Here is brief list containing all of the EU/GDPR fines imposed on companies since the implementation of the law. This list does not contain any fines charged outside of the EU or the UK.
| Country | Date | Fine £ | Controller/Processor | Quoted Art. | Type | Source |
|---|---|---|---|---|---|---|
| SPAIN | 2020-12-22 00:00:00 | 5300 | Iberdrola Clientes, SAU | Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDD | Insufficient fulfilment of data subjects rights | link |
| ROMANIA | 2020-12-22 00:00:00 | 1794 | S.C. C&V Water Control S.A. | Art. 58 (1) a), e) GDPR, Art. 58 (2) i) GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 2020-12-21 00:00:00 | 32000 | Banco Bilbao Vizcaya Argentaria, S.A. | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | link |
| ROMANIA | 2020-12-17 00:00:00 | 90700 | Banca Transilvania SA | Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| FRANCE | 2020-12-17 00:00:00 | 2722 | Doctor | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| FRANCE | 2020-12-17 00:00:00 | 5444 | Doctor | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 2020-12-16 00:00:00 | 1940 | Unknown | Art. 5 (1) b), c) GDPR, Art. 13 (1) GDPR | Insufficient fulfilment of information obligations | link |
| HUNGARY | 2020-12-16 00:00:00 | 50269 | Robinson Tours Ltd. (Robinson Tours Idegenforgalmi és Szolgáltató Kft.) | Art. 25 (1), (2) GDPR, Art. 32 (1) b) GDPR, Art. 34 (1) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 2020-12-16 00:00:00 | 1256 | Next Time Media Agency Ltd. (Next Time Media Ügynökség Kft.) | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 2020-12-17 00:00:00 | 92000 | Banca Transilvania SA | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| IRELAND | 2020-12-15 00:00:00 | 406000 | Twitter International Company | Art. 33 (1) GDPR, Art. 33 (5) GDPR | Insufficient fulfilment of data breach notification obligations | link |
| POLAND | 2020-12-14 00:00:00 | 1715000 | Virgin Mobile Polska | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1) b) GDPR, Art. 32 (1) d) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-12-11 00:00:00 | 4500000 | Banco Bilbao Vizcaya Argentaria, S.A. | Art. 6 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SWEDEN | 2020-12-11 00:00:00 | 48000 | Umeå University | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-12-10 00:00:00 | 3600 | Borjamotor, S.A. | Art. 7 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 2020-12-09 00:00:00 | 36000 | Xfera Moviles S.A. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-12-09 00:00:00 | 9000 | Unknown | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SWEDEN | 2020-12-03 00:00:00 | 1263000 | Aleris Sjukvård AB | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 2020-12-03 00:00:00 | 999000 | Aleris Sjukvård AB | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-12-03 00:00:00 | 2400 | Dr Marín Cirugia Plástica, S.L.P. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SWEDEN | 2020-12-03 00:00:00 | 243800 | Östergötland Region | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 2020-12-03 00:00:00 | 243800 | Västerbotten Region | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 2020-12-03 00:00:00 | 341300 | Sahlgrenska University Hospital | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 2020-12-03 00:00:00 | 390100 | Karolinska University Hospital of Solna | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 2020-12-03 00:00:00 | 2900000 | Capio St. Göran AB | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| NORWAY | 2020-12-03 00:00:00 | 18840 | Municipality of Indre Østfold | Art. 6 GDPR, Art. 32 (1) b) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-12-02 00:00:00 | 6000 | Servicio de Alojamientos Responsables, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-12-02 00:00:00 | 3000 | Comercio Online Levante, S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-12-02 00:00:00 | 5000 | Asociación de Víctimas por Arbitrariedades Judiciales, (JAVA) | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-12-02 00:00:00 | 10000 | Losada Advocats S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-11-27 00:00:00 | 1200 | Private Individual | Art. 5 (1) a) GDPR | Non-compliance with general data processing principles | Link |
| SWEDEN | 2020-11-25 00:00:00 | 19500 | Gnosjö Municipality | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 35 GDPR, Art. 36 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-11-25 00:00:00 | 40000 | Miraclia Telecomunicaciones S.L. | Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | link |
| BELGIUM | 2020-11-25 00:00:00 | 1500 | Private Individual | Art. 6 GDPR, Art. 25 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2020-11-24 00:00:00 | 5000 | Dada Creation S.R.L. | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 2020-11-24 00:00:00 | 394000 | City of Stockholm | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-11-23 00:00:00 | 12000 | Recambios Villalegre S.L. | Art. 6 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2020-11-23 00:00:00 | 4000 | Vodafone România SA | Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| ITALY | 2020-11-23 00:00:00 | 20000 | Burgo Group S.p.A | Art. 5 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-11-19 00:00:00 | 36000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-11-18 00:00:00 | 2000 | Anmavas 61, S.L. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| FRANCE | 2020-11-18 00:00:00 | 800000 | Carrefour Banque | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| FRANCE | 2020-11-18 00:00:00 | 2250000 | Carrefour France | Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 32 GDPR, Art. 33 GDPR | Non-compliance with general data processing principles | link |
| ITALY | 2020-11-17 00:00:00 | 30000 | Provincial Health Authority of Cosenza | Art. 9 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 2020-11-17 00:00:00 | 2000 | Comune di Collegno | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 2020-11-16 00:00:00 | 1600 | Homeowners Association | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-11-16 00:00:00 | 42000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | |
| UNITED KINGDOM | 2020-11-15 00:00:00 | 1.6 m | TicketMaster UK | Article 56 of the GDPR, Article 60 of the GDPR | Fincial details in chatbot compromised. | link |
| Germany | 2020-11-11 00:00:00 | 800500 | Telecoms provider (1&1 Telecom GmbH) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-11-05 00:00:00 | 67000 | Telefonica Moviles Espana, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-11-03 00:00:00 | 26000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| UNITED KINGDOM | 2020-10-30 00:00:00 | 18226109 | Marriott International, Inc | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-10-28 00:00:00 | 32085 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-10-28 00:00:00 | 3600 | Play Orenes, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| ITALY | 2020-10-26 00:00:00 | 18000 | Università Campus Bio-medico di Roma (Polyclinic) | Art. 5 (2) a), f) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | link |
| HUNGARY | 2020-10-23 00:00:00 | 48841 | Deichmann Cipőkereskedelmi Korlátolt Felelősségű Társaságnak | Art. 12 GDPR, Art. 15 GDPR, Art. 18 (1) c) GDPR, Art. 25 GDPR | Insufficient fulfilment of data subjects rights | link |
| CYPRUS | 2020-10-22 00:00:00 | 5348 | Cyprus Police | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| LITHUANIA | 2020-10-21 00:00:00 | 13500 | Vilnius City Municipality Administration | Art. 5 (1) d) GDPR, Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link link |
| ROMANIA | 2020-10-20 00:00:00 | 1800 | Globus Score SRL | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| CYPRUS | 2020-10-19 00:00:00 | 890 | Grant Ideas Ltd | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| CYPRUS | 2020-10-19 00:00:00 | 13500 | Bank of Cyprus Public Company Ltd | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 15 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| UNITED KINGDOM | 2020-10-16 00:00:00 | 19648548 | British Airways | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 2020-10-15 00:00:00 | 2600 | S.C. Marsorom S.R.L. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-10-09 00:00:00 | 802.13 | Café Restaurante B.B.B | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-10-09 00:00:00 | 1800 | Private Person | Art. 5 (1) c) GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-10-09 00:00:00 | 44000 | Centro de Investigación y Estudio para la Obesidad, SL | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-10-09 00:00:00 | 4400 | Caja Rural San José de Nules S. Cooperativa de Crédito | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-10-06 00:00:00 | 53475 | Lycamobile | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-10-06 00:00:00 | 3600 | Callesgarcia, S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-10-03 00:00:00 | 2600 | Avata Hispania, S.L. | Art. 5 GDPR, Art. 6 GDPR, Art. 28 (3) g) GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 2020-10-01 00:00:00 | 31424404 | H&M Hennes & Mauritz Online Shop A.B. & Co. KG | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2020-10-01 00:00:00 | 2600 | Megareduceri TV S.R.L. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ROMANIA | 2020-10-01 00:00:00 | 1800 | Asociația de proprietari Militari R | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ITALY | 2020-09-30 00:00:00 | 71300 | Azienda Ospedaliera di Rilievo Nazionale ‘Antonio Cardarelli’ (Private Hospital) | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 2020-09-30 00:00:00 | 53475 | Scanshare s.r.l. | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-09-30 00:00:00 | 2600 | Venu Sanz Chef, S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-09-25 00:00:00 | 53475 | Xfera Moviles S.A. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 2020-09-25 00:00:00 | 12388 | Odin Flissenter AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-09-22 00:00:00 | 53475 | GLP Instalaciones 86, SL | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-09-22 00:00:00 | 6952 | Iweb Internet Learning, S.L. | Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 2020-09-17 00:00:00 | 53475 | Vodafone España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-09-17 00:00:00 | 2600 | Grupo Carolizan | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-09-16 00:00:00 | 8900 | Property owners community | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-09-11 00:00:00 | 1350 | Political Party | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GREECE | 2020-09-11 00:00:00 | 6400 | Private Person | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| POLAND | 2020-09-08 00:00:00 | 10033 | Warsaw University of Life Sciences | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 2020-09-08 00:00:00 | 1800 | Sanatatea Press Group S.R.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-09-07 00:00:00 | 2600 | Barcelona Airport Security Guard Association (‘AVSAB’) | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| ITALY | 2020-09-07 00:00:00 | 1800 | Istituto Comprensivo Statale Crucoli Torretta | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BELGIUM | 2020-09-07 00:00:00 | 4400 | Former mayor of a community | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 2020-09-03 00:00:00 | 247262 | Bergen Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 2020-09-03 00:00:00 | 1800 | Comune di Casaloldo | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-09-01 00:00:00 | 67190 | Telefónica Móviles España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2020-09-01 00:00:00 | 445 | Apartment building owners association | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | link |
| POLAND | 2020-08-31 00:00:00 | 20336 | Surveyor General of Poland (‘GKK’) | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-08-28 00:00:00 | 44000 | Bankia S.A. | Art. 5 (1) b) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-08-28 00:00:00 | 4400 | Basketball Federation of Castilla and Leon | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-08-17 00:00:00 | 4400 | Party of the Socialists of Catalonia | Art. 5 (1) b) GDPR | Non-compliance with general data processing principles | link |
| ESTONIA | 2020-08-17 00:00:00 | 43 | Police Officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 2020-08-10 00:00:00 | 8900 | Cavauto S.R.L. | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 2020-08-10 00:00:00 | 8900 | Community of Baronissi | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-08-06 00:00:00 | 2600 | GROW BEATS SL | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| ITALY | 2020-08-06 00:00:00 | 2600 | GTL S.R.L. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 2020-08-06 00:00:00 | 2600 | Just Landed S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| FRANCE | 2020-08-05 00:00:00 | 223969 | Spartoo | Art. 5 (1) GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| FINLAND | 2020-08-05 00:00:00 | 6271 | Acc Consulting Varsinais-Suomi | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-08-05 00:00:00 | 2600 | Restaurant | Art. 5 (1) c) GDPR, Art. 12 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | link |
| AUSTRIA | 2020-08-05 00:00:00 | 89 | Bank | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 2020-08-05 00:00:00 | 1800 | School | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| DENMARK | 2020-08-04 00:00:00 | 18007 | PrivatBo A.M.B.A. | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-08-04 00:00:00 | 53752 | Vodafone España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 2020-08-04 00:00:00 | 13500 | Mapei S.p.A. | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 2020-08-04 00:00:00 | 4400 | National Institute for Social Security – Department of the Province of Brescia | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| ITALY | 2020-08-04 00:00:00 | 890 | Supermarket | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GREECE | 2020-08-03 00:00:00 | 2600 | Candidate for parliamentary elections | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 2020-07-31 00:00:00 | 40314 | Vodafone España SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-07-31 00:00:00 | 1343 | Tour & People Max S.L. | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| ROMANIA | 2020-07-30 00:00:00 | 1800 | SC Viva Credit IFN SA | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| ROMANIA | 2020-07-30 00:00:00 | 1800 | Romanian Post National Company | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 2020-07-30 00:00:00 | 1800 | Community of Manduria | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 2020-07-29 00:00:00 | 2600 | Community of San Giorgio Jonico | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 2020-07-29 00:00:00 | 3600 | Region of Campania | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| DENMARK | 2020-07-28 00:00:00 | 132410 | Arp Hansen Hotel Group A/S | Art. 5 (1) e) GDPR | Non-compliance with general data processing principles | link |
| BELGIUM | 2020-07-28 00:00:00 | 2600 | Communal political association | Art. 5 GDPR, Art. 6 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2020-07-27 00:00:00 | 4479 | SC Cntar Tarom SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-07-23 00:00:00 | 8900 | El Periódico de Catalunya, S.L.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-07-23 00:00:00 | 49273 | Telefónica Móviles España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-07-23 00:00:00 | 62711 | Telefónica Móviles España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-07-23 00:00:00 | 67190 | Telefónica Móviles España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-07-23 00:00:00 | 4400 | Xfera Moviles S.A. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 2020-07-23 00:00:00 | 4400 | El Real Sporting de Gijón S.A.D. | Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2020-07-23 00:00:00 | 501 | Forbes Hungary | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2020-07-23 00:00:00 | 1522 | Employer | Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 2020-07-20 00:00:00 | 21501 | Banco Bilbao Vizcaya Argentaria, SA | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-07-20 00:00:00 | 36000 | Iberia Lae SA Operadora Unipersonal | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 2020-07-20 00:00:00 | 1350 | Comercial Vigobrandy, SL | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 2020-07-20 00:00:00 | 71670 | Orange Espagne S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-07-20 00:00:00 | 62711 | Xfera Moviles S.A. | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| HUNGARY | 2020-07-16 00:00:00 | 25 | Google Ireland Ltd. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| POLAND | 2020-07-15 00:00:00 | 19978 | Office for geodesy and cartography | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| BELGIUM | 2020-07-14 00:00:00 | 537527 | Google Belgium SA | Art. 5 GDPR, Art. 6 GDPR, Art. 17 (1) a) GDPR, Art. 12 GDPR | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 2020-07-14 00:00:00 | 4400 | Operator of CCTV of a residential building | Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 2020-07-13 00:00:00 | 180000 | Merlini s.r.l. | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 28 GDPR, Art. 29 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 2020-07-13 00:00:00 | 14961172 | Wind Tre S.p.A. | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 24 GDPR, Art. 25 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 2020-07-13 00:00:00 | 716702 | Iliad Italia S.p.A. | Art. 5 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| POLAND | 2020-07-10 00:00:00 | 3045 | East Power Sp. z o.o. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| NORWAY | 2020-07-10 00:00:00 | 41801 | Municipality of Rælingen | Art. 32 GDPR, Art. 35 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-07-10 00:00:00 | 1350 | Auto Desguaces Iglesias S.L. | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-07-10 00:00:00 | 890 | Centro Internacional De Crecimiento Laboral Y Profesional S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-07-10 00:00:00 | 10750 | Vodafone España, SAU | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-07-10 00:00:00 | 4400 | Global Business Travel Spain SLU | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-07-10 00:00:00 | 4400 | School Fitness Holiday & Franchising S.L. | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-07-10 00:00:00 | 49273 | Xfera Moviles S.A. | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 2020-07-09 00:00:00 | 13500 | Proleasing Motors SRL | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| THE NETHERLANDS | 2020-07-06 00:00:00 | 743579 | Bureau Krediet Registration (‘BKR’) | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 2020-07-02 00:00:00 | 21501 | Iberdrola Clientes | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-07-02 00:00:00 | 3600 | De Vere Spain S.L. | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| NORWAY | 2020-07-02 00:00:00 | 25084 | Odin Flissenter AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-07-02 00:00:00 | 3225 | Saunier-Tec Mantenimientos de Calor y Frio, SL. | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| SPAIN | 2020-07-02 00:00:00 | 4400 | Xfera Moviles S.A. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ITALY | 2020-07-02 00:00:00 | 13500 | Mapei S.p.A. | Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| GERMANY | 2020-06-30 00:00:00 | 1110889 | Allgemeine Ortskrankenkasse (‘AOK’) (health insurance company) | Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| DENMARK | 2020-06-30 00:00:00 | 6002 | Lejre Municipality | Art. 5 GDPR, Art. 6 GDPR, Art. 33 GDPR, Art. 34 GDPR | Non-compliance with general data processing principles | link |
| IRELAND | 2020-06-30 00:00:00 | 36000 | Tusla Child and Family Agency | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| GREECE | 2020-06-29 00:00:00 | 4400 | New York College S.A. | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| ISLE OF MAN | 2020-06-25 00:00:00 | 12094 | Department of Home Affairs | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 2020-06-23 00:00:00 | 6719 | Miraclia (telecommunications company) | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-06-22 00:00:00 | 1800 | Unknown | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| NORWAY | 2020-06-22 00:00:00 | 100338 | Østfold HF Hospital | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BELGIUM | 2020-06-19 00:00:00 | 8900 | Unknown | Art. 5 GDPR, Art. 6 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| NORWAY | 2020-06-19 00:00:00 | 25084 | Aquateknikk AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-06-19 00:00:00 | 5375 | National Police Brigade | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2020-06-18 00:00:00 | 3600 | Enel Energie | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-06-16 00:00:00 | 1800 | Café Bar | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| SWEDEN | 2020-06-16 00:00:00 | 1702 | Housing Association | Art. 5 GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | link |
| BELGIUM | 2020-06-16 00:00:00 | 890 | Unknown | Art. 17 GDPR, Art. 21 GDPR, Art. 31 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 2020-06-15 00:00:00 | 67191 | Xfera Moviles S.A. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2020-06-12 00:00:00 | 258013 | Digi Távközlési Szolgáltató Kft. (‘Digi’) (electronic communication service provider) | Art. 5 (1) b), (e) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 2020-06-11 00:00:00 | 2600 | Telekom Romania | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-06-09 00:00:00 | 4400 | Consulting de Seguridad e Investigacion Mira Dp Madrid S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-06-09 00:00:00 | 483.77 | Chenming Ye (Bazar Real) | Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 2020-06-09 00:00:00 | 890 | Property Owner | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-06-09 00:00:00 | 67191 | Equifax Iberica, S.L. | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 2020-06-09 00:00:00 | 34939 | Xfera Moviles S.A. | Art. 5 (1) f) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-06-09 00:00:00 | 22396 | Glovoapp23 | Art. 37 GDPR | Lack of appointment of data protection officer | link |
| SPAIN | 2020-06-09 00:00:00 | 36000 | TELEFONICA MOVILES ESPAÑA, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-06-09 00:00:00 | 2687 | Salad Market S.L. (Catering Company) | Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 2020-06-09 00:00:00 | 1800 | Attorney | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-06-09 00:00:00 | 1800 | Property Owner | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| BELGIUM | 2020-06-08 00:00:00 | 4400 | Municipal employee | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-06-04 00:00:00 | 3583 | Iberdrola Clientes | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| POLAND | 2020-06-03 00:00:00 | 960 | Entrepreneur running a non-public nursery and pre-school | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| BELGIUM | 2020-05-29 00:00:00 | 890 | Non-profit organisation | Art. 6 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| FINLAND | 2020-05-29 00:00:00 | 64503 | Taksi Helsinki | Art. 5 GDPR, Art. 6 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | link |
| FINLAND | 2020-05-22 00:00:00 | 89000 | Posti Group Oyj | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| FINLAND | 2020-05-22 00:00:00 | 14334 | Kymen Vesi Oy | Art. 35 GDPR | Non-compliance with general data processing principles | link |
| FINLAND | 2020-05-22 00:00:00 | 11198 | Unknown Company | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| IRELAND | 2020-05-17 00:00:00 | 67190 | Tusla Child and Family Agency | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| DENMARK | 2020-05-15 00:00:00 | 6002 | JobTeam A/S DKK | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 2020-05-14 00:00:00 | 44000 | Social Media Provider | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SWEDEN | 2020-05-12 00:00:00 | 10033 | Health and Medical Board of the Region of Örebro County | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2020-05-05 00:00:00 | 4450 | Banca Comercială Română SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| NORWAY | 2020-05-03 00:00:00 | 120047 | Telenor Norge AS | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| THE NETHERLANDS | 2020-04-30 00:00:00 | 649511 | Unknown Organisation | Art. 5 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| ESTONIA | 2020-04-30 00:00:00 | 445 | Housing Association | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SWEDEN | 2020-04-29 00:00:00 | 16752 | National Government Service Centre (NGSC) | Art. 33 GDPR, Art. 34 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| BELGIUM | 2020-04-28 00:00:00 | 44500 | Proximus SA | Art. 31 GDPR, Art. 58 GDPR, Art. 37 GDPR | Lack of appointment of data protection officer | link |
| ROMANIA | 2020-04-23 00:00:00 | 2600 | Estee Lauder Romania | Art. 6 GDPR, Art. 7 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2020-04-23 00:00:00 | 2600 | Telekom Romania Communications SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 2020-04-14 00:00:00 | 1800 | Political Party | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2020-03-26 00:00:00 | 2589 | Bank | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2020-03-25 00:00:00 | 1800 | SOS Infertility Association | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ROMANIA | 2020-03-25 00:00:00 | 2600 | Enel Energie | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 2020-03-25 00:00:00 | 3717 | Vodafone Romania | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 2020-03-25 00:00:00 | 2600 | Dante International | Art. 6 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-03-25 00:00:00 | 4400 | Xfera Moviles S.A. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| GREECE | 2020-03-20 00:00:00 | 6400 | Speech and Special Education Centre – Mihou Dimitra | Art. 15 GDPR, Art. 58 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 2020-03-19 00:00:00 | 5375 | Oliveros Ustrell, S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2020-03-19 00:00:00 | 5000 | Unknown Company | Art. 6 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 2020-03-18 00:00:00 | 26876 | Telefónica | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 2020-03-16 00:00:00 | 4400 | Centro De Estudio Dirigidos Delta, S.L. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-03-16 00:00:00 | 3600 | Private Person | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-03-16 00:00:00 | 5375 | Amalfi Servicios de Restauracion S.L. | Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| CROATIA | 2020-03-13 00:00:00 | unknown | Bank (name not available at the moment) | Art. 15 (1), (3) GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 2020-03-12 00:00:00 | 1800 | Homeowners Association | Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| SWEDEN | 2020-03-11 00:00:00 | 6271150 | Google LLC | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| DENMARK | 2020-03-10 00:00:00 | 6271 | Hørsholm Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| DENMARK | 2020-03-10 00:00:00 | 12542 | Gladsaxe Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ICELAND | 2020-03-10 00:00:00 | 18455 | National Center of Addiction Medicine (‘SAA’) | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ICELAND | 2020-03-10 00:00:00 | 8063 | Breiðholt Upper Secondary School | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-03-09 00:00:00 | 13500 | Gesthotel Activos Balagares | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| POLAND | 2020-03-09 00:00:00 | 3942 | Vis Consulting Sp. z o.o. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| HUNGARY | 2020-03-09 00:00:00 | 779.41 | Creditor | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 2020-03-06 00:00:00 | 3600 | Liceo Artistico Statale di Napoli | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 2020-03-06 00:00:00 | 3600 | Liceo Scientifico Nobel di Torre del Greco | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-03-06 00:00:00 | 3600 | Private person | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-03-06 00:00:00 | 2867 | Retailer | Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| ITALY | 2020-03-05 00:00:00 | 2600 | San Giorgio Jonico | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | link |
| POLAND | 2020-03-04 00:00:00 | 3800 | School in Gdansk (Danzig) (fine imposed against town of Gdansk) | Art. 5 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-03-04 00:00:00 | 53753 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2020-03-04 00:00:00 | 259.8 | Representative of a local government | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | link |
| THE NETHERLANDS | 2020-03-03 00:00:00 | 445500 | Royal Dutch Tennis Association (‘KNLTB’) | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-03-03 00:00:00 | 1613 | Solo Embrague | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 2020-03-03 00:00:00 | 37627 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-03-03 00:00:00 | 36000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-03-03 00:00:00 | 21501 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-02-28 00:00:00 | 43002 | Vodafone ONO, S.A.U. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-02-28 00:00:00 | 3225 | AEMA Hispánica | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| NORWAY | 2020-02-28 00:00:00 | 32968 | Coop Finnmark SA | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-02-27 00:00:00 | 107505 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 2020-02-26 00:00:00 | 65937 | Rælingen Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-02-25 00:00:00 | 43002 | HM Hospitales | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-02-25 00:00:00 | 4200 | Casa Gracio Operation | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| GREECE | 2020-02-21 00:00:00 | 4479 | Public Power Corporation S.A. | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| BULGARIA | 2020-02-20 00:00:00 | 2293 | T.K. EOOD | Art. 25 (1) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 2020-02-20 00:00:00 | 2293 | L.E. EOOD | Art. 25 (1) GDPR, Art. 32 GDPR, Art. 6 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-02-18 00:00:00 | 1350 | Mymoviles Europa 2000, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 2020-02-14 00:00:00 | 2240 | Grupo Valsor Y Losan, S.L. | Art. 5 (1) f) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-02-14 00:00:00 | 2600 | Colegio Arenales Carabanchel (School) | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-02-14 00:00:00 | 71670 | Iberdrola Clientes | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-02-14 00:00:00 | 37627 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2020-02-14 00:00:00 | 26876 | Xfera Moviles S.A. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 2020-02-13 00:00:00 | 3600 | Comune di Urago | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2020-02-11 00:00:00 | 2600 | Vodafone Romania | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 2020-02-06 00:00:00 | 1800 | RTI – Reti Televisive Italiane s.p.a. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-02-04 00:00:00 | 1350 | Cafetería Nagasaki | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-02-03 00:00:00 | 53753 | Xfera Moviles S.A. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-02-03 00:00:00 | 67191 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-02-03 00:00:00 | 53753 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-02-03 00:00:00 | 44794 | Vodafone España, S.A.U. | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-02-03 00:00:00 | 1800 | Iberia Lineas Aereas de Espana, S.A. Operadora Unipersonal | Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-02-03 00:00:00 | 67191 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-02-03 00:00:00 | 5976 | Banco Bilbao Vizcaya Argentaria S.L. | Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-02-03 00:00:00 | 4400 | Queseria Artesenal Ameco S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-02-03 00:00:00 | 716.7 | Automoción | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 2020-01-30 00:00:00 | 3600 | Comune di Colledara | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2020-01-24 00:00:00 | 1299 | Accounting firm | Art. 24 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 2020-01-23 00:00:00 | 26000 | Azienda Ospedaliero Universitaria Integrata di Verona (Hospital) | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 2020-01-23 00:00:00 | 26000 | Sapienza Università di Roma | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 2020-01-15 00:00:00 | 24905425 | TIM (telecommunications operator) | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 2020-01-15 00:00:00 | 8900 | Community of Francavilla Fontana | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-01-14 00:00:00 | 3225 | Zhang Bordeta 2006, S.L. (Store and Restaurant) | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| CYPRUS | 2020-01-13 00:00:00 | 8063 | Social Insurance Services of the Ministry of Labor, Welfare and Social Insurance | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| CYPRUS | 2020-01-13 00:00:00 | 890 | eShop for Sports (M.L. PRO.FIT SOLUTIONS LTD) | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GREECE | 2020-01-13 00:00:00 | 13500 | Allseas Marine S.A. | Art. 5 (1) a), (2) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-01-09 00:00:00 | 2600 | Vodafone España, S.A.U. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 2020-01-07 00:00:00 | 39419 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2020-01-07 00:00:00 | 67191 | EDP España S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-01-07 00:00:00 | 67191 | EDP Comercializadora, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2020-01-07 00:00:00 | 8900 | Asociación de Médicos Demócratas | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 2020-01-06 00:00:00 | 4400 | Utility Company | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| GREECE | 2019-12-19 00:00:00 | 134382 | Aegean Marine Petroleum Network Inc. | Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 2019-12-18 00:00:00 | 1800 | Telekom Romania Mobile Communications SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| UNITED KINGDOM | 2019-12-17 00:00:00 | 286681 | Doorstep Dispensaree Ltd. (Pharmacy) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BELGIUM | 2019-12-17 00:00:00 | 1800 | Nursing Care Organisation | Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 2019-12-17 00:00:00 | 13500 | Website providing legal information | Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SWEDEN | 2019-12-16 00:00:00 | 31356 | Nusvar AB | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2019-12-16 00:00:00 | 1800 | Globus Score SRL | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ROMANIA | 2019-12-16 00:00:00 | 5375 | SC Enel Energie S.A. (Electricity Distributor) | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2019-12-13 00:00:00 | 4400 | Entirely Shipping & Trading S.R.L. | Art. 5 (1) GDPR, Art. 6 GDPR, Art. 7 GDPR | Non-compliance with general data processing principles | link |
| ROMANIA | 2019-12-13 00:00:00 | 4400 | Entirely Shipping & Trading S.R.L. | Art. 5 (1) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | link |
| HUNGARY | 2019-12-11 00:00:00 | 1281 | Unknown Company | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| ITALY | 2019-12-11 00:00:00 | 7614968 | Eni Gas e Luce | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 2019-12-11 00:00:00 | 2600000 | Eni Gas e Luce | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2019-12-10 00:00:00 | 1433 | Megastar SL | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | |
| SPAIN | 2019-12-10 00:00:00 | 4400 | Shop Macoyn, S.L. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 2019-12-10 00:00:00 | 12542 | Hora Credit IFN SA | Art. 5 GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| GERMANY | 2019-12-09 00:00:00 | 8555640 | Telecoms provider (1&1 Telecom GmbH) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| GERMANY | 2019-12-09 00:00:00 | 8900 | Rapidata GmbH | Art. 37 GDPR | Lack of appointment of data protection officer | link |
| ROMANIA | 2019-12-04 00:00:00 | 18000 | S CNTAR TAROM SA (Airline) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| GERMANY | 2019-12-03 00:00:00 | 94067 | Hospital | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2019-12-03 00:00:00 | 1350 | Cerrajeria Verin S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 2019-12-03 00:00:00 | 4479 | Linea Directa Aseguradora | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2019-12-02 00:00:00 | 1800 | Nicola Medical Team 17 SRL | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ROMANIA | 2019-11-29 00:00:00 | 2240 | Royal President S.R.L. | Art. 15 GDPR, Art. 6 GDPR, Art. 32 GDPR | Insufficient fulfilment of data subjects rights | link |
| ROMANIA | 2019-11-29 00:00:00 | 440 | Homeowners Association | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BELGIUM | 2019-11-28 00:00:00 | 4400 | Mayor | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| BELGIUM | 2019-11-28 00:00:00 | 4400 | Municipal alderman | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2019-11-28 00:00:00 | 71670 | ING Bank N.V. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2019-11-28 00:00:00 | 67191 | Curenergía Comercializador de último recurso | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2019-11-26 00:00:00 | 2600 | Modern Barber | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ROMANIA | 2019-11-25 00:00:00 | 9700 | Courier Services Company | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 2019-11-22 00:00:00 | 1800 | BNP Paribas Personal Finance S.A. | Art. 12 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 2019-11-21 00:00:00 | 53753 | Viaqua Xestión Integral Augas de Galicia | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| FRANCE | 2019-11-21 00:00:00 | 445500 | Futura Internationale | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 2019-11-19 00:00:00 | 53753 | Corporación radiotelevisión espanola | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2019-11-19 00:00:00 | 53753 | Xfera Moviles S.A. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2019-11-19 00:00:00 | 5375 | Sports Bar | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2019-11-14 00:00:00 | 26000 | Telefónica SA | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2019-11-13 00:00:00 | 2600 | General Confederation of Labour (‘CGT’) | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2019-11-07 00:00:00 | 806.29 | TODOTECNICOS24H S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 2019-11-06 00:00:00 | 806.29 | Cerrajero Online | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 2019-11-06 00:00:00 | 53753 | Vodafone España, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| LATVIA | 2019-11-01 00:00:00 | 135000 | Unknown | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2019-10-31 00:00:00 | 5375 | Jocker Premium Invex | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| THE NETHERLANDS | 2019-10-31 00:00:00 | 806290 | UWV (Dutch employee insurance service provider) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| THE NETHERLANDS | 2019-10-31 00:00:00 | 44000 | Menzis (Health Insurance Company) | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 2019-10-30 00:00:00 | 12990239 | Deutsche Wohnen SE | Art. 5 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 2019-10-30 00:00:00 | unknown | Deutsche Wohnen SE | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| BULGARIA | 2019-10-28 00:00:00 | 445 | Employer | Art. 12 (3) GDPR, Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 2019-10-25 00:00:00 | 32252 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| CYPRUS | 2019-10-25 00:00:00 | 62712 | LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| CYPRUS | 2019-10-25 00:00:00 | 8959 | LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| CYPRUS | 2019-10-25 00:00:00 | 1800 | LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2019-10-24 00:00:00 | 6630 | Military Hospital | Art. 32 GDPR, Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| GERMANY | 2019-10-24 00:00:00 | 89000 | Food company | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| AUSTRIA | 2019-10-23 00:00:00 | 16125814 | Austrian Post | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2019-10-23 00:00:00 | 53753 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| POLAND | 2019-10-18 00:00:00 | 8403 | Major of Aleksandrów Kujawski | Art. 28 GDPR | Insufficient data processing agreement | link |
| GREECE | 2019-10-18 00:00:00 | 18000 | Wind Hellas Telecommunications | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| ROMANIA | 2019-10-17 00:00:00 | 2240 | UTTIS INDUSTRIES SRL | Art. 12 GDPR, Art. 13 GDPR, Art. 5 (1) c) GDPR, Art. 6 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 2019-10-16 00:00:00 | 53753 | Xfera Moviles S.A. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2019-10-16 00:00:00 | 7167 | Iberdrola Clientes | Art. 31 GDPR | Insufficient cooperation with supervisory authority | link |
| POLAND | 2019-10-16 00:00:00 | 42106 | ClickQuickNow | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| HUNGARY | 2019-10-15 00:00:00 | 2562 | Unknown Company | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| ROMANIA | 2019-10-09 00:00:00 | 135000 | Raiffeisen Bank SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 2019-10-09 00:00:00 | 18000 | Vreau Credit SRL | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 2019-10-08 00:00:00 | 4550 | The Ministry of Interior Affairs | Art. 5 (1) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| GREECE | 2019-10-07 00:00:00 | 180000 | Telecommunication Service Provider | Art. 5 (1) c) GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| GREECE | 2019-10-07 00:00:00 | 180000 | Telecommunication Service Provider | Art. 21 (3) GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| BULGARIA | 2019-10-07 00:00:00 | 445 | B.D. | Art. 31 GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 2019-10-01 00:00:00 | 26000 | Vueling Airlines | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2019-10-01 00:00:00 | 13500 | Town of Kerepes | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2019-09-26 00:00:00 | 8063 | Inteligo Media SA | Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 2019-09-19 00:00:00 | 175061 | Delivery Hero | Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 2019-09-17 00:00:00 | 89000 | Merchant | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| POLAND | 2019-09-10 00:00:00 | 577842 | Morele.net | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 2019-09-03 00:00:00 | 25174 | National Revenue Agency | Art. 6 (1) GDPR, Art. 58 (2) e) GDPR, Art. 83 (5) a) GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 2019-09-03 00:00:00 | 900 | Telecommunication service provide | Art. 6 (1) GDPR, Art. 25 (1) GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 2019-09-03 00:00:00 | 4500 | Telecommunication service provide | Art. 6 (1) GDPR, Art. 25 (1) GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 2019-09-03 00:00:00 | 10536 | Commercial representative of telecommunication service provider | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 2019-09-03 00:00:00 | 900 | Private enforcement agent | Art. 12 (4) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| BULGARIA | 2019-08-28 00:00:00 | 2329284 | National Revenue Agency | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 2019-08-28 00:00:00 | 445000 | DSK Bank | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| LATVIA | 2019-08-26 00:00:00 | 6271 | Online Services | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| SWEDEN | 2019-08-20 00:00:00 | 16690 | School in Skellefteå | Art. 5 (1) c) GDPR, Art. 9 GDPR, Art. 35 GDPR, Art. 36 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2019-08-16 00:00:00 | 53753 | AVON COSMETICS | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2019-08-08 00:00:00 | 1536 | Government Office Managing the Real Estate Register | Art. 5 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 2019-08-05 00:00:00 | 180 | Private person (YouTube-Channel) | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2019-08-02 00:00:00 | 3843 | Public area maintenance company | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | link |
| AUSTRIA | 2019-08-01 00:00:00 | 44000 | Company in the medical sector | Art. 13 GDPR, Art. 37 GDPR | Insufficient fulfilment of information obligations | link |
| GREECE | 2019-07-30 00:00:00 | 134382 | PWC Business Solutions | Art. 5 (1) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 13 (1) c) GDPR, Art. 14 (1) c) GDPR | Insufficient legal basis for data processing | link |
| FRANCE | 2019-07-25 00:00:00 | 161258 | ACTIVE ASSURANCES (car insurer) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 2019-07-17 00:00:00 | 7682 | Budapest Environs Regional Court | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2019-07-05 00:00:00 | 2600 | LEGAL COMPANY & TAX HUB SRL | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 2019-07-02 00:00:00 | 13438 | WORLD TRADE CENTER BUCHAREST SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| AUSTRIA | 2019-07-01 00:00:00 | 9100 | Private person (soccer coach) | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2019-06-27 00:00:00 | 116464 | UNICREDIT BANK SA | Art. 25 (1) GDPR, Art. 5 (1) c) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 2019-06-26 00:00:00 | 2553 | Unknown | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2019-06-26 00:00:00 | 2553 | Financial Enterprise | Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2019-06-25 00:00:00 | 13500 | Unknown | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| THE NETHERLANDS | 2019-06-18 00:00:00 | 412104 | Haga Hospital | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| FRANCE | 2019-06-13 00:00:00 | 18000 | Employer UNIONTRAD COMPANY | Art. 5 (1) c) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2019-06-11 00:00:00 | 223970 | Professional Football League (LaLiga) | Art. 5 (1) a), Art. 7 (3) GDPR | Insufficient fulfilment of information obligations | link |
| DENMARK | 2019-06-03 00:00:00 | 179937 | IDdesign A / S | Art. 5 (1) e) GDPR, Art. 5 (2) GDPR | Non-compliance with general data processing principles | link |
| HUNGARY | 2019-06-03 00:00:00 | 2553 | Claim management company | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2019-05-31 00:00:00 | 1800 | Local bank | Art. 12 (3), (4), (5) GDPR, Art. 15 GDPR, Art. 18 GDPR | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 2019-05-28 00:00:00 | 1800 | Mayor | Art. 5 (1) b) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| FRANCE | 2019-05-28 00:00:00 | 360000 | SERGIC (Real Estate) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 2019-05-23 00:00:00 | 82552 | Organizer of SZIGET festival and VOLT festival | Art. 6 GDPR, Art. 5 (1) b) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2019-05-21 00:00:00 | 256.22 | Directorate of Social and Child Welfare Institutions of the Ferencvaros District of Budapest | Art. 33 GDPR | Insufficient fulfilment of data breach obligations | link |
| LITHUANIA | 2019-05-16 00:00:00 | 55097 | Payment service provider UAB MisterTango | Art. 5 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| GERMANY | 2019-05-09 00:00:00 | 1300 | Police Officer | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| CZECH REPUBLIC | 2019-05-06 00:00:00 | 173.8 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| NORWAY | 2019-04-29 00:00:00 | 107505 | Oslo Municipal Education Department | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| POLAND | 2019-04-25 00:00:00 | 11602 | Sports association | Art. 6 GDPR | Insufficient legal basis for data processing | link link |
| ITALY | 2019-04-17 00:00:00 | 44000 | Italian political party Movimento 5 Stelle | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 2019-04-17 00:00:00 | 8421 | Unknown | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 2019-04-12 00:00:00 | 71670 | Company in the financial sector | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 2019-04-08 00:00:00 | 440 | Medical centers | Art. 5 (1) a) GDPR, Art. 9 (1) GDPR, Art. 9 (2) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2019-04-05 00:00:00 | 30796 | Hungarian political party | Art. 33 (1) GDPR, Art. 33 (5) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | link |
| HUNGARY | 2019-04-05 00:00:00 | 1702 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| POLAND | 2019-03-26 00:00:00 | 197093 | Private company working with data from publicly available sources | Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| BULGARIA | 2019-03-26 00:00:00 | 4400 | A.P. EOOD | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| PORTUGAL | 2019-03-25 00:00:00 | 1800 | Unknown | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| CZECH REPUBLIC | 2019-03-21 00:00:00 | 8900 | Unknown | Art. 5 (1) GDPR | Non-compliance with general data processing principles | link |
| PORTUGAL | 2019-03-19 00:00:00 | 1800 | Unknown | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| HUNGARY | 2019-03-04 00:00:00 | 2867 | Unnamed financial institution | Art. 5 (1) b) GDPR, Art. 5 (1) c) GDPR, Art. 13 (3) GDPR, Art. 17 (1) GDPR, Art. 6 (4) GDRP | Insufficient fulfilment of data subjects rights | link link |
| GERMANY | 2019-03-01 00:00:00 | 44000 | N26 | Art. 6 GDPR | Insufficient legal basis for data processing | Page 131 of the activity report of the Data Protection Commissioner of Berlin link link |
| NORWAY | 2019-03-01 00:00:00 | 152299 | Bergen Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| CZECH REPUBLIC | 2019-02-28 00:00:00 | 500 | Unknown | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 2019-02-28 00:00:00 | 2867 | Mayor’s Office of the city of Kecdkemét | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link link |
| BULGARIA | 2019-02-26 00:00:00 | 24278 | Telecommunication service provider | Art. 6 GDPR, Art. 5 (1) a) GDPR | Insufficient legal basis for data processing | link |
| CZECH REPUBLIC | 2019-02-26 00:00:00 | 695.2 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| BULGARIA | 2019-02-22 00:00:00 | 440 | Employer | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| HUNGARY | 2019-02-20 00:00:00 | 13500 | Debt collector | Art. 5 (1) a) GDPR, Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link link |
| MALTA | 2019-02-18 00:00:00 | 4400 | Lands Authority | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 2019-02-08 00:00:00 | 1398 | Bank | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | link link |
| GERMANY | 2019-02-05 00:00:00 | 2240 | Private person | Art. 6 GDPR, Art. 5 GDPR | Insufficient legal basis for data processing | link |
| PORTUGAL | 2019-02-05 00:00:00 | 18000 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| CZECH REPUBLIC | 2019-02-04 00:00:00 | 1044 | Car renting company | Art. 5 (1) a) GDPR | Insufficient fulfilment of information obligations | link |
| CZECH REPUBLIC | 2019-02-04 00:00:00 | 1044 | Credit brokerage | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| FRANCE | 2019-01-21 00:00:00 | 44000000 | Google Inc. | Art. 13 GDPR, Art. 14 GDPR, Art. 6 GDPR, Art. 5 GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 2019-01-17 00:00:00 | 440 | Bank | Art. 6 GDPR, Art. 5 (1) a) GDPR | Insufficient legal basis for data processing | link |
| CZECH REPUBLIC | 2019-01-10 00:00:00 | 347.6 | Employer | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| CYPRUS | 2019 | 4400 | State Hospital | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| CYPRUS | 2019 | 8900 | Newspaper | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| DENMARK | 2019 | 143341 | Taxa 4×35 | Art. 5(1) e) GDPR | Non-compliance with general data processing principles | link |
| CYPRUS | 2019 | 12542 | Doctor | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 2019 | Unknown | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link | |
| SPAIN | 2019 | 18500 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2019 | 32252 | VODAFONE ONO, S.A.U. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2019 | 43002 | VODAFONE ONO, S.A.U. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2019 | 43002 | TELEFONICA MOVILES ESPAÑA, S.A.U. | Art. 5 (1) a) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2019 | 26000 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2019 | 36000 | Vodafone España, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2019 | 18000 | Private Person | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2019 | 8063 | Private Person | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2019 | 3225 | AMADOR RECREATIVOS, S.L | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 2019 | 716.7 | Police Officer | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 2019 | 263388 | Unknown | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 2019 | 46000 | Facebook Germany GmbH | Art. 37 GDPR | Lack of appointment of data protection officer | link |
| GERMANY | 2019 | 18000 | Hamburger Verkehrsverbund GmbH (HVV GmbH) | Art. 33 GDPR, Art. 34 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| GERMANY | 2019 | Unknown | Hamburger Volksbank eG | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| GERMANY | 2019 | 1800 | Restaurant | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 2019 | 45100 | Unknown Company | Art. 15 GDPR, Art. 28 GDPR | Insufficient fulfilment of data subjects rights | link |
| AUSTRIA | 2018-12-20 00:00:00 | 19800 | Private person | Art. 5 (1) a) GDPR, Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2018-12-18 00:00:00 | 2888 | Unknown | Art. 12 (4) GDPR, Art. 15 GDPR, Art. 18 (1) c) GDPR, Art. 13 GDPR | Insufficient fulfilment of data subjects rights | link |
| GERMANY | 2018-12-17 00:00:00 | 4500 | Kolibri Image Regina und Dirk Maass GbR | Art. 28 (3) GDPR | Insufficient data processing agreement | link link |
| AUSTRIA | 2018-12-09 00:00:00 | 4332 | Betting place | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| BULGARIA | 2018-12-04 00:00:00 | 451 | Bank | Art. 5 (1) b) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | |
| GERMANY | 2018-11-21 00:00:00 | 18500 | Knuddels.de | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link link |
| CZECH REPUBLIC | 2018-10-25 00:00:00 | 350 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| AUSTRIA | 2018-09-27 00:00:00 | 270 | Private car owner | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| PORTUGAL | 2018-07-17 00:00:00 | 36100 | Public Hospital | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| AUSTRIA | 2018 | 1625 | Kebab restaurant | Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 2018 | 18500 | Unknown | Art. 83 (4) a) GDPR, Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | Page 134 of the activity report of the Data Protection Commissioner of Hamburg, accessible under link |
| GERMANY | 2018 | 451 | Unknown | Unknown | Unknown | link |
| CZECH REPUBLIC | Unknown | 2834 | UniCredit Bank Czech Republic and Slovakia, a.s. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GERMANY | Unknown | 106 | Unknown | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | Unknown | 4500 | Vodafone España, S.A.U. | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | Unknown | 54000 | Debt collecting agancy (GESTIÓN DE COBROS, YO COBRO SL) | Art. 5 (1) f) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | Unknown | 24000 | Vodafone España, S.A.U. | Art. 5 (1) d) GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | Unknown | 54000 | ENDESA (energy supplyer) | Art. 5 (1) f) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | Unknown | 8666 | Restaurant (SANTI 3000, S.L.) | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SLOVAKIA | Unknown | Unknown | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SLOVAKIA | Unknown | Unknown | Unknown | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SLOVAKIA | Unknown | Unknown | Unknown | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SLOVAKIA | Unknown | Unknown | Unknown | Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | link |
| SLOVAKIA | Unknown | 36000 | Slovak Telekom | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | Unknown | 10830 | Madrileña Red de Gas | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SLOVAKIA | Unknown | 45000 | Social Insurance Agency | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| CZECH REPUBLIC | Unknown | 538 | Alza.cz a.s. | Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | link |
| CZECH REPUBLIC | Unknown | 884 | Individual entrepreneur – no further details published | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | Unknown | 9025 | Ikea Ibérica | Art. 6 GDPR | Insufficient legal basis for data processing | link |