The GDPR Fine Tracker

Here is brief list containing all of the EU/GDPR fines imposed on companies since the implementation of the law. This list does not contain any fines charged outside of the EU or the UK.

CountryDateFine £Controller/ProcessorQuoted Art.TypeSource
UNITED KINGDOM1-7-2021200,000Brazier Consulting Services21A of PECRunlawful nuisance calls to publiclink
ICELAND29-6-202129,247Huppuís ISKviolation of Articles 6(1)(a) and (c), Article 5(1), 12(1) and (2) and 13 unlawful employee video surveillancelink
NORWAY24-6-202142,312Moss municipalityArticles 32(1)(b) and 32(1)(d)Failure in ensring confidentiality and integrity processing systems and services also lack of organisational measures in ensuring security of data processinglink
UNITED KINGDOM23-6-2021130,000ColourCoatRegulations 21 and 24 (PECR)969,273 nuisance marketing calls without consent of userslink
NORWAY22-06-202112,662UnknownArticles 13, 17, and 21 of the (GDPR)Company accessed the former employee data without valid consentlink
SPAIN22-06-20218,590TNT Express WorldwideArticle 5(1)(d) (GDPR)violation of principles of data processinglink
ITALY22 -6-202172,159Municipality of BolzanoArticles 5 (1)(a) and (c), 6, 9,13, 88, and 35 (GDPR')indiscriminate monitoring of employeeslink
ITALY22 -06-202142,951Mayor MenissaArticle 5(1)(a) and (b) of (GDPR')publishing content on social media portraying identifiable minors and persons iwithout such publication being justified by reasons of public interest,link
ITALY22 -06-20212,577,585Iren Mercato SpAArticles 5(1) and (2), 6(1), and 7(1)carrying out telemarketing activities without valid consentlink
SPAIN22-06-202110,297Audax RenovablesArticle 21Unsolcited telemarketing calls despite of data subject request to opt outlink
LITHUANIA21-06-202117,165UAB VS FITNESSArt. 5 (1) a), c) GDPR, Art. 9 (1) GDPR, Art. 13 (1), (2) GDPR, Art. 30 GDPR, Art. 35 (1) GDPRNon-compliance with general data processing principleslink
FRANCE17-06-2021428,466Brico PrivéArticle 5(1)(e)Articles 13, 17, and 32 of GDPRfailure to respect the data retention periods, the right to erasure, and data security obligations link
ROMANIA16-06-20211,714La SantradeArticle 83(5)(e), 83(5)(b) and 12(2) and (3)no adoption measures to ensure the effective exercise of the rights of data subjects, which led to the failure to comply with an erasure requestlink
UNITED KINGDOM15-06-202110,000Papa Jhon'sRegulation 22 of PECRsending marketing texts without consentlink
GREECE15-06-202112,856Purple SeaArticles 5(1)(a) and (c) and 5(2)for illegal installation and operation of video surveillance systemlink
DENAMRK16-06-202123,161Vejle MunicipalityArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN14-06-20211,029Inmopiso Zaragoza S.L.Art. 13 GDPRInsufficient fulfilment of information obligationslink
NORWAY11-06-202134,079BRAbank ASAArticles 24(1), 32(1), and 32(2) a risk assessment and implement appropriate technical measures when launching a customer portallink
ROMANIA09-06-2021La Santrade S.R.L.Art. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
SWEDEN09-06-202129,855Directorate of the Östra Skaraborg Rescue ServiceArt. 5 (1) a), c) GDPR, Art. 32 (1), (4) GDPRNon-compliance with general data processing principleslink
ROMANIA9-6-20211,718SC Dreamtime Call S.R.L.Article 83(5)(e) ('GDPR').illegally processed the personal data of an individual. without prior consentlink
SWEDEN7-6-202155,376Voice Integrate Nordic ABArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SWEDEN7-6-20211,030,401MedHelp ABArt. 5 (1) a), f) GDPR, Art. 6 GDPR, Art. 9 (1) GDPR, Art. 13 GDPR, Art. 32 GDPRNon-compliance with general data processing principleslink
SWEDEN7-6-202142,936Region StockholmArt. 5 (1) a) GDPR, Art. 13 GDPR, Art. 14 GDPRInsufficient fulfilment of information obligationslink
LUXEMBOURG7 -6- 20212,061UnknownArticle 5(1)(e) and 13 GDPRviolation principle of data minimisation with regards to their use of video surveillancelink
SPAIN7 -6- 202121,474Master DistanciaArticle 6(1) of GDPRviolation of the principle of lawfulness of processinglink
UNITED KINGDOM3-6-202110,000Conservative PartyRegulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ('PECR').Sending 51 marketing emails to individuals without obtaining valid consentlink
SPAIN3 -6-20215,161Creator Energy, S.LArticle 6(1)(b)data processing without consentlink
SPAIN1-6-20213,446Avalos ConsultoresArticle 6(1) GDPR'transfer of personal data to a third party without the consentlink
SPAIN28-5-20211,292local community ownersArticle 5(1)(c) GDPRvideo surveillance without just cause.link
SPAIN27-5-20211,719Private IndividualArt. 5 (1) (c) GDPRNon-compliance with general data processing principleslink
SPAIN25-5-2021774unknownArticle 13 of the GDPRthe defendant did not provide the claimant with any information relating to the processing of personal datalink
SPAIN25-5-202185,982Vodafone España, SAUArticle 28(1) of the GDPRInsufficient technical and organisational measures to ensure information securitylink
GREECE25-5-20218,598Municipal Organisation of Preschool Education and Social Solidarity ('DOPAKA')Articles 5 and 6(1)(c) , Articles 12(3) and (4), and 17(1)(d) of the GDPR. processing personal data without a legal basis, failure to comply with its obligation to delete personal data upon such request, link
SPAIN25-5-202138,712Telefonica De Espana, SAUArticle 6 GDPRProcessing the personal data without a legitimate basislink
SPAIN25-5-2021775Managing Director of a companyArt. 13 GDPRInsufficient fulfilment of information obligationslink
SPAIN21-5-20212,581PhysicianArt. 6 GDPRInsufficient legal basis for data processinglink
NORWAY20-5- 202133,781Oslo MunicipalityArticle 32disclosure of personal data without consentlink
UNITED KINGDOM20-5-202190,000American Expressviolation of Regulation 22 of the Privacy and Electronic Communications Regulation 2003 ('PECR')sending 4M marketing emails without consentlink
SPAIN20-5-20212,593UnknownArticle 6unlawful data processing of client's personal datalink
ITALY20-5-202134,562Proma S.S.A. Srl.Articles 5 and 13unlawful processing of employees' personal datalink
ITALY20-5-202134,568Municipality of PalermoArticle 5 of the GDPRfailures to adequately project personal datalink
UNITED KINGDOM20-5-20218,000Tested.comRegulation 22 of the Privacy and Electronic Communications Regulations 2003 ('PECR')email marketing without consentlink
ITALY20-5-20216,052AUSSL 9 Scaligera and the doctorArticles 5 & and Article 33unlawful dissemination of sensitive personal datalink
ROMANIA19-5- 2021432Municipality of IasiArticle 83(5)(e) read with Article 58(1)(a) and (e)information not provided by organisation to data subjectlink
NETHERLANDS19-5-202112,964CP&A B.V.Articles 9 & Article32 processed more health data than was allowed. Moreover, the absenteeism registration was insufficiently secured.link
NORWAY18-5-202182,106Innovasjon NorgeArt. 5 (1) GDPR, Art. 6 (1) GDPRInsufficient legal basis for data processinglink
ROMANIA18-5-20211,729Banca Comercială RomânăArticles 5(1)(a) and (d), 5(2), and 6used data without consentlink
GREECE17-5-20218,597Municipal Organization for Pre-School Education and Social Solidarity (DOPAKA) of the municipality of Tavros MoschatoArt. 6 (1) c) GDPR, Art. 12 (3), (4) GDPR, Art. 17 (1) d) GDPRInsufficient legal basis for data processinglink
POLAND17-5-2021218,710Cyfrowy PolsatArticles 24(1) and 32lack of appropriate technical and organisational security measureslink
ROMANIA14-5-2021173Website operatorArt. 5 (1) a), b) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 13 (1), (2), (3) GDPR, Art. 32 (2) GDPRNon-compliance with general data processing principleslink
ROMANIA13-5-20211,726Telekom Romania CommunicationsArt. 6 GDPR, Art. 21 GDPRCommercial calls despite the data subject’s objection.link
SPAIN13-5-202125,878Allianz SergurosArt. 6 GDPRInsufficient legal basis for data processinglink
NEITHERLANDS12-5-2021452,438locatefamily.comArticle 27no representative for the EUlink
NEITHERLANDS12-5-20216,467PVV OverijsselArticle 33Failure to notify data protection authority of data breach.link
SPAIN12-5-20212,586Solram T Y R S.L.Art. 17Insufficient fulfilment of data subjects rightslink
ROMANIA7-5-20211,721World Class România S.A.Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN4-5-20211,291,058EDP Energía, S.A.UArt. 13 GDPR, Art. 25 GDPRInsufficient fulfilment of information obligationslink
SPAIN4-5-20211,291,147 EDP Comercializadora, S.A.UArt. 13 GDPR, Art. 25 GDPRInsufficient fulfilment of information obligationslink
FINLAND30-4-202164,550ParkkiPate OyArt. 5 (1) c) GDPR, Art. 12 (3), (4), (6) GDPR, Art. 14 (2) a) GDPR, Art. 14 (3) GDPR, Art. 15 GDPR, Art. 17 (1) a) GDPR, Art. 25 (2) GDPRInsufficient fulfilment of data subjects rightslink
ICELAND29-4-202119,885InfoMentor ehfArt. 5 (1) f) GDPR, Art. 32 (1) b), d) GDPRInsufficient technical and organisational measures to ensure information securitylink
THE NETHERLANDS29-4-2021517,561Municipality of EnschedeArt. 5 (1) a) GDPR, Art. 6 (1) GDPRInsufficient legal basis for data processinglink
SPAIN27-4-20212,594Pagamastarde S.L.Art. 17 (1) GDPR, Art. 21 LSSIInsufficient fulfilment of data subjects rightslink
SPAIN27-4-202113,037Anytime Fitness Iberia S.L.Art. 17 GDPR, Art. 21 LSSIInsufficient fulfilment of data subjects rightslink
BELGIUM26-4-202186,911Financial companyArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN23-4-2021869,162Equifax Iberica S.L.Art. 5 (1) a), b), c), d) GDPR, Art. 6 (1) GDPR, Art. 14 GDPRInsufficient legal basis for data processinglink
SPAIN22-4-20211,305Private IndividualArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
FINLAND21-4-202164,553ParkkiPate OyArt. 5 (1) c) GDPR, Art. 12 (3), (4), (6) GDPR, Art. 14 (2) a) GDPR, Art. 14 (3) GDPR, Art. 15 GDPR, Art. 17 (1) a) GDPR, Art. 25 (2) GDPRInsufficient fulfilment of data subjects rightslink
SPAIN20-4-20216,962Highcliffe Estates Marbella S.L.Art. 6 (1) GDPRInsufficient legal basis for data processinglink
ROMANIA19-4-20211,305Lugera & Makler Broker S.R.L.Art. 29 GDPR, Art. 32 (2), (4) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN19-4-20211,305Pub ownerArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
ROMANIA15-4-20214,331S.C. Tip Top Food Industry S.R.LArt. 5 (1) b), (c) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPRInsufficient legal basis for data processinglink
SPAIN15-4-20212,599Private IndividualArt. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principleslink
SPAIN13-4-202177,969Vodafone España, S.A.U.Art. 6 (1) GDPRInsufficient legal basis for data processinglink
NORWAY9-4-20212,945Miljø- og Kvalitetsledelse ASArt. 5 (1) (a) GDPR, Art. 6 (1) GDPRInsufficient legal basis for data processinglink
SPAIN8-4-202151,985Kutxabank, S.AArt. 17 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN6-4-20212,079Promotech Digital S.L.Art. 21 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN5-4-20212,598Kukimbia S.L.Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN5-4-20212,598Electrotecnica Bastida S.L.Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN5-4-20213,464Stockhunters S.L.Art. 13 GDPRInsufficient fulfilment of information obligationslink
ROMANIA30-3-20218,489Telekom Romania Mobile Communications S.A.Art. 32 (1), (2) GDPR, Art. 58 (1) a), e) GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA23-3-20211,706S.C. Medicover S.R.L.Art. 32 (1) b), (2), (4) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN23-3-2021853Laboratorio Octogón, S.L.Art. 5 (1) c) GDPRNon-compliance with general data processing principleslink
SPAIN18-3-20212,593Asesoría Alpi-Clúa S.L.Art. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRNon-compliance with general data processing principleslink
SPAIN16-3-202151,867Vodafone España, S.A.U.Art. 6 (1) GDPRInsufficient legal basis for data processinglink
BELGIUM15-3-2021864SchoolArt. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 8 GDPRInsufficient legal basis for data processinglink
SPAIN15-3-20212,592Cultural associationArt. 6 (1) a) GDPRInsufficient legal basis for data processinglink
SPAIN15-3-20211,727Heredad de Urueña S.A.Art. 13 GDPRInsufficient fulfilment of information obligationslink
SPAIN12-3-20211,295Private PersonArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
SPAIN12-3-202110,364NBQ Technology, S.A.UArt. 6 (1) GDPRInsufficient legal basis for data processinglink
SPAIN11-3-20217,040,173Vodafone España, S.A.U.Art. 28 GDPR, Art. 24 GDPR, Art. 44 GDPR, Art. 21 LSSI, Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 LOPDGDDInsufficient fulfilment of data subjects rightslink
GERMANY10-3-2021259,142VfB Stuttgart 1893 AGArt. 5 (2) GDPRNon-compliance with general data processing principleslink
SPAIN10-3-20218,636Hospital Campogrande DEArt. 5 (1) f) GDPRNon-compliance with general data processing principleslink
SPAIN10-3-20216,909Filigrana Comunicación S.L.U.Art. 6 (1) GDPR, Art. 13 GPDR, Art. 14 GDPRInsufficient fulfilment of information obligationslink
SPAIN10-3-202143,177Equifax Iberica S.L.Art. 6 (1)(f) GDPRInsufficient legal basis for data processinglink
SPAIN10-3-202177,742Xfera Moviles S.AArt. 5 (1) (f) GDPR, Art. 17 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN9-3-202112,953Homeowners AssociationArt. 5 (1) f) GDPRNon-compliance with general data processing principleslink
ROMANIA4-3-2021432Natural person holding the position of General Secretary for a political party in BucharestArt. 32 (1), (2) GDPR, Art. 58 (1) a), e) GDPRInsufficient technical and organisational measures to ensure information securitylink
GERMANY3-3-2021173Private IndividualArt. 5 GDPR, Art. 32 GDPRNon-compliance with general data processing principleslink
CYPRUS3-3-202121,592Hellenic BankArt. 5 (1) e), f) GDPR, Art. 32 (1) b), c) GDPR, Art. 33 (1) GDPRInsufficient technical and organisational measures to ensure information securitylink
CYPRUS3-3-20218,640Cypriot Real Estate Registration AuthorityArt. 12 GDPR, Art. 15 GDPR, Art. 31 GDPR, 58 (1) e) GDPRInsufficient fulfilment of information obligationslink
CYPRUS3-3-20215,183KEPIDESArt. 32 (4)Insufficient technical and organisational measures to ensure information securitylink
CYPRUS3-3-202134,566Electricity Authority of CyprusArt. 6 (1) GDPR, Art. 9 (2) GDPRInsufficient legal basis for data processinglink
NORWAY2-3-202121,069UnknownArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2-3-20217,771UnknownArt. 6 GDPR, Art. 13 GDPRInsufficient legal basis for data processinglink
LITHUANIA2-3-202112,951Registrų CentrasArt. 32 (1) b), c) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2-3-2021172,759I-DE Redes Eléctricas Inteligentes, S.A.UArt. 5 (1) b), c) GDPR, Art. 6 (1) b) GDPRNon-compliance with general data processing principleslink
LITHUANIA26-2-202110,363Nacionaliniam visuomenės sveikatos centrui (NVSC)Art. 5 (1), (2) GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 35 GDPR, Art. 58 (2) f) GDPR Non-compliance with general data processing principleslink
LITHUANIA26-2-20212,591IT sprendimai sėkmeiArt. 5 (1), (2) GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 35 GDPR, Art. 58 (2) f) GDPR Non-compliance with general data processing principleslink
ITALY25-2-2021259,035Istituto Nazionale Previdenza Sociale (INPS)Art. 5 (1) a), c), d) GDPR, Art. 25 GDPR, Art. 35 GDPRNon-compliance with general data processing principleslink
SPAIN24-2-202110,361Avilon Center 2016 S.L.Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDDInsufficient fulfilment of data subjects rightslink
GERMANY23-2-20210Deutsche Wohnen SEArt. 5 GDPR, Art. 25 GDPRNon-compliance with general data processing principleslink
CROTIA22-2-2021UnknownSecurity company (name not available at the moment)Art. 32 (1) b), d) GDPR, Art. 32 (2), (4) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN16-2-2021864The Washpoint S.L.Art. 13 GDPRInsufficient fulfilment of information obligationslink
DENAMRK12-2-202111,615IDdesign A / SArt. 5 (1) e) GDPR, Art. 5 (2) GDPRNon-compliance with general data processing principleslink
SPAIN12-2-2021103,618Vodafone España, SAUArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN12-2-20211,382Ripobruna 207, S.L.Art. 5 (1) c) GDPRNon-compliance with general data processing principleslink
SPAIN11-2-202120,725Vamavi Phone S.LArt. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 LOPDGDD, Art. 28 GDPRInsufficient fulfilment of data subjects rightslink
THE NETHERLANDS11-2-2021379,964OLVGArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
POLAND11-2-202119,173Krajowa Szkoła Sądownictwa i ProkuraturyArt. 5 (1) f) GDPR, Art. 25 (1) GDPR, Art. 28 (3) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY11-2-202164,763Ministero dello Sviluppo EconomicoArt. 5 (1) a), b), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR, Art. 37 (1), (7) GDPRNon-compliance with general data processing principleslink
ROMANIA10-2-2021864ING Bank N.V. Amsterdam - Bucharest officeArt. 29 GDPR, Art. 32 (2), (4) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN9-2-20214,317Predase Servicios Integrales S.L.Art. 13 GDPRInsufficient fulfilment of information obligationslink
LATAVIA9-2-202148,476Lursoft IT SIAArt. 6 (1) GDPRInsufficient legal basis for data processinglink
SPAIN8-2-20212,590Patio Ancestral S.L.Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN8-2-20214,317Private PersonArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
SPAIN4-2-20211,727Private PersonArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
NORWAY3-2-202116,667Cyberbook ASArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN3-2-202186,357Iberdrola ClientesArt. 5 (1) d) GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN1-2-202120,726Xfera Moviles S.A.Art. 58 (2) GDPRInsufficient cooperation with supervisory authoritylink
SPAIN1-2-20212,591 IDFINANCE Spain, S.L.Art. 5 (1) f) GDPRInsufficient technical and organisational measures to ensure information securitylink
FRANCE27-1-202164,779UnknownArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BELGIUM27-1-202143,189Family Service / N.D.P.K. nv.Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 28 GDPRInsufficient legal basis for data processinglink
ITALY27-1-202143,189Azienda USL della RomagnaArt. 5 (1) a), d), f) GDPR, Art. 9 GDPR, Art. 32 (1) b) GDPRNon-compliance with general data processing principleslink
ITALY27-1-202143,189Azienda Ospedaliero Universitaria SeneseArt. 5 (1) f) GDRP, Art. 9 GDPRNon-compliance with general data processing principleslink
ITALY27-1-202143,189Azienda Ospedaliero Universitaria di ParmaArt. 5 (1) f) GDRP, Art. 9 GDPRNon-compliance with general data processing principleslink
BELGIUM22-1-202121,591UnknownArt. 5 (1) f), (2) GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 33 (1), (5) GDPR, Art. 34 (1) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN21-1-202143,178Alterna Operador Integral S.L.Art. 6 (1) b) GDPRInsufficient legal basis for data processinglink
SPAIN21-1-202164,772Telefónica Móviles España, SAUArt. 6 (1) GDPRInsufficient legal basis for data processinglink
SPAIN20-1-20211,036IndividualArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
NORWAY19-1-20218,378Aquateknikk ASArt. 5 GPDR, Art. 6 GDPRInsufficient legal basis for data processinglink
POLAND15-1-20213,973Anwara Sp. z.o.o.Art. 31 GDPR, Art. 58 (1) a) GDPRInsufficient cooperation with supervisory authoritylink
NORWAY14-1-202133,336Coop Finnmark SAArt. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ITALY14-1-20216,909Agenzia regionale protezione ambientale Campania (ARPAC)Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY14-1-202125,911Azienda sanitaria provinciale di EnnaArt. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 32 GDPRInsufficient legal basis for data processinglink
ITALY14-1-20211,727Poliambulatorio Talenti S.r.l.Art. 12 (3) GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
ITALY14-1-202115,547Azienda Usl di BolognaArt. 5 (1) f) GDRP, Art. 9 GDPRNon-compliance with general data processing principleslink
ITALY14-1-202164,784Regione LazioArt. 5 (2) GDPR, Art. 28 GDPRInsufficient data processing agreementlink
SPAIN13-1-20215,183,280Caixabank S.A.Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPRInsufficient legal basis for data processinglink
NORWAY12-1-202133,347UnknownArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
BELGIUM12-1-20218,638UnknownArt. 6 (1) GDPR, Art. 12 (3) GDPR, Art. 21 (1) GDPRInsufficient legal basis for data processinglink
POLAND11-1-202125,917Enea S.A.Art. 33 (1) GDPRInsufficient fulfilment of data breach notification obligationslink
GERMANY8-1-20218,988,035notebooksbilliger.deArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
NORWAY7-1-20216,265Gveik AS Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
NORWAY6-1-20218,383Lindstrand Trading ASArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
FRANCE5-1-202117,280Nestor SASArt. 12 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligationslink link
POLAND5-1-20204,753Śląski Uniwersytet Medyczny (Medical University of Silesia)Art. 33 (1) GDPR, Art. 34 (1) GDPRInsufficient fulfilment of data breach notification obligationslink
POLAND5-1-202116,416UnknownArt. 34 (1), (2) GDPR, Art. 58 (2) e) GDPRInsufficient fulfilment of data breach notification obligationslink
SPAIN4-1-202146,651Vodafone España, S.A.U.Art. 5 (1) d), f) GDPR Non-compliance with general data processing principleslink
NORWAY4-1-202182,505Innovasjon NorgeArt. 5 (1) GDPR, Art. 6 (1) GDPRInsufficient legal basis for data processinglink
CZECH REPUBLIC4-1-2021102,369UnknownArt. 6 (1) GDPR, Art. 14 GDPRInsufficient legal basis for data processinglink
ROMANIA30-12-20202,591ING Bank N.V. Amsterdam - Bucharest officeArt. 5 (1) a) - d) GDPR, Art. 6 (1) GDPRInsufficient legal basis for data processinglink
ROMANIA29-12-2020864Qualitance QBS SAArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
POLAND23-12-202016,353.32Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A.Art. 33 (1) GDPR, Art. 34 (1) GDPRInsufficient fulfilment of data breach notification obligationslink
Belgium23-12-202043,193UnknownArt. 14 (1), (2) GDPR, Art. 12 (1), (2), (3) GDPR, Art. 15 (1) GDPR, Art. 5 (1) c), (2) GDPR, Art. 24 (1), (2) GDPRInsufficient fulfilment of data subjects rightslink
BELGIUM23-12-202012,959UnknownArt. 14 (1), (2) GDPR, Art. 12 (3) GDPR, Art. 6 GDPR, Art. 5 (1) c), (2) GDPR, Art. 24 (1), (2) GDPRInsufficient fulfilment of data subjects rightslink
SPAIN22-12-20205300Iberdrola Clientes, SAUArt. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDDInsufficient fulfilment of data subjects rightslink
ROMANIA22-12-20201794S.C. C&V Water Control S.A.Art. 58 (1) a), e) GDPR, Art. 58 (2) i) GDPRInsufficient cooperation with supervisory authoritylink
SPAIN21-12-202032,000Banco Bilbao Vizcaya Argentaria, S.A.Art. 5 (1) d) GDPRNon-compliance with general data processing principleslink
ROMANIA17-12-202090,700Banca Transilvania SAArt. 5 (1) f) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
FRANCE17-12-20202,722DoctorArt. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information securitylink
FRANCE17-12-20205,444DoctorArt. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information securitylink
HUNGARY16-12-20201,940UnknownArt. 5 (1) b), c) GDPR, Art. 13 (1) GDPRInsufficient fulfilment of information obligationslink
HUNGARY16-12-202050,269Robinson Tours Ltd. (Robinson Tours Idegenforgalmi és Szolgáltató Kft.)Art. 25 (1), (2) GDPR, Art. 32 (1) b) GDPR, Art. 34 (1) GDPRInsufficient technical and organisational measures to ensure information securitylink
HUNGARY16-12-20201,256Next Time Media Agency Ltd. (Next Time Media Ügynökség Kft.)Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA17-12-202092,000Banca Transilvania SAArt. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
IRELAND15-12-2020406,000Twitter International CompanyArt. 33 (1) GDPR, Art. 33 (5) GDPRInsufficient fulfilment of data breach notification obligationslink
POLAND14-12-20201,715,000Virgin Mobile PolskaArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1) b) GDPR, Art. 32 (1) d) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN11-12-20204,500,000Banco Bilbao Vizcaya Argentaria, S.A.Art. 6 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligationslink
SWEDEN11-12-202048,000Umeå UniversityArt. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN10-12-20203,600Borjamotor, S.A.Art. 7 GDPRInsufficient fulfilment of information obligationslink
SPAIN9-12-202036,000Xfera Moviles S.A.Art. 6 (1) GDPRInsufficient legal basis for data processinglink
SPAIN9-12-20209,000UnknownArt. 5 (1) f) GDPRNon-compliance with general data processing principleslink
SWEDEN3-12-20201,263,000Aleris Sjukvård ABArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
SWEDEN3-12-2020999,000Aleris Sjukvård ABArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN3-12-20202,400Dr Marín Cirugia Plástica, S.L.P.Art. 13 GDPRInsufficient fulfilment of information obligationslink
SWEDEN3-12-2020243,800Östergötland RegionArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
SWEDEN3-12-2020243,800Västerbotten RegionArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
SWEDEN3-12-2020341,300Sahlgrenska University HospitalArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
SWEDEN3-12-2020390,100Karolinska University Hospital of SolnaArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
SWEDEN3-12-20202,900,000Capio St. Göran ABArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
NORWAY3-12-202018,840Municipality of Indre ØstfoldArt. 6 GDPR, Art. 32 (1) b) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2-12-20206,000Servicio de Alojamientos Responsables, S.L.Art. 6 (1) GDPRInsufficient legal basis for data processinglink
SPAIN2-12-20203,000Comercio Online Levante, S.L.Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2-12-20205,000Asociación de Víctimas por Arbitrariedades Judiciales, (JAVA)Art. 6 (1) GDPRInsufficient legal basis for data processinglink
SPAIN2-12-202010,000Losada Advocats S.L.Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN27-11-20201,200Private IndividualArt. 5 (1) a) GDPRNon-compliance with general data processing principlesLink
SWEDEN25-11-202019,500Gnosjö MunicipalityArt. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 35 GDPR, Art. 36 GDPRInsufficient legal basis for data processinglink
SPAIN25-11-202040,000Miraclia Telecomunicaciones S.L.Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPRInsufficient legal basis for data processinglink
BELGIUM25-11-20201,500Private IndividualArt. 6 GDPR, Art. 25 GDPRInsufficient legal basis for data processinglink
ROMANIA24-11-20205,000Dada Creation S.R.L.Art. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information securitylink
SWEDEN24-11-2020394,000City of StockholmArt. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN23-11-202012,000Recambios Villalegre S.L.Art. 6 GDPR, Art. 13 GDPRInsufficient legal basis for data processinglink
ROMANIA23-11-20204,000Vodafone România SAArt. 12 GDPR, Art. 15 GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rightslink
ITALY23-11-202020,000Burgo Group S.p.AArt. 5 GDPR, Art. 13 GDPRNon-compliance with general data processing principleslink
SPAIN19-11-202036,000Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN18-11-20202000Anmavas 61, S.L.Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
FRANCE18-11-2020800,000Carrefour BanqueArt. 5 GDPRNon-compliance with general data processing principleslink
FRANCE18-11-20202,250,000Carrefour FranceArt. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 32 GDPR, Art. 33 GDPRNon-compliance with general data processing principleslink
ITALY17-11-202030,000Provincial Health Authority of CosenzaArt. 9 GDPRInsufficient legal basis for data processinglink
ITALY17-11-20202000Comune di CollegnoArt. 12 GDPR, Art. 13 GDPR, Art. 14 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN16-11-20201,600Homeowners AssociationArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
SPAIN16-11-202042,000Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
UNITED KINGDOM15-11-20201.6 mTicketMaster UKArticle 56 of the GDPR, Article 60 of the GDPRFincial details in chatbot compromised.link
Germany11-11-2020800,500Telecoms provider (1&1 Telecom GmbH)Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN5-11-202067,000Telefonica Moviles Espana, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN3-11-202026,000Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
UNITED KINGDOM30-10-202018,226,109Marriott International, IncArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN28-10-202032,085Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN28-10-20203,600Play Orenes, S.L.Art. 5 (1) c) GDPRNon-compliance with general data processing principleslink
ITALY26-10-202018,000Università Campus Bio-medico di Roma (Polyclinic)Art. 5 (2) a), f) GDPR, Art. 9 GDPRNon-compliance with general data processing principleslink
HUNGARY23-10-202048,841Deichmann Cipőkereskedelmi Korlátolt Felelősségű TársaságnakArt. 12 GDPR, Art. 15 GDPR, Art. 18 (1) c) GDPR, Art. 25 GDPRInsufficient fulfilment of data subjects rightslink
CYPRUS22-10-20205,348Cyprus PoliceArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
LITHUANIA21-10-202013,500Vilnius City Municipality AdministrationArt. 5 (1) d) GDPR, Art. 5 (1) f) GDPRNon-compliance with general data processing principleslink link
ROMANIA20-10-20201800Globus Score SRLArt. 58 GDPRInsufficient cooperation with supervisory authoritylink
CYPRUS19-10-2020890Grant Ideas LtdArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
CYPRUS19-10-202013,500Bank of Cyprus Public Company LtdArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 15 GDPR, Art. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information securitylink
UNITED KINGDOM16-10-202019,648,548British AirwaysArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA15-10-20202,600S.C. Marsorom S.R.L.Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN9-10-2020802.13Café Restaurante B.B.BArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
SPAIN9-10-20201800Private PersonArt. 5 (1) c) GDPR, Art. 6 GDPRNon-compliance with general data processing principleslink
SPAIN9-10-202044,000Centro de Investigación y Estudio para la Obesidad, SLArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN9-10-20204,400Caja Rural San José de Nules S. Cooperativa de CréditoArt. 5 (1) f) GDPRNon-compliance with general data processing principleslink
SPAIN6-10-202053,475LycamobileArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN6-10-20203,600Callesgarcia, S.L.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN3-10-20202,600Avata Hispania, S.L.Art. 5 GDPR, Art. 6 GDPR, Art. 28 (3) g) GDPRInsufficient legal basis for data processinglink
GERMANY1-10-202031,424,404H&M Hennes & Mauritz Online Shop A.B. & Co. KGArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA1-10-20202,600Megareduceri TV S.R.L.Art. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
ROMANIA1-10-20201800Asociația de proprietari Militari RArt. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
ITALY30-9-202071,300Azienda Ospedaliera di Rilievo Nazionale ‘Antonio Cardarelli’ (Private Hospital)Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY30-9-202053,475Scanshare s.r.l.Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN30-9-20202,600Venu Sanz Chef, S.L.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN25-9-202053,475Xfera Moviles S.A.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
NORWAY25-9-202012,388Odin Flissenter ASArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN22-9-202053,475GLP Instalaciones 86, SLArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN22-9-20206,952Iweb Internet Learning, S.L.Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligationslink
SPAIN17-9-202053,475Vodafone España, SAUArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN17-9-20202,600Grupo CarolizanArt. 5 GDPRNon-compliance with general data processing principleslink
SPAIN16-9-20208,900Property owners communityArt. 5 GDPRNon-compliance with general data processing principleslink
SPAIN11-9-20201,350Political PartyArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
GREECE11-9-20206,400Private PersonArt. 5 GDPRNon-compliance with general data processing principleslink
POLAND8-9-202010,033Warsaw University of Life SciencesArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA8-9-20201800Sanatatea Press Group S.R.L.Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN7-9-20202,600Barcelona Airport Security Guard Association (‘AVSAB’)Art. 5 (1) f) GDPRNon-compliance with general data processing principleslink
ITALY7-9-20201800Istituto Comprensivo Statale Crucoli TorrettaArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BELGIUM7-9-20204,400Former mayor of a communityArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
NORWAY3-9-2020247,262Bergen MunicipalityArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY3-9-20201800Comune di CasaloldoArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN1-9-202067,190Telefónica Móviles España, SAUArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA1-9-2020445Apartment building owners associationArt. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 32 GDPRInsufficient legal basis for data processinglink
POLAND31-8-202020,336Surveyor General of Poland (‘GKK’)Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN28-8-202044,000Bankia S.A.Art. 5 (1) b) GDPRNon-compliance with general data processing principleslink
SPAIN28-8-20204,400Basketball Federation of Castilla and LeonArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN17-8-20204,400Party of the Socialists of CataloniaArt. 5 (1) b) GDPRNon-compliance with general data processing principleslink
ESTONIA17-8-202043Police OfficerArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ITALY10-8-20208,900Cavauto S.R.L.Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPRInsufficient legal basis for data processinglink
ITALY10-8-20208,900Community of BaronissiArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN6-8-20202,600GROW BEATS SLArt. 12 GDPR, Art. 13 GDPR, Art. 14 GDPRInsufficient fulfilment of information obligationslink
ITALY6-8-20202,600GTL S.R.L.Art. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN6-8-20202,600Just Landed S.L.Art. 13 GDPRInsufficient fulfilment of information obligationslink
FRANCE5-8-2020223,969SpartooArt. 5 (1) GDPR, Art. 13 GDPR, Art. 14 GDPRNon-compliance with general data processing principleslink
FINLAND5-8-20206,271Acc Consulting Varsinais-SuomiArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN5-8-20202,600RestaurantArt. 5 (1) c) GDPR, Art. 12 GDPR, Art. 13 GDPRNon-compliance with general data processing principleslink
AUSTRIA5-8-202089BankArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ITALY5-8-20201800SchoolArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
DENMARK4-8-202018,007PrivatBo A.M.B.A.Art. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN4-8-202053,752Vodafone España, SAUArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ITALY4-8-202013,500Mapei S.p.A.Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPRInsufficient legal basis for data processinglink
ITALY4-8-20204,400National Institute for Social Security – Department of the Province of BresciaArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
ITALY4-8-2020890SupermarketArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
GREECE3-8-20202,600Candidate for parliamentary electionsArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN31-7-202040,314Vodafone España SAUArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN31-7-20201,343Tour & People Max S.L.Art. 21 GDPRInsufficient fulfilment of data subjects rightslink
ROMANIA30-7-20201800SC Viva Credit IFN SAArt. 17 GDPRInsufficient fulfilment of data subjects rightslink
ROMANIA30-7-20201800Romanian Post National CompanyArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY30-7-20201800Community of ManduriaArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ITALY29-7-20202,600Community of San Giorgio JonicoArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ITALY29-7-20203,600Region of CampaniaArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
DENMARK28-7-2020132,410Arp Hansen Hotel Group A/SArt. 5 (1) e) GDPRNon-compliance with general data processing principleslink
BELGIUM28-7-20202,600Communal political associationArt. 5 GDPR, Art. 6 GDPR, Art. 14 GDPRInsufficient legal basis for data processinglink
ROMANIA27-7-20204,479SC Cntar Tarom SAArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN23-7-20208,900El Periódico de Catalunya, S.L.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN23-7-202049,273Telefónica Móviles España, SAUArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN23-7-202062,711Telefónica Móviles España, SAUArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN23-7-202067,190Telefónica Móviles España, SAUArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN23-7-20204,400Xfera Moviles S.A.Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
SPAIN23-7-20204,400El Real Sporting de Gijón S.A.D.Art. 6 GDPR, Art. 7 GDPRInsufficient legal basis for data processinglink
HUNGARY23-7-2020501Forbes HungaryArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY23-7-20201,522EmployerArt. 12 GDPR, Art. 15 GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN20-7-202021,501Banco Bilbao Vizcaya Argentaria, SAArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN20-7-202036,000Iberia Lae SA Operadora UnipersonalArt. 58 GDPRInsufficient cooperation with supervisory authoritylink
SPAIN20-7-20201,350Comercial Vigobrandy, SLArt. 12 GDPR, Art. 13 GDPR, Art. 14 GDPRInsufficient fulfilment of information obligationslink
SPAIN20-7-202071,670Orange Espagne S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN20-7-202062,711Xfera Moviles S.A.Art. 5 GDPRNon-compliance with general data processing principleslink
HUNGARY16-7-202025Google Ireland Ltd.Art. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
POLAND15-7-202019,978Office for geodesy and cartographyArt. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
BELGIUM14-7-2020537,527Google Belgium SAArt. 5 GDPR, Art. 6 GDPR, Art. 17 (1) a) GDPR, Art. 12 GDPRInsufficient fulfilment of data subjects rightslink
BELGIUM14-7-20204,400Operator of CCTV of a residential buildingArt. 6 GDPR, Art. 7 GDPRInsufficient legal basis for data processinglink
ITALY13-7-2020180,000Merlini s.r.l.Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 28 GDPR, Art. 29 GDPRInsufficient legal basis for data processinglink
ITALY13-7-202014,961,172Wind Tre S.p.A.Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 24 GDPR, Art. 25 GDPRInsufficient legal basis for data processinglink
ITALY13-7-2020716,702Iliad Italia S.p.A.Art. 5 GDPR, Art. 25 GDPRNon-compliance with general data processing principleslink
POLAND10-7-20203,045East Power Sp. z o.o.Art. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
NORWAY10-7-202041,801Municipality of RælingenArt. 32 GDPR, Art. 35 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN10-7-20201,350Auto Desguaces Iglesias S.L.Art. 5 GDPRNon-compliance with general data processing principleslink
SPAIN10-7-2020890Centro Internacional De Crecimiento Laboral Y Profesional S.L.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN10-7-202010,750Vodafone España, SAUArt. 5 GDPRNon-compliance with general data processing principleslink
SPAIN10-7-20204,400Global Business Travel Spain SLUArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN10-7-20204,400School Fitness Holiday & Franchising S.L.Art. 5 GDPRNon-compliance with general data processing principleslink
SPAIN10-7-202049,273Xfera Moviles S.A.Art. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA9-7-202013,500Proleasing Motors SRLArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
THE NETHERLANDS6-7-2020743,579Bureau Krediet Registration (‘BKR’)Art. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN2-7-202021,501Iberdrola ClientesArt. 5 GDPRNon-compliance with general data processing principleslink
SPAIN2-7-20203,600De Vere Spain S.L.Art. 21 GDPRInsufficient fulfilment of data subjects rightslink
NORWAY2-7-202025,084Odin Flissenter ASArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2-7-20203,225Saunier-Tec Mantenimientos de Calor y Frio, SL.Art. 33 GDPRInsufficient fulfilment of data breach notification obligationslink
SPAIN2-7-20204,400Xfera Moviles S.A.Art. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
ITALY2-7-202013,500Mapei S.p.A.Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
GERMANY30-6-20201,110,889Allgemeine Ortskrankenkasse (‘AOK’) (health insurance company)Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
DENMARK30-6-20206,002Lejre MunicipalityArt. 5 GDPR, Art. 6 GDPR, Art. 33 GDPR, Art. 34 GDPRNon-compliance with general data processing principleslink
IRELAND30-6-202036,000Tusla Child and Family AgencyArt. 33 GDPRInsufficient fulfilment of data breach notification obligationslink
GREECE29-6-20204,400New York College S.A.Art. 5 GDPRNon-compliance with general data processing principleslink
ISLE OF MAN25-6-202012,094Department of Home AffairsArt. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN23-6-20206,719Miraclia (telecommunications company)Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN22-6-20201800UnknownArt. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPRNon-compliance with general data processing principleslink
NORWAY22-6-2020100,338Østfold HF HospitalArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BELGIUM19-6-20208,900UnknownArt. 5 GDPR, Art. 6 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
NORWAY19-6-202025,084Aquateknikk ASArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN19-6-20205,375National Police BrigadeArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA18-6-20203,600Enel EnergieArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN16-6-20201800Café BarArt. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPRNon-compliance with general data processing principleslink
SWEDEN16-6-20201,702Housing AssociationArt. 5 GDPR, Art. 6 GDPRNon-compliance with general data processing principleslink
BELGIUM16-6-2020890UnknownArt. 17 GDPR, Art. 21 GDPR, Art. 31 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN15-6-202067,191Xfera Moviles S.A.Art. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY12-6-2020258,013Digi Távközlési Szolgáltató Kft. (‘Digi’) (electronic communication service provider)Art. 5 (1) b), (e) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA11-6-20202,600Telekom RomaniaArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN9-6-20204,400Consulting de Seguridad e Investigacion Mira Dp Madrid S.L.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN9-6-2020483.77Chenming Ye (Bazar Real)Art. 13 GDPR, Art. 14 GDPRInsufficient fulfilment of information obligationslink
SPAIN9-6-2020890Property OwnerArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
SPAIN9-6-202067,191Equifax Iberica, S.L.Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN9-6-202034,939Xfera Moviles S.A.Art. 5 (1) f) GDPRInsufficient legal basis for data processinglink
SPAIN9-6-202022,396Glovoapp23Art. 37 GDPRLack of appointment of data protection officerlink
SPAIN9-6-202036,000TELEFONICA MOVILES ESPAÑA, S.A.U.Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN9-6-20202,687Salad Market S.L. (Catering Company)Art. 13 GDPR, Art. 14 GDPRInsufficient fulfilment of information obligationslink
SPAIN9-6-20201800AttorneyArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN9-6-20201800Property OwnerArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
BELGIUM8-6-20204,400Municipal employeeArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN4-6-20203,583Iberdrola ClientesArt. 58 GDPRInsufficient cooperation with supervisory authoritylink
POLAND3-6-2020960Entrepreneur running a non-public nursery and pre-schoolArt. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
BELGIUM29-5-2020890Non-profit organisationArt. 6 GDPR, Art. 21 GDPRInsufficient fulfilment of data subjects rightslink
FINLAND29-5-202064,503Taksi HelsinkiArt. 5 GDPR, Art. 6 GDPR, Art. 35 GDPRNon-compliance with general data processing principleslink
FINLAND22-5-202089,000Posti Group OyjArt. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
FINLAND22-5-202014,334Kymen Vesi OyArt. 35 GDPRNon-compliance with general data processing principleslink
FINLAND22-5-202011,198Unknown CompanyArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
IRELAND17-5-202067,190Tusla Child and Family AgencyArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
DENMARK15-5-20206,002JobTeam A/S DKKArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
BELGIUM14-5-202044,000Social Media ProviderArt. 6 GDPRInsufficient legal basis for data processinglink
SWEDEN12-5-202010,033Health and Medical Board of the Region of Örebro CountyArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA5-5-20204,450Banca Comercială Română SAArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
NORWAY3-5-2020120,047Telenor Norge ASArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
THE NETHERLANDS30-4-2020649,511Unknown OrganisationArt. 5 GDPR, Art. 9 GDPRInsufficient legal basis for data processinglink
ESTONIA30-4-2020445Housing AssociationArt. 6 GDPRInsufficient legal basis for data processinglink
SWEDEN29-4-202016,752National Government Service Centre (NGSC)Art. 33 GDPR, Art. 34 GDPRInsufficient fulfilment of data breach notification obligationslink
BELGIUM28-4-202044,500Proximus SAArt. 31 GDPR, Art. 58 GDPR, Art. 37 GDPRLack of appointment of data protection officerlink
ROMANIA23-4-20202,600Estee Lauder RomaniaArt. 6 GDPR, Art. 7 GDPR, Art. 9 GDPRInsufficient legal basis for data processinglink
ROMANIA23-4-20202,600Telekom Romania Communications SAArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BULGARIA14-4-20201800Political PartyArt. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY26-3-20202,589BankArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA25-3-20201800SOS Infertility AssociationArt. 58 GDPRInsufficient cooperation with supervisory authoritylink
ROMANIA25-3-20202,600Enel EnergieArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA25-3-20203,717Vodafone RomaniaArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA25-3-20202,600Dante InternationalArt. 6 GDPR, Art. 21 GDPRInsufficient legal basis for data processinglink
SPAIN25-3-20204,400Xfera Moviles S.A.Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
GREECE20-3-20206,400Speech and Special Education Centre – Mihou DimitraArt. 15 GDPR, Art. 58 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN19-3-20205,375Oliveros Ustrell, S.L.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY19-3-20205,000Unknown CompanyArt. 6 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN18-3-202026,876TelefónicaArt. 58 GDPRInsufficient cooperation with supervisory authoritylink
SPAIN16-3-20204,400Centro De Estudio Dirigidos Delta, S.L.Art. 5 (1) f) GDPRNon-compliance with general data processing principleslink
SPAIN16-3-20203,600Private PersonArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN16-3-20205,375Amalfi Servicios de Restauracion S.L.Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPRNon-compliance with general data processing principleslink
CROATIA13-3-2020unknownBank (name not available at the moment)Art. 15 (1), (3) GDPRInsufficient fulfilment of data subjects rightslink
SPAIN12-3-20201800Homeowners AssociationArt. 5 GDPR, Art. 13 GDPR, Art. 14 GDPRNon-compliance with general data processing principleslink
SWEDEN11-3-20206,271,150Google LLCArt. 5 GDPR, Art. 6 GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rightslink
DENMARK10-3-20206,271Hørsholm MunicipalityArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
DENMARK10-3-202012,542Gladsaxe MunicipalityArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ICELAND10-3-202018,455National Center of Addiction Medicine (‘SAA’)Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ICELAND10-3-20208,063Breiðholt Upper Secondary SchoolArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN9-3-202013,500Gesthotel Activos BalagaresArt. 5 (1) f) GDPRNon-compliance with general data processing principleslink
POLAND9-3-20203,942Vis Consulting Sp. z o.o.Art. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
HUNGARY9-3-2020779.41CreditorArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ITALY6-3-20203,600Liceo Artistico Statale di NapoliArt. 5 GDPR, Art. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processinglink
ITALY6-3-20203,600Liceo Scientifico Nobel di Torre del GrecoArt. 5 GDPR, Art. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processinglink
SPAIN6-3-20203,600Private personArt. 5 GDPRNon-compliance with general data processing principleslink
SPAIN6-3-20202,867RetailerArt. 13 GDPR, Art. 14 GDPRInsufficient fulfilment of information obligationslink
ITALY5-3-20202,600San Giorgio JonicoArt. 5 GDPR, Art. 6 GDPR, Art. 17 GDPRInsufficient legal basis for data processinglink
POLAND4-3-20203,800School in Gdansk (Danzig) (fine imposed against town of Gdansk)Art. 5 GDPR, Art. 9 GDPRInsufficient legal basis for data processinglink
SPAIN4-3-202053,753Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY4-3-2020259.8Representative of a local governmentArt. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPRInsufficient legal basis for data processinglink
THE NETHERLANDS3-3-2020445,500Royal Dutch Tennis Association (‘KNLTB’)Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN3-3-20201,613Solo EmbragueArt. 13 GDPRInsufficient fulfilment of information obligationslink
SPAIN3-3-202037,627Vodafone España, S.A.U.Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN3-3-202036,000Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN3-3-202021,501Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN28-2-202043,002Vodafone ONO, S.A.U.Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN28-2-20203,225AEMA HispánicaArt. 5 (1) f) GDPRNon-compliance with general data processing principleslink
NORWAY28-2-202032,968Coop Finnmark SAArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN27-2-2020107,505Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
NORWAY26-2-202065,937Rælingen MunicipalityArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN25-2-202043,002HM HospitalesArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN25-2-20204,200Casa Gracio OperationArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
GREECE21-2-20204,479Public Power Corporation S.A.Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
BULGARIA20-2-20202,293T.K. EOODArt. 25 (1) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BULGARIA20-2-20202,293L.E. EOODArt. 25 (1) GDPR, Art. 32 GDPR, Art. 6 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN18-2-20201,350Mymoviles Europa 2000, S.L.Art. 13 GDPRInsufficient fulfilment of information obligationslink
SPAIN14-2-20202,240Grupo Valsor Y Losan, S.L.Art. 5 (1) f) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN14-2-20202,600Colegio Arenales Carabanchel (School)Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN14-2-202071,670Iberdrola ClientesArt. 6 GDPRInsufficient legal basis for data processinglink
SPAIN14-2-202037,627Vodafone España, S.A.U.Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN14-2-202026,876Xfera Moviles S.A.Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY13-2-20203,600Comune di UragoArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA11-2-20202,600Vodafone RomaniaArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY6-2-20201,800RTI – Reti Televisive Italiane s.p.a.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN4-2-20201,350Cafetería NagasakiArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN3-2-202053,753Xfera Moviles S.A.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN3-2-202067,191Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN3-2-202053,753Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN3-2-202044,794Vodafone España, S.A.U.Art. 5 GDPRNon-compliance with general data processing principleslink
SPAIN3-2-20201,800Iberia Lineas Aereas de Espana, S.A. Operadora UnipersonalArt. 5 GDPR, Art. 6 GDPR, Art. 21 GDPRInsufficient legal basis for data processinglink
SPAIN3-2-202067,191Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN3-2-20205,976Banco Bilbao Vizcaya Argentaria S.L.Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPRInsufficient legal basis for data processinglink
SPAIN3-2-20204,400Queseria Artesenal Ameco S.L.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN3-2-2020716.7AutomociónArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ITALY30-1-20203,600Comune di ColledaraArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY24-1-20201,299Accounting firmArt. 24 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY23-1-202026,000Azienda Ospedaliero Universitaria Integrata di Verona (Hospital)Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY23-1-202026,000Sapienza Università di RomaArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY15-1-202024,905,425TIM (telecommunications operator)Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 32 GDPRInsufficient legal basis for data processinglink
ITALY15-1-20208,900Community of Francavilla FontanaArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN14-1-20203,225Zhang Bordeta 2006, S.L. (Store and Restaurant)Art. 5 GDPRNon-compliance with general data processing principleslink
CYPRUS13-1-20208,063Social Insurance Services of the Ministry of Labor, Welfare and Social InsuranceArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
CYPRUS13-1-2020890eShop for Sports (M.L. PRO.FIT SOLUTIONS LTD)Art. 6 GDPRInsufficient legal basis for data processinglink
GREECE13-1-202013,500Allseas Marine S.A.Art. 5 (1) a), (2) GDPRNon-compliance with general data processing principleslink
SPAIN9-1-20202,600Vodafone España, S.A.U.Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
SPAIN7-1-202039,419Vodafone España, S.A.U.Art. 5 (1) f) GDPRNon-compliance with general data processing principleslink
SPAIN7-1-202067,191EDP España S.A.U.Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN7-1-202067,191EDP Comercializadora, S.A.U.Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN7-1-20208,900Asociación de Médicos DemócratasArt. 6 GDPRInsufficient legal basis for data processinglink
BULGARIA6-1-20204,400Utility CompanyArt. 6 (1) GDPRInsufficient legal basis for data processinglink
GREECE19-12-2019134,382Aegean Marine Petroleum Network Inc.Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA18-12-20191800Telekom Romania Mobile Communications SAArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
UNITED KINGDOM17-12-2019286,681Doorstep Dispensaree Ltd. (Pharmacy)Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BELGIUM17-12-20191800Nursing Care OrganisationArt. 12 GDPR, Art. 15 GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rightslink
BELGIUM17-12-201913,500Website providing legal informationArt. 6 GDPR, Art. 12 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligationslink
SWEDEN16-12-201931,356Nusvar ABArt. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA16-12-20191800Globus Score SRLArt. 58 GDPRInsufficient cooperation with supervisory authoritylink
ROMANIA16-12-20195,375SC Enel Energie S.A. (Electricity Distributor)Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 21 GDPRInsufficient legal basis for data processinglink
ROMANIA13-12-20194,400Entirely Shipping & Trading S.R.L.Art. 5 (1) GDPR, Art. 6 GDPR, Art. 7 GDPRNon-compliance with general data processing principleslink
ROMANIA13-12-20194,400Entirely Shipping & Trading S.R.L.Art. 5 (1) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 9 GDPRNon-compliance with general data processing principleslink
HUNGARY11-12-20191,281Unknown CompanyArt. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPRNon-compliance with general data processing principleslink
ITALY11-12-20197,614,968Eni Gas e LuceArt. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPRInsufficient legal basis for data processinglink
ITALY11-12-20192,600,000Eni Gas e LuceArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN10-12-20191,433Megastar SLArt. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
SPAIN10-12-20194,400Shop Macoyn, S.L.Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA10-12-201912,542Hora Credit IFN SAArt. 5 GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information securitylink
GERMANY9-12-20198,555,640Telecoms provider (1&1 Telecom GmbH)Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
GERMANY9-12-20198,900Rapidata GmbHArt. 37 GDPRLack of appointment of data protection officerlink
ROMANIA4-12-201918,000S CNTAR TAROM SA (Airline)Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
GERMANY3-12-201994,067HospitalArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN3-12-20191,350Cerrajeria Verin S.L.Art. 13 GDPRInsufficient fulfilment of information obligationslink
SPAIN3-12-20194,479Linea Directa AseguradoraArt. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA2-12-20191800Nicola Medical Team 17 SRLArt. 58 GDPRInsufficient cooperation with supervisory authoritylink
ROMANIA29-11-20192,240Royal President S.R.L.Art. 15 GDPR, Art. 6 GDPR, Art. 32 GDPRInsufficient fulfilment of data subjects rightslink
ROMANIA29-11-2019440Homeowners AssociationArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BELGIUM28-11-20194,400MayorArt. 6 GDPRInsufficient legal basis for data processinglink
BELGIUM28-11-20194,400Municipal aldermanArt. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA28-11-201971,670ING Bank N.V.Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN28-11-201967,191Curenergía Comercializador de último recursoArt. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA26-11-20192,600Modern BarberArt. 58 GDPRInsufficient cooperation with supervisory authoritylink
ROMANIA25-11-20199,700Courier Services CompanyArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA22-11-20191800BNP Paribas Personal Finance S.A.Art. 12 GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN21-11-201953,753Viaqua Xestión Integral Augas de GaliciaArt. 6 GDPRInsufficient legal basis for data processinglink
FRANCE21-11-2019445,500Futura InternationaleArt. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 21 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN19-11-201953,753Corporación radiotelevisión espanolaArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN19-11-201953,753Xfera Moviles S.A.Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN19-11-20195,375Sports BarArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
SPAIN14-11-201926,000Telefónica SAArt. 5 GDPRNon-compliance with general data processing principleslink
SPAIN13-11-20192,600General Confederation of Labour (‘CGT’)Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN7-11-2019806.29TODOTECNICOS24H S.L.Art. 13 GDPRInsufficient fulfilment of information obligationslink
SPAIN6-11-2019806.29Cerrajero OnlineArt. 13 GDPRInsufficient fulfilment of information obligationslink
SPAIN6-11-201953,753Vodafone España, S.A.U.Art. 6 GDPRInsufficient legal basis for data processinglink
LATVIA1-11-2019135,000UnknownArt. 6 GDPRInsufficient legal basis for data processinglink
SPAIN31-10-20195,375Jocker Premium InvexArt. 6 GDPRInsufficient legal basis for data processinglink
THE NETHERLANDS31-10-2019806290UWV (Dutch employee insurance service provider)Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
THE NETHERLANDS31-10-201944,000Menzis (Health Insurance Company)Art. 5 GDPRNon-compliance with general data processing principleslink
GERMANY30-10-201912,990,239Deutsche Wohnen SEArt. 5 GDPR, Art. 25 GDPRNon-compliance with general data processing principleslink
GERMANY30-10-2019unknownDeutsche Wohnen SEArt. 5 GDPRNon-compliance with general data processing principleslink
BULGARIA28-10-2019445EmployerArt. 12 (3) GDPR, Art. 15 (1) GDPRInsufficient fulfilment of data subjects rightslink
SPAIN25-10-201932,252Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
CYPRUS25-10-201962,712LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation LtdArt. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processinglink
CYPRUS25-10-20198,959LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation LtdArt. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processinglink
CYPRUS25-10-20191,800LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation LtdArt. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processinglink
HUNGARY24-10-20196,630Military HospitalArt. 32 GDPR, Art. 33 GDPRInsufficient fulfilment of data breach notification obligationslink
GERMANY24-10-201989,000Food companyArt. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
AUSTRIA23-10-201916,125,814Austrian PostArt. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN23-10-201953,753Vodafone España, S.A.U.Art. 5 (1) f) GDPRNon-compliance with general data processing principleslink
POLAND18-10-20198,403Major of Aleksandrów KujawskiArt. 28 GDPRInsufficient data processing agreementlink
GREECE18-10-201918,000Wind Hellas TelecommunicationsArt. 21 GDPRInsufficient fulfilment of data subjects rightslink
ROMANIA17-10-20192,240UTTIS INDUSTRIES SRLArt. 12 GDPR, Art. 13 GDPR, Art. 5 (1) c) GDPR, Art. 6 GDPRInsufficient fulfilment of information obligationslink
SPAIN16-10-201953,753Xfera Moviles S.A.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN16-10-20197,167Iberdrola ClientesArt. 31 GDPRInsufficient cooperation with supervisory authoritylink
POLAND16-10-201942,106ClickQuickNowArt. 5 GDPRNon-compliance with general data processing principleslink
HUNGARY15-10-20192,562Unknown CompanyArt. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPRNon-compliance with general data processing principleslink
ROMANIA9-10-2019135,000Raiffeisen Bank SAArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA9-10-201918,000Vreau Credit SRLArt. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information securitylink
BULGARIA8-10-20194,550The Ministry of Interior AffairsArt. 5 (1) GDPR, Art. 6 (1) GDPRInsufficient legal basis for data processinglink
GREECE7-10-2019180,000Telecommunication Service ProviderArt. 5 (1) c) GDPR, Art. 25 GDPRNon-compliance with general data processing principleslink
GREECE7-10-2019180,000Telecommunication Service ProviderArt. 21 (3) GDPR, Art. 25 GDPRNon-compliance with general data processing principleslink
BULGARIA7-10-2019445B.D.Art. 31 GDPRInsufficient cooperation with supervisory authoritylink
SPAIN1-10-201926,000Vueling AirlinesArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY1-10-201913,500Town of KerepesArt. 6 (1) GDPRInsufficient legal basis for data processinglink
ROMANIA26-9-20198,063Inteligo Media SAArt. 5 (1) a) GDPR, Art. 6 (1) a) GDPRInsufficient legal basis for data processinglink
GERMANY19-9-2019175,061Delivery HeroArt. 15 GDPR, Art. 17 GDPR, Art. 21 GDPRInsufficient fulfilment of data subjects rightslink
BELGIUM17-9-201989,000MerchantArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
POLAND10-9-2019577,842Morele.netArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BULGARIA3-9-201925,174National Revenue AgencyArt. 6 (1) GDPR, Art. 58 (2) e) GDPR, Art. 83 (5) a) GDPRInsufficient legal basis for data processinglink
BULGARIA3-9-2019900Telecommunication service provideArt. 6 (1) GDPR, Art. 25 (1) GDPRInsufficient legal basis for data processinglink
BULGARIA3-9-20194,500Telecommunication service provideArt. 6 (1) GDPR, Art. 25 (1) GDPRInsufficient legal basis for data processinglink
BULGARIA3-9-201910,536Commercial representative of telecommunication service providerArt. 6 (1) GDPRInsufficient legal basis for data processinglink
BULGARIA3-9-2019900Private enforcement agentArt. 12 (4) GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
BULGARIA28-8-20192,329,284National Revenue AgencyArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BULGARIA28-8-2019445,000DSK BankArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
LATVIA26-8-20196,271Online ServicesArt. 17 GDPRInsufficient fulfilment of data subjects rightslink
SWEDEN20-8-201916,690School in SkellefteåArt. 5 (1) c) GDPR, Art. 9 GDPR, Art. 35 GDPR, Art. 36 GDPRInsufficient legal basis for data processinglink
SPAIN16-8-201953,753AVON COSMETICSArt. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY8-8-20191,536Government Office Managing the Real Estate RegisterArt. 5 GDPR, Art. 14 GDPRNon-compliance with general data processing principleslink
GERMANY5-8-2019180Private person (YouTube-Channel)Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY2-8-20193,843Public area maintenance companyArt. 5 GDPR, Art. 6 GDPR, Art. 13 GDPRNon-compliance with general data processing principleslink
AUSTRIA1-8-201944,000Company in the medical sectorArt. 13 GDPR, Art. 37 GDPRInsufficient fulfilment of information obligationslink
GREECE30-7-2019134,382PWC Business SolutionsArt. 5 (1) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 13 (1) c) GDPR, Art. 14 (1) c) GDPRInsufficient legal basis for data processinglink
FRANCE25-7-2019161,258ACTIVE ASSURANCES (car insurer)Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
HUNGARY17-7-20197,682Budapest Environs Regional CourtArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA5-7-20192,600LEGAL COMPANY & TAX HUB SRLArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA2-7-201913,438WORLD TRADE CENTER BUCHAREST SAArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
AUSTRIA1-7-20199,100Private person (soccer coach)Art. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA27-6-2019116,464UNICREDIT BANK SAArt. 25 (1) GDPR, Art. 5 (1) c) GDPRInsufficient technical and organisational measures to ensure information securitylink
HUNGARY26-6-20192,553UnknownArt. 5 GDPR, Art. 6 GDPR, Art. 17 GDPRInsufficient legal basis for data processinglink
HUNGARY26-6-20192,553Financial EnterpriseArt. 5 GDPR, Art. 6 GDPR, Art. 21 GDPRInsufficient legal basis for data processinglink
HUNGARY25-6-201913,500UnknownArt. 33 GDPRInsufficient fulfilment of data breach notification obligationslink
THE NETHERLANDS18-6-2019412,104Haga HospitalArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
FRANCE13-6-201918,000Employer UNIONTRAD COMPANYArt. 5 (1) c) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 32 GDPRInsufficient legal basis for data processinglink
SPAIN11-6-2019223,970Professional Football League (LaLiga)Art. 5 (1) a), Art. 7 (3) GDPRInsufficient fulfilment of information obligationslink
DENMARK3-6-2019179,937IDdesign A / SArt. 5 (1) e) GDPR, Art. 5 (2) GDPRNon-compliance with general data processing principleslink
HUNGARY3-6-20192,553Claim management companyArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY31-5-20191,800Local bankArt. 12 (3), (4), (5) GDPR, Art. 15 GDPR, Art. 18 GDPRInsufficient fulfilment of data subjects rightslink
BELGIUM28-5-20191,800MayorArt. 5 (1) b) GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
FRANCE28-5-2019360,000SERGIC (Real Estate)Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
HUNGARY23-5-201982,552Organizer of SZIGET festival and VOLT festivalArt. 6 GDPR, Art. 5 (1) b) GDPR, Art. 13 GDPRInsufficient legal basis for data processinglink
HUNGARY21-5-2019256.22Directorate of Social and Child Welfare Institutions of the Ferencvaros District of BudapestArt. 33 GDPRInsufficient fulfilment of data breach obligationslink
LITHUANIA16-5-201955,097Payment service provider UAB MisterTangoArt. 5 GDPR, Art. 32 GDPR, Art. 33 GDPRInsufficient fulfilment of data breach notification obligationslink
GERMANY9-5-20191,300Police OfficerArt. 6 GDPRInsufficient legal basis for data processinglink
CZECH REPUBLIC6-5-2019173.8UnknownArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
NORWAY29-4-2019107,505Oslo Municipal Education DepartmentArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
POLAND25-4-201911,602Sports associationArt. 6 GDPRInsufficient legal basis for data processinglink link
ITALY17-4-201944,000Italian political party Movimento 5 StelleArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
HUNGARY17-4-20198,421UnknownArt. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
GERMANY12-4-201971,670Company in the financial sectorArt. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BULGARIA8-4-2019440Medical centersArt. 5 (1) a) GDPR, Art. 9 (1) GDPR, Art. 9 (2) GDPR, Art. 6 (1) GDPRInsufficient legal basis for data processinglink
HUNGARY5-4-201930,796Hungarian political partyArt. 33 (1) GDPR, Art. 33 (5) GDPR, Art. 34 (1) GDPRInsufficient fulfilment of data breach notification obligationslink
HUNGARY5-4-20191,702UnknownArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
POLAND26-3-2019197,093Private company working with data from publicly available sourcesArt. 14 GDPRInsufficient fulfilment of information obligationslink
BULGARIA26-3-20194,400A.P. EOODArt. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
PORTUGAL25-3-20191,800UnknownArt. 13 GDPRInsufficient fulfilment of information obligationslink
CZECH REPUBLIC21-3-20198,900UnknownArt. 5 (1) GDPRNon-compliance with general data processing principleslink
PORTUGAL19-3-20191,800UnknownArt. 13 GDPRInsufficient fulfilment of information obligationslink
HUNGARY4-3-20192,867Unnamed financial institutionArt. 5 (1) b) GDPR, Art. 5 (1) c) GDPR, Art. 13 (3) GDPR, Art. 17 (1) GDPR, Art. 6 (4) GDRPInsufficient fulfilment of data subjects rightslink link
GERMANY1-3-201944,000N26Art. 6 GDPRInsufficient legal basis for data processingPage 131 of the activity report of the Data Protection Commissioner of Berlin link link
NORWAY1-3-2019152,299Bergen MunicipalityArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
CZECH REPUBLIC28-2-2019500UnknownArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
HUNGARY28-2-20192,867Mayor’s Office of the city of KecdkemétArt. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink link
BULGARIA26-2-201924,278Telecommunication service providerArt. 6 GDPR, Art. 5 (1) a) GDPRInsufficient legal basis for data processinglink
CZECH REPUBLIC26-2-2019695.2UnknownArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
BULGARIA22-2-2019440EmployerArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
HUNGARY20-2-201913,500Debt collectorArt. 5 (1) a) GDPR, Art. 5 (1) c) GDPRNon-compliance with general data processing principleslink link
MALTA18-2-20194,400Lands AuthorityArt. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
HUNGARY8-2-20191,398BankArt. 5 (1) d) GDPRNon-compliance with general data processing principleslink link
GERMANY5-2-20192,240Private personArt. 6 GDPR, Art. 5 GDPRInsufficient legal basis for data processinglink
PORTUGAL5-2-201918,000UnknownArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
CZECH REPUBLIC4-2-20191,044Car renting companyArt. 5 (1) a) GDPRInsufficient fulfilment of information obligationslink
CZECH REPUBLIC4-2-20191,044Credit brokerageArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
FRANCE21-1-201944,000,000Google Inc.Art. 13 GDPR, Art. 14 GDPR, Art. 6 GDPR, Art. 5 GDPRInsufficient legal basis for data processinglink
BULGARIA17-1-2019440BankArt. 6 GDPR, Art. 5 (1) a) GDPRInsufficient legal basis for data processinglink
CZECH REPUBLIC10-1-2019347.6EmployerArt. 6 GDPRInsufficient legal basis for data processinglink
CYPRUS20194,400State HospitalArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
CYPRUS20198,900NewspaperArt. 6 GDPRInsufficient legal basis for data processinglink
DENMARK2019143,341Taxa 4×35Art. 5(1) e) GDPRNon-compliance with general data processing principleslink
CYPRUS201912,542DoctorArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
GERMANY2019UnknownArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN201918,500Vodafone España, S.A.U.Art. 6 (1) GDPRInsufficient legal basis for data processinglink
SPAIN201932,252VODAFONE ONO, S.A.U.Art. 5 (1) f) GDPRNon-compliance with general data processing principleslink
SPAIN201943,002VODAFONE ONO, S.A.U.Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN201943,002TELEFONICA MOVILES ESPAÑA, S.A.U.Art. 5 (1) a) GDPRNon-compliance with general data processing principleslink
SPAIN201926,000Vodafone España, S.A.U.Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN201936,000Vodafone España, S.A.U.Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN201918,000Private PersonArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
SPAIN20198,063Private PersonArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
SPAIN20193,225AMADOR RECREATIVOS, S.LArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
GERMANY2019716.7Police OfficerArt. 6 GDPRInsufficient legal basis for data processinglink
GERMANY2019263,388UnknownArt. 5 GDPRNon-compliance with general data processing principleslink
GERMANY201946,000Facebook Germany GmbHArt. 37 GDPRLack of appointment of data protection officerlink
GERMANY201918,000Hamburger Verkehrsverbund GmbH (HVV GmbH)Art. 33 GDPR, Art. 34 GDPRInsufficient fulfilment of data breach notification obligationslink
GERMANY2019UnknownHamburger Volksbank eGArt. 21 GDPRInsufficient fulfilment of data subjects rightslink
GERMANY20191,800RestaurantArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
GERMANY201945100Unknown CompanyArt. 15 GDPR, Art. 28 GDPRInsufficient fulfilment of data subjects rightslink
AUSTRIA20-12-201819,800Private personArt. 5 (1) a) GDPR, Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 13 GDPRInsufficient legal basis for data processinglink
HUNGARY18-12-20182,888UnknownArt. 12 (4) GDPR, Art. 15 GDPR, Art. 18 (1) c) GDPR, Art. 13 GDPRInsufficient fulfilment of data subjects rightslink
GERMANY17-12-20184,500Kolibri Image Regina und Dirk Maass GbRArt. 28 (3) GDPRInsufficient data processing agreementlink link
AUSTRIA9-12-20184,332Betting placeArt. 13 GDPRInsufficient fulfilment of information obligationslink
BULGARIA4-12-2018451BankArt. 5 (1) b) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
GERMANY21-11-201818,500Knuddels.deArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink link
CZECH REPUBLIC25-10-2018350UnknownArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
AUSTRIA27-9-2018270Private car ownerArt. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
PORTUGAL18-7-201836,100Public HospitalArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
AUSTRIA20181,625Kebab restaurantArt. 5 GDPR, Art. 13 GDPR, Art. 14 GDPRInsufficient legal basis for data processinglink
GERMANY201818,500UnknownArt. 83 (4) a) GDPR, Art. 33 (1) GDPR, Art. 34 (1) GDPRInsufficient fulfilment of data breach notification obligationsPage 134 of the activity report of the Data Protection Commissioner of Hamburg, accessible under link
GERMANY2018451UnknownUnknownUnknownlink
CZECH REPUBLICUnknown2,834UniCredit Bank Czech Republic and Slovakia, a.s.Art. 6 GDPRInsufficient legal basis for data processinglink
GERMANYUnknown106UnknownArt. 6 GDPRInsufficient legal basis for data processinglink
SPAINUnknown4,500Vodafone España, S.A.U.Art. 5 (1) d) GDPRNon-compliance with general data processing principleslink
SPAINUnknown54,000Debt collecting agancy (GESTIÓN DE COBROS, YO COBRO SL)Art. 5 (1) f) GDPRInsufficient legal basis for data processinglink
SPAINUnknown24,000Vodafone España, S.A.U.Art. 5 (1) d) GDPRInsufficient fulfilment of data subjects rightslink
SPAINUnknown54,000ENDESA (energy supplyer)Art. 5 (1) f) GDPRInsufficient legal basis for data processinglink
SPAINUnknown8,666Restaurant (SANTI 3000, S.L.)Art. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SLOVAKIAUnknownUnknownUnknownArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
SLOVAKIAUnknownUnknownUnknownArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SLOVAKIAUnknownUnknownUnknownArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SLOVAKIAUnknownUnknownUnknownArt. 5 (1) a) GDPR, Art. 6 (1) a) GDPRInsufficient legal basis for data processinglink
SLOVAKIAUnknown36,000Slovak TelekomArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAINUnknown10,830Madrileña Red de GasArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SLOVAKIAUnknown45,000Social Insurance AgencyArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
CZECH REPUBLICUnknown538Alza.cz a.s.Art. 6 GDPR, Art. 7 GDPRInsufficient legal basis for data processinglink
CZECH REPUBLICUnknown884Individual entrepreneur – no further details publishedArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAINUnknown9,025Ikea IbéricaArt. 6 GDPRInsufficient legal basis for data processinglink

Speak your mind