Who was sanctioned, and for what?

From January 2013 to March 2022, the distributor of premium pet food and pet supplies imposed minimum resale prices on its retailers and threatened sanctions if they were undercut. In a settlement procedure, the Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) imposed 36.438 million CZK; the company ended the conduct after the inspection and introduced a compliance programme.

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Competition law · Cartels and collusion

Legal basis

Verbot vertikaler Preisbindung (tschechisches Wettbewerbsgesetz, Art. 101 AEUV)

Action

Fine

Status of proceedings

final

Sector

Retail and e-commerce

Culpability

intentional

Mitigating circumstances

Termination immediately after the inspection, information of customers about free pricing, full cooperation, settlement and newly introduced compliance programme.

Published

24 Sep 2026

Original amount 36,438,000 CZK, converted at the ECB reference rate of 24 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The provider of web-based systems for sickness reporting, rehabilitation and occupational safety incidents was hacked in August 2025; the stolen personal data appeared on the dark web shortly afterwards. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) found that, despite the high need for protection, there were no adequate security measures and no automatic real-time monitoring for attacks, assessed this as negligent and imposed 1,800,000 SEK.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Published

22 Sep 2026

Original amount 1,800,000 SEK, converted at the ECB reference rate of 22 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

On a total of 249 days, the Portuguese branch of the energy supplier failed to hold the mandatory natural gas security reserves, did not correctly show network charges on invoices, did not publish, or published late, mandatory information and its quality report, and failed to meet the standards for hotline waiting times. In a settlement procedure, the Entidade Reguladora dos Serviços Energéticos (Portuguese Energy Services Regulatory Authority, ERSE) set a fine of 44,000 EUR and reduced it to 22,000 EUR.

Authority / court

Entidade Reguladora dos Serviços Energéticos (ERSE)

Area of law

Other

Legal basis

Regime Sancionatório do Setor Energético (RSSE), Art. 28, 29; Decreto-Lei n.º 62/2020, Art. 96; RRC; RQS

Action

Fine

Status of proceedings

final

Sector

Energy and utilities

Culpability

negligent

Mitigating circumstances

Settlement (transação) with full admission, remediation of all infringements

Checked against the official source on 25 Sep 2026 · Direct link

From July 2021 to July 2024, the state forestry company contractually prohibited a customer from actively and passively exporting wood chips and logging residues and secured the ban with a right of termination. The Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) considered this a restriction of competition by object under Czech and EU law and imposed 17.268 million CZK (first instance, not final).

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Competition law · Cartels and collusion

Legal basis

Tschechisches Wettbewerbsgesetz, Art. 101 AEUV (Exportverbot)

Action

Fine

Status of proceedings

unknown

Sector

Food and agriculture

Mitigating circumstances

Voluntary termination immediately after proceedings were opened.

Published

17 Sep 2026

Original amount 17,268,000 CZK, converted at the ECB reference rate of 17 Sep 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

As a so-called fund hotel, the company had its funds managed by other firms, but examined these delegation agreements only insufficiently, did not take the related decisions properly and did not monitor the funds’ returns in relation to risk closely enough. The Swedish financial supervisory authority Finansinspektionen (FI) issued a remark and imposed 2 million SEK; no damage to investors was established.

Authority / court

Finansinspektionen (FI)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Schwedisches Fondsrecht – Regeln zur Delegation der Fondsverwaltung und deren Überwachung

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

No established damage to investors; remedial measures already taken during the investigation.

Published

16 Sep 2026

Original amount 2,000,000 SEK, converted at the ECB reference rate of 16 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Following an on-site inspection, the Finantsinspektsioon (Estonian Financial Supervision Authority) issued an order requiring the payment institution Wallester to remedy, by 31 December, deficiencies in governance and control functions (separation of the lines of defence, internal rules), in safeguarding customer funds and in the staffing of its anti-money laundering and counter-terrorist financing function. Date = publication of the press release.

Authority / court

Finantsinspektsioon (Estnische Finanzaufsicht)

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Aufsichtsrechtliche Anordnung (ettekirjutus) der Finantsinspektsioon

Action

Order

Status of proceedings

unknown

Sector

Financial services and insurance

Published

16 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

In an insurance tender in 2024 worth around 200 million CZK, the ministry had parts of the tender documents drawn up by a broker who could later receive commissions from the winning insurer. As the contracting authority took no measures against the conflict of interest, the Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) imposed a final fine of 300,000 CZK.

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Other

Legal basis

Gesetz über die Vergabe öffentlicher Aufträge (Pflicht zur Vermeidung von Interessenkonflikten)

Action

Fine

Status of proceedings

final

Sector

Public sector

Culpability

negligent

Published

15 Sep 2026

Original amount 300,000 CZK, converted at the ECB reference rate of 15 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

For seven months (October 2025 to May 2026), the bank continued to send a customer advertising via its app, although he had objected several times. The Italian data protection authority (Garante per la protezione dei dati personali) also found deficient systems for implementing objections and inaccurate information about the processing, and imposed 5,508,000 EUR (Provvedimento No. 613).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. a, Art. 12, 21, 24 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Hospital staff opened a colleague's electronic health record to organise duty rosters during Covid rather than for treatment purposes. Technical barriers limiting access to treating staff were lacking; the Italian data protection authority (Garante per la protezione dei dati personali) imposed 24,000 EUR (Provvedimento No. 616).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a, b, c, f, Art. 9, 25, 32 DSGVO; Art. 75 Codice privacy; Linee guida dossier sanitario

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Since 2007, the municipal sports facilities operator had had cameras in the changing rooms of a swimming pool that recorded the locker area. The Italian data protection authority (Garante per la protezione dei dati personali) found no sound legal basis, incomplete notices and a 72-hour retention period not justified by a necessity assessment, and imposed 8,000 EUR (Provvedimento No. 619); the cameras were removed during the proceedings.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1 lit. c und e DSGVO; Art. 2-ter Codice privacy

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The financial institution did not deliver on time the data due every seven days to the Centralised Bank Account Register (CBAR). The Financial Intelligence Analysis Unit (FIAU) set a fine of 162,704 EUR, which was reduced by 40% to 97,622 EUR under a settlement pursuant to its 2026 settlement policy.

Authority / court

Financial Intelligence Analysis Unit (FIAU)

Area of law

Money laundering and terrorist financing

Legal basis

Reg. 4(2), 8, 9 CBAR Regulations (S.L. 373.03)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Settlement with 40% reduction

Published

4 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

At the payment institution, the customer risk assessment had only been introduced after business had started, some customers remained unassessed, and customer profiles were based on transaction thresholds rather than on risk. The Financial Intelligence Analysis Unit (FIAU) set a fine of 266,833 EUR and a follow-up directive; under a settlement, the fine was reduced by 40% to 160,099 EUR.

Authority / court

Financial Intelligence Analysis Unit (FIAU)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Reg. 2(1), 5(5)(a)(ii), 7(1)(c), 7(2)(a), 21, 22 PMLFTR

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Settlement with 40% reduction; remediation demonstrated

Published

2 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

A lily and tulip grower with an average of around 50 (at peak 75) employees, where Polish migrant workers are employed (anonymised in the judgment), was unable to produce sufficient records of hours worked and wages paid for 18 employees for September 2020 to February 2021. The Dutch Minister of Social Affairs and Employment (Minister van Sociale Zaken en Werkgelegenheid) imposed 118,000 EUR in 2024 (112,100 EUR after objection); the North Netherlands District Court (Rechtbank Noord-Nederland) reduced the fine to 95,587.50 EUR, partly because of measures taken and excessively long proceedings.

Authority / court

Rechtbank Noord-Nederland (Bußgeld: Minister van Sociale Zaken en Werkgelegenheid / Nederlandse Arbeidsinspectie)

Area of law

Health and safety and employment law · Minimum wage and undeclared work

Legal basis

Art. 18b Abs. 2 Wet minimumloon en minimumvakantiebijslag (Wml)

Action

Fine

Status of proceedings

reduced

Sector

Food and agriculture

Employees

50 to 249

Mitigating circumstances

Reduction of 12.5 % for appropriate measures, 5 % for delay and 2,500 EUR for exceeding the reasonable length of proceedings.

Checked against the official source on 25 Sep 2026 · Direct link

From December 2012 to June 2022, the two companies allocated customers for vehicle tracking and electronic logbook services between themselves and coordinated bids, including in public tenders. At first instance, the Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) fined O2 262.32 million CZK and SHERLOG 18.357 million CZK and imposed a six-month ban on public contracts; for O2, the fine was increased instead of a procurement ban.

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Competition law · Cartels and collusion

Legal basis

Tschechisches Wettbewerbsgesetz, Art. 101 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

intentional

Published

26 Aug 2026

Original amount 280,677,000 CZK, converted at the ECB reference rate of 26 Aug 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In 2022–2024, the delivery service used a standard clause to prohibit restaurants from being cheaper on their own channels than on Wolt, while at the same time being able to grant discounts without consultation and to compensate customers up to 400 DKK at the restaurants’ expense. The Konkurrencerådet (Danish Competition Council) ordered the practice to cease, required Wolt to inform all restaurants and intends to enforce a fine through the courts.

Authority / court

Konkurrencerådet (Danish Competition Council)

Area of law

Competition law · Abuse of market power

Legal basis

Konkurrenceloven; AEUV Art. 102

Action

Order

Status of proceedings

unknown

Sector

Media and online platforms

Published

26 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

In 2023, intruders gained access to two former psychiatric hospitals and posted videos of the patient records stored there online. An inspection of twelve sites found records with mould, water and animal damage in unsuitable rooms, up to and including shipping containers. Ireland's Data Protection Commission (DPC) imposed a fine of 645,000 EUR, issued a reprimand and ordered audits and the relocation of records.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. e und f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1

Action

Fine

Status of proceedings

final

Sector

Public sector

Employees

10,000 or more

Published

2 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

As a buyer with significant bargaining power, the company from Solin purchased agricultural and food products from two suppliers without written contracts. The Agencija za zaštitu tržišnog natjecanja (Croatian Competition Agency, AZTN) considered this an unfair trading practice and, taking mitigating circumstances into account, imposed 10,000 EUR (date = publication).

Authority / court

Agencija za zaštitu tržišnog natjecanja (AZTN)

Area of law

Competition law · Abuse of market power

Legal basis

Zakon o zabrani nepoštenih trgovačkih praksi u lancu opskrbe hranom (ZNTP)

Action

Fine

Status of proceedings

unknown

Sector

Food and agriculture

Mitigating circumstances

Several mitigating circumstances taken into account

Published

25 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Banque nationale de Belgique (National Bank of Belgium) found serious anti-money laundering due diligence failures at Wise Europe SA, including in identifying and verifying customers and beneficial owners, ongoing monitoring of business relationships, analysis of atypical transactions and intra-group information sharing. It made public that Wise Europe had not complied with an order of 8 July 2025 to meet these obligations by 31 March 2026, and ordered full compliance by 31 January 2027 at the latest; no fine was published.

Authority / court

Banque nationale de Belgique / Nationale Bank van België (BNB/NBB)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Art. 13 § 1, 23, 26, 27, 35 § 1 und 45 Gesetz vom 18. September 2017 zur Verhinderung von Geldwäsche; Anordnung nach Art. 93 § 1 1°, Veröffentlichung nach Art. 93 § 2 1° und Art. 98/1 i. V. m. 135 § 3

Action

Order

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

yes

Published

25 Aug 2026

Checked against the official source on 2 Oct 2026 · Direct link

The Nederlandse Arbeidsinspectie (Netherlands Labour Authority) imposed fines totalling 316,875 EUR on a gym chain in Amsterdam that is not named in the release. For 25 foreign workers the required work permit or combined residence and work permit was missing, and for three people identity had not been established (Wav, Foreign Nationals Employment Act, 234,375 EUR); because of deficient records it could not be verified whether the minimum wage had been paid for all hours worked (WML, Minimum Wage and Minimum Holiday Allowance Act, 60,000 EUR), plus a breach of the Arbeidstijdenwet (Working Hours Act, 22,500 EUR). The company also received two warnings that work may be preventively halted if the same or similar breaches recur.

Authority / court

Nederlandse Arbeidsinspectie

Area of law

Health and safety and employment law · Minimum wage and undeclared work

Legal basis

Wet arbeid vreemdelingen (Wav); Wet minimumloon en minimumvakantiebijslag (WML); Arbeidstijdenwet (ATW)

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

24 Aug 2026

Checked against the official source on 2 Oct 2026 · Direct link

Attackers obtained the credentials of a user account with administrator rights through phishing and accessed customer data. The Romanian data protection authority (ANSPDCP) criticised the lack of technical and organisational measures and of regular effectiveness testing, imposed 15,728 lei (3,000 EUR) and ordered regular employee training, including on recognising phishing e-mails. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 lit. b und Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

19 Aug 2026

Original amount 15,728 RON, converted at the ECB reference rate of 19 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

From 2004 to 2018, the three issuers of paper meal vouchers coordinated with retail chains how many vouchers would be accepted per purchase. The President of the Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) dismissed the appeals against the recalculation of the fines: Pluxee 132.271 million, Edenred 101.94 million and Up 44.941 million CZK, a total of 279.152 million CZK.

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Competition law · Cartels and collusion

Legal basis

Tschechisches Wettbewerbsgesetz, Art. 101 AEUV

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

intentional

Published

17 Aug 2026

Original amount 279,152,000 CZK, converted at the ECB reference rate of 17 Aug 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In 2021, the operators of the online retailer eMAG had committed to a support programme for Hungarian businesses, but once again implemented it only partially and not with the prescribed content. In the follow-up review, the Gazdasági Versenyhivatal (Hungarian Competition Authority, GVH) imposed 225 million HUF; in total, the operators have already received fines of 710 million HUF.

Authority / court

Gazdasági Versenyhivatal (GVH)

Area of law

Consumer protection and online retail

Legal basis

Nachprüfungsverfahren zu verbindlichen Zusagen

Action

Fine

Status of proceedings

final

Sector

Retail and e-commerce

Repeat case

yes

Mitigating circumstances

The companies acknowledged the failures and waived legal remedies.

Published

13 Aug 2026

Original amount 225,000,000 HUF, converted at the ECB reference rate of 13 Aug 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The Nederlandse Arbeidsinspectie (Netherlands Labour Authority) imposed fines totalling 153,300 EUR on a platform for freelancers and nine companies that used it to deploy foreign workers without a right to work in hospitality and education: 146,500 EUR under the Wav (Foreign Nationals Employment Act) (platform 66,000 EUR, the nine hirers 4,000 to 27,000 EUR each, together 80,500 EUR) and 6,800 EUR under the Waadi (Placement of Personnel by Intermediaries Act) (platform 3,400 EUR, two hirers 2,000 and 1,400 EUR). The platform regarded itself merely as an intermediary; based on how it actually operated, the Labour Authority classed it as an employer under the broad Wav definition.

Authority / court

Nederlandse Arbeidsinspectie

Area of law

Health and safety and employment law · Minimum wage and undeclared work

Legal basis

Wet arbeid vreemdelingen (Wav); Wet allocatie arbeidskrachten door intermediairs (Waadi)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Published

13 Aug 2026

Checked against the official source on 2 Oct 2026 · Direct link

The Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) found a cartel in public tenders for mining and construction machinery (price fixing and market sharing, Art. 15 ZZK – Bulgarian Protection of Competition Act, Art. 101 TFEU). Inzhkonsult and Zemekop, as a single undertaking, were exempted from the fine; O-Rent received a sanction of 2,403.07 EUR. All three companies must introduce a competition law compliance programme within 60 days and report on it.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 15 Abs. 1 Nr. 1 und 2 ZZK; Art. 101 Abs. 1 lit. a und c AEUV

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Mitigating circumstances

Immunity from fines for two participants (leniency programme)

Published

20 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Bundeskartellamt (Federal Cartel Office) declared binding commitments by Apple on its App Tracking Transparency Framework (ATTF), closing its proceedings under Section 19a(2) of the German Competition Act (GWB) and Article 102 TFEU. According to the preliminary assessment, third-party apps had to obtain, for personalised advertising, an additional and more off-putting consent prompt prescribed by Apple, while Apple used a prompt of its own for its own services; in future the prompts will be aligned so that content, wording and design are neutral, and app providers will be able to combine the required prompts more easily.

Authority / court

Bundeskartellamt

Area of law

Competition law · Abuse of market power

Legal basis

§ 19a Abs. 2 GWB, Art. 102 AEUV (Verpflichtungszusagen, Az. B7-54/25)

Action

Order

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

17 Aug 2026

Checked against the official source on 2 Oct 2026 · Direct link

In 2018–2022, the distributor of professional hairdressing products (Alfaparf, Yellow) determined the prices at which its territorial representatives were allowed to sell to salons and retailers and restricted passive sales outside the territories. Under a settlement and with a commitment to a compliance programme, the Gazdasági Versenyhivatal (Hungarian Competition Authority, GVH) imposed 68.5 million HUF.

Authority / court

Gazdasági Versenyhivatal (GVH)

Area of law

Competition law · Cartels and collusion

Legal basis

Ungarisches Wettbewerbsgesetz, Verbot wettbewerbsbeschränkender Vereinbarungen

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

intentional

Mitigating circumstances

Cooperation, acknowledgement in the settlement and commitment to a comprehensive compliance programme.

Published

7 Aug 2026

Original amount 68,500,000 HUF, converted at the ECB reference rate of 7 Aug 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

From around 2010 to September 2019, six suppliers of thin cold-laid asphalt surface layers (Dünne Asphaltdeckschichten in Kaltbauweise, DSK) allocated customers – primarily public contracting authorities – and contracts among themselves nationwide and coordinated prices. Germany's Federal Cartel Office (Bundeskartellamt) imposed fines of around 60.3 million EUR; all proceedings ended in settlements.

Authority / court

Bundeskartellamt

Area of law

Competition law · Cartels and collusion

Legal basis

§ 1 GWB, Art. 101 AEUV

Action

Fine

Status of proceedings

final

Sector

Construction and real estate

Mitigating circumstances

Leniency bonus for Possehl/VSI, Bitunova, Kutter and AS; settlement

Published

6 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

Following several complaints, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (Romanian data protection authority, ANSPDCP) found that current and former employees, untrained and without procedural rules, had access to extensive data (including health, family and income data), that data subjects were not informed under Art. 14 GDPR, that excessive data were collected and that automated advertising calls were made without consent. Fines: 78,465 lei (15,000 EUR, Art. 32(4)), 52,310 lei (10,000 EUR, Art. 14), 104,620 lei (20,000 EUR, Art. 5/9 GDPR) and 50,000 lei (Law 506/2004); in addition, an order to provide regular employee training. Date = publication of the press release; according to the authority, the investigation was concluded in June 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. c i. V. m. Art. 9, Art. 14, Art. 32 Abs. 4 DSGVO; Art. 12 Abs. 1 Gesetz 506/2004

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

6 Aug 2026

Original amount 285,395 RON, converted at the ECB reference rate of 6 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

From May 2024, in social media videos (campaign ‘Създавай! Не копирай!’), the company falsely accused a competing family business for hot chillies of having stolen its business, ideas and concept, and promoted the clips partly through paid advertising. The Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) regarded this as unfair damage to reputation (Art. 30 ZZK – Bulgarian Protection of Competition Act), imposed 4% of 2025 net turnover (500,555 EUR), i.e. 20,022 EUR, and ordered immediate cessation. Appeals have been lodged against the decision.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Competition law

Legal basis

Art. 30 ZZK (Schädigung des guten Rufs eines Wettbewerbers)

Action

Fine

Status of proceedings

under appeal

Sector

Food and agriculture

Published

19 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

In several months of 2023 and 2024, the gas supplier did not hold the natural gas security reserves and did not name the competent alternative dispute resolution bodies in customer contracts. The Entidade Reguladora dos Serviços Energéticos (Portuguese Energy Services Regulatory Authority, ERSE) accepted the settlement proposal, set a fine of 24,000 EUR and reduced it to 12,000 EUR.

Authority / court

Entidade Reguladora dos Serviços Energéticos (ERSE)

Area of law

Other

Legal basis

RSSE, Art. 29; Decreto-Lei n.º 62/2020, Art. 57, 96; Portaria n.º 59/2022; RRC Art. 22

Action

Fine

Status of proceedings

final

Sector

Energy and utilities

Culpability

negligent

Mitigating circumstances

Settlement with admission and remediation

Checked against the official source on 25 Sep 2026 · Direct link

The KNF imposed five fines totalling PLN 47,500,000 on PKO BP in connection with structured deposits: PLN 26m for failing to inform clients of existing conflicts of interest, PLN 8m each for not analysing costs and charges and for an imprecise definition of the risk category and target market, PLN 4m for selling without checking target-market suitability and PLN 1.5m for misleading sales material on two products. The decision is not final.

Authority / court

Komisja Nadzoru Finansowego (KNF)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Art. 88c Abs. 1 und 2, Art. 88m Abs. 5 und 9 Prawo bankowe i. V. m. Verordnung des Finanzministers vom 21.01.2019 über Dienstleistungen der Banken bei strukturierten Einlagen

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Original amount 47,500,000 PLN, converted at the ECB reference rate of 5 Aug 2026.

Checked against the official source on 28 Sep 2026 · Direct link

The Oberlandesgericht (OLG, Higher Regional Court) Linz added a forfeiture of 375,000 EUR to the conviction of a limited company under the Verbandsverantwortlichkeitsgesetz (VbVG, Austrian Corporate Criminal Liability Act) for intentionally handling and moving waste in a way that endangered the environment; the suspended corporate fine of 30 daily rates of 500 EUR (15,000 EUR) imposed by the Landesgericht (Regional Court) Salzburg remained in place. From May 2021 to May 2024 and again from May 2025 to February 2026, contrary to the AWG 2002 (Waste Management Act) and partly to an official decision, the company had excavated soil, construction waste, asphalt and concrete rubble accepted for payment and deposited on a plot; removal costs were put at around 3.24 million EUR. Only the forfeiture of EUR 375,000 is recorded as the amount; the corporate fine of EUR 15,000 was conditionally suspended.

Authority / court

Oberlandesgericht Linz (Berufung gegen Urteil des Landesgerichts Salzburg vom 06.03.2026)

Area of law

Environment and sustainability · Waste and hazardous substances

Legal basis

§ 181b Abs. 1 und 2 StGB; §§ 3, 4 Abs. 1 und 3, § 6 Abs. 1, § 14 Abs. 1 VbVG; § 20 Abs. 3 StGB; AWG 2002

Action

Disgorgement of profits

Status of proceedings

final

Sector

Other

Culpability

intentional

Repeat case

no

Mitigating circumstances

No previous convictions of the company; rather low environmental risk. Further circumstances taken into account by the court concern a natural person and are not reported here.

Liability of senior managers

Under the VbVG, the company's liability is linked to the conduct of its managing director.

Checked against the official source on 2 Oct 2026 · Direct link

From 2020 to April 2026, on the basis of old long-term logging contracts, the state forestry group supplied six wood processors with guaranteed quantities of roundwood outside public auctions, while all others could only buy through auctions. In its first decision on the competitive neutrality of public undertakings, the Konkurences padome (Latvian Competition Council) imposed 7,859,606.89 EUR and required equal sales conditions for all qualified bidders.

Authority / court

Konkurences padome (Lettischer Wettbewerbsrat)

Area of law

Competition law

Legal basis

Art. 14.1 Konkurences likums (Wettbewerbsneutralität)

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

13 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

The three sharing providers made it difficult for holders of a Metrebus annual pass to access the free-ride passes promised when the concessions were awarded, through inadequate organisation, cumbersome activation and long waiting times, which shortened the usable time; Bird also deactivated accounts without prior notice. The AGCM imposed fines totalling 2.675 million EUR in three proceedings (Lime 1.4 million, Dott 525,000, Bird 750,000 EUR).

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Codice del Consumo (pratiche commerciali scorrette), Verfahren PS13028, PS13029, PS13030

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

6 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

At roadworks on the R238 in Donegal in August 2020, one wheel of a car dropped onto the unfinished hard shoulder; when the driver steered back, the car slid on the freshly laid surface and went into Lough Foyle; three occupants drowned and one was injured, and appropriate temporary traffic management was lacking. The company pleaded guilty to breaching its duties towards non-employees under s. 12 of the Safety, Health and Welfare at Work Act 2005 and was fined €1,200,000.

Authority / court

Letterkenny Circuit Criminal Court (Anklage: Health and Safety Authority)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

s. 12 i. V. m. s. 77(9)(a) Safety, Health and Welfare at Work Act 2005

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Published

31 Jul 2026

Checked against the official source on 2 Oct 2026 · Direct link

The car rental company charged customers an "administration fee" of 33.88 to 45 EUR when a rental car incurred a traffic offence – even though naming the driver is a statutory obligation of the rental company. Spain's Ministry of Social Rights, Consumer Affairs and 2030 Agenda classified this as a very serious infringement and imposed the maximum fine of 1 million EUR; a court had already declared the clause void in 2020.

Authority / court

Ministerio de Derechos Sociales, Consumo y Agenda 2030

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Artt. 82, 87.5 y 87.6 TRLGDCU (Real Decreto Legislativo 1/2007)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Repeat case

yes

Published

29 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

In the programme ‘Sport aktuell’ on ORF 1 on 29 July 2025, a logo wall was visible as product placement without being labelled. The Austrian Communications Authority (Kommunikationsbehörde Austria, KommAustria) found, with final effect, a violation of the ORF Act (ORF-Gesetz).

Authority / court

Kommunikationsbehörde Austria (KommAustria)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

§ 16 Abs. 5 Z 4 ORF-G

Action

Order

Status of proceedings

final

Sector

Media and online platforms

Published

29 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

A large-scale breach affected EETAA information systems used to implement programmes of the Ministry of Social Cohesion and Family; identification, contact, financial and health data of a large number of people were affected. The Archi Prostasias Dedomenon (Hellenic Data Protection Authority) attributed the success of the attack to outdated systems and inadequate security measures and criticised the absence of a data processing agreement. In Decision 15/2026 it imposed a total of EUR 350,000 (ministry EUR 150,000 under Art. 5(1)(f)/Art. 32 and EUR 50,000 under Art. 28(3) GDPR; EETAA EUR 100,000 under Art. 32 and EUR 50,000 under Art. 28(3) GDPR) and ordered the agreement to be concluded and the planned security measures implemented within one month.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 28 Abs. 3, Art. 32 Abs. 1, Art. 58 Abs. 2 lit. d und i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

According to the authority, the ministry met its breach notification and communication obligations.

Checked against the official source on 28 Sep 2026 · Direct link

For refunds in the event of delays of 60 minutes or more or cancellations, Trenitalia required prior written confirmation from the call centre or ticket office. The AGCM accepted binding commitments: abolition of the confirmation requirement, strengthened refund channels, an information page on disruptions and an implementation report within three months; no infringement was found.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Codice del Consumo (impegni); EU-Fahrgastrechte im Eisenbahnverkehr

Action

Order

Status of proceedings

final

Sector

Transport, logistics and shipping

Mitigating circumstances

Binding commitments, no finding of an infringement.

Published

30 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

In July 2020 a farmer on a dairy farm in County Limerick was fatally injured by a pneumatically operated milking parlour gate designed and manufactured by Dairymaster. The company pleaded guilty to six counts; the court imposed €200,000 each for breaches of s. 16(3) and s. 16(1)(a) of the Safety, Health and Welfare at Work Act 2005 (duties of designers and manufacturers), totalling €400,000, with the remaining counts taken into consideration.

Authority / court

Limerick Circuit Criminal Court (Anklage: Health and Safety Authority)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

s. 16(1)(a), 16(3) i. V. m. s. 77(2)(a), 77(9)(a) Safety, Health and Welfare at Work Act 2005

Action

Fine

Status of proceedings

unknown

Sector

Manufacturing and mechanical engineering

Published

28 Jul 2026

Checked against the official source on 2 Oct 2026 · Direct link

On 24 July 2026 Arcom imposed a fine of EUR 200,000 on Société d'exploitation d'un service d'information (SESI), the operator of the news channel CNews. In Arcom's view, two programmes broadcast in June and September 2025 contained statements about people of (presumed) immigrant background and Muslims, without sufficient context or challenge, that were capable of inciting hatred and discrimination; Arcom considered this a breach of Article 15 of Law No 86-1067 and of the channel's contractual obligations on non-discrimination and control of its programming. In setting the amount, Arcom took into account earlier sanctions against SESI for breaches of the same obligations in 2021 and 2024. Arcom did not sanction a third programme it examined. Whether the decision has been appealed is not known here.

Authority / court

Autorité de régulation de la communication audiovisuelle et numérique (Arcom)

Area of law

Other

Legal basis

Art. 15, 42-1 und 42-2 Loi n° 86-1067 du 30 septembre 1986 (liberté de communication); Art. 2-2-1 und 2-3-2 der Vereinbarungen vom 27. November 2019 und 10. Dezember 2024

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

yes

Published

29 Jul 2026

Checked against the official source on 2 Oct 2026 · Direct link

The Bundesnetzagentur (Federal Network Agency) imposed fines totalling 34,327 EUR on a call centre that mainly marketed telecoms products: 32,000 EUR for unlawful telephone advertising and 2,327 EUR because consents to sales calls had not been fully documented. The campaign continued despite the gaps and requests to stop calling were sometimes ignored; the company has appealed.

Authority / court

Bundesnetzagentur (BNetzA)

Area of law

Data protection · Marketing and consent

Legal basis

UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern; § 7a UWG (Dokumentation und Aufbewahrung von Einwilligungen)

Action

Fine

Status of proceedings

under appeal

Sector

Other

Checked against the official source on 2 Oct 2026 · Direct link

In two decisions, the European Commission found that Google favours its own services in search (460 million EUR) and prevents app developers on Google Play from steering customers to alternative offers (430 million EUR). Google was ordered to bring the infringements to an end.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2022/1925 (DMA), Selbstbevorzugungsverbot und Anti-Steering-Pflicht

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

23 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Garante (Italian data protection authority) fined TIM 9,516,000 EUR because call centres outside the official sales network made promotional calls on the company's behalf using numbers not recorded in the operators' register ROC or falsified numbers (spoofing), often to lines entered in the do-not-call register, and the contacts obtained in this way reached its systems as apparently lawful leads via fictitious call-back requests on sales partners' web forms. The authority found that TIM had selected and supervised its sales partners inadequately and had systematically failed to answer, or answered late, requests for access, erasure and objection. In addition, TIM must secure its lead process, strengthen oversight of the sales chain and adapt its procedures for data subject rights.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5, 6, 7, 12, 15–22, 24, 25, 28 und 32 DSGVO; Art. 130 Codice in materia di protezione dei dati personali (D.Lgs. 196/2003)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Culpability

negligent

Repeat case

yes

Mitigating circumstances

Taken into account as mitigating: short period and limited number of data subjects, measures taken during the proceedings (including checks on and termination of contracts with partners), a high level of cooperation, no special categories of personal data, adherence to the telemarketing code of conduct and substantial investment in controlling the sales chain.

Published

31 Jul 2026

Checked against the official source on 28 Sep 2026 · Direct link

In summer 2025, an attacker gained access to the private hospital's electronic patient record system and obtained data on 524,867 patients and 202,246 trusted persons. There was no VPN or multi-factor authentication for external users, no appropriate access control and no detection of suspicious activity; the trusted persons were not notified. France's data protection authority (Commission nationale de l'informatique et des libertés, CNIL) imposed a fine of 500,000 EUR (SAN-2026-009).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32, Art. 34

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

3 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The CNIL (French data protection authority) fined the IT and engineering consultancy EXTIA EUR 300,000 because, of 265 erasure requests received in 2024 – mostly from job applicants, occasionally from former employees – 12 were not processed at all and 166 applicants were not told of the outcome; 27 received their reply only after the one-month deadline. The CNIL regarded this as particularly negligent, especially as the company had already been reminded of its obligations by the CNIL twice in 2024 (Art. 12 and 17 GDPR).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12 und 17 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

1,000 to 9,999

Culpability

negligent

Repeat case

yes

Mitigating circumstances

During the proceedings the company deleted the data concerned and informed the applicants retrospectively.

Published

9 Sep 2026

Checked against the official source on 2 Oct 2026 · Direct link

Maxxis guaranteed wholesalers fixed margins per tyre sold of the Maxxis and CST brands, monitored prices in particular on the Tyre24 platform and intervened when prices were too low. Germany's Federal Cartel Office (Bundeskartellamt) imposed fines on Maxxis and two tyre wholesalers that had pushed for the margin guarantees; at the time of publication the decisions were not final (an objection to the Higher Regional Court of Düsseldorf was possible).

Authority / court

Bundeskartellamt

Area of law

Competition law · Cartels and collusion

Legal basis

§ 1 GWB (vertikale Preisbindung)

Action

Fine

Status of proceedings

unknown

Sector

Automotive

Mitigating circumstances

Settlement with Maxxis and Reifen Müller

Published

21 Jul 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

AliExpress did not diligently assess the risks posed by illegal, unsafe and counterfeit products (including insufficient moderation capacity, recommender and advertising systems) and did not take effective countermeasures (including deficient enforcement of sanctions against traders, product checks that could be circumvented). The European Commission imposed 550 million EUR under the Digital Services Act (DSA) and required an action plan by 20 October 2026.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2022/2065 (DSA), Risikobewertung und Risikominderung

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Mitigating circumstances

Novelty of the Digital Services Act (taken into account by the Commission when setting the fine)

Published

20 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

In a settlement procedure the energy regulator ordered electricity and gas supplier Enforcesco to pay 107,920 EUR in total: 90,000 EUR (halved from 180,000 EUR) under the energy-sector sanctions regime and 17,920 EUR in voluntarily paid fines for economic administrative offences. The breaches included taking over 6,853 customers without explicit consent, failing to hold the required natural gas security reserves from January 2023 to February 2025, incorrect invoices, an unlawful disconnection and a call-centre answer rate of only 57.8% in 2023.

Authority / court

Entidade Reguladora dos Serviços Energéticos (ERSE)

Area of law

Consumer protection and online retail

Legal basis

Lei n.º 9/2013 (RSSE), Art. 28 und 29, i. V. m. RRC 2020 und geltendem RRC, RQS, Diretivas ERSE n.º 1/2018 und 22/2022, Portaria n.º 59/2022; RJCE

Action

Fine

Status of proceedings

final

Sector

Energy and utilities

Culpability

negligent

Mitigating circumstances

Full admission, cooperation, remedying of all breaches, the company's financial situation and compensation of three customers (150 EUR in total) were taken into account in the settlement procedure.

Checked against the official source on 28 Sep 2026 · Direct link

A synchronisation error between two applications allowed a customer to retrieve other customers’ invoices in the mobile app; in addition, the ticketing platform, which was publicly accessible without VPN, MFA or IP restriction, was attacked and a very large data set (including copies of identity documents, card data, IBANs) was exfiltrated. The Romanian data protection authority (ANSPDCP) imposed fines of 104,780 lei (20,000 EUR, Art. 25) and 419,120 lei (80,000 EUR, Art. 32), a total of 523,900 lei, and ordered test and change management. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 25 Abs. 1, Art. 32 Abs. 1 lit. b und d, Abs. 2 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

17 Jul 2026

Original amount 523,900 RON, converted at the ECB reference rate of 17 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Germany's Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, BaFin) imposed a fine of 240,000 EUR on the software company because it had not disclosed the information about a cyberattack it had suffered as inside information without delay. The fine notice is final.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 17 Abs. 1 UAbs. 1 MAR (EU) Nr. 596/2014

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Published

20 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

On the confirmation page of its online cancellation process, a gym operator displayed a highlighted notice with the button "Pause contract via self-service"; in addition, the confirmation button was labelled "Find contract", which the defendant had already acknowledged. In an action brought by the Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband), the BGH ruled that the confirmation page may only contain the information required for the cancellation and the confirmation button, set aside the judgment of the Higher Regional Court of Düsseldorf (OLG Düsseldorf) dismissing the action to that extent and ordered the operator to cease and desist.

Authority / court

Bundesgerichtshof (I. Zivilsenat), Az. I ZR 200/25

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

§ 312k Abs. 1 Satz 1, Abs. 2 BGB (Kündigungsbutton)

Action

Order

Status of proceedings

final

Sector

Other

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

From 2016 to 2022, three distributors of test and measuring equipment coordinated discounts as essential price components and informed each other of customer contacts, usually with a request for "restraint". This was evidenced by more than 400 emails; the proceedings ended in settlements.

Authority / court

Bundeskartellamt

Area of law

Competition law · Cartels and collusion

Legal basis

§ 1 GWB

Action

Fine

Status of proceedings

final

Sector

Manufacturing and mechanical engineering

Mitigating circumstances

Settlement; cooperation by Elektronik-Kontor Messtechnik taken into account

Published

15 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The 2022 examination revealed that for more than two years the remote gaming operator had had no proper customer risk assessment for almost its entire player base; the assessments submitted had been prepared specifically for the examination. In addition, once players reached the deposit threshold of 2,000 EUR, it did not check in good time whether they were politically exposed persons. The Financial Intelligence Analysis Unit (FIAU) imposed 80,907 EUR; the fine was still open to appeal at the time of publication.

Authority / court

Financial Intelligence Analysis Unit (FIAU)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Reg. 5(5)(a)(ii), 11(5), 21 PMLFTR; FIAU Implementing Procedures Part I und II (Remote Gaming)

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Germany's Federal Financial Supervisory Authority (BaFin) imposed fines totalling 210,000 EUR on the cooperative bank: business relationships were not monitored on an ongoing basis or with enhanced scrutiny, additional information was not obtained and suspicious activity reports were not filed or were filed late. The function of the money laundering reporting officer had been outsourced to an external service provider with several clients.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

§ 56 Abs. 1 S. 1 Nr. 20, 36, 38 und 69 GwG; Bekanntmachung nach § 57 GwG

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

17 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Baltimore-based US asset manager had not submitted voting rights notifications to the issuer and BaFin in time; the deadline is four trading days after reaching a notifiable threshold. BaFin imposed a fine of 187,500 EUR; the notice is final.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

§ 33 Abs. 1 Satz 1 WpHG

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

22 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

At the request of the press association Alliance de la Presse d’Information Générale (APIG), the Autorité de la concurrence (French Competition Authority) imposed interim measures on Meta because its conduct in negotiations on remuneration for press publishers’ neighbouring rights could amount to an abuse of a dominant position. Meta must negotiate in good faith on remuneration for all Meta services from 1 February 2025, provide the information needed for the assessment within 15 days, must not degrade the display of press content during the negotiations and must report to the authority monthly. On the same day a similar decision (26-MC-02) was issued at the request of the collective management organisation DVP.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Abuse of market power

Legal basis

Art. L. 464-1 Code de commerce (mesures conservatoires); vorläufige Würdigung nach Art. L. 420-2 Code de commerce und Art. 102 AEUV; Art. L. 218-4 Code de la propriété intellectuelle

Action

Order

Status of proceedings

under appeal

Sector

Media and online platforms

Employees

10,000 or more

Published

8 Jul 2026

Checked against the official source on 2 Oct 2026 · Direct link

From May to the end of August 2024, the public hospital accidentally published on its website a surgery list containing patients' telephone numbers, illnesses and planned procedures; a member of the public found the document via Google. The Hellenic Data Protection Authority imposed a total of 25,000 EUR: 10,000 EUR for inadequate security, 2,000 EUR for the late notification, 10,000 EUR for failing to notify the data subjects and 3,000 EUR for missing contact details of the data protection officer (DPO).

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1, 12, 13 i. V. m. 37 (Entscheidung 13/2026)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

The data protection authority had prohibited a company from tracking its three company vehicles continuously by GPS and ordered the data to be erased; narrow purposes such as theft protection while parked remained permitted. The Upravno sodišče Republike Slovenije (Administrative Court of the Republic of Slovenia) upheld this and clarified that employee consent bundled with other declarations is invalid.

Authority / court

Upravno sodišče Republike Slovenije (bekanntgemacht durch den Informacijski pooblaščenec)

Area of law

Data protection · Employee data

Legal basis

Art. 6 Abs. 1 lit. f, Art. 7 Abs. 2 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

7 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Garante (Italian data protection authority) fined the US operator of the generative AI service Character.AI, on which users – including minors – chat with virtual characters, 158,000 EUR, among other things for deficient privacy information, a data protection impact assessment prepared late and the late appointment of a representative in the EU. It also criticised weaknesses in the protection of minors and in age verification; within 120 days the company must ensure working age verification, an effective cooling-off period preventing blocked minors from re-registering and private-by-default profiles for minors.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 2, 12 Abs. 1, 13 Abs. 1 und 2, 14 Abs. 1 und 2, 24 Abs. 1, 25 Abs. 2, 27 Abs. 1 und 35 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Repeat case

no

Mitigating circumstances

Mitigating: progressively strengthened age checks (a dedicated service for minors, age verification by a third-party provider), no previous relevant infringements, cooperation and amendments to the privacy policy during the proceedings.

Published

9 Jul 2026

Checked against the official source on 28 Sep 2026 · Direct link