Sebastyijan/gdpr-enforcement-sample huggingface dataset:
Authority: Italian Data Protection Authority (Garante)
Company: GEDI News Network Spa
The Italian DPA (Garante) has imposed a fine of EUR 20,000 on GEDI News Network Spa. A data subject filed a complaint with the Italian DPA against the controller regarding an article published by the latter in which he was referred to. In this context, the data subject exercised his right under Art. 17 GDPR and requested the deletion of the article, considering it no longer relevant. However, the controller did not respond to the data subject's request in a timely manner.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Italian National Social Security Institute (“INPS”) vs. anonymous 
The Italian Data Protection Authority (“Garante”) found that the personal data breach the online portal of the INPS suffered was likely to result in a high risk to the rights and freedoms of the natural persons concerned, hence requiring a notification to the data subjects under Article 34 GDPR.
Authority: AEPD (Spain)
The DPA fined a councillor €600 for publishing a data subject's personal data in a Facebook group with 400 people without a legal basis. The personal data was contained in a note of a municipal plenary session handling a complaint by the data subject.
Authority: Sweden
Company: The Swedish DPA IMY
The Swedish Supreme Administrative Court ruled that the DPA's decision not to investigate a complaint can be appealed.
Authority: Spanish Data Protection Authority (aepd)
Company: Homeowners' association
The Spanish DPA has imposed a fine on a Homeowners' association. The association had installed video surveillance cameras which, among other things, also covered the public space. The DPA considered this to be a violation of the principle of data minimization. The DPA also found a breach of the controller's obligation to provide information on data processing under Art. 13 GDPR. The original fine of EUR 1000 was reduced to EUR 600 due to the voluntary payment and the acknowledgement of responsibility.
Authority: Data Protection Authority of Berlin
Company: Deutsche Wohnen SE
In addition to sanctioning violations of privacy by design principles (Art. 5 GDPR, Art. 25 GDPR - see separate entry), the Berlin data protection commissioner imposed further fines of between 6,000 and 17,000 euros on the company for the inadmissible storage of personal data of tenants in 15 specific individual cases.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: LEGAL COMPANY & TAX HUB SRL
The fine was imposed because adequate technical and organizational measures to ensure a level of security appropriate to the risk of processing were not implemented. This has led to unauthorized disclosure and unauthorized access to the personal data of people who have made transactions received by the avocatoo.ro website (name, surname, mailing address, email, phone, job, details of transactions made), due to publicly accessible documents between 10th of December 2018 and 1st of February 2019.

The National Supervisory Authority applied the sanction following a notification dated 12th of October 2018 indicating that a set of files regarding the details of the transactions received by the avocatoo.ro website which contained the name, surname, address correspondence, email, telephone, job and details of transactions made, was publicly accessible through two links.
Authority: Spanish Data Protection Authority (aepd)
Company: WATIUM S.L.
The Spanish DPA has fined WATIUM S.L. for failing to provide information requested by the DPA. The original fine of EUR 160,000 was reduced to EUR 96,000 due to voluntary payment and acknowledgement of responsibility.
Authority: NAIH (Hungary)
Company: Magyar Éremkibocsátó Kft.
The Hungarian DPA fined a company €73,500 for using consent as general authorization to use personal data for any purposes and for failing to properly inform data subjects about separate processing purposes, including Google and Facebook advertisements.
Authority: AKI (Estonia)
Company: Nura OÜ 
The DPA issued a warning to a controller along with an order to provide two patients with information on their medical treatment after failing to respond to their access requests.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Azienda Ospedaliera Complesso Ospedaliero San Giovanni – Addolorata
The DPA issued a reprimand against a hospital. It held that data about the symptoms of an employee who is on sick leave are health data and forwarding such data to the hospital’s general director is unnecessary for the purposes of finding a replacement for the employee.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Med Life S.A.
The Romanian DPA has imposed a fine of EUR 1,000 on Centrul Medical dr. Furtună Dan. The controller had sent results of a medical test via WhatsApp to the wrong recipient. As a result, personal data of the data subject, such as first and last name, telephone number and medical data, were unauthorizedly disclosed to third parties. The DPA found that the controller had failed to implement adequate technical and organizational measures to protect personal data.
Authority: Hellenic Data Protection Authority (HDPA)
Company: Allseas Marine S.A.
The data protection supervisory authority has fined the extent to which employee data are processed by a video surveillance system in the workplace, the fact that the introduction of the video surveillance system was unlawful and the fact that the company did not sufficiently inform its employees about it.
Authority: IMY (Sweden)
The Swedish DPA reprimanded a controller for violating Article 9 GDPR by publishing sensitive data in its background check database, such as information about compulsory care due to mental illness and addiction.
Authority: Germany
Company: Anonymous
The Administrative Court of Gießen ruled that an insolvency administrator has no right of access on behalf of a debtor.
Authority: AEPD (Spain)
Company: XFERA MÓVILES, S.A.
The Spanish DPA (AEPD) fined XFERA MÓVILES, S.A. €40000 for violating Article 6(1) GDPR by illegally processing personal data of the claimants in a fraudulent hiring. The defendant was not sufficiently diligent in verifying the identity of the persons hiring two telephone lines.
Authority: HDPA (Greece)
The Hellenic Data Protection Authority (HDPA) fined politician € 2.500 for sending unsolicited political SMSs to people without their consent.
Authority: Spanish Data Protection Authority (aepd)
Company: BILBAO AD INFINITUM, S.L.
The Spanish DPA has fined BILBAO AD INFINITUM, S.L. EUR 500. The controller had installed video surveillance cameras which, among other things, also covered the public street. The DPA considered this a violation of the principle of data minimization.
Authority: AEPD (Spain)
Company: Wenance Lending de España S.A.
The DPA fined a fintech company €72,000 after its inadequate measures to verify its customer’s identity enabled fraudsters to take out a loan in the name of an unaware data subject.
Authority: Czech Data Protection Auhtority (UOOU)
Company: Legal Person
The Czech DPA has imposed a fine of EUR 2,000 on a legal person. The accused provided the data subject with access to their personal data only after being requested to do so by the Office. However, the accuseed did not provide them with access to all the data it processed about them.
Authority: Netherlands
Company: AVROTROS
The District Court of Central Netherlands (Rb. Midden-Nederland) held in a preliminary ruling that AVROTROS can broadcast an episode of the television program 'Opgelicht?!', in which the plaintiff was recognizably portrayed. The interest of AVROTROS as a public watchdog prevailed over the interest of the plaintiff.
Authority: Spanish Data Protection Authority (aepd)
Company: CAJA RURAL GRANADA, S.C.C.
The Spanish DPA has imposed a fine on CAJA RURAL
GRANADA, S.C.C.. The controller had suffered a cyber attack in which the attackers were able to access customer data due to a security vulnerability in its systems. The DPA found that the company had failed to implement the necessary security measures that could have prevented such an incident. The original fine of EUR 15,000 was reduced to EUR 12,000 due to voluntary payment.
Authority: Italian Data Protection Authority (Garante)
Company: Private individual
The Italian DPA has imposed a fine of EUR 1,000 on a private individual. Two individuals had filed a complaint with the DPA due to the fact that the controller had published personal data of them and their families in their dissertation. The individuals had participated in treatments conducted by the controller, but they had not consented to the publication of their data in the dissertation in an unanonymized form.
Authority: Austria
A court held that the refusal of the DPA to examine the 20 complaints, filed by a data subject against different controllers over several months, was lawful, as the complaints were excessive.
Authority: APD/GBA (Belgium)
Company: Complainant: Mr. X
The Data Protection Authority decided that cases concerning camera surveillance by neighbours are to be dealt with by the police, due to the Act of March 2007 (regulating the installation of surveillance cameras).
Authority: Spanish Data Protection Authority (aepd)
Company: THE PHONE HOUSE SPAIN, S.L.
The Spanish DPA has imposed a fine of EUR 6.5 million on THE PHONE HOUSE SPAIN, S.L. The controller had suffered a ransomware attack affecting personal data of 13 million individuals (e.g. customers and employees), which was exfiltrated and published on the deep web. The DPA's investigation revealed that the controller had failed to implement appropriate technical and organisational measures to protect personal data, in order to prevent such an incident.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Banca di Credito Cooperativa di Spinazzola
The DPA held that a data subject has a right to access their data regardless of the purpose of the request. The controller shall not assume a purpose and refuse to act on the basis that such a purpose is illegitimate.
Authority: Bulgarian Commission for Personal Data Protection (KZLD)
Company: Telecommunication service provider
Repeated registration of prepaid services without the knowledge and consent of the data subject

Employees of the telecommunications provider have used personal data and registered the complainant with the company's prepaid service. The data subject had not signed the application and had not consented to the processing of his personal data for the stated purpose. There was also no other legal basis applicable. The signature of the application and the complainant own genuine application were not identical and the persons personal identification number was indicated, but the identity card number was not the complainants one.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: LORIS FUEL SHOP SRL
The Romanian DPA has imposed a fine of EUR 1,000 on the gas station operator LORIS FUEL SHOP SRL.  

A person had filed a complaint with the DPA because pictures of him were published on Facebook. The images originated from a video surveillance system installed in one of the controller's gas stations.

During its investigation, the DPA found that the controller had not taken sufficient technical and organizational measures to ensure the confidentiality of the personal data generated through the CCTV system installed in the gas stations. This resulted in unauthorized third parties filming the images from the video cameras and subsequently publishing them on social networks.
Authority: Spanish Data Protection Authority (aepd)
Company: Private individual
The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space. The DPA considered this to be a violation of the principle of data minimization. In addition, the controller had not properly informed the data subjects about the processing of the data by the video surveillance and thus violated its duty to inform
Authority: Austria
An Austrian Court ruled that, as the GDPR does not apply to legal persons, a company cannot rely on GDPR provisions to lodge a complaint. The court confirmed DPA’s decision to dismiss the complaint that was lodged after the time limitation period under the national law already expired.
Authority: United Kingdom
Company: WM MORRISON SUPERMARKETS PLC
Employee unlawfully disclosed personal data of 99,998 employees on file-sharing website to take personal revenge. Employer was held vicariously liable by data subjects. The court confirmed the link between offence and employment, and employer was vicariously liable.
Authority: Spanish Data Protection Authority (aepd)
Company: General Confederation of Labour ('CGT')
The CGT, with the aim of convening a meeting, e-mailed personal data of the complainant, including her home address, family relationship, pregnancy status and the date of an ongoing verbal abuse and harassment case, to 400 union members without her consent.
Authority: Spanish Data Protection Authority (aepd)
Company: VACACIONES EDREAMS, S.L.
The Spanish DPA has imposed a fine of EUR 10,000 on VACACIONES EDREAMS, S.L.. A data subject had filed a complaint against the controller with the DPA due to the controller's failure to properly comply with their request for access to their personal data.
Authority: French Data Protection Authority (CNIL)
Company: Candidate for parliamentary elections
The French DPA has imposed a fine on a candidate for parliamentary elections. The candidate had sent the data subject election advertising by email despite the data subject's objection.
Authority: Dutch Supervisory Authority for Data Protection (AP)
Company: Experian Nederland B.V.
The Dutch DPA has imposed a fine of EUR 2,700,000 on Experian Nederland B.V. The controller, a company that determines individuals' creditworthiness and sells this information, processed personal data without a sufficient legal basis. The controller also failed to inform data subjects about the processing of their data. Following the decision, the company decided to stop its activities in the Netherlands and will delete its database by the end of the year.
Authority: Belgian Data Protection Authority (APD)
The Belgian DPA (APD) imposed a fine of EUR 50,000 on a company for several violations of the GDPR. The controller is a company that carries out parking ticket controls. The controller controller  had issued the data subject a fine for illegal parking. However, the data subject states that he or she did not receive the fine ticket. Instead, the data subject only found out about it when he or she received an official reminder letter from a law firm commissioned with debt collection, which then demanded payment of the reminder fee in addition to the original fine. The data subject then contacted the company and demanded, among others, information about which of his/her personal data had been processed. After this request was not properly fulfilled in a timely manner, the data subject filed a complaint against the controller 

During its investigations the DPA discovered that the controller  violated several GDPR provisions. Firstly the DPA found that the controller  failed to provide a proper privacy policy. The privacy policy on the controller´s website did not contain any information regarding the processing of personal data nor any contact information of the company. Secondly, the controller violated the data subject's right to information by failing to comply with the data subject's request for information on data processing. Lastly the controller infringed the principle of minimasation by processing the data subject's data for the purpose of sending a payment reminder only one day after the ticket had been issued even though the data subject had the opportunity to pay the fine without such a reminder at that time.
Authority: APD/GBA (Belgium)
The DPA issued a warning against an embassy for, among other things, not giving access to the identity of an employee who made an unauthorized consultation of the data subject’s personal data.
Authority: French Data Protection Authority (CNIL)
Company: Clearview Al Inc.
The French DPA has fined Clearview Al Inc. EUR 20,000,000. The company holds a database of more than 20 billion facial images (including those of french residents and nationals) from around the world. The data is collected online from publicly accessible platforms such as social networks. The company offers a search service that allows individuals to  be identified based on the biometric data extracted from the images. Individuals' profiles can be enriched with information associated with those images, such as image tags and geolocation. 

In the course of its investigation the DPA found that the personal data contained in the company's database had been processed unlawfully and without a valid legal basis.

In addition, the DPA found that Clearview AI restricted the exercise of data subjects' rights. 
For example, it limited the exercise of data subjects' rights to twice a year without justification. Also, data subjects had to submit several requests before one was answered. Moreover, requests were often not answered at all or only inadequately. 

Finally, the DPA criticized the cooperation of Clearview AI. The company did not respond to investigation forms at all or only very incompletely.
Authority: ANSPDCP (Romania)
Company: Technoplus Industry SRL
The Romanian DPA fined Tehnoplus Industry SRL a total of €5,000 for various violations of Articles 5 and 6 GDPR in relation to the processing activities performed through GPS trackers installed on company cars.
Authority: Spanish Data Protection Authority (aepd)
Company: Private individual
The Spanish DPA has fined a private individual. An individual had filed a complaint with the DPA because another individual had written reviews on the internet using a photo of them and their name without their consent. The original fine of EUR 1,000 was reduced to EUR 600 due to voluntary payment and admission of responsibility.
Authority: Spanish Data Protection Authority (aepd)
Company: PLATAFORMA CABANILLAS SA.
The Spanish DPA imposed a fine of EUR 100,000 on PLATAFORMA CABANILLAS SA. The controller is requesting criminal record certificates from potential employees before inviting them to a job interview. This infringes the principle of data minimisation.
Authority: Spanish Data Protection Authority (aepd)
Company: Xfera Moviles S.A.
The AEPD found that a third party had access to the name, telephone number and address of another customer.
Authority: IDPC (Malta)
The Maltese DPA decided that a controller, sending personal schoolwork to a data subject's personal email adress with other people in the "cc", is an infringement of Article 5(1)(f) and 32(1)(b) GDPR.
Authority: Italian Data Protection Authority (Garante)
Company: Azienda ULSS n.5 Polesana
The Italian DPA has imposed a fine of EUR 5,000 on Azienda ULSS n.5 Polesana. The healthcare facility had mistakenly sent a patient medical record to the wrong patient. The DPA found that the healthcare facility had not taken sufficient technical and organizational measures to protect personal data, which allowed such an incident to occur.
Authority: Datatilsynet (Denmark)
Company: Statistics Denmark 
The Danish DPA (Datatilsynet) expressed criticism towards Statistics Denmark for failing to update a list with people who were not willing to participate in voluntary surveys, in accordance with the Article 5(1)(d) of the GDPR.
Authority: Poland
The Polish Supreme Administrative Court held that the Polish DPA should make a data minimisation assessment on the necessity of processing a data subject's phone number for the collection of debts.
Authority: Germany
The Administrative Court Bremen upheld the decision of a DPA to order the erasure of all personal data of a politician, which was recorded in an advisory board meeting and subsequently published on a website, as the processing lacked a legal basis under Article 6 GDPR.
Authority: Datainspektionen (Sweden)
The Swedish DPA (Datainspektionen) issued a fine of approximately €392000 at the Educational Board of Stockholm after receiving many complaints that the new IT system "Skolplattformen", used for education administration, has suffered data breaches.
Authority: Spanish Data Protection Authority (aepd)
Company: EL DIARIO DE PRENSA DIGITAL SL.
The Spanish DPA has imposed a fine of EUR 50,000 on EL DIARIO DE PRENSA DIGITAL SL.. Several media outlets, including the controller had published an audio recording of a multiple rape victim's testimony in court on their websites as well as on Twitter to report on the case. The case had attracted a lot of media attention. During its investigation, the DPA determined that the rape victim's right to privacy outweighed the controller's freedom of information. The audio recordings of the victim did not add any significant value to the reporting, but rather severely compromised the victim's privacy. For this reason, the DPA found that the controller violated the principle of data minimization.
Authority: Austria
A court held that a medical diagnosis is a subjective professional opinion and not factual information; the diagnosis can therefore not be subject to the right to rectification under Article 16 GDPR.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Comune di Brescia
The DPA fined a municipality €10,000 for unlawfully placing the parents' surnames and date of termination of pregnancy, without their authorization, on several fetuses' graves and in the online portal of the cemetery.
Authority: Netherlands
Company: Dutch Minister of Social Affairs and Employment
The Regional Court of Amsterdam ordered the Dutch Ministry of Social Affairs and Employment to reevaluate its withholding of official information since it had not sufficiently justified the nature of the withheld personal data while ensuring compliance with Article 9 GDPR.
Authority: ICO (UK)
Company: Birmingham Children's Trust Community Interest Company
The DPA issued a reprimand to the Birmingham Children’s Trust Community Interest Company for a data breach related to the production of a child care protection plan that included inappropriate personal data in the form of criminal allegations against a child.
Authority: Spanish Data Protection Authority (aepd)
Company: Private Individual
The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on a private individual. That private individual had published personal data of the data subject on a website without her permission. The data included photos, personal notes and information about the sexual relationship between the controller and the data subject. The DPA finds that the controller processed these data without a valid legal basis and thus violated Art. 6 (1) a) GDPR.
Authority: Spanish Data Protection Authority (aepd)
Company: SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.
The Spanish DPA has imposed a fine of EUR 70,000 on SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.. A customer had filed a complaint with the DPA due to the fact that the controller carried out a change of their electricity and gas supply company without obtaining their consent beforehand.
Authority: Spanish Data Protection Authority (aepd)
Company: GOHIPOTECA, S.L.
The Spanish DPA has imposed a fine of EUR on GOHIPOTECA, S.L. The controller processed data of a data subject without a sufficient legal basis. The contract used as the basis for the processing was signed by the data subject's spouse, which was not sufficient. The original fine of EUR 2,000 was reduced to EUR 1,200 due to immediate payment and admission of responsibility by the controller.
Authority: Austria
The Supreme Administrative Court confirmed that the first layer of a website’s cookie banner must provide the option to close the cookie banner without giving consent. This option must be visually equivalent to the option to consent.