Here is brief list containing all of the EU/GDPR fines imposed on companies since the implementation of the law. This list does not contain any fines charged outside of the EU or the UK.
| Country | Date | Fine £ | Controller/Processor | Quoted Art. | Type | Source |
|---|---|---|---|---|---|---|
| GERMANY | 10-3-2021 | 300,000 | VfB Stuttgart 1893 AG | Art. 5 (2) GDPR | Non-compliance with general data processing principles | |
| SPAIN | 10-3-2021 | 10,000 | Hospital Campogrande DE | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 10-3-2021 | 8,000 | Filigrana Comunicación S.L.U. | Art. 6 (1) GDPR, Art. 13 GPDR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 10-3-2021 | 50,000 | Equifax Iberica S.L. | Art. 6 (1)(f) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 10-3-2021 | 90,000 | Xfera Moviles S.A | Art. 5 (1) (f) GDPR, Art. 17 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 09-3-2021 | 15,000 | Homeowners Association | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| ROMANIA | 04-3-2021 | 500 | Natural person holding the position of General Secretary for a political party in Bucharest | Art. 32 (1), (2) GDPR, Art. 58 (1) a), e) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| GERMANY | 03-3-2021 | 200 | Private Individual | Art. 5 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | link |
| CYPRUS | 03-3-2021 | 25,000 | Hellenic Bank | Art. 5 (1) e), f) GDPR, Art. 32 (1) b), c) GDPR, Art. 33 (1) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| CYPRUS | 03-3-2021 | 10,000 | Cypriot Real Estate Registration Authority | Art. 12 GDPR, Art. 15 GDPR, Art. 31 GDPR, 58 (1) e) GDPR | Insufficient fulfilment of information obligations | link |
| CYPRUS | 03-3-2021 | 6,000 | KEPIDES | Art. 32 (4) | Insufficient technical and organisational measures to ensure information security | link |
| CYPRUS | 03-3-2021 | 40,000 | Electricity Authority of Cyprus | Art. 6 (1) GDPR, Art. 9 (2) GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 02-3-2021 | 24,400 | Unknown | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 02-3-2021 | 9,000 | Unknown | Art. 6 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | link |
| LITHUNIA | 26-02-2021 | 3,000 | IT sprendimai sėkmei | Art. 5 (1), (2) GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 35 GDPR, Art. 58 (2) f) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 24-02-2021 | 12,000 | Avilon Center 2016 S.L. | Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDD | Insufficient fulfilment of data subjects rights | link |
| GERMANY | 23-02-2021 | 0 | Deutsche Wohnen SE | Art. 5 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| CROTIA | 22-02-2021 | Unknown | Security company (name not available at the moment) | Art. 32 (1) b), d) GDPR, Art. 32 (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 16-02-2021 | 1,000 | The Washpoint S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| DENAMRK | 12-02-2021 | 13,450 | IDdesign A / S | Art. 5 (1) e) GDPR, Art. 5 (2) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 12-02-2021 | 120,000 | Vodafone España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 12-02-2021 | 1,600 | Ripobruna 207, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 11-02-2021 | 24,000 | Vamavi Phone S.L | Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 LOPDGDD, Art. 28 GDPR | Insufficient fulfilment of data subjects rights | link |
| THE NETHERLANDS | 11-02-2021 | 440,000 | OLVG | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| POLAND | 11-02-2021 | 22,200 | Krajowa Szkoła Sądownictwa i Prokuratury | Art. 5 (1) f) GDPR, Art. 25 (1) GDPR, Art. 28 (3) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 10-02-2021 | 1,000 | ING Bank N.V. Amsterdam - Bucharest office | Art. 29 GDPR, Art. 32 (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 09-02-2021 | 5,000 | Predase Servicios Integrales S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| LATAVIA | 09-02-2021 | 65,000 | Lursoft IT SIA | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 08-02-2021 | 3,000 | Patio Ancestral S.L. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 08-02-2021 | 5,000 | Private Person | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 04-02-2021 | 2,000 | Private Person | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| NORWAY | 03-02-2021 | 19,300 | Cyberbook AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 03-02-2021 | 100,000 | Iberdrola Clientes | Art. 5 (1) d) GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 01-02-2021 | 24,000 | Xfera Moviles S.A. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 01-02-2021 | 3,000 | IDFINANCE Spain, S.L. | Art. 5 (1) f) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| FRANCE | 27-01-2021 | 75,000 | Unknown | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BELGIUM | 27-01-2021 | 50,000 | Family Service / N.D.P.K. nv. | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 28 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 27-01-2021 | 50,000 | Azienda USL della Romagna | Art. 5 (1) a), d), f) GDPR, Art. 9 GDPR, Art. 32 (1) b) GDPR | Non-compliance with general data processing principles | link |
| ITALY | 27-01-2021 | 50,000 | Azienda Ospedaliero Universitaria Senese | Art. 5 (1) f) GDRP, Art. 9 GDPR | Non-compliance with general data processing principles | link |
| ITALY | 27-01-2021 | 50,000 | Azienda Ospedaliero Universitaria di Parma | Art. 5 (1) f) GDRP, Art. 9 GDPR | Non-compliance with general data processing principles | link |
| BELGIUM | 22-01-2021 | 25,000 | Unknown | Art. 5 (1) f), (2) GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 33 (1), (5) GDPR, Art. 34 (1) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 21-01-2021 | 50,000 | Alterna Operador Integral S.L. | Art. 6 (1) b) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 21-01-2021 | 75,000 | Telefónica Móviles España, SAU | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 20-01-2021 | 1,200 | Individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| NORWAY | 19-01-2021 | 9,700 | Aquateknikk AS | Art. 5 GPDR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| POLAND | 15-01-2021 | 4,600 | Anwara Sp. z.o.o. | Art. 31 GDPR, Art. 58 (1) a) GDPR | Insufficient cooperation with supervisory authority | link |
| NORWAY | 14-01-2021 | 38,600 | Coop Finnmark SA | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 14-01-2021 | 8,000 | Agenzia regionale protezione ambientale Campania (ARPAC) | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 14-01-2021 | 30,000 | Azienda sanitaria provinciale di Enna | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 14-01-2021 | 2,000 | Poliambulatorio Talenti S.r.l. | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| ITALY | 14-01-2021 | 18,000 | Azienda Usl di Bologna | Art. 5 (1) f) GDRP, Art. 9 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 13-01-2021 | 6,000,000 | Caixabank S.A. | Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 12-01-2021 | 38,600 | Unknown | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| BELGIUM | 12-01-2021 | Unknown | Unknown | Art. 6 (1) GDPR, Art. 12 (3) GDPR, Art. 21 (1) GDPR | Insufficient legal basis for data processing | link |
| POLAND | 11-01-2021 | 30,000 | Enea S.A. | Art. 33 (1) GDPR | Insufficient fulfilment of data breach notification obligations | link |
| GERMANY | 08-01-2021 | 10,400,000 | notebooksbilliger.de | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 07-01-2021 | 7,250 | Gveik AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 06-01-2021 | 9,700 | Lindstrand Trading AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| FRANCE | 05-01-2021 | 20,000 | Nestor SAS | Art. 12 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| POLAND | 05-01-2021 | 5,500 | Śląski Uniwersytet Medyczny (Medical University of Silesia) | Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | link |
| POLAND | 05-01-2021 | 19,000 | Unknown | Art. 34 (1), (2) GDPR, Art. 58 (2) e) GDPR | Insufficient fulfilment of data breach notification obligations | link |
| SPAIN | 04-01-2021 | 54,000 | Vodafone España, S.A.U. | Art. 5 (1) d), f) GDPR | Non-compliance with general data processing principles | link |
| NORWAY | 04-01-2021 | 95,500 | Innovasjon Norge | Art. 5 (1) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| CZECH REPUBLIC | 04-01-2021 | 118,500 | Unknown | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 30-12-2020 | 3,000 | ING Bank N.V. Amsterdam - Bucharest office | Art. 5 (1) a) - d) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 29-12-2020 | 1,000 | Qualitance QBS SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| POLAND | 23-12-2020 | 5000 | Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A. | Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | link |
| BELGIUM | 23-12-2020 | 15,000 | Unknown | Art. 14 (1), (2) GDPR, Art. 12 (3) GDPR, Art. 6 GDPR, Art. 5 (1) c), (2) GDPR, Art. 24 (1), (2) GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 22-12-2020 | 5300 | Iberdrola Clientes, SAU | Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDD | Insufficient fulfilment of data subjects rights | link |
| ROMANIA | 22-12-2020 | 1794 | S.C. C&V Water Control S.A. | Art. 58 (1) a), e) GDPR, Art. 58 (2) i) GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 21-12-2020 | 32,000 | Banco Bilbao Vizcaya Argentaria, S.A. | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | link |
| ROMANIA | 17-12-2020 | 90,700 | Banca Transilvania SA | Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| FRANCE | 17-12-2020 | 2,722 | Doctor | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| FRANCE | 17-12-2020 | 5,444 | Doctor | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 16-12-2020 | 1,940 | Unknown | Art. 5 (1) b), c) GDPR, Art. 13 (1) GDPR | Insufficient fulfilment of information obligations | link |
| HUNGARY | 16-12-2020 | 50,269 | Robinson Tours Ltd. (Robinson Tours Idegenforgalmi és Szolgáltató Kft.) | Art. 25 (1), (2) GDPR, Art. 32 (1) b) GDPR, Art. 34 (1) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 16-12-2020 | 1,256 | Next Time Media Agency Ltd. (Next Time Media Ügynökség Kft.) | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 17-12-2020 | 92,000 | Banca Transilvania SA | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| IRELAND | 15-12-2020 | 406,000 | Twitter International Company | Art. 33 (1) GDPR, Art. 33 (5) GDPR | Insufficient fulfilment of data breach notification obligations | link |
| POLAND | 14-12-2020 | 1,715,000 | Virgin Mobile Polska | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1) b) GDPR, Art. 32 (1) d) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 11-12-2020 | 4,500,000 | Banco Bilbao Vizcaya Argentaria, S.A. | Art. 6 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SWEDEN | 11-12-2020 | 48,000 | Umeå University | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 10-12-2020 | 3,600 | Borjamotor, S.A. | Art. 7 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 09-12-2020 | 36,000 | Xfera Moviles S.A. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 09-12-2020 | 9,000 | Unknown | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SWEDEN | 03-12-2020 | 1,263,000 | Aleris Sjukvård AB | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 03-12-2020 | 999,000 | Aleris Sjukvård AB | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 03-12-2020 | 2,400 | Dr Marín Cirugia Plástica, S.L.P. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SWEDEN | 03-12-2020 | 243,800 | Östergötland Region | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 03-12-2020 | 243,800 | Västerbotten Region | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 03-12-2020 | 341,300 | Sahlgrenska University Hospital | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 03-12-2020 | 390,100 | Karolinska University Hospital of Solna | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 03-12-2020 | 2,900,000 | Capio St. Göran AB | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| NORWAY | 03-12-2020 | 18,840 | Municipality of Indre Østfold | Art. 6 GDPR, Art. 32 (1) b) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 02-12-2020 | 6,000 | Servicio de Alojamientos Responsables, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 02-12-2020 | 3,000 | Comercio Online Levante, S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 02-12-2020 | 5,000 | Asociación de Víctimas por Arbitrariedades Judiciales, (JAVA) | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 02-12-2020 | 10,000 | Losada Advocats S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 27-11-2020 | 1,200 | Private Individual | Art. 5 (1) a) GDPR | Non-compliance with general data processing principles | link |
| SWEDEN | 25-11-2020 | 19,500 | Gnosjö Municipality | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 35 GDPR, Art. 36 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 25-11-2020 | 40,000 | Miraclia Telecomunicaciones S.L. | Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | link |
| BELGIUM | 25-11-2020 | 1,500 | Private Individual | Art. 6 GDPR, Art. 25 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 24-11-2020 | 5,000 | Dada Creation S.R.L. | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 24-11-2020 | 394,000 | City of Stockholm | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 23-11-2020 | 12,000 | Recambios Villalegre S.L. | Art. 6 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 23-11-2020 | 4,000 | Vodafone România SA | Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| ITALY | 23-11-2020 | 20,000 | Burgo Group S.p.A | Art. 5 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 19-11-2020 | 36,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 18-11-2020 | 2000 | Anmavas 61, S.L. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| FRANCE | 18-11-2020 | 800,000 | Carrefour Banque | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| FRANCE | 18-11-2020 | 2,250,000 | Carrefour France | Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 32 GDPR, Art. 33 GDPR | Non-compliance with general data processing principles | link |
| ITALY | 17-11-2020 | 30,000 | Provincial Health Authority of Cosenza | Art. 9 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 17-11-2020 | 2000 | Comune di Collegno | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 16-11-2020 | 1,600 | Homeowners Association | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 16-11-2020 | 42,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| UNITED KINGDOM | 15-11-2020 | 1.6 m | TicketMaster UK | Article 56 of the GDPR, Article 60 of the GDPR | Fincial details in chatbot compromised. | link |
| Germany | 11-11-2020 | 800,500 | Telecoms provider (1&1 Telecom GmbH) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 05-11-2020 | 67,000 | Telefonica Moviles Espana, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 03-11-2020 | 26,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| UNITED KINGDOM | 30-10-2020 | 18,226,109 | Marriott International, Inc | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 28-10-2020 | 32,085 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 28-10-2020 | 3,600 | Play Orenes, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| ITALY | 26-10-2020 | 18,000 | Università Campus Bio-medico di Roma (Polyclinic) | Art. 5 (2) a), f) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | link |
| HUNGARY | 23-10-2020 | 48,841 | Deichmann Cipőkereskedelmi Korlátolt Felelősségű Társaságnak | Art. 12 GDPR, Art. 15 GDPR, Art. 18 (1) c) GDPR, Art. 25 GDPR | Insufficient fulfilment of data subjects rights | link |
| CYPRUS | 22-10-2020 | 5,348 | Cyprus Police | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| LITHUANIA | 21-10-2020 | 13,500 | Vilnius City Municipality Administration | Art. 5 (1) d) GDPR, Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| ROMANIA | 20-10-2020 | 1800 | Globus Score SRL | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| CYPRUS | 19-10-2020 | 890 | Grant Ideas Ltd | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| CYPRUS | 19-10-2020 | 13,500 | Bank of Cyprus Public Company Ltd | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 15 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| UNITED KINGDOM | 16-10-2020 | 19,648,548 | British Airways | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 15-10-2020 | 2,600 | S.C. Marsorom S.R.L. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 09-10-2020 | 802.13 | Café Restaurante B.B.B | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 09-10-2020 | 1800 | Private Person | Art. 5 (1) c) GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 09-10-2020 | 44,000 | Centro de Investigación y Estudio para la Obesidad, SL | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 09-10-2020 | 4,400 | Caja Rural San José de Nules S. Cooperativa de Crédito | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 06-10-2020 | 53,475 | Lycamobile | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 06-10-2020 | 3,600 | Callesgarcia, S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 03-10-2020 | 2,600 | Avata Hispania, S.L. | Art. 5 GDPR, Art. 6 GDPR, Art. 28 (3) g) GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 01-10-2020 | 31,424,404 | H&M Hennes & Mauritz Online Shop A.B. & Co. KG | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 01-10-2020 | 2,600 | Megareduceri TV S.R.L. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ROMANIA | 01-10-2020 | 1800 | Asociația de proprietari Militari R | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ITALY | 30-09-2020 | 71,300 | Azienda Ospedaliera di Rilievo Nazionale ‘Antonio Cardarelli’ (Private Hospital) | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 30-09-2020 | 53,475 | Scanshare s.r.l. | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 30-09-2020 | 2,600 | Venu Sanz Chef, S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 25-09-2020 | 53,475 | Xfera Moviles S.A. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 25-09-2020 | 12,388 | Odin Flissenter AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 22-09-2020 | 53,475 | GLP Instalaciones 86, SL | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 22-09-2020 | 6,952 | Iweb Internet Learning, S.L. | Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 17-09-2020 | 53,475 | Vodafone España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 17-09-2020 | 2,600 | Grupo Carolizan | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 16-09-2020 | 8,900 | Property owners community | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 11-09-2020 | 1,350 | Political Party | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GREECE | 11-09-2020 | 6,400 | Private Person | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| POLAND | 08-09-2020 | 10,033 | Warsaw University of Life Sciences | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 08-09-2020 | 1800 | Sanatatea Press Group S.R.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 07-09-2020 | 2,600 | Barcelona Airport Security Guard Association (‘AVSAB’) | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| ITALY | 07-09-2020 | 1800 | Istituto Comprensivo Statale Crucoli Torretta | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BELGIUM | 07-09-2020 | 4,400 | Former mayor of a community | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 03-09-2020 | 247,262 | Bergen Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 03-09-2020 | 1800 | Comune di Casaloldo | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 01-09-2020 | 67,190 | Telefónica Móviles España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 01-09-2020 | 445 | Apartment building owners association | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | link |
| POLAND | 31-08-2020 | 20,336 | Surveyor General of Poland (‘GKK’) | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 28-08-2020 | 44,000 | Bankia S.A. | Art. 5 (1) b) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 28-08-2020 | 4,400 | Basketball Federation of Castilla and Leon | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 17-08-2020 | 4,400 | Party of the Socialists of Catalonia | Art. 5 (1) b) GDPR | Non-compliance with general data processing principles | link |
| ESTONIA | 17-08-2020 | 43 | Police Officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 10-08-2020 | 8,900 | Cavauto S.R.L. | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 10-08-2020 | 8,900 | Community of Baronissi | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 06-08-2020 | 2,600 | GROW BEATS SL | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| ITALY | 06-08-2020 | 2,600 | GTL S.R.L. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 06-08-2020 | 2,600 | Just Landed S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| FRANCE | 05-08-2020 | 223,969 | Spartoo | Art. 5 (1) GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| FINLAND | 05-08-2020 | 6,271 | Acc Consulting Varsinais-Suomi | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 05-08-2020 | 2,600 | Restaurant | Art. 5 (1) c) GDPR, Art. 12 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | link |
| AUSTRIA | 05-08-2020 | 89 | Bank | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 05-08-2020 | 1800 | School | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| DENMARK | 04-08-2020 | 18,007 | PrivatBo A.M.B.A. | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 04-08-2020 | 53,752 | Vodafone España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 04-08-2020 | 13,500 | Mapei S.p.A. | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 04-08-2020 | 4,400 | National Institute for Social Security – Department of the Province of Brescia | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| ITALY | 04-08-2020 | 890 | Supermarket | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GREECE | 03-08-2020 | 2,600 | Candidate for parliamentary elections | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 31-07-2020 | 40,314 | Vodafone España SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 31-07-2020 | 1,343 | Tour & People Max S.L. | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| ROMANIA | 30-07-2020 | 1800 | SC Viva Credit IFN SA | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| ROMANIA | 30-07-2020 | 1800 | Romanian Post National Company | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 30-07-2020 | 1800 | Community of Manduria | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 29-07-2020 | 2,600 | Community of San Giorgio Jonico | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 29-07-2020 | 3,600 | Region of Campania | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| DENMARK | 28-07-2020 | 132,410 | Arp Hansen Hotel Group A/S | Art. 5 (1) e) GDPR | Non-compliance with general data processing principles | link |
| BELGIUM | 28-07-2020 | 2,600 | Communal political association | Art. 5 GDPR, Art. 6 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 27-07-2020 | 4,479 | SC Cntar Tarom SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 23-07-2020 | 8,900 | El Periódico de Catalunya, S.L.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 23-07-2020 | 49,273 | Telefónica Móviles España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 23-07-2020 | 62,711 | Telefónica Móviles España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 23-07-2020 | 67,190 | Telefónica Móviles España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 23-07-2020 | 4,400 | Xfera Moviles S.A. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 23-07-2020 | 4,400 | El Real Sporting de Gijón S.A.D. | Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 23-07-2020 | 501 | Forbes Hungary | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 23-07-2020 | 1,522 | Employer | Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 20-07-2020 | 21,501 | Banco Bilbao Vizcaya Argentaria, SA | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 20-07-2020 | 36,000 | Iberia Lae SA Operadora Unipersonal | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 20-07-2020 | 1,350 | Comercial Vigobrandy, SL | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 20-07-2020 | 71,670 | Orange Espagne S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 20-07-2020 | 62,711 | Xfera Moviles S.A. | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| HUNGARY | 16-07-2020 | 25 | Google Ireland Ltd. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| POLAND | 15-07-2020 | 19,978 | Office for geodesy and cartography | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| BELGIUM | 14-07-2020 | 537,527 | Google Belgium SA | Art. 5 GDPR, Art. 6 GDPR, Art. 17 (1) a) GDPR, Art. 12 GDPR | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 14-07-2020 | 4,400 | Operator of CCTV of a residential building | Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 13-07-2020 | 180,000 | Merlini s.r.l. | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 28 GDPR, Art. 29 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 13-07-2020 | 14,961,172 | Wind Tre S.p.A. | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 24 GDPR, Art. 25 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 13-07-2020 | 716,702 | Iliad Italia S.p.A. | Art. 5 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| POLAND | 10-07-2020 | 3,045 | East Power Sp. z o.o. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| NORWAY | 10-07-2020 | 41,801 | Municipality of Rælingen | Art. 32 GDPR, Art. 35 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 10-07-2020 | 1,350 | Auto Desguaces Iglesias S.L. | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 10-07-2020 | 890 | Centro Internacional De Crecimiento Laboral Y Profesional S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 10-07-2020 | 10,750 | Vodafone España, SAU | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 10-07-2020 | 4,400 | Global Business Travel Spain SLU | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 10-07-2020 | 4,400 | School Fitness Holiday & Franchising S.L. | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 10-07-2020 | 49,273 | Xfera Moviles S.A. | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 09-07-2020 | 13,500 | Proleasing Motors SRL | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| THE NETHERLANDS | 06-07-2020 | 743,579 | Bureau Krediet Registration (‘BKR’) | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 02-07-2020 | 21,501 | Iberdrola Clientes | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 02-07-2020 | 3,600 | De Vere Spain S.L. | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| NORWAY | 02-07-2020 | 25,084 | Odin Flissenter AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 02-07-2020 | 3,225 | Saunier-Tec Mantenimientos de Calor y Frio, SL. | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| SPAIN | 02-07-2020 | 4,400 | Xfera Moviles S.A. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ITALY | 02-07-2020 | 13,500 | Mapei S.p.A. | Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| GERMANY | 30-06-2020 | 1,110,889 | Allgemeine Ortskrankenkasse (‘AOK’) (health insurance company) | Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| DENMARK | 30-06-2020 | 6,002 | Lejre Municipality | Art. 5 GDPR, Art. 6 GDPR, Art. 33 GDPR, Art. 34 GDPR | Non-compliance with general data processing principles | link |
| IRELAND | 30-06-2020 | 36,000 | Tusla Child and Family Agency | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| GREECE | 29-06-2020 | 4,400 | New York College S.A. | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| ISLE OF MAN | 25-06-2020 | 12,094 | Department of Home Affairs | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 23-06-2020 | 6,719 | Miraclia (telecommunications company) | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 30-06-2020 | 1800 | Unknown | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| NORWAY | 22-06-2020 | 100,338 | Østfold HF Hospital | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BELGIUM | 19-06-2020 | 8,900 | Unknown | Art. 5 GDPR, Art. 6 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| NORWAY | 19-06-2020 | 25,084 | Aquateknikk AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 19-06-2020 | 5,375 | National Police Brigade | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 18-06-2020 | 3,600 | Enel Energie | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 16-06-2020 | 1800 | Café Bar | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| SWEDEN | 16-06-2020 | 1,702 | Housing Association | Art. 5 GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | link |
| BELGIUM | 16-06-2020 | 890 | Unknown | Art. 17 GDPR, Art. 21 GDPR, Art. 31 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 15-06-2020 | 67,191 | Xfera Moviles S.A. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 12-06-2020 | 258,013 | Digi Távközlési Szolgáltató Kft. (‘Digi’) (electronic communication service provider) | Art. 5 (1) b), (e) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 11-06-2020 | 2,600 | Telekom Romania | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 09-06-2020 | 4,400 | Consulting de Seguridad e Investigacion Mira Dp Madrid S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 09-06-2020 | 483.77 | Chenming Ye (Bazar Real) | Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 09-06-2020 | 890 | Property Owner | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 09-06-2020 | 67,191 | Equifax Iberica, S.L. | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 09-06-2020 | 34,939 | Xfera Moviles S.A. | Art. 5 (1) f) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 09-06-2020 | 22,396 | Glovoapp23 | Art. 37 GDPR | Lack of appointment of data protection officer | link |
| SPAIN | 09-06-2020 | 36,000 | TELEFONICA MOVILES ESPAÑA, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 09-06-2020 | 2,687 | Salad Market S.L. (Catering Company) | Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 09-06-2020 | 1800 | Attorney | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 09-06-2020 | 1800 | Property Owner | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| BELGIUM | 08-06-2020 | 4,400 | Municipal employee | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 04-06-2020 | 3,583 | Iberdrola Clientes | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| POLAND | 03-06-2020 | 960 | Entrepreneur running a non-public nursery and pre-school | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| BELGIUM | 25-05-2020 | 890 | Non-profit organisation | Art. 6 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| FINLAND | 25-05-2020 | 64,503 | Taksi Helsinki | Art. 5 GDPR, Art. 6 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | link |
| FINLAND | 22-05-2020 | 89,000 | Posti Group Oyj | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| FINLAND | 22-05-2020 | 14,334 | Kymen Vesi Oy | Art. 35 GDPR | Non-compliance with general data processing principles | link |
| FINLAND | 22-05-2020 | 11,198 | Unknown Company | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| IRELAND | 17-05-2020 | 67,190 | Tusla Child and Family Agency | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| DENMARK | 15-05-2020 | 6,002 | JobTeam A/S DKK | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 14-05-2020 | 44,000 | Social Media Provider | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SWEDEN | 12-05-2020 | 10,033 | Health and Medical Board of the Region of Örebro County | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 05-05-2020 | 4,450 | Banca Comercială Română SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| NORWAY | 03-05-2020 | 120,047 | Telenor Norge AS | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| THE NETHERLANDS | 30-04-2020 | 649,511 | Unknown Organisation | Art. 5 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| ESTONIA | 30-04-2020 | 445 | Housing Association | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SWEDEN | 29-04-2020 | 16,752 | National Government Service Centre (NGSC) | Art. 33 GDPR, Art. 34 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| BELGIUM | 28-04-2020 | 44,500 | Proximus SA | Art. 31 GDPR, Art. 58 GDPR, Art. 37 GDPR | Lack of appointment of data protection officer | link |
| ROMANIA | 23-04-2020 | 2,600 | Estee Lauder Romania | Art. 6 GDPR, Art. 7 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 23-04-2020 | 2,600 | Telekom Romania Communications SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 14-04-2020 | 1800 | Political Party | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 26-03-2020 | 2,589 | Bank | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 25-03-2020 | 1800 | SOS Infertility Association | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ROMANIA | 25-03-2020 | 2,600 | Enel Energie | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 25-03-2020 | 3,717 | Vodafone Romania | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 25-03-2020 | 2,600 | Dante International | Art. 6 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 25-03-2020 | 4,400 | Xfera Moviles S.A. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| GREECE | 20-03-2020 | 6,400 | Speech and Special Education Centre – Mihou Dimitra | Art. 15 GDPR, Art. 58 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 19-03-2020 | 5,375 | Oliveros Ustrell, S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 19-03-2020 | 5,000 | Unknown Company | Art. 6 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 18-03-2020 | 26,876 | Telefónica | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 16-03-2020 | 4,400 | Centro De Estudio Dirigidos Delta, S.L. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 16-03-2020 | 3,600 | Private Person | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 16-03-2020 | 5,375 | Amalfi Servicios de Restauracion S.L. | Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| CROATIA | 13-03-2020 | unknown | Bank (name not available at the moment) | Art. 15 (1), (3) GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 12-03-2020 | 1800 | Homeowners Association | Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| SWEDEN | 11-03-2020 | 6,271,150 | Google LLC | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| DENMARK | 10-03-2020 | 6,271 | Hørsholm Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| DENMARK | 10-03-2020 | 12,542 | Gladsaxe Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ICELAND | 10-03-2020 | 18,455 | National Center of Addiction Medicine (‘SAA’) | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ICELAND | 10-03-2020 | 8,063 | Breiðholt Upper Secondary School | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 09-03-2020 | 13,500 | Gesthotel Activos Balagares | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| POLAND | 09-03-2020 | 3,942 | Vis Consulting Sp. z o.o. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| HUNGARY | 09-03-2020 | 779.41 | Creditor | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 06-03-2020 | 3,600 | Liceo Artistico Statale di Napoli | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 06-03-2020 | 3,600 | Liceo Scientifico Nobel di Torre del Greco | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 06-03-2020 | 3,600 | Private person | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 06-03-2020 | 2,867 | Retailer | Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| ITALY | 05-03-2020 | 2,600 | San Giorgio Jonico | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | link |
| POLAND | 04-03-2020 | 3,800 | School in Gdansk (Danzig) (fine imposed against town of Gdansk) | Art. 5 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 04-03-2020 | 53,753 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 04-03-2020 | 259.8 | Representative of a local government | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | link |
| THE NETHERLANDS | 03-03-2020 | 445,500 | Royal Dutch Tennis Association (‘KNLTB’) | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 03-03-2020 | 1,613 | Solo Embrague | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 03-03-2020 | 37,627 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 03-03-2020 | 36,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 03-03-2020 | 21,501 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 28-02-2020 | 43,002 | Vodafone ONO, S.A.U. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 28-02-2020 | 3,225 | AEMA Hispánica | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| NORWAY | 28-02-2020 | 32,968 | Coop Finnmark SA | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 27-02-2020 | 107,505 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 27-02-2020 | 65,937 | Rælingen Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 25-02-2020 | 43,002 | HM Hospitales | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 25-02-2020 | 4,200 | Casa Gracio Operation | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| GREECE | 21-02-2020 | 4,479 | Public Power Corporation S.A. | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| BULGARIA | 20-02-2020 | 2,293 | T.K. EOOD | Art. 25 (1) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 20-02-2020 | 2,293 | L.E. EOOD | Art. 25 (1) GDPR, Art. 32 GDPR, Art. 6 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 18-02-2020 | 1,350 | Mymoviles Europa 2000, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 14-02-2020 | 2,240 | Grupo Valsor Y Losan, S.L. | Art. 5 (1) f) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 14-02-2020 | 2,600 | Colegio Arenales Carabanchel (School) | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 14-02-2020 | 71,670 | Iberdrola Clientes | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 14-02-2020 | 37,627 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 14-02-2020 | 26,876 | Xfera Moviles S.A. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 13-02-2020 | 3,600 | Comune di Urago | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 11-02-2020 | 2,600 | Vodafone Romania | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 06-02-2020 | 1,800 | RTI – Reti Televisive Italiane s.p.a. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 04-02-2020 | 1,350 | Cafetería Nagasaki | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 03-02-2020 | 53,753 | Xfera Moviles S.A. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 03-02-2020 | 67,191 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 03-02-2020 | 53,753 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 03-02-2020 | 44,794 | Vodafone España, S.A.U. | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 03-02-2020 | 1,800 | Iberia Lineas Aereas de Espana, S.A. Operadora Unipersonal | Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 03-02-2020 | 67,191 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 03-02-2020 | 5,976 | Banco Bilbao Vizcaya Argentaria S.L. | Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 03-02-2020 | 4,400 | Queseria Artesenal Ameco S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 03-02-2020 | 716.7 | Automoción | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 30-01-2020 | 3,600 | Comune di Colledara | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 24-01-2020 | 1,299 | Accounting firm | Art. 24 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 23-01-2020 | 26,000 | Azienda Ospedaliero Universitaria Integrata di Verona (Hospital) | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 23-01-2020 | 26,000 | Sapienza Università di Roma | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 15-01-2020 | 24,905,425 | TIM (telecommunications operator) | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 15-01-2020 | 8,900 | Community of Francavilla Fontana | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 14-01-2020 | 3,225 | Zhang Bordeta 2006, S.L. (Store and Restaurant) | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| CYPRUS | 13-01-2020 | 8,063 | Social Insurance Services of the Ministry of Labor, Welfare and Social Insurance | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| CYPRUS | 13-01-2020 | 890 | eShop for Sports (M.L. PRO.FIT SOLUTIONS LTD) | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GREECE | 13-01-2020 | 13,500 | Allseas Marine S.A. | Art. 5 (1) a), (2) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 09-01-2020 | 2,600 | Vodafone España, S.A.U. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 07-01-2020 | 39,419 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 07-01-2020 | 67,191 | EDP España S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 07-01-2020 | 67,191 | EDP Comercializadora, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 07-01-2020 | 8,900 | Asociación de Médicos Demócratas | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 06-01-2020 | 4,400 | Utility Company | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| GREECE | 19-12-2019 | 134,382 | Aegean Marine Petroleum Network Inc. | Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 18-12-2019 | 1800 | Telekom Romania Mobile Communications SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| UNITED KINGDOM | 17-12-2019 | 286,681 | Doorstep Dispensaree Ltd. (Pharmacy) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BELGIUM | 17-12-2019 | 1800 | Nursing Care Organisation | Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 17-12-2019 | 13,500 | Website providing legal information | Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SWEDEN | 16-12-2019 | 31,356 | Nusvar AB | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 16-12-2019 | 1800 | Globus Score SRL | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ROMANIA | 16-12-2019 | 5,375 | SC Enel Energie S.A. (Electricity Distributor) | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 13-12-2019 | 4,400 | Entirely Shipping & Trading S.R.L. | Art. 5 (1) GDPR, Art. 6 GDPR, Art. 7 GDPR | Non-compliance with general data processing principles | link |
| ROMANIA | 13-12-2019 | 4,400 | Entirely Shipping & Trading S.R.L. | Art. 5 (1) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | link |
| HUNGARY | 11-12-2019 | 1,281 | Unknown Company | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| ITALY | 11-12-2019 | 7,614,968 | Eni Gas e Luce | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 11-12-2019 | 2,600,000 | Eni Gas e Luce | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 10-12-2019 | 1,433 | Megastar SL | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 10-12-2019 | 4,400 | Shop Macoyn, S.L. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 10-12-2019 | 12,542 | Hora Credit IFN SA | Art. 5 GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| GERMANY | 09-12-2019 | 8,555,640 | Telecoms provider (1&1 Telecom GmbH) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| GERMANY | 09-12-2019 | 8,900 | Rapidata GmbH | Art. 37 GDPR | Lack of appointment of data protection officer | link |
| ROMANIA | 04-12-2019 | 18,000 | S CNTAR TAROM SA (Airline) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| GERMANY | 03-12-2019 | 94,067 | Hospital | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 03-12-2019 | 1,350 | Cerrajeria Verin S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 03-12-2019 | 4,479 | Linea Directa Aseguradora | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 02-12-2019 | 1800 | Nicola Medical Team 17 SRL | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ROMANIA | 29-11-2019 | 2,240 | Royal President S.R.L. | Art. 15 GDPR, Art. 6 GDPR, Art. 32 GDPR | Insufficient fulfilment of data subjects rights | link |
| ROMANIA | 29-11-2019 | 440 | Homeowners Association | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BELGIUM | 28-11-2019 | 4,400 | Mayor | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| BELGIUM | 28-11-2019 | 4,400 | Municipal alderman | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 28-11-2019 | 71,670 | ING Bank N.V. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 28-11-2019 | 67,191 | Curenergía Comercializador de último recurso | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 26-11-2019 | 2,600 | Modern Barber | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ROMANIA | 25-11-2019 | 9,700 | Courier Services Company | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 22-11-2019 | 1800 | BNP Paribas Personal Finance S.A. | Art. 12 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 21-11-2019 | 53,753 | Viaqua Xestión Integral Augas de Galicia | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| FRANCE | 21-11-2019 | 445,500 | Futura Internationale | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 19-11-2019 | 53,753 | Corporación radiotelevisión espanola | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 19-11-2019 | 53,753 | Xfera Moviles S.A. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 19-11-2019 | 5,375 | Sports Bar | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 14-11-2019 | 26,000 | Telefónica SA | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 13-11-2019 | 2,600 | General Confederation of Labour (‘CGT’) | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 07-11-2019 | 806.29 | TODOTECNICOS24H S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 06-11-2019 | 806.29 | Cerrajero Online | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 06-11-2019 | 53,753 | Vodafone España, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| LATVIA | 11-2019 | 135,000 | Unknown | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 31-10-2019 | 5,375 | Jocker Premium Invex | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| THE NETHERLANDS | 31-10-2019 | 806290 | UWV (Dutch employee insurance service provider) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| THE NETHERLANDS | 31-10-2019 | 44,000 | Menzis (Health Insurance Company) | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 30-10-2019 | 12,990,239 | Deutsche Wohnen SE | Art. 5 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 30-10-2019 | unknown | Deutsche Wohnen SE | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| BULGARIA | 28-10-2019 | 445 | Employer | Art. 12 (3) GDPR, Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 25-10-2019 | 32,252 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| CYPRUS | 25-10-2019 | 62,712 | LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| CYPRUS | 25-10-2019 | 8,959 | LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| CYPRUS | 25-10-2019 | 1,800 | LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 24-10-2019 | 6,630 | Military Hospital | Art. 32 GDPR, Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| GERMANY | 24-10-2019 | 89,000 | Food company | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| AUSTRIA | 23-10-2019 | 16,125,814 | Austrian Post | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 23-10-2019 | 53,753 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| POLAND | 18-10-2019 | 8,403 | Major of Aleksandrów Kujawski | Art. 28 GDPR | Insufficient data processing agreement | link |
| GREECE | 18-10-2019 | 18,000 | Wind Hellas Telecommunications | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| ROMANIA | 17-10-2019 | 2,240 | UTTIS INDUSTRIES SRL | Art. 12 GDPR, Art. 13 GDPR, Art. 5 (1) c) GDPR, Art. 6 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 16-10-2019 | 53,753 | Xfera Moviles S.A. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 16-10-2019 | 7,167 | Iberdrola Clientes | Art. 31 GDPR | Insufficient cooperation with supervisory authority | link |
| POLAND | 16-10-2019 | 42,106 | ClickQuickNow | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| HUNGARY | 15-10-2019 | 2,562 | Unknown Company | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| ROMANIA | 09-10-2019 | 135,000 | Raiffeisen Bank SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 09-10-2019 | 18,000 | Vreau Credit SRL | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 08-10-2019 | 4,550 | The Ministry of Interior Affairs | Art. 5 (1) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| GREECE | 07-10-2019 | 180,000 | Telecommunication Service Provider | Art. 5 (1) c) GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| GREECE | 07-10-2019 | 180,000 | Telecommunication Service Provider | Art. 21 (3) GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| BULGARIA | 07-10-2019 | 445 | B.D. | Art. 31 GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 01-10-2019 | 26,000 | Vueling Airlines | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 10-2019 | 13,500 | Town of Kerepes | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 26-09-2019 | 8,063 | Inteligo Media SA | Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 19-09-2019 | 175,061 | Delivery Hero | Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 17-09-2019 | 89,000 | Merchant | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| POLAND | 10-09-2019 | 577,842 | Morele.net | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 03-09-2019 | 25,174 | National Revenue Agency | Art. 6 (1) GDPR, Art. 58 (2) e) GDPR, Art. 83 (5) a) GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 03-09-2019 | 900 | Telecommunication service provide | Art. 6 (1) GDPR, Art. 25 (1) GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 03-09-2019 | 4,500 | Telecommunication service provide | Art. 6 (1) GDPR, Art. 25 (1) GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 03-09-2019 | 10,536 | Commercial representative of telecommunication service provider | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 03-09-2019 | 900 | Private enforcement agent | Art. 12 (4) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| BULGARIA | 28-08-2019 | 2,329,284 | National Revenue Agency | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 28-08-2019 | 445,000 | DSK Bank | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| LATVIA | 26-08-2019 | 6,271 | Online Services | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| SWEDEN | 20-08-2019 | 16,690 | School in Skellefteå | Art. 5 (1) c) GDPR, Art. 9 GDPR, Art. 35 GDPR, Art. 36 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 16-08-2019 | 53,753 | AVON COSMETICS | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 08-08-2019 | 1,536 | Government Office Managing the Real Estate Register | Art. 5 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 05-08-2019 | 180 | Private person (YouTube-Channel) | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 02-08-2019 | 3,843 | Public area maintenance company | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | link |
| AUSTRIA | 08-2019 | 44,000 | Company in the medical sector | Art. 13 GDPR, Art. 37 GDPR | Insufficient fulfilment of information obligations | link |
| GREECE | 30-07-2019 | 134,382 | PWC Business Solutions | Art. 5 (1) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 13 (1) c) GDPR, Art. 14 (1) c) GDPR | Insufficient legal basis for data processing | link |
| FRANCE | 25-07-2019 | 161,258 | ACTIVE ASSURANCES (car insurer) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 17-07-2019 | 7,682 | Budapest Environs Regional Court | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 05-07-2019 | 2,600 | LEGAL COMPANY & TAX HUB SRL | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 02-07-2019 | 13,438 | WORLD TRADE CENTER BUCHAREST SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| AUSTRIA | 07-2019 | 9,100 | Private person (soccer coach) | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 27-06-2019 | 116,464 | UNICREDIT BANK SA | Art. 25 (1) GDPR, Art. 5 (1) c) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 26-06-2019 | 2,553 | Unknown | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 26-06-2019 | 2,553 | Financial Enterprise | Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 25-06-2019 | 13,500 | Unknown | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| THE NETHERLANDS | 18-06-2019 | 412,104 | Haga Hospital | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| FRANCE | 13-06-2019 | 18,000 | Employer UNIONTRAD COMPANY | Art. 5 (1) c) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 11-06-2019 | 223,970 | Professional Football League (LaLiga) | Art. 5 (1) a), Art. 7 (3) GDPR | Insufficient fulfilment of information obligations | link |
| DENMARK | 03-06-2019 | 179,937 | IDdesign A / S | Art. 5 (1) e) GDPR, Art. 5 (2) GDPR | Non-compliance with general data processing principles | link |
| HUNGARY | 03-06-2019 | 2,553 | Claim management company | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 31-05-2019 | 1,800 | Local bank | Art. 12 (3), (4), (5) GDPR, Art. 15 GDPR, Art. 18 GDPR | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 28-05-2019 | 1,800 | Mayor | Art. 5 (1) b) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| FRANCE | 28-05-2019 | 360,000 | SERGIC (Real Estate) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 23-05-2019 | 82,552 | Organizer of SZIGET festival and VOLT festival | Art. 6 GDPR, Art. 5 (1) b) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 21-05-2019 | 256.22 | Directorate of Social and Child Welfare Institutions of the Ferencvaros District of Budapest | Art. 33 GDPR | Insufficient fulfilment of data breach obligations | link |
| LITHUANIA | 16-05-2019 | 55,097 | Payment service provider UAB MisterTango | Art. 5 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| GERMANY | 09-05-2019 | 1,300 | Police Officer | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| CZECH REPUBLIC | 04-05-2019 | 173.8 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| NORWAY | 29-04-2019 | 107,505 | Oslo Municipal Education Department | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| POLAND | 25-04-2019 | 11,602 | Sports association | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 17-04-2019 | 44,000 | Italian political party Movimento 5 Stelle | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 17-04-2019 | 8,421 | Unknown | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 12-04-2019 | 71,670 | Company in the financial sector | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 08-04-2019 | 440 | Medical centers | Art. 5 (1) a) GDPR, Art. 9 (1) GDPR, Art. 9 (2) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 05-04-2019 | 30,796 | Hungarian political party | Art. 33 (1) GDPR, Art. 33 (5) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | link |
| HUNGARY | 05-04-2019 | 1,702 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| POLAND | 26-03-2019 | 197,093 | Private company working with data from publicly available sources | Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| BULGARIA | 26-03-2019 | 4,400 | A.P. EOOD | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| PORTUGAL | 25-03-2019 | 1,800 | Unknown | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| CZECH REPUBLIC | 21-03-2019 | 8,900 | Unknown | Art. 5 (1) GDPR | Non-compliance with general data processing principles | link |
| PORTUGAL | 19-03-2019 | 1,800 | Unknown | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| HUNGARY | 04-03-2019 | 2,867 | Unnamed financial institution | Art. 5 (1) b) GDPR, Art. 5 (1) c) GDPR, Art. 13 (3) GDPR, Art. 17 (1) GDPR, Art. 6 (4) GDRP | Insufficient fulfilment of data subjects rights | link |
| GERMANY | 03-2019 | 44,000 | N26 | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 03-2019 | 152,299 | Bergen Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| CZECH REPUBLIC | 28-02-2019 | 500 | Unknown | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 28-02-2019 | 2,867 | Mayor’s Office of the city of Kecdkemét | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 26-02-2019 | 24,278 | Telecommunication service provider | Art. 6 GDPR, Art. 5 (1) a) GDPR | Insufficient legal basis for data processing | link |
| CZECH REPUBLIC | 26-02-2019 | 695.2 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| BULGARIA | 22-02-2019 | 440 | Employer | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| HUNGARY | 20-02-2019 | 13,500 | Debt collector | Art. 5 (1) a) GDPR, Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| MALTA | 18-02-2019 | 4,400 | Lands Authority | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 08-02-2019 | 1,398 | Bank | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 05-02-2019 | 2,240 | Private person | Art. 6 GDPR, Art. 5 GDPR | Insufficient legal basis for data processing | link |
| PORTUGAL | 05-02-2019 | 18,000 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| CZECH REPUBLIC | 04-02-2019 | 1,044 | Car renting company | Art. 5 (1) a) GDPR | Insufficient fulfilment of information obligations | link |
| CZECH REPUBLIC | 04-02-2019 | 1,044 | Credit brokerage | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| FRANCE | 21-01-2019 | 44,000,000 | Google Inc. | Art. 13 GDPR, Art. 14 GDPR, Art. 6 GDPR, Art. 5 GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 17-01-2019 | 440 | Bank | Art. 6 GDPR, Art. 5 (1) a) GDPR | Insufficient legal basis for data processing | link |
| CZECH REPUBLIC | 10-01-2019 | 347.6 | Employer | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| CYPRUS | 2019 | 4,400 | State Hospital | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| CYPRUS | 2019 | 8,900 | Newspaper | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| DENMARK | 2019 | 143,341 | Taxa 4×35 | Art. 5(1) e) GDPR | Non-compliance with general data processing principles | link |
| CYPRUS | 2019 | 12,542 | Doctor | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 2019 | Unknown | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link | |
| SPAIN | 2019 | 18,500 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2019 | 32,252 | VODAFONE ONO, S.A.U. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2019 | 43,002 | VODAFONE ONO, S.A.U. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2019 | 43,002 | TELEFONICA MOVILES ESPAÑA, S.A.U. | Art. 5 (1) a) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2019 | 26,000 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2019 | 36,000 | Vodafone España, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2019 | 18,000 | Private Person | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2019 | 8,063 | Private Person | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2019 | 3,225 | AMADOR RECREATIVOS, S.L | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 2019 | 716.7 | Police Officer | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 2019 | 263,388 | Unknown | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 2019 | 46,000 | Facebook Germany GmbH | Art. 37 GDPR | Lack of appointment of data protection officer | link |
| GERMANY | 2019 | 18,000 | Hamburger Verkehrsverbund GmbH (HVV GmbH) | Art. 33 GDPR, Art. 34 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| GERMANY | 2019 | Unknown | Hamburger Volksbank eG | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| GERMANY | 2019 | 1,800 | Restaurant | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 2019 | 45100 | Unknown Company | Art. 15 GDPR, Art. 28 GDPR | Insufficient fulfilment of data subjects rights | link |
| AUSTRIA | 20-12-2018 | 19,800 | Private person | Art. 5 (1) a) GDPR, Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 18-12-2018 | 2,888 | Unknown | Art. 12 (4) GDPR, Art. 15 GDPR, Art. 18 (1) c) GDPR, Art. 13 GDPR | Insufficient fulfilment of data subjects rights | link |
| GERMANY | 17-12-2018 | 4,500 | Kolibri Image Regina und Dirk Maass GbR | Art. 28 (3) GDPR | Insufficient data processing agreement | link |
| AUSTRIA | 09-12-2018 | 4,332 | Betting place | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| BULGARIA | 04-12-2018 | 451 | Bank | Art. 5 (1) b) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 21-11-2018 | 18,500 | Knuddels.de | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| CZECH REPUBLIC | 25-10-2018 | 350 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| AUSTRIA | 27-09-2018 | 270 | Private car owner | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| PORTUGAL | 17-07-2018 | 36,100 | Public Hospital | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| AUSTRIA | 2018 | 1,625 | Kebab restaurant | Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 2018 | 18,500 | Unknown | Art. 83 (4) a) GDPR, Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | link |
| GERMANY | 2018 | 451 | Unknown | Unknown | Unknown | link |
| CZECH REPUBLIC | Unknown | 2,834 | UniCredit Bank Czech Republic and Slovakia, a.s. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GERMANY | Unknown | 106 | Unknown | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | Unknown | 4,500 | Vodafone España, S.A.U. | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | Unknown | 54,000 | Debt collecting agancy (GESTIÓN DE COBROS, YO COBRO SL) | Art. 5 (1) f) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | Unknown | 24,000 | Vodafone España, S.A.U. | Art. 5 (1) d) GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | Unknown | 54,000 | ENDESA (energy supplyer) | Art. 5 (1) f) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | Unknown | 8,666 | Restaurant (SANTI 3000, S.L.) | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SLOVAKIA | Unknown | Unknown | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SLOVAKIA | Unknown | Unknown | Unknown | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SLOVAKIA | Unknown | Unknown | Unknown | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SLOVAKIA | Unknown | Unknown | Unknown | Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | link |
| SLOVAKIA | Unknown | 36,000 | Slovak Telekom | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | Unknown | 10,830 | Madrileña Red de Gas | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SLOVAKIA | Unknown | 45,000 | Social Insurance Agency | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| CZECH REPUBLIC | Unknown | 538 | Alza.cz a.s. | Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | link |
| CZECH REPUBLIC | Unknown | 884 | Individual entrepreneur – no further details published | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | Unknown | 9,025 | Ikea Ibérica | Art. 6 GDPR | Insufficient legal basis for data processing | link |