Sebastyijan/gdpr-enforcement-sample huggingface dataset:
Authority: Persónuvernd (Island)
Company: Creditinfo Lánstrausti hf.
The Icelandic DPA held that a credit scoring company that registered information on non-payments without meeting the conditions for registration being fulfilled according to the operational license of the said company, breached the principle of lawfulness, fairness and transparency under Article 5(1)(a) GDPR. The company was fined 37,856,900 ISK (approx. €257,660).
Authority: Croatia
The Administrative Court found that, although the DPA failed to enforce its previous decision, the statute of limitations for enforcing an order under national law had expired and the DPA could not be ordered to enforce its decision.
Authority: Spanish Data Protection Authority (aepd)
Company: Homeowners Association
The Spanish DPA has fined a homeowners association EUR 2,500 for publishing information (name, surname, apartments) regarding several owners on their website.
Authority: Datatilsynet (Denmark)
Company: nemlig.com A/S
The Danish Data Protection Authority (Datatilsynet) decided on two similar cases regarding the notification requirements in the case of a personal data breach, 2019-441-1581 and 2019-441-1578.

Both cases regarded insufficient access controls on a web based reporting service. In both cases, the information regarding customers’ orders were freely available online. Datatilsynet emphasized that the decision to not inform data subjects about a personal data breach pursuant to Article 34 was based on an insufficient assessment.
Authority: Information Commissioner (ICO)
Company: Mermaids
The ICO has fined transgender charity Mermaids EUR 29,000 for failing to protect the personal data of its users, in breach of Art. 5 (1) f) UK GPDR and Art. 32 (1), (2) UK GDPR. 
The ICO conducted an investigation after it received a report of a data breach relating to an internal email group.
During the investigation, the ICO found that the group was created with insufficiently secure settings, resulting in approximately 780 pages of confidential emails being viewable online for nearly three years.  This resulted in personal information, such as names and email addresses, of 550 people being online. 
The ICO concludes that Mermaids should have restricted access to its email group and could have considered pseudonymization or encryption to provide additional protection for the personal data. Organizations responsible for personal data must ensure that they take the appropriate technical and organizational measures to ensure the security of personal data.
Authority: AEPD (Spain)
The Spanish DPA (AEPD) imposed a fine of €6 million on CaixaBank S.A following complaints received from a customer of the bank in 2018 and from the non-profit organization ‘FACUA’ in 2019. CaixaBank infringed Articles 6, 13, and 14 of the GDPR.
Authority: Italian Data Protection Authority (Garante)
Company: Azienda socio sanitaria locale n. 3 di Nuoro
The Italian DPA has imposed a fine of EUR 13,000 on Azienda socio sanitaria locale n. 3 di Nuoro. An individual had filed a complaint with the DPA because the health authority had published their personal data (date of birth, residence, health-related data) on the internet in the context of a medication request. In the course of its investigation, the DPA found that the controller had published the data without a valid legal basis and therefore had acted unlawfully.
Authority: Austria
Company: anonymous
The Federal Administrative Court of Austria held that the Austrian Data Protection Authority only has the power to declare processing activities unlawful in proceedings following a complaint, and not when they were initiated by the DSB itself.
Authority: HDPA (Greece)
Company: Infinity Pack
After the data subject had withdrawn a complaint, the Hellenic DPA continued with an ex officio investigation into the sending of unauthorized advertising messages and issued a reprimand on the controller for violation of Article 5(1)(a) GDPR.
Authority: Netherlands
Company: SAMEN VEILIG MIDDEN-NEDERLAND
The District Court of Central Netherlands (Rb. Midden-Nederland) held that the child protection service Samen Veilig was wrong to limit the complainant's access request. Samen Veilig did not strike the right balance in their assessment of the interests at stake.
Authority: Hellenic Data Protection Authority (HDPA)
Company: Ministry of Rural Development and Food
The Hellenic DPA has imposed a fine of EUR 25,000 on the Ministry of Rural Development and Food for failing to appoint a data protection officer and not sufficiently cooperating with the DPA.
Authority: Spanish Data Protection Authority (aepd)
Company: EDUCANDO JUNTOS SL
The Spanish DPA (AEPD) has imposed a fine of EUR 9,000 on EDUCANDO JUNTOS SL. The controller had published photos of an employee on some of its channels on social networks and its website. However, the controller had published the photos without having obtained the consent of the data subject. For this reason, the data subject repeatedly requested the removal of the photos from the social networks and the website. However, the controller did not comply with this request. The fine is made up of EUR 6,000 for a violation of Art. 6 (1) GDPR and EUR 3,000 for a violation of Art. 17 GDPR.
Authority: Garante per la protezione dei dati personali (Italy)
Company: ISWEB S.p.A
The Italian DPA fined a processor €40,000 for violating Article 28(2) GDPR by engaging a sub-processor without specific authorisation from the controller.
Authority: Spanish Data Protection Authority (aepd)
Company: Sports Bar
The sports bar operated a video surveillance system in which the observation angle of the cameras extended into the public traffic area.
Authority: Germany
The court holds that the obligation to provide contact details in restaurants during the corona pandemic is legitimate in summary review.
Authority: Spanish Data Protection Authority (aepd)
Company: EXPLOTACIONES HOSTELERAS Y DE OCIO ALBACETEÑAS, S.L.
The Spanish DPA has imposed a fine of EUR 2,000 on EXPLOTACIONES HOSTELERAS Y DE OCIO ALBACETEÑAS, S.L.. The controller had installed video surveillance cameras which, among other things, also covered the public space. The DPA considered this to be a violation of the principle of data minimization. The DPA also found a breach of the controller's obligation to provide sufficient information on data processing under Art. 13 GDPR.