Free Cookie Audit

The GDPR Fine Tracker

 | 

Here is brief list containing all of the EU/GDPR fines imposed on companies since the implementation of the law. This list does not contain any fines charged outside of the EU or the UK.

CountryDateFine £Controller/ProcessorQuoted Art.TypeSource
SPAIN2020-12-22 00:00:005300Iberdrola Clientes, SAUArt. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDDInsufficient fulfilment of data subjects rightslink
ROMANIA2020-12-22 00:00:001794S.C. C&V Water Control S.A.Art. 58 (1) a), e) GDPR, Art. 58 (2) i) GDPRInsufficient cooperation with supervisory authoritylink
SPAIN2020-12-21 00:00:0032000Banco Bilbao Vizcaya Argentaria, S.A.Art. 5 (1) d) GDPRNon-compliance with general data processing principleslink
ROMANIA2020-12-17 00:00:0090700Banca Transilvania SAArt. 5 (1) f) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
FRANCE2020-12-17 00:00:002722DoctorArt. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information securitylink
FRANCE2020-12-17 00:00:005444DoctorArt. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information securitylink
HUNGARY2020-12-16 00:00:001940UnknownArt. 5 (1) b), c) GDPR, Art. 13 (1) GDPRInsufficient fulfilment of information obligationslink
HUNGARY2020-12-16 00:00:0050269Robinson Tours Ltd. (Robinson Tours Idegenforgalmi és Szolgáltató Kft.)Art. 25 (1), (2) GDPR, Art. 32 (1) b) GDPR, Art. 34 (1) GDPRInsufficient technical and organisational measures to ensure information securitylink
HUNGARY2020-12-16 00:00:001256Next Time Media Agency Ltd. (Next Time Media Ügynökség Kft.)Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA2020-12-17 00:00:0092000Banca Transilvania SAArt. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
IRELAND2020-12-15 00:00:00406000Twitter International CompanyArt. 33 (1) GDPR, Art. 33 (5) GDPRInsufficient fulfilment of data breach notification obligationslink
POLAND2020-12-14 00:00:001715000Virgin Mobile PolskaArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1) b) GDPR, Art. 32 (1) d) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-12-11 00:00:004500000Banco Bilbao Vizcaya Argentaria, S.A.Art. 6 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligationslink
SWEDEN2020-12-11 00:00:0048000Umeå UniversityArt. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-12-10 00:00:003600Borjamotor, S.A.Art. 7 GDPRInsufficient fulfilment of information obligationslink
SPAIN2020-12-09 00:00:0036000Xfera Moviles S.A.Art. 6 (1) GDPRInsufficient legal basis for data processinglink
SPAIN2020-12-09 00:00:009000UnknownArt. 5 (1) f) GDPRNon-compliance with general data processing principleslink
SWEDEN2020-12-03 00:00:001263000Aleris Sjukvård ABArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
SWEDEN2020-12-03 00:00:00999000Aleris Sjukvård ABArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-12-03 00:00:002400Dr Marín Cirugia Plástica, S.L.P.Art. 13 GDPRInsufficient fulfilment of information obligationslink
SWEDEN2020-12-03 00:00:00243800Östergötland RegionArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
SWEDEN2020-12-03 00:00:00243800Västerbotten RegionArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
SWEDEN2020-12-03 00:00:00341300Sahlgrenska University HospitalArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
SWEDEN2020-12-03 00:00:00390100Karolinska University Hospital of SolnaArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
SWEDEN2020-12-03 00:00:002900000Capio St. Göran ABArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
NORWAY2020-12-03 00:00:0018840Municipality of Indre ØstfoldArt. 6 GDPR, Art. 32 (1) b) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-12-02 00:00:006000Servicio de Alojamientos Responsables, S.L.Art. 6 (1) GDPRInsufficient legal basis for data processinglink
SPAIN2020-12-02 00:00:003000Comercio Online Levante, S.L.Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-12-02 00:00:005000Asociación de Víctimas por Arbitrariedades Judiciales, (JAVA)Art. 6 (1) GDPRInsufficient legal basis for data processinglink
SPAIN2020-12-02 00:00:0010000Losada Advocats S.L.Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-11-27 00:00:001200Private IndividualArt. 5 (1) a) GDPRNon-compliance with general data processing principlesLink
SWEDEN2020-11-25 00:00:0019500Gnosjö MunicipalityArt. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 35 GDPR, Art. 36 GDPRInsufficient legal basis for data processinglink
SPAIN2020-11-25 00:00:0040000Miraclia Telecomunicaciones S.L.Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPRInsufficient legal basis for data processinglink
BELGIUM2020-11-25 00:00:001500Private IndividualArt. 6 GDPR, Art. 25 GDPRInsufficient legal basis for data processinglink
ROMANIA2020-11-24 00:00:005000Dada Creation S.R.L.Art. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information securitylink
SWEDEN2020-11-24 00:00:00394000City of StockholmArt. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-11-23 00:00:0012000Recambios Villalegre S.L.Art. 6 GDPR, Art. 13 GDPRInsufficient legal basis for data processinglink
ROMANIA2020-11-23 00:00:004000Vodafone România SAArt. 12 GDPR, Art. 15 GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rightslink
ITALY2020-11-23 00:00:0020000Burgo Group S.p.AArt. 5 GDPR, Art. 13 GDPRNon-compliance with general data processing principleslink
SPAIN2020-11-19 00:00:0036000Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-11-18 00:00:002000Anmavas 61, S.L.Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
FRANCE2020-11-18 00:00:00800000Carrefour BanqueArt. 5 GDPRNon-compliance with general data processing principleslink
FRANCE2020-11-18 00:00:002250000Carrefour FranceArt. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 32 GDPR, Art. 33 GDPRNon-compliance with general data processing principleslink
ITALY2020-11-17 00:00:0030000Provincial Health Authority of CosenzaArt. 9 GDPRInsufficient legal basis for data processinglink
ITALY2020-11-17 00:00:002000Comune di CollegnoArt. 12 GDPR, Art. 13 GDPR, Art. 14 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN2020-11-16 00:00:001600Homeowners AssociationArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
SPAIN2020-11-16 00:00:0042000Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
UNITED KINGDOM2020-11-15 00:00:001.6 mTicketMaster UKArticle 56 of the GDPR, Article 60 of the GDPRFincial details in chatbot compromised.link
Germany2020-11-11 00:00:00800500Telecoms provider (1&1 Telecom GmbH)Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-11-05 00:00:0067000Telefonica Moviles Espana, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-11-03 00:00:0026000Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
UNITED KINGDOM2020-10-30 00:00:0018226109Marriott International, IncArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-10-28 00:00:0032085Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-10-28 00:00:003600Play Orenes, S.L.Art. 5 (1) c) GDPRNon-compliance with general data processing principleslink
ITALY2020-10-26 00:00:0018000Università Campus Bio-medico di Roma (Polyclinic)Art. 5 (2) a), f) GDPR, Art. 9 GDPRNon-compliance with general data processing principleslink
HUNGARY2020-10-23 00:00:0048841Deichmann Cipőkereskedelmi Korlátolt Felelősségű TársaságnakArt. 12 GDPR, Art. 15 GDPR, Art. 18 (1) c) GDPR, Art. 25 GDPRInsufficient fulfilment of data subjects rightslink
CYPRUS2020-10-22 00:00:005348Cyprus PoliceArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
LITHUANIA2020-10-21 00:00:0013500Vilnius City Municipality AdministrationArt. 5 (1) d) GDPR, Art. 5 (1) f) GDPRNon-compliance with general data processing principleslink link
ROMANIA2020-10-20 00:00:001800Globus Score SRLArt. 58 GDPRInsufficient cooperation with supervisory authoritylink
CYPRUS2020-10-19 00:00:00890Grant Ideas LtdArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
CYPRUS2020-10-19 00:00:0013500Bank of Cyprus Public Company LtdArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 15 GDPR, Art. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information securitylink
UNITED KINGDOM2020-10-16 00:00:0019648548British AirwaysArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA2020-10-15 00:00:002600S.C. Marsorom S.R.L.Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-10-09 00:00:00802.13Café Restaurante B.B.BArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
SPAIN2020-10-09 00:00:001800Private PersonArt. 5 (1) c) GDPR, Art. 6 GDPRNon-compliance with general data processing principleslink
SPAIN2020-10-09 00:00:0044000Centro de Investigación y Estudio para la Obesidad, SLArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-10-09 00:00:004400Caja Rural San José de Nules S. Cooperativa de CréditoArt. 5 (1) f) GDPRNon-compliance with general data processing principleslink
SPAIN2020-10-06 00:00:0053475LycamobileArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-10-06 00:00:003600Callesgarcia, S.L.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-10-03 00:00:002600Avata Hispania, S.L.Art. 5 GDPR, Art. 6 GDPR, Art. 28 (3) g) GDPRInsufficient legal basis for data processinglink
GERMANY2020-10-01 00:00:0031424404H&M Hennes & Mauritz Online Shop A.B. & Co. KGArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA2020-10-01 00:00:002600Megareduceri TV S.R.L.Art. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
ROMANIA2020-10-01 00:00:001800Asociația de proprietari Militari RArt. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
ITALY2020-09-30 00:00:0071300Azienda Ospedaliera di Rilievo Nazionale ‘Antonio Cardarelli’ (Private Hospital)Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY2020-09-30 00:00:0053475Scanshare s.r.l.Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-09-30 00:00:002600Venu Sanz Chef, S.L.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-09-25 00:00:0053475Xfera Moviles S.A.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
NORWAY2020-09-25 00:00:0012388Odin Flissenter ASArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-09-22 00:00:0053475GLP Instalaciones 86, SLArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-09-22 00:00:006952Iweb Internet Learning, S.L.Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligationslink
SPAIN2020-09-17 00:00:0053475Vodafone España, SAUArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-09-17 00:00:002600Grupo CarolizanArt. 5 GDPRNon-compliance with general data processing principleslink
SPAIN2020-09-16 00:00:008900Property owners communityArt. 5 GDPRNon-compliance with general data processing principleslink
SPAIN2020-09-11 00:00:001350Political PartyArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
GREECE2020-09-11 00:00:006400Private PersonArt. 5 GDPRNon-compliance with general data processing principleslink
POLAND2020-09-08 00:00:0010033Warsaw University of Life SciencesArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA2020-09-08 00:00:001800Sanatatea Press Group S.R.L.Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-09-07 00:00:002600Barcelona Airport Security Guard Association (‘AVSAB’)Art. 5 (1) f) GDPRNon-compliance with general data processing principleslink
ITALY2020-09-07 00:00:001800Istituto Comprensivo Statale Crucoli TorrettaArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BELGIUM2020-09-07 00:00:004400Former mayor of a communityArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
NORWAY2020-09-03 00:00:00247262Bergen MunicipalityArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY2020-09-03 00:00:001800Comune di CasaloldoArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-09-01 00:00:0067190Telefónica Móviles España, SAUArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA2020-09-01 00:00:00445Apartment building owners associationArt. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 32 GDPRInsufficient legal basis for data processinglink
POLAND2020-08-31 00:00:0020336Surveyor General of Poland (‘GKK’)Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-08-28 00:00:0044000Bankia S.A.Art. 5 (1) b) GDPRNon-compliance with general data processing principleslink
SPAIN2020-08-28 00:00:004400Basketball Federation of Castilla and LeonArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-08-17 00:00:004400Party of the Socialists of CataloniaArt. 5 (1) b) GDPRNon-compliance with general data processing principleslink
ESTONIA2020-08-17 00:00:0043Police OfficerArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ITALY2020-08-10 00:00:008900Cavauto S.R.L.Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPRInsufficient legal basis for data processinglink
ITALY2020-08-10 00:00:008900Community of BaronissiArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-08-06 00:00:002600GROW BEATS SLArt. 12 GDPR, Art. 13 GDPR, Art. 14 GDPRInsufficient fulfilment of information obligationslink
ITALY2020-08-06 00:00:002600GTL S.R.L.Art. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN2020-08-06 00:00:002600Just Landed S.L.Art. 13 GDPRInsufficient fulfilment of information obligationslink
FRANCE2020-08-05 00:00:00223969SpartooArt. 5 (1) GDPR, Art. 13 GDPR, Art. 14 GDPRNon-compliance with general data processing principleslink
FINLAND2020-08-05 00:00:006271Acc Consulting Varsinais-SuomiArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-08-05 00:00:002600RestaurantArt. 5 (1) c) GDPR, Art. 12 GDPR, Art. 13 GDPRNon-compliance with general data processing principleslink
AUSTRIA2020-08-05 00:00:0089BankArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ITALY2020-08-05 00:00:001800SchoolArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
DENMARK2020-08-04 00:00:0018007PrivatBo A.M.B.A.Art. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-08-04 00:00:0053752Vodafone España, SAUArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ITALY2020-08-04 00:00:0013500Mapei S.p.A.Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPRInsufficient legal basis for data processinglink
ITALY2020-08-04 00:00:004400National Institute for Social Security – Department of the Province of BresciaArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
ITALY2020-08-04 00:00:00890SupermarketArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
GREECE2020-08-03 00:00:002600Candidate for parliamentary electionsArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN2020-07-31 00:00:0040314Vodafone España SAUArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-07-31 00:00:001343Tour & People Max S.L.Art. 21 GDPRInsufficient fulfilment of data subjects rightslink
ROMANIA2020-07-30 00:00:001800SC Viva Credit IFN SAArt. 17 GDPRInsufficient fulfilment of data subjects rightslink
ROMANIA2020-07-30 00:00:001800Romanian Post National CompanyArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY2020-07-30 00:00:001800Community of ManduriaArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ITALY2020-07-29 00:00:002600Community of San Giorgio JonicoArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ITALY2020-07-29 00:00:003600Region of CampaniaArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
DENMARK2020-07-28 00:00:00132410Arp Hansen Hotel Group A/SArt. 5 (1) e) GDPRNon-compliance with general data processing principleslink
BELGIUM2020-07-28 00:00:002600Communal political associationArt. 5 GDPR, Art. 6 GDPR, Art. 14 GDPRInsufficient legal basis for data processinglink
ROMANIA2020-07-27 00:00:004479SC Cntar Tarom SAArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-07-23 00:00:008900El Periódico de Catalunya, S.L.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-07-23 00:00:0049273Telefónica Móviles España, SAUArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-07-23 00:00:0062711Telefónica Móviles España, SAUArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-07-23 00:00:0067190Telefónica Móviles España, SAUArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-07-23 00:00:004400Xfera Moviles S.A.Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
SPAIN2020-07-23 00:00:004400El Real Sporting de Gijón S.A.D.Art. 6 GDPR, Art. 7 GDPRInsufficient legal basis for data processinglink
HUNGARY2020-07-23 00:00:00501Forbes HungaryArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY2020-07-23 00:00:001522EmployerArt. 12 GDPR, Art. 15 GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN2020-07-20 00:00:0021501Banco Bilbao Vizcaya Argentaria, SAArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-07-20 00:00:0036000Iberia Lae SA Operadora UnipersonalArt. 58 GDPRInsufficient cooperation with supervisory authoritylink
SPAIN2020-07-20 00:00:001350Comercial Vigobrandy, SLArt. 12 GDPR, Art. 13 GDPR, Art. 14 GDPRInsufficient fulfilment of information obligationslink
SPAIN2020-07-20 00:00:0071670Orange Espagne S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-07-20 00:00:0062711Xfera Moviles S.A.Art. 5 GDPRNon-compliance with general data processing principleslink
HUNGARY2020-07-16 00:00:0025Google Ireland Ltd.Art. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
POLAND2020-07-15 00:00:0019978Office for geodesy and cartographyArt. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
BELGIUM2020-07-14 00:00:00537527Google Belgium SAArt. 5 GDPR, Art. 6 GDPR, Art. 17 (1) a) GDPR, Art. 12 GDPRInsufficient fulfilment of data subjects rightslink
BELGIUM2020-07-14 00:00:004400Operator of CCTV of a residential buildingArt. 6 GDPR, Art. 7 GDPRInsufficient legal basis for data processinglink
ITALY2020-07-13 00:00:00180000Merlini s.r.l.Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 28 GDPR, Art. 29 GDPRInsufficient legal basis for data processinglink
ITALY2020-07-13 00:00:0014961172Wind Tre S.p.A.Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 24 GDPR, Art. 25 GDPRInsufficient legal basis for data processinglink
ITALY2020-07-13 00:00:00716702Iliad Italia S.p.A.Art. 5 GDPR, Art. 25 GDPRNon-compliance with general data processing principleslink
POLAND2020-07-10 00:00:003045East Power Sp. z o.o.Art. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
NORWAY2020-07-10 00:00:0041801Municipality of RælingenArt. 32 GDPR, Art. 35 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-07-10 00:00:001350Auto Desguaces Iglesias S.L.Art. 5 GDPRNon-compliance with general data processing principleslink
SPAIN2020-07-10 00:00:00890Centro Internacional De Crecimiento Laboral Y Profesional S.L.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-07-10 00:00:0010750Vodafone España, SAUArt. 5 GDPRNon-compliance with general data processing principleslink
SPAIN2020-07-10 00:00:004400Global Business Travel Spain SLUArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-07-10 00:00:004400School Fitness Holiday & Franchising S.L.Art. 5 GDPRNon-compliance with general data processing principleslink
SPAIN2020-07-10 00:00:0049273Xfera Moviles S.A.Art. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA2020-07-09 00:00:0013500Proleasing Motors SRLArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
THE NETHERLANDS2020-07-06 00:00:00743579Bureau Krediet Registration (‘BKR’)Art. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN2020-07-02 00:00:0021501Iberdrola ClientesArt. 5 GDPRNon-compliance with general data processing principleslink
SPAIN2020-07-02 00:00:003600De Vere Spain S.L.Art. 21 GDPRInsufficient fulfilment of data subjects rightslink
NORWAY2020-07-02 00:00:0025084Odin Flissenter ASArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-07-02 00:00:003225Saunier-Tec Mantenimientos de Calor y Frio, SL.Art. 33 GDPRInsufficient fulfilment of data breach notification obligationslink
SPAIN2020-07-02 00:00:004400Xfera Moviles S.A.Art. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
ITALY2020-07-02 00:00:0013500Mapei S.p.A.Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
GERMANY2020-06-30 00:00:001110889Allgemeine Ortskrankenkasse (‘AOK’) (health insurance company)Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
DENMARK2020-06-30 00:00:006002Lejre MunicipalityArt. 5 GDPR, Art. 6 GDPR, Art. 33 GDPR, Art. 34 GDPRNon-compliance with general data processing principleslink
IRELAND2020-06-30 00:00:0036000Tusla Child and Family AgencyArt. 33 GDPRInsufficient fulfilment of data breach notification obligationslink
GREECE2020-06-29 00:00:004400New York College S.A.Art. 5 GDPRNon-compliance with general data processing principleslink
ISLE OF MAN2020-06-25 00:00:0012094Department of Home AffairsArt. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN2020-06-23 00:00:006719Miraclia (telecommunications company)Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-06-22 00:00:001800UnknownArt. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPRNon-compliance with general data processing principleslink
NORWAY2020-06-22 00:00:00100338Østfold HF HospitalArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BELGIUM2020-06-19 00:00:008900UnknownArt. 5 GDPR, Art. 6 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
NORWAY2020-06-19 00:00:0025084Aquateknikk ASArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-06-19 00:00:005375National Police BrigadeArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA2020-06-18 00:00:003600Enel EnergieArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-06-16 00:00:001800Café BarArt. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPRNon-compliance with general data processing principleslink
SWEDEN2020-06-16 00:00:001702Housing AssociationArt. 5 GDPR, Art. 6 GDPRNon-compliance with general data processing principleslink
BELGIUM2020-06-16 00:00:00890UnknownArt. 17 GDPR, Art. 21 GDPR, Art. 31 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN2020-06-15 00:00:0067191Xfera Moviles S.A.Art. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY2020-06-12 00:00:00258013Digi Távközlési Szolgáltató Kft. (‘Digi’) (electronic communication service provider)Art. 5 (1) b), (e) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA2020-06-11 00:00:002600Telekom RomaniaArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-06-09 00:00:004400Consulting de Seguridad e Investigacion Mira Dp Madrid S.L.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-06-09 00:00:00483.77Chenming Ye (Bazar Real)Art. 13 GDPR, Art. 14 GDPRInsufficient fulfilment of information obligationslink
SPAIN2020-06-09 00:00:00890Property OwnerArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
SPAIN2020-06-09 00:00:0067191Equifax Iberica, S.L.Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN2020-06-09 00:00:0034939Xfera Moviles S.A.Art. 5 (1) f) GDPRInsufficient legal basis for data processinglink
SPAIN2020-06-09 00:00:0022396Glovoapp23Art. 37 GDPRLack of appointment of data protection officerlink
SPAIN2020-06-09 00:00:0036000TELEFONICA MOVILES ESPAÑA, S.A.U.Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-06-09 00:00:002687Salad Market S.L. (Catering Company)Art. 13 GDPR, Art. 14 GDPRInsufficient fulfilment of information obligationslink
SPAIN2020-06-09 00:00:001800AttorneyArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-06-09 00:00:001800Property OwnerArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
BELGIUM2020-06-08 00:00:004400Municipal employeeArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-06-04 00:00:003583Iberdrola ClientesArt. 58 GDPRInsufficient cooperation with supervisory authoritylink
POLAND2020-06-03 00:00:00960Entrepreneur running a non-public nursery and pre-schoolArt. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
BELGIUM2020-05-29 00:00:00890Non-profit organisationArt. 6 GDPR, Art. 21 GDPRInsufficient fulfilment of data subjects rightslink
FINLAND2020-05-29 00:00:0064503Taksi HelsinkiArt. 5 GDPR, Art. 6 GDPR, Art. 35 GDPRNon-compliance with general data processing principleslink
FINLAND2020-05-22 00:00:0089000Posti Group OyjArt. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
FINLAND2020-05-22 00:00:0014334Kymen Vesi OyArt. 35 GDPRNon-compliance with general data processing principleslink
FINLAND2020-05-22 00:00:0011198Unknown CompanyArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
IRELAND2020-05-17 00:00:0067190Tusla Child and Family AgencyArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
DENMARK2020-05-15 00:00:006002JobTeam A/S DKKArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
BELGIUM2020-05-14 00:00:0044000Social Media ProviderArt. 6 GDPRInsufficient legal basis for data processinglink
SWEDEN2020-05-12 00:00:0010033Health and Medical Board of the Region of Örebro CountyArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA2020-05-05 00:00:004450Banca Comercială Română SAArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
NORWAY2020-05-03 00:00:00120047Telenor Norge ASArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
THE NETHERLANDS2020-04-30 00:00:00649511Unknown OrganisationArt. 5 GDPR, Art. 9 GDPRInsufficient legal basis for data processinglink
ESTONIA2020-04-30 00:00:00445Housing AssociationArt. 6 GDPRInsufficient legal basis for data processinglink
SWEDEN2020-04-29 00:00:0016752National Government Service Centre (NGSC)Art. 33 GDPR, Art. 34 GDPRInsufficient fulfilment of data breach notification obligationslink
BELGIUM2020-04-28 00:00:0044500Proximus SAArt. 31 GDPR, Art. 58 GDPR, Art. 37 GDPRLack of appointment of data protection officerlink
ROMANIA2020-04-23 00:00:002600Estee Lauder RomaniaArt. 6 GDPR, Art. 7 GDPR, Art. 9 GDPRInsufficient legal basis for data processinglink
ROMANIA2020-04-23 00:00:002600Telekom Romania Communications SAArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BULGARIA2020-04-14 00:00:001800Political PartyArt. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY2020-03-26 00:00:002589BankArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA2020-03-25 00:00:001800SOS Infertility AssociationArt. 58 GDPRInsufficient cooperation with supervisory authoritylink
ROMANIA2020-03-25 00:00:002600Enel EnergieArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA2020-03-25 00:00:003717Vodafone RomaniaArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA2020-03-25 00:00:002600Dante InternationalArt. 6 GDPR, Art. 21 GDPRInsufficient legal basis for data processinglink
SPAIN2020-03-25 00:00:004400Xfera Moviles S.A.Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
GREECE2020-03-20 00:00:006400Speech and Special Education Centre – Mihou DimitraArt. 15 GDPR, Art. 58 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN2020-03-19 00:00:005375Oliveros Ustrell, S.L.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY2020-03-19 00:00:005000Unknown CompanyArt. 6 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN2020-03-18 00:00:0026876TelefónicaArt. 58 GDPRInsufficient cooperation with supervisory authoritylink
SPAIN2020-03-16 00:00:004400Centro De Estudio Dirigidos Delta, S.L.Art. 5 (1) f) GDPRNon-compliance with general data processing principleslink
SPAIN2020-03-16 00:00:003600Private PersonArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-03-16 00:00:005375Amalfi Servicios de Restauracion S.L.Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPRNon-compliance with general data processing principleslink
CROATIA2020-03-13 00:00:00unknownBank (name not available at the moment)Art. 15 (1), (3) GDPRInsufficient fulfilment of data subjects rightslink
SPAIN2020-03-12 00:00:001800Homeowners AssociationArt. 5 GDPR, Art. 13 GDPR, Art. 14 GDPRNon-compliance with general data processing principleslink
SWEDEN2020-03-11 00:00:006271150Google LLCArt. 5 GDPR, Art. 6 GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rightslink
DENMARK2020-03-10 00:00:006271Hørsholm MunicipalityArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
DENMARK2020-03-10 00:00:0012542Gladsaxe MunicipalityArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ICELAND2020-03-10 00:00:0018455National Center of Addiction Medicine (‘SAA’)Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ICELAND2020-03-10 00:00:008063Breiðholt Upper Secondary SchoolArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-03-09 00:00:0013500Gesthotel Activos BalagaresArt. 5 (1) f) GDPRNon-compliance with general data processing principleslink
POLAND2020-03-09 00:00:003942Vis Consulting Sp. z o.o.Art. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
HUNGARY2020-03-09 00:00:00779.41CreditorArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ITALY2020-03-06 00:00:003600Liceo Artistico Statale di NapoliArt. 5 GDPR, Art. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processinglink
ITALY2020-03-06 00:00:003600Liceo Scientifico Nobel di Torre del GrecoArt. 5 GDPR, Art. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processinglink
SPAIN2020-03-06 00:00:003600Private personArt. 5 GDPRNon-compliance with general data processing principleslink
SPAIN2020-03-06 00:00:002867RetailerArt. 13 GDPR, Art. 14 GDPRInsufficient fulfilment of information obligationslink
ITALY2020-03-05 00:00:002600San Giorgio JonicoArt. 5 GDPR, Art. 6 GDPR, Art. 17 GDPRInsufficient legal basis for data processinglink
POLAND2020-03-04 00:00:003800School in Gdansk (Danzig) (fine imposed against town of Gdansk)Art. 5 GDPR, Art. 9 GDPRInsufficient legal basis for data processinglink
SPAIN2020-03-04 00:00:0053753Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY2020-03-04 00:00:00259.8Representative of a local governmentArt. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPRInsufficient legal basis for data processinglink
THE NETHERLANDS2020-03-03 00:00:00445500Royal Dutch Tennis Association (‘KNLTB’)Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-03-03 00:00:001613Solo EmbragueArt. 13 GDPRInsufficient fulfilment of information obligationslink
SPAIN2020-03-03 00:00:0037627Vodafone España, S.A.U.Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-03-03 00:00:0036000Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-03-03 00:00:0021501Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-02-28 00:00:0043002Vodafone ONO, S.A.U.Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-02-28 00:00:003225AEMA HispánicaArt. 5 (1) f) GDPRNon-compliance with general data processing principleslink
NORWAY2020-02-28 00:00:0032968Coop Finnmark SAArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-02-27 00:00:00107505Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
NORWAY2020-02-26 00:00:0065937Rælingen MunicipalityArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-02-25 00:00:0043002HM HospitalesArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-02-25 00:00:004200Casa Gracio OperationArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
GREECE2020-02-21 00:00:004479Public Power Corporation S.A.Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
BULGARIA2020-02-20 00:00:002293T.K. EOODArt. 25 (1) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BULGARIA2020-02-20 00:00:002293L.E. EOODArt. 25 (1) GDPR, Art. 32 GDPR, Art. 6 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-02-18 00:00:001350Mymoviles Europa 2000, S.L.Art. 13 GDPRInsufficient fulfilment of information obligationslink
SPAIN2020-02-14 00:00:002240Grupo Valsor Y Losan, S.L.Art. 5 (1) f) GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-02-14 00:00:002600Colegio Arenales Carabanchel (School)Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-02-14 00:00:0071670Iberdrola ClientesArt. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-02-14 00:00:0037627Vodafone España, S.A.U.Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2020-02-14 00:00:0026876Xfera Moviles S.A.Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY2020-02-13 00:00:003600Comune di UragoArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA2020-02-11 00:00:002600Vodafone RomaniaArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY2020-02-06 00:00:001800RTI – Reti Televisive Italiane s.p.a.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-02-04 00:00:001350Cafetería NagasakiArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-02-03 00:00:0053753Xfera Moviles S.A.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-02-03 00:00:0067191Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-02-03 00:00:0053753Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-02-03 00:00:0044794Vodafone España, S.A.U.Art. 5 GDPRNon-compliance with general data processing principleslink
SPAIN2020-02-03 00:00:001800Iberia Lineas Aereas de Espana, S.A. Operadora UnipersonalArt. 5 GDPR, Art. 6 GDPR, Art. 21 GDPRInsufficient legal basis for data processinglink
SPAIN2020-02-03 00:00:0067191Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-02-03 00:00:005976Banco Bilbao Vizcaya Argentaria S.L.Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPRInsufficient legal basis for data processinglink
SPAIN2020-02-03 00:00:004400Queseria Artesenal Ameco S.L.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-02-03 00:00:00716.7AutomociónArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ITALY2020-01-30 00:00:003600Comune di ColledaraArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY2020-01-24 00:00:001299Accounting firmArt. 24 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY2020-01-23 00:00:0026000Azienda Ospedaliero Universitaria Integrata di Verona (Hospital)Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY2020-01-23 00:00:0026000Sapienza Università di RomaArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ITALY2020-01-15 00:00:0024905425TIM (telecommunications operator)Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 32 GDPRInsufficient legal basis for data processinglink
ITALY2020-01-15 00:00:008900Community of Francavilla FontanaArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-01-14 00:00:003225Zhang Bordeta 2006, S.L. (Store and Restaurant)Art. 5 GDPRNon-compliance with general data processing principleslink
CYPRUS2020-01-13 00:00:008063Social Insurance Services of the Ministry of Labor, Welfare and Social InsuranceArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
CYPRUS2020-01-13 00:00:00890eShop for Sports (M.L. PRO.FIT SOLUTIONS LTD)Art. 6 GDPRInsufficient legal basis for data processinglink
GREECE2020-01-13 00:00:0013500Allseas Marine S.A.Art. 5 (1) a), (2) GDPRNon-compliance with general data processing principleslink
SPAIN2020-01-09 00:00:002600Vodafone España, S.A.U.Art. 58 GDPRInsufficient cooperation with supervisory authoritylink
SPAIN2020-01-07 00:00:0039419Vodafone España, S.A.U.Art. 5 (1) f) GDPRNon-compliance with general data processing principleslink
SPAIN2020-01-07 00:00:0067191EDP España S.A.U.Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-01-07 00:00:0067191EDP Comercializadora, S.A.U.Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2020-01-07 00:00:008900Asociación de Médicos DemócratasArt. 6 GDPRInsufficient legal basis for data processinglink
BULGARIA2020-01-06 00:00:004400Utility CompanyArt. 6 (1) GDPRInsufficient legal basis for data processinglink
GREECE2019-12-19 00:00:00134382Aegean Marine Petroleum Network Inc.Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA2019-12-18 00:00:001800Telekom Romania Mobile Communications SAArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
UNITED KINGDOM2019-12-17 00:00:00286681Doorstep Dispensaree Ltd. (Pharmacy)Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BELGIUM2019-12-17 00:00:001800Nursing Care OrganisationArt. 12 GDPR, Art. 15 GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rightslink
BELGIUM2019-12-17 00:00:0013500Website providing legal informationArt. 6 GDPR, Art. 12 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligationslink
SWEDEN2019-12-16 00:00:0031356Nusvar ABArt. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA2019-12-16 00:00:001800Globus Score SRLArt. 58 GDPRInsufficient cooperation with supervisory authoritylink
ROMANIA2019-12-16 00:00:005375SC Enel Energie S.A. (Electricity Distributor)Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 21 GDPRInsufficient legal basis for data processinglink
ROMANIA2019-12-13 00:00:004400Entirely Shipping & Trading S.R.L.Art. 5 (1) GDPR, Art. 6 GDPR, Art. 7 GDPRNon-compliance with general data processing principleslink
ROMANIA2019-12-13 00:00:004400Entirely Shipping & Trading S.R.L.Art. 5 (1) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 9 GDPRNon-compliance with general data processing principleslink
HUNGARY2019-12-11 00:00:001281Unknown CompanyArt. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPRNon-compliance with general data processing principleslink
ITALY2019-12-11 00:00:007614968Eni Gas e LuceArt. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPRInsufficient legal basis for data processinglink
ITALY2019-12-11 00:00:002600000Eni Gas e LuceArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2019-12-10 00:00:001433Megastar SLArt. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
SPAIN2019-12-10 00:00:004400Shop Macoyn, S.L.Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA2019-12-10 00:00:0012542Hora Credit IFN SAArt. 5 GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information securitylink
GERMANY2019-12-09 00:00:008555640Telecoms provider (1&1 Telecom GmbH)Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
GERMANY2019-12-09 00:00:008900Rapidata GmbHArt. 37 GDPRLack of appointment of data protection officerlink
ROMANIA2019-12-04 00:00:0018000S CNTAR TAROM SA (Airline)Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
GERMANY2019-12-03 00:00:0094067HospitalArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2019-12-03 00:00:001350Cerrajeria Verin S.L.Art. 13 GDPRInsufficient fulfilment of information obligationslink
SPAIN2019-12-03 00:00:004479Linea Directa AseguradoraArt. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA2019-12-02 00:00:001800Nicola Medical Team 17 SRLArt. 58 GDPRInsufficient cooperation with supervisory authoritylink
ROMANIA2019-11-29 00:00:002240Royal President S.R.L.Art. 15 GDPR, Art. 6 GDPR, Art. 32 GDPRInsufficient fulfilment of data subjects rightslink
ROMANIA2019-11-29 00:00:00440Homeowners AssociationArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BELGIUM2019-11-28 00:00:004400MayorArt. 6 GDPRInsufficient legal basis for data processinglink
BELGIUM2019-11-28 00:00:004400Municipal aldermanArt. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA2019-11-28 00:00:0071670ING Bank N.V.Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2019-11-28 00:00:0067191Curenergía Comercializador de último recursoArt. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA2019-11-26 00:00:002600Modern BarberArt. 58 GDPRInsufficient cooperation with supervisory authoritylink
ROMANIA2019-11-25 00:00:009700Courier Services CompanyArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA2019-11-22 00:00:001800BNP Paribas Personal Finance S.A.Art. 12 GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN2019-11-21 00:00:0053753Viaqua Xestión Integral Augas de GaliciaArt. 6 GDPRInsufficient legal basis for data processinglink
FRANCE2019-11-21 00:00:00445500Futura InternationaleArt. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 21 GDPRInsufficient fulfilment of data subjects rightslink
SPAIN2019-11-19 00:00:0053753Corporación radiotelevisión espanolaArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2019-11-19 00:00:0053753Xfera Moviles S.A.Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN2019-11-19 00:00:005375Sports BarArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
SPAIN2019-11-14 00:00:0026000Telefónica SAArt. 5 GDPRNon-compliance with general data processing principleslink
SPAIN2019-11-13 00:00:002600General Confederation of Labour (‘CGT’)Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2019-11-07 00:00:00806.29TODOTECNICOS24H S.L.Art. 13 GDPRInsufficient fulfilment of information obligationslink
SPAIN2019-11-06 00:00:00806.29Cerrajero OnlineArt. 13 GDPRInsufficient fulfilment of information obligationslink
SPAIN2019-11-06 00:00:0053753Vodafone España, S.A.U.Art. 6 GDPRInsufficient legal basis for data processinglink
LATVIA2019-11-01 00:00:00135000UnknownArt. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2019-10-31 00:00:005375Jocker Premium InvexArt. 6 GDPRInsufficient legal basis for data processinglink
THE NETHERLANDS2019-10-31 00:00:00806290UWV (Dutch employee insurance service provider)Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
THE NETHERLANDS2019-10-31 00:00:0044000Menzis (Health Insurance Company)Art. 5 GDPRNon-compliance with general data processing principleslink
GERMANY2019-10-30 00:00:0012990239Deutsche Wohnen SEArt. 5 GDPR, Art. 25 GDPRNon-compliance with general data processing principleslink
GERMANY2019-10-30 00:00:00unknownDeutsche Wohnen SEArt. 5 GDPRNon-compliance with general data processing principleslink
BULGARIA2019-10-28 00:00:00445EmployerArt. 12 (3) GDPR, Art. 15 (1) GDPRInsufficient fulfilment of data subjects rightslink
SPAIN2019-10-25 00:00:0032252Vodafone España, S.A.U.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
CYPRUS2019-10-25 00:00:0062712LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation LtdArt. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processinglink
CYPRUS2019-10-25 00:00:008959LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation LtdArt. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processinglink
CYPRUS2019-10-25 00:00:001800LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation LtdArt. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processinglink
HUNGARY2019-10-24 00:00:006630Military HospitalArt. 32 GDPR, Art. 33 GDPRInsufficient fulfilment of data breach notification obligationslink
GERMANY2019-10-24 00:00:0089000Food companyArt. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
AUSTRIA2019-10-23 00:00:0016125814Austrian PostArt. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2019-10-23 00:00:0053753Vodafone España, S.A.U.Art. 5 (1) f) GDPRNon-compliance with general data processing principleslink
POLAND2019-10-18 00:00:008403Major of Aleksandrów KujawskiArt. 28 GDPRInsufficient data processing agreementlink
GREECE2019-10-18 00:00:0018000Wind Hellas TelecommunicationsArt. 21 GDPRInsufficient fulfilment of data subjects rightslink
ROMANIA2019-10-17 00:00:002240UTTIS INDUSTRIES SRLArt. 12 GDPR, Art. 13 GDPR, Art. 5 (1) c) GDPR, Art. 6 GDPRInsufficient fulfilment of information obligationslink
SPAIN2019-10-16 00:00:0053753Xfera Moviles S.A.Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN2019-10-16 00:00:007167Iberdrola ClientesArt. 31 GDPRInsufficient cooperation with supervisory authoritylink
POLAND2019-10-16 00:00:0042106ClickQuickNowArt. 5 GDPRNon-compliance with general data processing principleslink
HUNGARY2019-10-15 00:00:002562Unknown CompanyArt. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPRNon-compliance with general data processing principleslink
ROMANIA2019-10-09 00:00:00135000Raiffeisen Bank SAArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA2019-10-09 00:00:0018000Vreau Credit SRLArt. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information securitylink
BULGARIA2019-10-08 00:00:004550The Ministry of Interior AffairsArt. 5 (1) GDPR, Art. 6 (1) GDPRInsufficient legal basis for data processinglink
GREECE2019-10-07 00:00:00180000Telecommunication Service ProviderArt. 5 (1) c) GDPR, Art. 25 GDPRNon-compliance with general data processing principleslink
GREECE2019-10-07 00:00:00180000Telecommunication Service ProviderArt. 21 (3) GDPR, Art. 25 GDPRNon-compliance with general data processing principleslink
BULGARIA2019-10-07 00:00:00445B.D.Art. 31 GDPRInsufficient cooperation with supervisory authoritylink
SPAIN2019-10-01 00:00:0026000Vueling AirlinesArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY2019-10-01 00:00:0013500Town of KerepesArt. 6 (1) GDPRInsufficient legal basis for data processinglink
ROMANIA2019-09-26 00:00:008063Inteligo Media SAArt. 5 (1) a) GDPR, Art. 6 (1) a) GDPRInsufficient legal basis for data processinglink
GERMANY2019-09-19 00:00:00175061Delivery HeroArt. 15 GDPR, Art. 17 GDPR, Art. 21 GDPRInsufficient fulfilment of data subjects rightslink
BELGIUM2019-09-17 00:00:0089000MerchantArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
POLAND2019-09-10 00:00:00577842Morele.netArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BULGARIA2019-09-03 00:00:0025174National Revenue AgencyArt. 6 (1) GDPR, Art. 58 (2) e) GDPR, Art. 83 (5) a) GDPRInsufficient legal basis for data processinglink
BULGARIA2019-09-03 00:00:00900Telecommunication service provideArt. 6 (1) GDPR, Art. 25 (1) GDPRInsufficient legal basis for data processinglink
BULGARIA2019-09-03 00:00:004500Telecommunication service provideArt. 6 (1) GDPR, Art. 25 (1) GDPRInsufficient legal basis for data processinglink
BULGARIA2019-09-03 00:00:0010536Commercial representative of telecommunication service providerArt. 6 (1) GDPRInsufficient legal basis for data processinglink
BULGARIA2019-09-03 00:00:00900Private enforcement agentArt. 12 (4) GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rightslink
BULGARIA2019-08-28 00:00:002329284National Revenue AgencyArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BULGARIA2019-08-28 00:00:00445000DSK BankArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
LATVIA2019-08-26 00:00:006271Online ServicesArt. 17 GDPRInsufficient fulfilment of data subjects rightslink
SWEDEN2019-08-20 00:00:0016690School in SkellefteåArt. 5 (1) c) GDPR, Art. 9 GDPR, Art. 35 GDPR, Art. 36 GDPRInsufficient legal basis for data processinglink
SPAIN2019-08-16 00:00:0053753AVON COSMETICSArt. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY2019-08-08 00:00:001536Government Office Managing the Real Estate RegisterArt. 5 GDPR, Art. 14 GDPRNon-compliance with general data processing principleslink
GERMANY2019-08-05 00:00:00180Private person (YouTube-Channel)Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY2019-08-02 00:00:003843Public area maintenance companyArt. 5 GDPR, Art. 6 GDPR, Art. 13 GDPRNon-compliance with general data processing principleslink
AUSTRIA2019-08-01 00:00:0044000Company in the medical sectorArt. 13 GDPR, Art. 37 GDPRInsufficient fulfilment of information obligationslink
GREECE2019-07-30 00:00:00134382PWC Business SolutionsArt. 5 (1) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 13 (1) c) GDPR, Art. 14 (1) c) GDPRInsufficient legal basis for data processinglink
FRANCE2019-07-25 00:00:00161258ACTIVE ASSURANCES (car insurer)Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
HUNGARY2019-07-17 00:00:007682Budapest Environs Regional CourtArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA2019-07-05 00:00:002600LEGAL COMPANY & TAX HUB SRLArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
ROMANIA2019-07-02 00:00:0013438WORLD TRADE CENTER BUCHAREST SAArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
AUSTRIA2019-07-01 00:00:009100Private person (soccer coach)Art. 6 GDPRInsufficient legal basis for data processinglink
ROMANIA2019-06-27 00:00:00116464UNICREDIT BANK SAArt. 25 (1) GDPR, Art. 5 (1) c) GDPRInsufficient technical and organisational measures to ensure information securitylink
HUNGARY2019-06-26 00:00:002553UnknownArt. 5 GDPR, Art. 6 GDPR, Art. 17 GDPRInsufficient legal basis for data processinglink
HUNGARY2019-06-26 00:00:002553Financial EnterpriseArt. 5 GDPR, Art. 6 GDPR, Art. 21 GDPRInsufficient legal basis for data processinglink
HUNGARY2019-06-25 00:00:0013500UnknownArt. 33 GDPRInsufficient fulfilment of data breach notification obligationslink
THE NETHERLANDS2019-06-18 00:00:00412104Haga HospitalArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
FRANCE2019-06-13 00:00:0018000Employer UNIONTRAD COMPANYArt. 5 (1) c) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 32 GDPRInsufficient legal basis for data processinglink
SPAIN2019-06-11 00:00:00223970Professional Football League (LaLiga)Art. 5 (1) a), Art. 7 (3) GDPRInsufficient fulfilment of information obligationslink
DENMARK2019-06-03 00:00:00179937IDdesign A / SArt. 5 (1) e) GDPR, Art. 5 (2) GDPRNon-compliance with general data processing principleslink
HUNGARY2019-06-03 00:00:002553Claim management companyArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
HUNGARY2019-05-31 00:00:001800Local bankArt. 12 (3), (4), (5) GDPR, Art. 15 GDPR, Art. 18 GDPRInsufficient fulfilment of data subjects rightslink
BELGIUM2019-05-28 00:00:001800MayorArt. 5 (1) b) GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
FRANCE2019-05-28 00:00:00360000SERGIC (Real Estate)Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
HUNGARY2019-05-23 00:00:0082552Organizer of SZIGET festival and VOLT festivalArt. 6 GDPR, Art. 5 (1) b) GDPR, Art. 13 GDPRInsufficient legal basis for data processinglink
HUNGARY2019-05-21 00:00:00256.22Directorate of Social and Child Welfare Institutions of the Ferencvaros District of BudapestArt. 33 GDPRInsufficient fulfilment of data breach obligationslink
LITHUANIA2019-05-16 00:00:0055097Payment service provider UAB MisterTangoArt. 5 GDPR, Art. 32 GDPR, Art. 33 GDPRInsufficient fulfilment of data breach notification obligationslink
GERMANY2019-05-09 00:00:001300Police OfficerArt. 6 GDPRInsufficient legal basis for data processinglink
CZECH REPUBLIC2019-05-06 00:00:00173.8UnknownArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
NORWAY2019-04-29 00:00:00107505Oslo Municipal Education DepartmentArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
POLAND2019-04-25 00:00:0011602Sports associationArt. 6 GDPRInsufficient legal basis for data processinglink link
ITALY2019-04-17 00:00:0044000Italian political party Movimento 5 StelleArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
HUNGARY2019-04-17 00:00:008421UnknownArt. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
GERMANY2019-04-12 00:00:0071670Company in the financial sectorArt. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
BULGARIA2019-04-08 00:00:00440Medical centersArt. 5 (1) a) GDPR, Art. 9 (1) GDPR, Art. 9 (2) GDPR, Art. 6 (1) GDPRInsufficient legal basis for data processinglink
HUNGARY2019-04-05 00:00:0030796Hungarian political partyArt. 33 (1) GDPR, Art. 33 (5) GDPR, Art. 34 (1) GDPRInsufficient fulfilment of data breach notification obligationslink
HUNGARY2019-04-05 00:00:001702UnknownArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
POLAND2019-03-26 00:00:00197093Private company working with data from publicly available sourcesArt. 14 GDPRInsufficient fulfilment of information obligationslink
BULGARIA2019-03-26 00:00:004400A.P. EOODArt. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
PORTUGAL2019-03-25 00:00:001800UnknownArt. 13 GDPRInsufficient fulfilment of information obligationslink
CZECH REPUBLIC2019-03-21 00:00:008900UnknownArt. 5 (1) GDPRNon-compliance with general data processing principleslink
PORTUGAL2019-03-19 00:00:001800UnknownArt. 13 GDPRInsufficient fulfilment of information obligationslink
HUNGARY2019-03-04 00:00:002867Unnamed financial institutionArt. 5 (1) b) GDPR, Art. 5 (1) c) GDPR, Art. 13 (3) GDPR, Art. 17 (1) GDPR, Art. 6 (4) GDRPInsufficient fulfilment of data subjects rightslink link
GERMANY2019-03-01 00:00:0044000N26Art. 6 GDPRInsufficient legal basis for data processingPage 131 of the activity report of the Data Protection Commissioner of Berlin link link
NORWAY2019-03-01 00:00:00152299Bergen MunicipalityArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
CZECH REPUBLIC2019-02-28 00:00:00500UnknownArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
HUNGARY2019-02-28 00:00:002867Mayor’s Office of the city of KecdkemétArt. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink link
BULGARIA2019-02-26 00:00:0024278Telecommunication service providerArt. 6 GDPR, Art. 5 (1) a) GDPRInsufficient legal basis for data processinglink
CZECH REPUBLIC2019-02-26 00:00:00695.2UnknownArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
BULGARIA2019-02-22 00:00:00440EmployerArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
HUNGARY2019-02-20 00:00:0013500Debt collectorArt. 5 (1) a) GDPR, Art. 5 (1) c) GDPRNon-compliance with general data processing principleslink link
MALTA2019-02-18 00:00:004400Lands AuthorityArt. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
HUNGARY2019-02-08 00:00:001398BankArt. 5 (1) d) GDPRNon-compliance with general data processing principleslink link
GERMANY2019-02-05 00:00:002240Private personArt. 6 GDPR, Art. 5 GDPRInsufficient legal basis for data processinglink
PORTUGAL2019-02-05 00:00:0018000UnknownArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
CZECH REPUBLIC2019-02-04 00:00:001044Car renting companyArt. 5 (1) a) GDPRInsufficient fulfilment of information obligationslink
CZECH REPUBLIC2019-02-04 00:00:001044Credit brokerageArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
FRANCE2019-01-21 00:00:0044000000Google Inc.Art. 13 GDPR, Art. 14 GDPR, Art. 6 GDPR, Art. 5 GDPRInsufficient legal basis for data processinglink
BULGARIA2019-01-17 00:00:00440BankArt. 6 GDPR, Art. 5 (1) a) GDPRInsufficient legal basis for data processinglink
CZECH REPUBLIC2019-01-10 00:00:00347.6EmployerArt. 6 GDPRInsufficient legal basis for data processinglink
CYPRUS20194400State HospitalArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
CYPRUS20198900NewspaperArt. 6 GDPRInsufficient legal basis for data processinglink
DENMARK2019143341Taxa 4×35Art. 5(1) e) GDPRNon-compliance with general data processing principleslink
CYPRUS201912542DoctorArt. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
GERMANY2019UnknownArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN201918500Vodafone España, S.A.U.Art. 6 (1) GDPRInsufficient legal basis for data processinglink
SPAIN201932252VODAFONE ONO, S.A.U.Art. 5 (1) f) GDPRNon-compliance with general data processing principleslink
SPAIN201943002VODAFONE ONO, S.A.U.Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN201943002TELEFONICA MOVILES ESPAÑA, S.A.U.Art. 5 (1) a) GDPRNon-compliance with general data processing principleslink
SPAIN201926000Vodafone España, S.A.U.Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAIN201936000Vodafone España, S.A.U.Art. 6 GDPRInsufficient legal basis for data processinglink
SPAIN201918000Private PersonArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
SPAIN20198063Private PersonArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
SPAIN20193225AMADOR RECREATIVOS, S.LArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
GERMANY2019716.7Police OfficerArt. 6 GDPRInsufficient legal basis for data processinglink
GERMANY2019263388UnknownArt. 5 GDPRNon-compliance with general data processing principleslink
GERMANY201946000Facebook Germany GmbHArt. 37 GDPRLack of appointment of data protection officerlink
GERMANY201918000Hamburger Verkehrsverbund GmbH (HVV GmbH)Art. 33 GDPR, Art. 34 GDPRInsufficient fulfilment of data breach notification obligationslink
GERMANY2019UnknownHamburger Volksbank eGArt. 21 GDPRInsufficient fulfilment of data subjects rightslink
GERMANY20191800RestaurantArt. 5 (1) c) GDPRNon-compliance with general data processing principleslink
GERMANY201945100Unknown CompanyArt. 15 GDPR, Art. 28 GDPRInsufficient fulfilment of data subjects rightslink
AUSTRIA2018-12-20 00:00:0019800Private personArt. 5 (1) a) GDPR, Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 13 GDPRInsufficient legal basis for data processinglink
HUNGARY2018-12-18 00:00:002888UnknownArt. 12 (4) GDPR, Art. 15 GDPR, Art. 18 (1) c) GDPR, Art. 13 GDPRInsufficient fulfilment of data subjects rightslink
GERMANY2018-12-17 00:00:004500Kolibri Image Regina und Dirk Maass GbRArt. 28 (3) GDPRInsufficient data processing agreementlink link
AUSTRIA2018-12-09 00:00:004332Betting placeArt. 13 GDPRInsufficient fulfilment of information obligationslink
BULGARIA2018-12-04 00:00:00451BankArt. 5 (1) b) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
GERMANY2018-11-21 00:00:0018500Knuddels.deArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink link
CZECH REPUBLIC2018-10-25 00:00:00350UnknownArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
AUSTRIA2018-09-27 00:00:00270Private car ownerArt. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
PORTUGAL2018-07-17 00:00:0036100Public HospitalArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
AUSTRIA20181625Kebab restaurantArt. 5 GDPR, Art. 13 GDPR, Art. 14 GDPRInsufficient legal basis for data processinglink
GERMANY201818500UnknownArt. 83 (4) a) GDPR, Art. 33 (1) GDPR, Art. 34 (1) GDPRInsufficient fulfilment of data breach notification obligationsPage 134 of the activity report of the Data Protection Commissioner of Hamburg, accessible under link
GERMANY2018451UnknownUnknownUnknownlink
CZECH REPUBLICUnknown2834UniCredit Bank Czech Republic and Slovakia, a.s.Art. 6 GDPRInsufficient legal basis for data processinglink
GERMANYUnknown106UnknownArt. 6 GDPRInsufficient legal basis for data processinglink
SPAINUnknown4500Vodafone España, S.A.U.Art. 5 (1) d) GDPRNon-compliance with general data processing principleslink
SPAINUnknown54000Debt collecting agancy (GESTIÓN DE COBROS, YO COBRO SL)Art. 5 (1) f) GDPRInsufficient legal basis for data processinglink
SPAINUnknown24000Vodafone España, S.A.U.Art. 5 (1) d) GDPRInsufficient fulfilment of data subjects rightslink
SPAINUnknown54000ENDESA (energy supplyer)Art. 5 (1) f) GDPRInsufficient legal basis for data processinglink
SPAINUnknown8666Restaurant (SANTI 3000, S.L.)Art. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processinglink
SLOVAKIAUnknownUnknownUnknownArt. 15 GDPRInsufficient fulfilment of data subjects rightslink
SLOVAKIAUnknownUnknownUnknownArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SLOVAKIAUnknownUnknownUnknownArt. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SLOVAKIAUnknownUnknownUnknownArt. 5 (1) a) GDPR, Art. 6 (1) a) GDPRInsufficient legal basis for data processinglink
SLOVAKIAUnknown36000Slovak TelekomArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAINUnknown10830Madrileña Red de GasArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SLOVAKIAUnknown45000Social Insurance AgencyArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
CZECH REPUBLICUnknown538Alza.cz a.s.Art. 6 GDPR, Art. 7 GDPRInsufficient legal basis for data processinglink
CZECH REPUBLICUnknown884Individual entrepreneur – no further details publishedArt. 32 GDPRInsufficient technical and organisational measures to ensure information securitylink
SPAINUnknown9025Ikea IbéricaArt. 6 GDPRInsufficient legal basis for data processinglink

Speak your mind