 10,200 lei (2,000 EUR) on the processor and ordered additional checks of the work instructions; the fine has been paid. Date = publication of the press release; according to the authority, the investigation was concluded in April 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Video surveillance

Legal basis

Art. 29, Art. 32 Abs. 1 lit. b, Abs. 2 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

15 Jun 2026

Original amount 10,200 RON, converted at the ECB reference rate of 15 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The online retailer had not set a retention period for customer accounts and kept data until customers requested deletion; purchases were only possible with an account. The sanctions board of the Finnish Data Protection Ombudsman imposed 856,000 EUR in 2024, the administrative court reduced the fine to 792,639 EUR on the basis of current turnover, and the Supreme Administrative Court (Korkein hallinto-oikeus, KHO) confirmed this on 12 June 2026.

Authority / court

Korkein hallinto-oikeus (KHO); Sanktionsgremium des Datenschutzbeauftragten

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. e DSGVO

Action

Fine

Status of proceedings

reduced

Sector

Retail and e-commerce

Published

18 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

A data subject complained about the disclosure of footage from the supermarket chain’s video surveillance and about the inadequate response to his access request. The Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found that Market In had passed the video footage to the judicial authorities without informing the data subject beforehand, processed more data than necessary, failed to comply with the right of access and failed to cooperate with the authority, and by Decision 10/2026 imposed a total of 95,000 EUR (50,000 EUR for lawfulness/transparency, 20,000 EUR each for data minimisation and the right of access, 5,000 EUR for failure to cooperate); in the same proceedings, ΜΕΔΕ ΑΕ received 65,000 EUR.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, c, Art. 5 Abs. 2, Art. 12, 13, 15, 31 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Checked against the official source on 25 Sep 2026 · Direct link

In November 2018 attackers encrypted patient data in the laboratory information system of Midlands Regional Hospital Tullamore. The DPC found that the HSE had infringed Art. 5(1)(f), 28, 30, 32(1) and 34 GDPR (including insufficient security, deficient processor contracts and record of processing, and incomplete notification of affected persons), issued a reprimand, imposed €300,000 for the security failings (Art. 5(1)(f) and 32(1)) and ordered it to introduce specified policies and procedures for secure processing.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 28, 30, 32(1), 34 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 2 Oct 2026 · Direct link

Philip Morris Italia widely promoted heated tobacco devices, e-cigarettes and nicotine products for oral use with phrases such as "senza fumo" (smoke-free) and a "smoke-free future"; the AGCM considered this misleading because it suggested that the products were harmless or less harmful, although they can endanger health and safety. The authority imposed a fine of 7,000,000 EUR and prohibited continuation; the proceedings were triggered by a report from the Ministry of Health.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 20, 21 Abs. 1 und 3, 22 Codice del consumo (D.lgs. 206/2005)

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

10 Jun 2026

Checked against the official source on 28 Sep 2026 · Direct link

In 2019, the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI) had imposed 14.5 million EUR on the housing group because tenant data such as salary statements, bank statements and social security data were held in an archive system with no means of deletion. Following the 2023 CJEU judgment on direct corporate liability, the Berlin Regional Court (Landgericht Berlin I) confirmed on 9 June 2026 infringements of data minimisation and storage limitation; the press release does not state the amount of the fine set by the court.

Authority / court

Landgericht Berlin I (Bußgeldbehörde: Berliner Beauftragte für Datenschutz und Informationsfreiheit)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5, Art. 25 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Liability of senior managers

According to the CJEU (C-807/21), a breach of duty by a person in a management position need not be proven for the corporate fine.

Published

10 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

The European Commission ordered Meta to restore access for rival general-purpose AI assistants to the WhatsApp for Business interface on the terms in place before 15 October 2025, i.e. free of charge, and to maintain it until the final decision. The Commission found a prima facie abuse of a dominant position in consumer communication apps, because Meta had first excluded third-party assistants and later charged a fee with practically the same effect; the measures had to be implemented within five working days.

Authority / court

Europäische Kommission

Area of law

Competition law · Abuse of market power

Legal basis

Art. 102 AEUV; Art. 54 EWR-Abkommen; Art. 8 Abs. 1 VO (EG) Nr. 1/2003

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

9 Jun 2026

Checked against the official source on 28 Sep 2026 · Direct link

The listed hotel group did not publish its 2024 annual financial report on time; the Cyprus Securities and Exchange Commission (CySEC) imposed a total of 16,500 EUR. At the same meeting, eleven other issuers were fined between 1,500 and 17,000 EUR for the same reason; a fine of 13,500 EUR had already been imposed on the company under the same law in 2025.

Authority / court

Cyprus Securities and Exchange Commission (CySEC)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Sec. 9(1), 37(2)(a) Transparency Requirements (Securities Admitted to Trading on a Regulated Market) Law 2007

Action

Fine

Status of proceedings

unknown

Sector

Other

Repeat case

yes

Published

7 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

With the support of a consultancy, the three largest pay-TV providers agreed from 2019 to May 2025 to introduce advertising as a condition for accessing recordings and to standardise the marketing of this advertising space. The Autoridade da Concorrência (Portuguese Competition Authority, AdC) imposed 8,181,000 EUR on three companies; together with the fourth participant, already sanctioned earlier under a settlement, the fines add up to 13,351,000 EUR. Owing to ongoing court proceedings, the AdC did not publish the names in its announcement.

Authority / court

Autoridade da Concorrência (AdC)

Area of law

Competition law · Cartels and collusion

Legal basis

Lei da Concorrência (Lei n.º 19/2012), Art. 9.º (Processo PRC/2020/4)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

5 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

Due to errors by a processor of the energy supplier, incorrect details of a direct debit mandate were recorded, so that three bills instead of one were debited from the customer's account; call recordings and the mandate form had not been retained. ZENITH responded inadequately to the access request and did not correct the data (100,000 EUR), while Piraeus Bank infringed the right of access (10,000 EUR and a reprimand); Decision No. 8/2026 of the Hellenic Data Protection Authority.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic DPA)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. d, Art. 12 Abs. 3, Art. 15, Art. 28 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 25 Sep 2026 · Direct link

The importer and wholesaler of the Vans, Eastpak and The North Face brands contractually prohibited its retailers from using price comparison portals and search engine advertising (in particular Google Ads). The Επιτροπή Ανταγωνισμού (Hellenic Competition Commission) regarded this as a hardcore restriction in online sales and, in a settlement procedure (Decision 913/2026), set a reduced fine of 954,485 EUR; date = press release.

Authority / court

Επιτροπή Ανταγωνισμού (Hellenic Competition Commission)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 1 Gesetz 3959/2011; Art. 101 AEUV; Art. 4 lit. e VO (EU) 2022/720

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Mitigating circumstances

Settlement procedure (Diettheti Diaforon) with fine reduction

Published

3 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

On 2 June 2026 the Autoriteit Financiële Markten (AFM, Dutch Authority for the Financial Markets) fined bunq B.V. 170,000 EUR because in seven cases the bank did not give a substantive reply within the statutory 15 working days to complaints from customers who had fallen victim to online fraud (November to December 2023 and April to at least August 2024). Because bunq fully or largely compensated those affected without being legally obliged to, the AFM lowered the base amount from 500,000 to 200,000 EUR; the simplified settlement brought a further 15% reduction.

Authority / court

Autoriteit Financiële Markten (AFM)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Art. 43a Abs. 1 i. V. m. Abs. 2 Besluit Gedragstoezicht financiële ondernemingen Wft (BGfo), Umsetzung von Art. 101 PSD2

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Voluntary full or largely full compensation of the customers concerned; simplified settlement (−15%).

Published

8 Jun 2026

Checked against the official source on 2 Oct 2026 · Direct link

The KNF imposed four fines totalling PLN 14,900,000 on mBank: PLN 0.4m and 6m because staff negotiated client transactions with unauthorised third parties and passed client information to them, PLN 5m for not treating currency hedging transactions as financial instruments and PLN 3.5m for ineffective internal control and compliance functions. Following a request for reconsideration, the KNF upheld the decision on 28 August 2026; it is not final.

Authority / court

Komisja Nadzoru Finansowego (KNF)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

§ 8 Abs. 1 i. V. m. § 26 Nr. 1 Verordnung des Finanzministers vom 24.09.2012; Art. 83b Abs. 3 und 6, Art. 83c Abs. 1 ustawa o obrocie instrumentami finansowymi; Art. 9c Abs. 1 Nr. 4 Prawo bankowe; Art. 21 und 22 Delegierte Verordnung (EU) 2017/565

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Original amount 14,900,000 PLN, converted at the ECB reference rate of 29 May 2026.

Checked against the official source on 28 Sep 2026 · Direct link

Temu's 2024 risk assessment was based on general industry data rather than on findings about its own service and underestimated how often EU consumers encounter illegal products; test purchases revealed unsafe chargers and baby toys. The European Commission imposed 200 million EUR under the Digital Services Act (DSA) and required an action plan by 28 August 2026.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2022/2065 (DSA), Risikobewertungspflichten sehr großer Online-Plattformen; Art. 75

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Published

28 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

In September 2024 three construction companies coordinated their bid prices and decided the winner in a civil engineering tender of the municipality of Ommen, which was awarded for 153,250 EUR. Because of earlier cartel infringements by the companies or their legal predecessors established in 2005, the ACM (Autoriteit Consument & Markt, Dutch competition and consumer authority) increased the fines by 20%. In the simplified procedure it imposed allegedly 30,000 EUR on Timmerhuis and allegedly 15,500 EUR on Bouwhuis (45,500 EUR in total); Van Gelder, as first leniency applicant, was not fined.

Authority / court

Autoriteit Consument & Markt (ACM)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 6 Abs. 1 Mededingingswet

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Repeat case

yes

Mitigating circumstances

For cooperating in the simplified procedure, the ACM reduced the fines of Bouwhuis and Timmerhuis by 15%, and that of Timmerhuis by a further 5% for evidence provided voluntarily; Van Gelder, as first applicant, received full leniency immunity.

Published

2 Jun 2026

Checked against the official source on 4 Oct 2026 · Direct link

The manufacturer of solar tracking systems disseminated its results for 2023 by way of an "Otra Información Relevante" announcement containing inaccurate information. Spain's National Securities Market Commission (CNMV) imposed a fine of 190,000 EUR for a serious infringement; the company waived administrative appeals.

Authority / court

Comisión Nacional del Mercado de Valores (CNMV)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 297.1.e i. V. m. 297.2.d Ley 6/2023; Art. 17 i. V. m. Art. 7 MAR

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Published

3 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

The CNIL (French data protection authority) fined IQVIA Operations France EUR 5,000,000 because, for two health data warehouses authorised by the CNIL (fed with data from around 14,000 pharmacies and several thousand medical practices), the company did not comply with the conditions of the authorisations, including log analysis, multi-factor authentication, patient information and the right to object. In addition, pharmacy customers were not informed of the transfer of their data, in-house studies were carried out without the required authorisation and the pharmacy software transmitted data even after a refusal (Art. 25 GDPR). The CNIL classified the data as pseudonymised rather than anonymous and ordered remedial action within six months, subject to a penalty payment of EUR 10,000 per day.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 66 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés); Art. 14 und 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

The security shortcomings were remedied after the inspections.

Published

28 May 2026

Checked against the official source on 2 Oct 2026 · Direct link

On 7 November 2025, the publisher's news portals Origo and Magyar Nemzet linked to a map, created by unknown persons, containing the names, addresses, telephone numbers, email addresses, geo-coordinates and political preferences of Tisza sympathisers; Ripost showed an image with the name of the map. The Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) found intentional infringements of Art. 6 and 9 GDPR, prohibited further dissemination and imposed 50 million HUF.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection

Legal basis

DSGVO Art. 6 Abs. 1, Art. 9 Abs. 1, Art. 58 Abs. 2 lit. b und f

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Culpability

intentional

Published

26 May 2026

Original amount 50,000,000 HUF, converted at the ECB reference rate of 26 May 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

For the period June 2023 to June 2024, the Cyprus Securities and Exchange Commission (CySEC) examined the investment firm’s organisational requirements, client information, appropriateness assessment and compliance with the restrictions on marketing CFDs to retail investors. The proceedings were concluded with a settlement of 100,000 EUR, which the company has already paid.

Authority / court

Cyprus Securities and Exchange Commission (CySEC)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Art. 22(1), 25(1), 26(3) Gesetz über Wertpapierdienstleistungen 2017; Art. 42 VO (EU) 600/2014; CySEC-Richtlinie DI87-09; Art. 37(4) CySEC-Gesetz

Action

Other

Status of proceedings

final

Sector

Financial services and insurance

Published

24 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

On the auction website Ticketveiling.nl, House of Tickets B.V. drove up the prices of auctioned lots with automatic bids placed by an algorithm and misled consumers about how the final price came about. The ACM (Autoriteit Consument & Markt, Dutch competition and consumer authority) considered 300,000 EUR appropriate and reduced the fine by 10% to 270,000 EUR because the company admitted the infringements in the simplified procedure; it decided not to fine Ticketveiling B.V.

Authority / court

Autoriteit Consument & Markt (ACM)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 8.8 Whc i. V. m. Art. 6:193c Abs. 1 lit. d und Art. 6:193g lit. v BW

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Mitigating circumstances

10% reduction for admitting the infringements and cooperating in the simplified procedure; the infringements were short and ended voluntarily before the investigation began.

Published

28 May 2026

Checked against the official source on 2 Oct 2026 · Direct link

Attackers posed as technical support, induced staff at points of sale to grant system access and obtained data on more than 365,000 customers, including payment data for 41,359 of them. The Italian data protection authority (Garante per la protezione dei dati personali) criticised deficient management of access credentials and digital certificates as well as inadequate security assessments, and imposed 1,715,600 EUR.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO (Integrität und Vertraulichkeit, Art. 32)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Pyrolysis oil leaked twice at the Lavéra petrochemical site in Martigues: around 50 tonnes in July 2018 through a failed seal into the Anse d'Auguette, part of which reached the sea, and around one tonne in April 2022 through a corroded seawater pipe, of which some 500 kg reached the Anse d'Auguette. Naphtachimie therefore concluded an environmental CJIP (convention judiciaire d'intérêt public, French deferred prosecution agreement) with the Marseille public prosecutor; it pays a public interest fine of 1,200,000 EUR, compensates two environmental associations and will trial, at its own expense, a biological clean-up of the Anse d'Auguette; validated on 13 May 2026.

Authority / court

Parquet de Marseille (Procureur de la République); Validierung durch den Präsidenten des Tribunal judiciaire de Marseille

Area of law

Environment and sustainability · Emissions and permits

Legal basis

Art. 41-1-3 Code de procédure pénale (pollution des eaux)

Action

Fine

Status of proceedings

final

Sector

Chemicals and pharmaceuticals

Published

26 May 2026

Checked against the official source on 2 Oct 2026 · Direct link

The bank failed to draw up insider lists in good time for two pieces of inside information (termination of the core banking project with Cognizant in 2021, merger talks with Liedon Säästöpankki in 2022), did not update them and omitted mandatory information. The Finanssivalvonta (Finnish Financial Supervisory Authority, FIN-FSA) imposed a total fine of 400,000 EUR; the decision was not appealed and is final.

Authority / court

Finanssivalvonta (FIN-FSA)

Area of law

Capital markets and financial supervision · Market abuse and insider dealing

Legal basis

Verordnung (EU) Nr. 596/2014 (MAR) Art. 18 Abs. 1, 3 und 4; Durchführungsverordnung (EU) 2016/347

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Measures to prevent recurrence and partial admission/cooperation had a mitigating effect.

Published

15 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Finanssivalvonta (FIN-FSA, Finnish Financial Supervisory Authority) imposed a penalty payment of 115,000 EUR on Pareto Securities Ab. The firm had submitted no transaction reports at all on 71 days in 2024 and 20 days in 2025, and between June 2023 and May 2025 it reported 13 transactions an unusually high number of times, most of them more than 300 times. The admission of the failings reduced the amount.

Authority / court

Finanssivalvonta (FIN-FSA)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 26 Abs. 1 UAbs. 1 MiFIR (VO (EU) Nr. 600/2014); Sijoituspalvelulaki 15 luku 2 § 7 mom. 5 kohta; FivaL 40 §, 41 §

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Admission of the failings and cooperation with the supervisor.

Published

13 May 2026

Checked against the official source on 28 Sep 2026 · Direct link

The Walloon water utility recorded and listened in on customer calls for quality control and training purposes; the Litigation Chamber of the Autorité de protection des données (Belgian Data Protection Authority, APD/GBA) found infringements of transparency and fairness as well as in the engagement of a sub-processor. It imposed two fines totalling 86,000 EUR (85,000 + 1,000) after reducing the amounts in view of the situation of the public utility; an appeal against the decision has been lodged with the Market Court.

Authority / court

Autorité de protection des données (APD/GBA) – Chambre Contentieuse

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1, Art. 12 Abs. 1, Art. 13, Art. 28 Abs. 3

Action

Fine

Status of proceedings

under appeal

Sector

Energy and utilities

Checked against the official source on 25 Sep 2026 · Direct link

Fraudsters in possession of customer data posed as customers at the bank's ‘Open24’ call centre, had account details changed and obtained further information because security protocols were not followed; those affected had to close accounts, and some suffered losses. Ireland's Data Protection Commission (DPC) imposed 250,000 EUR for inadequate security and 27,500 EUR for late breach notification (decision served in the week before the press release).

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1, Art. 33 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

8 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

For more than ten years from 2012, the distributor and retailer of consumer electronics and household appliances set minimum resale prices for its retail customers, monitored them and sanctioned deviations. The Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) imposed 38.971 million CZK; a leniency application, settlement and an improved compliance programme reduced the fine, and the company appealed against the amount.

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Competition law · Cartels and collusion

Legal basis

Tschechisches Wettbewerbsgesetz, Art. 101 AEUV

Action

Fine

Status of proceedings

under appeal

Sector

Retail and e-commerce

Culpability

intentional

Mitigating circumstances

Leniency application, settlement and expansion of the internal compliance programme.

Published

6 May 2026

Original amount 38,971,000 CZK, converted at the ECB reference rate of 6 May 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The Česká národní banka (ČNB, Czech National Bank) fined Československá obchodní banka 30,000,000 CZK under the Czech anti-money laundering act. For customers internally rated as high-risk, including a credit institution, the bank did not adequately examine the purpose and background of transactions such as 58 cash withdrawals and did not fully screen ownership and management structures against sanctions lists. It also lacked effective internal procedures for ongoing customer due diligence and for enhanced due diligence on transactions involving high-risk third countries; for 8,414 legal entities with complex structures, the whole structure was not screened for sanctions.

Authority / court

Česká národní banka (ČNB)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

§ 9 Abs. 1 lit. c, § 9a Abs. 1, § 21 Abs. 1, § 44 Abs. 1 lit. b und Abs. 3 lit. d, § 48 Abs. 1 Zákon č. 253/2008 Sb. (AML-Gesetz)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Original amount 30,000,000 CZK, converted at the ECB reference rate of 6 May 2026.

Checked against the official source on 28 Sep 2026 · Direct link

One of the insurer’s intermediaries was removed from the FSMA register in December 2023; owing to a human data entry error in the monitoring tool, P&V only noticed this after more than a month and concluded 34 contracts through him during that time. The Autorité des services et marchés financiers (Belgian Financial Services and Markets Authority, FSMA) accepted a settlement of 150,000 EUR; there had already been a settlement for the same amount in 2020.

Authority / court

Autorité des services et marchés financiers (FSMA)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Loi du 4 avril 2014 relative aux assurances, Art. 259

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Repeat case

yes

Mitigating circumstances

IT adjustments to prevent recurrence.

Published

5 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

The manufacturer Decora and the wholesaler Bel-Pol had coordinated prices for vinyl panels, underlays, skirting boards and floor profiles from Decora's range and divided the wholesale market for these products. UOKiK imposed fines of PLN 28,344,000 on Decora and PLN 5,290,000 on Bel-Pol, PLN 33,634,000 in total. The decision is not final.

Authority / court

Prezes Urzędu Ochrony Konkurencji i Konsumentów (UOKiK)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 6 Abs. 1 Nr. 1 und 3 ustawa o ochronie konkurencji i konsumentów; Art. 101 Abs. 1 lit. a und c AEUV; Art. 106 Abs. 1 Nr. 1 und 2, Art. 113c und Art. 89a ustawa o ochronie konkurencji i konsumentów

Action

Fine

Status of proceedings

under appeal

Sector

Construction and real estate

Mitigating circumstances

As a leniency applicant, Bel-Pol received a 50% reduction of its fine and a further 10% for voluntarily accepting the fine (settlement).

Liability of senior managers

Measures against individuals are not reported here.

Original amount 33,634,000 PLN, converted at the ECB reference rate of 4 May 2026.

Checked against the official source on 28 Sep 2026 · Direct link

Although the Information and Data Protection Commissioner (IDPC) had already ruled in favour of a complainant, an insurance company (name redacted) again had him called for marketing purposes via a third-party company; his number remained on call lists. The IDPC criticised the lack of safeguards and inadequate contracts with processors, ordered remedial action within 20 days and imposed two fines totalling 1,000 EUR.

Authority / court

Information and Data Protection Commissioner (IDPC)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 2, Art. 21 Abs. 2, Art. 24 Abs. 1, Art. 28 Abs. 3 i. V. m. Art. 58 Abs. 2 lit. b, d, i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link

A processor of Berlin's public transport operator BVG, which had sent customer letters in early 2025, was hacked; around 180,000 customer records were affected, although they should long since have been deleted after the end of the contract. BVG had never checked the deletion, had not agreed any procedure for data breaches in the data processing agreement and reported the incident only after the 72-hour deadline had expired; the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI) issued a reprimand.

Authority / court

Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI)

Area of law

Data protection · Data processors

Legal basis

Art. 5 Abs. 2 i. V. m. Abs. 1 lit. c, e, f, Art. 28 Abs. 3 S. 2 lit. f, Art. 32 Abs. 1, Art. 33 DSGVO

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Mitigating circumstances

BVG has announced measures against similar incidents.

Published

4 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

On application by a client, the Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) found that VMZ had used technical documentation on disposable grenade launchers that had been provided in confidence (trade secret) contrary to the confidentiality agreements and good commercial practice (Art. 37(1) ZZK – Bulgarian Protection of Competition Act). Sanction of 50,855.09 EUR and obligation to cease, with immediate enforceability. Appeals have been lodged against the decision.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Competition law

Legal basis

Art. 37 Abs. 1 ZZK (Geschäftsgeheimnisse)

Action

Fine

Status of proceedings

under appeal

Sector

Defence and security

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In a secret, continuing agreement, three manufacturers of salty snacks and crisps divided up among themselves the supply of private-label snacks to food retailers. Fines: Amica Chips 8,239,210 EUR, Pata 7,555,387 EUR, Preziosi Food 7,503,550 EUR; this was the first time Italy's competition authority (Autorità Garante della Concorrenza e del Mercato, AGCM) applied its settlement procedure.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 101 AEUV; Art. 14-quater Gesetz 287/1990 (Settlement)

Action

Fine

Status of proceedings

unknown

Sector

Food and agriculture

Mitigating circumstances

Leniency reduction for Pata and Amica Chips; 10 % settlement discount for all

Published

28 Apr 2026

Checked against the official source on 25 Sep 2026 · Direct link

The KNF fined the insurer Compensa PLN 8,500,000 because, in motor third-party liability insurance (class 10) in 2022 to 2024, it set premiums that were insufficient to cover all obligations under the contracts and the costs of its insurance business. The decision is not final.

Authority / court

Komisja Nadzoru Finansowego (KNF)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Art. 33 Abs. 2 ustawa z dnia 11 września 2015 r. o działalności ubezpieczeniowej i reasekuracyjnej

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Original amount 8,500,000 PLN, converted at the ECB reference rate of 27 Apr 2026.

Checked against the official source on 28 Sep 2026 · Direct link

Because of an IT problem, Keytrade Bank displayed the same warning for every order from 27 December 2023 to 13 March 2024, regardless of the complexity of the instrument and the client's known level of knowledge. In the view of the FSMA (Belgian Financial Services and Markets Authority), the bank thereby breached the rules on clear client information and on the appropriateness assessment, including for 81,416 transactions in non-complex instruments, 1,081 transactions in complex instruments without asking for knowledge and experience and 4,542 transactions where the required warning of inappropriateness was missing. The bank refunded losses of affected clients and pays 250,000 EUR under the settlement.

Authority / court

Autorité des services et marchés financiers / Autoriteit voor Financiële Diensten en Markten (FSMA) – Comité de direction (règlement transactionnel)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Art. 27bis § 1 und Art. 27ter §§ 3 und 5 Gesetz vom 2. August 2002; Art. 71 § 3 Gesetz vom 2. August 2002

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

The bank sold affected complex positions, refunded losses and informed the clients.

Checked against the official source on 2 Oct 2026 · Direct link

On 20 April 2026 BaFin (German Federal Financial Supervisory Authority) imposed a fine of 1,000,000 EUR on flatexDEGIRO SE. At the end of 2022, the company had not published the results of a special audit under § 44 KWG (German Banking Act) at flatexDEGIRO Bank AG, in which BaFin had identified deficiencies in business organisation, without delay as an ad hoc announcement, but only later as a press release. The fine is final.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 17 Abs. 1 UAbs. 1 MAR (Verordnung (EU) Nr. 596/2014)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

30 Apr 2026

Checked against the official source on 2 Oct 2026 · Direct link

On 20 April 2026 the Autoriteit Financiële Markten (AFM, Dutch Authority for the Financial Markets) fined the US asset manager Arrowstreet Capital, Limited Partnership 297,000 EUR because, between July 2020 and November 2024, an error in its calculation method led it to report its net short positions in Just Eat Takeaway.com and Galapagos to the AFM too low on 101 occasions, 85 of which also breached the public disclosure obligation. Because the firm reported the error itself, corrected it quickly, cooperated fully and took measures against recurrence, the AFM reduced the base amount by 30%; the simplified settlement brought a further 15% reduction, and the matter is closed.

Authority / court

Autoriteit Financiële Markten (AFM)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 5 Abs. 1 und Art. 6 Abs. 1 Verordnung (EU) Nr. 236/2012 (Leerverkaufsverordnung, SSR)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Self-reporting, prompt correction, full cooperation and measures against recurrence (−30% on the base amount); simplified settlement (−15%).

Published

22 Apr 2026

Checked against the official source on 2 Oct 2026 · Direct link

Four laboratories and their association coordinated negotiations on prices with health insurers, coordinated in tenders, exchanged sensitive information and allocated customers. At first instance, the Protimonopolný úrad Slovenskej republiky (Antimonopoly Office of the Slovak Republic, PMÚ SR) imposed 14,551,800 EUR and three-year procurement bans; Unilabs received a substantially reduced fine as leniency applicant and under a settlement.

Authority / court

Protimonopolný úrad Slovenskej republiky (PMÚ SR)

Area of law

Competition law · Cartels and collusion

Legal basis

Slowakisches Wettbewerbsschutzgesetz (Kartellverbot)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

Unilabs: leniency reduction (50%) and settlement (a further 30%).

Published

12 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

Through the association Synadis Bio, market participants ensured for more than seven years that organic brands were not sold simultaneously in specialist organic shops and in conventional supermarkets, in order to prevent price comparisons (decision 26-D-05). Fines: Synadis Bio 10 million EUR, Greenweez/Carrefour 1.85 million EUR, ITM 740,000 EUR, Les Comptoirs de la Bio 80,000 EUR.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Cartels and collusion

Legal basis

Art. L.420-1 Code de commerce, Art. 101 Abs. 1 AEUV; Bußgeldbemessung nach Art. L.464-2 Code de commerce

Action

Fine

Status of proceedings

under appeal

Sector

Food and agriculture

Published

16 Apr 2026

Checked against the official source on 25 Sep 2026 · Direct link

The starting point was a complaint about incomplete disclosure of patient data; the clinic left several requests from the supervisory authority unanswered. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered it to revise its contracts with Align Technology (Invisalign) with regard to the GDPR roles (Art. 26/28 GDPR), to adapt the consent form and the privacy notices in accordance with Art. 7, 9, 13 and 14 GDPR and to publish them in Estonian; non-compliance is subject to a penalty payment of 1,000 EUR per item.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Data processors

Legal basis

§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. d DSGVO i. V. m. Art. 5 Abs. 1 lit. a, 7, 9, 13, 14, 26, 28 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

A provider of public utility services used GPS transmitters in company vehicles to record employees’ location data permanently and without cause, without defining a purpose, carrying out a balancing of interests or providing sufficient information. The Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia, IP) imposed 6,000 EUR on the company.

Authority / court

Informacijski pooblaščenec Republike Slovenije (IP)

Area of law

Data protection · Employee data

Legal basis

Art. 5 und Art. 6 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Liability of senior managers

Measures against individuals are not reported here.

Published

15 Apr 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link