Sebastyijan/gdpr-enforcement-sample huggingface dataset:
Authority: ANSPDCP (Romania)
The Romanian DPA fined an employer €1,000 after it unlawfully processed its employees' personal data by making an appointment on their behalf for a COVID-19 vaccination without their consent.
Authority: Italian Data Protection Authority (Garante)
Company: Libero Consorzio comunale di Caltanissetta
The Italian DPA has imposed a fine of EUR 2,000 on Libero Consorzio comunale di Caltanissetta for failing to provide the DPA with the contact details of their data protection officer in good time.
Authority: CNPD (Luxembourg)
The Luxembourg DPA (CNPD) imposed a fine of €5300 on a company for using a video camera surveillance system on its premises and tracking devices in some of its employees' vehicles in breach of the information obligation set out in Article 13 GDPR and in breach of the principle of data minimisation set out in Article 5(1)(c) GDPR.
Authority: IP (Slovenia)
Company: Anonymous
The Slovenian DPA (IP) issued a non-binding opinion under Article 58(3) GDPR regarding the lawfulness of processing of a photograph. The IP clarified that a photograph can be considered personal data, especially when a photo depicts an individual clearly and unambiguously allowing for their identification. Such processing must be based on a consent under Article 6(1)(a) GDPR collected in advance of such processing.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Wind Tre SpA
The telephone operator Wind Tre was fined 16,729,600 EUR by the Garante (Italian DPA) for several incidents of unlawful collection, processing and unauthorised marketing communications to customers. The Garante also prohibited Wind Tre from carrying out any further processing of the data they had acquired without consent.
Authority: AEPD (Spain)
Company: Conseguridad SL
The Spanish DPA (AEPD) imposed a fine of €50000 on Conseguridad SL for not having a data protection officer in violation of Article 37(1)(b) GDPR in conjunction with Articles 34(1)(ñ) and 34(3) LOPDGDD.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: EURO MINI STORAGE ROMANIA SRL
The Romanian DPA has imposed a fine of 5,000 euros on EURO MINI STORAGE ROMANIA SRL. The controller had suffered a data breach in which customer data was accessed without authorization. During its investigation, the DPA found that the controller had failed to take appropriate technical and organizational measures to prevent such an incident.
Authority: AEPD (Spain)
Company: Spanish self-employed entrepreneur
24 July 2020 - The Spanish Data Protection Agency (AEPD) decided to impose a warning on a Spanish self-employed entrepreneur (the defendant) for the infringement of its collaboration duties as per Article 58(2) of the GDPR.
Authority: ANSPDCP (Romania)
Company: Libra Internet Bank SA
The Romanian authority fined a bank approximately 11.000€ for failing to properly answer an access request. (The controller did not share a copy of all the data held about the data subject, including some video recordings, did not send the personal data in the format required by the data subject and did not respect the format requirements of Article 12(4).
Authority: Spanish Data Protection Authority (aepd)
Company: SEAN SERIOS S.L.
The Spanish DPA has imposed a fine of EUR 12,000 on SEAN SERIOS S.L. The controller had published the results of a selection procedure on a website. This included, among other things, personal data of the participants, such as surname, first name and score in the selection process. In the course of its investigation, the DPA found that the controller did not have a sufficient legal basis for publishing the data.
Authority: Netherlands
Company: Minister of Agriculture, Nature and Food quality
The District Court of Midden-Nederland held that to comply with an article 15(1) GDPR request a copy of documents did not need to be provided and that an overview was sufficient if the personal data processed was the data subject's name, address and contact details.
Authority: CNPD (Portugal)
Company: Instituto Nacional de Estatística
The Portuguese DPA fined the Portuguese National Statistics Institute €4,300,000 for multiple GDPR violations. Among the others, the Institute processed special categories of personal data without a legal basis, did not conduct a proper DPIA and provided insufficient information regarding its processing operations.
Authority: Italian Data Protection Authority (Garante)
Company: Intesa Sanpaolo Vita S.p.a.
The Italian DPA has fined Intesa Sanpaolo Vita S.p.a. EUR 20,000. The data subject, who had taken out a life insurance policy with the controller, had filed a complaint with the DPA against the controller for the unauthorized disclosure of their personal data. In the course of its investigation, the DPA found that the controller had disclosed personal data, such as first name, last name and information about the policy, to third parties without authorization. The unauthorized disclosure had occurred due to an employee's error.
Authority: Norwegian Supervisory Authority (Datatilsynet)
Company: T. Stene Transport AS
The Norwegian DPA has fined T. Stene Transport AS EUR 3,900 due to an unfair credit check on a data subject.
Authority: Spanish Data Protection Authority (aepd)
Company: Store owner
The Spanish DPA (AEPD) has fined a store owner EUR 1,000 for failing to provide information signs about CCTV surveillance in the establishment.
Authority: AEPD (Spain)
Company: Caja Rural de Jaén, Barcelona y Madrid, Sociedad Cooperativa de Crédito
A Spanish financial institution was fined €500,000 for failing to ensure the confidentiality and security of customer data under Article 5.1(f) GDPR. A cyberattack exposed sensitive data due to inadequate security measures, violating Article 32 GDPR.
Authority: ANSPDCP (Romania)
Company: SC Spark Car Sharing SRL 
The Romanian DPA fined a car sharing company approximately EUR 1,000 for sending marketing communications without a legal basis, and for continuing to send communications to a data subject after they submitted a data deletion request with the controller.
Authority: Germany
Company: Facebook
A court ordered Facebook to erase files documenting the blocking of the data subject's account, because the data was outdated and was not necessary for the legal defence of legal claims or quality assurance.
Authority: AEPD (Spain)
A building association was fined €1,000 for posting the minutes of their general assembly containing a list of debtors in the building lobby, in violation of Article 5(1)(f) GDPR.
Authority: Italian Data Protection Authority (Garante)
Company: H&M Hennes & Mauritz s.r.l. EUR 50,000
The Italian DPA has fined H&M Hennes & Mauritz s.r.l. EUR 50,000. H&M had installed numerous video surveillance systems in its Italian stores for the purpose of preventing theft and ensuring the safety of its employees. Each store was equipped with at least three video surveillance cameras that were active 24/7 and also covered employee areas. During its investigation, the DPA found that the video surveillance systems were being operated without the required authorization and therefore unlawfully.
Authority: Garante per la protezione dei dati personali (Italy)
The DPA fined the Municipality of Curtarolo €15,000 for unlawfully using video surveillance footage in order to investigate the behaviour of one of its employees.
Authority: National Commission for Data Protection (CNPD)
The DPA from Luxembourg (CNPD) has imposed a fine of EUR 7,200 on a company. The company had installed a video surveillance system to protect the company's assets, prevent intrusion by unauthorized persons and prevent accidents. However, the cameras also captured parts of an employee's work area and the smoking area that employees frequently used. Furthermore, the controller had installed location sensors on the cars in its fleet. This was intended to optimize the company's operations.

The DPA finds that the recording of employees was not necessary to ensure the purposes associated with the video surveillance and was therefore disproportionate. The DPA states that the controller thus violated the principle of data minimization under Article 5 (1) c) of the GDPR.

The location data collected by the controller was stored for a period of eight months, although this would not have been necessary for the purposes of the processing. The DPA considered this to be a violation of the principle of data retention. 

Furthermore, the DPA found a violation of the information obligations set out in Art. 13 GDPR. 

Finally, the DPA found a violation of Art. 32 (1) GDPR. All persons who had authorized access to the software via which the locations could be tracked used the same account and not an individual account.
Authority: NAIH (Hungary)
The Hungarian DPA issued a reprimand against a controller for the unlawful recording and sharing of a private conversation between two parents and a daycare employee which contained special categories of data.
Authority: Persónuvernd (Island)
The Icelandic DPA imposed a fine in the amount of €13,270 (ISK 2,000,000) on the City of Reykjavík for several GDPR violations in relation to the use of Google Cloud Services in primary schools.
Authority: National Commission for Data Protection (CNPD)
The DPA from Luxembourg (CNPD) has imposed a fine of EUR 7,600 on a company. This company had installed a video surveillance system for the purpose of protecting the company's assets, preventing intrusion by unauthorized persons and preventing accidents. However, two of the cameras also covered parts of a public street and six of the cameras covered the workplaces of some employees 
The DPA states that the recording of the employees and the public street was not necessary to ensure the purposes associated with the video surveillance and was therefore disproportionate. The DPA finds that the controller thus breached the principle of data minimization under Article 5(1)(c) of the GDPR.
In addition, the DPA found that the controller had not complied with its information obligations under Article 13 GDPR.
Authority: HDPA (Greece)
The DPA fined a controller €2,000 for illegally using geolocation data of their employee outside the latter’s working hours.
Authority: ICO (UK)
Company: Staines Health Group
The DPA reprimanded a clinic for sharing 23 years' worth of medical records based on a patient’s request to transmit the records of the last 5 years to their insurer. Furthermore, the DPA found that the clinic failed to ensure security of processing and to report a data breach in time.
Authority: Germany
A Court held that a telecom provider lawfully disclosed information about the conclusion of a contract to the credit information agency SCHUFA. The telecom provider could base this disclosure on its legitimate interest to prevent fraud attempts.
Authority: Italian Data Protection Authority (Garante)
Company: Istituto Comprensivo Statale Crucoli Torretta
Publication of personal data of students on the website of the Institute with, inter alia, notes about health and progress in school due to technical failure.
Authority: Persónuvernd (Iceland)
The Icelandic DPA held that a controller was not permitted to disclose personal information about the complainant from a non-conclusive judgment to a credit rating company. Additionally, the credit rating company was not permitted to process information on the complainant's claim in its default register.
Authority: Germany
Company: E (the controller)
A court held that Article 15 GDPR does not entitle employees to a complete copy of an internal investigation report, only a right to inspect the report in the personnel file.
Authority: CNIL (France)
Company: Amazon France Logistique
The French DPA, by conducting on-site inspections in Amazon France Logistique warehouses, found violations of Article 6, 5(1)(c),12, 13 and 32 GDPR in the context of extensive workplace surveillance and issued a €32 million fine.
Authority: VDAI (Lithuania)
The DPA clarified that direct marketing and political advertising are distinct and incompatible purposes for processing personal data, and warned a politician over unlawful political advertising.
Authority: Spanish Data Protection Authority (aepd)
Company: DHL PARCEL IBERIA, S.L.
The Spanish DPA has imposed a fine of EUR 3,000 on DHL PARCEL IBERIA, S.L. The conroller printed the private phone number of the recipient on a parcel, making it visible to third parties. The original fine of EUR 5,000 was reduced to EUR 3,000 due to immediate payment and admission of responsibility by the controller.
Authority: Spanish Data Protection Authority (aepd)
Company: CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.
The Spanish DPA has imposed a fine of EUR 70,000 on CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.. The data subject had received a message from a debt collection company on behalf of Caixabank requesting payment of outstanding debts. However, the debt had been annulled, which was also confirmed in a court ruling. For this reason, the DPA determined that the disclosure of the data subject's personal data for the purpose of contacting them regarding the settlement of the debt was unlawful.
Authority: IMY (Sweden)
Company: Consulate General of Sweden in Istanbul
The DPA audited the Consulate General of Sweden in Istanbul and ordered it to address security issues related to the processing of physical documents and the verification of the identify of authorized personnel.
Authority: CNIL (France)
Company: SLIMPAY
The French DPA fined the payment service provider SLIMPAY €180,000 for failing to implement appropriate technical and organisational measures, and to report a data breach which affected over 12,000,000 data subjects.
Authority: Garante per la protezione dei dati personali (Italy)
The DPA fined a lawyer €500 for unlawfully processing a data subject's personal data by sending a letter regarding his divorce to the data subject’s company email address, accessible by all employees.
Authority: Spanish Data Protection Authority (aepd)
Company: SERVICIOS E INTERVENCIONES EN EDIFICACION DEL MEDITERRÁNEO, S.L.
The Spanish DPA has imposed a fine on SERVICIOS E
INTERVENCIONES EN EDIFICACION DEL MEDITERRÁNEO, S.L.. An individual had filed a complaint with the DPA due to the fact that the company had published a picture of themselves without their permission. The original fine of EUR 2,000 was reduced to EUR 1,200 due to voluntary payment and admission of responsibility.
Authority: France
Company: Cdiscount
The French Supreme Administrative Court (Conseil d’Etat) held that the French DPA (CNIL) lawfully issued a guideline ("recommendation") on consent to storage of customer's credit card data by e-commerce websites. The Court also found that said websites do not have a legitimate interest to store credit card data under Article 6(1)(f) GDPR.
Authority: DBEB/AVPD (Basque Country)
The Basque DPA held that Articles 6(1)(c) and 6(1)(e) GDPR supplied a legal basis for a local police force to include personal data in files sent to the Chief of the Police, the Mayor’s Office, and the Councilman of Citizen Security. It is still assessing whether this practice complies with the principle of data minimisation.
Authority: Germany
A court held that a social network is not obligated to erase files documenting the blocking of the data subject's account when data could be needed for future legal disputes.
Authority: ANSPDCP (Romania)
Company: IA BILET SRL
The DPA fined an online shop RON 9,951.40 (€2,000) for the excessive deletion of the data subject's complete account after they had objected to the processing of their phone number for direct marketing purposes.
Authority: AEPD (Spain)
Company: Congosto de Valdavia City Council
The Spanish data protection authority (AEPD) held that a city council was in breach of GDPR data integrity and confidentiality principles by publishing a census containing individuals' names, surnames and ID card numbers online and on the council notice board.
Authority: Netherlands
Company: Microsoft Ireland Operations Limited
The District Court of Amsterdam held that it lacked jurisdiction in a case concerning the removal of URL's from Amazon's search engine, as the claimant had not sufficiently demonstrated that his 'centre of interests' was in the Netherlands. The fact that the claimant is director and sole shareholder of a company established in the Netherlands was insufficient.
Authority: Spanish Data Protection Authority (aepd)
Company: BASER COMERCIALIZADORA DE REFERENCIA, S.A.
The Spanish DPA has fined BASER COMERCIALIZADORA DE REFERENCIA, S.A., EUR 150,000. A customer of the company had filed a complaint with the DPA since their electricity supply contract was modified without their consent. This resulted in an increase in the electricity supply. In the course of its investigations, the DPA found that a fraudster had pretended to be the data subject by providing the name and ID number of the data subject. In this way, they were able to modify the data subject's contract. 

According to the DPA, the controller had not properly verified the identity of the fraudster before modifying the contract and, due to a lack of sufficient security measures, had not made sure that the inquirer was actually the data subject.
Authority: Spanish Data Protection Authority (aepd)
Company: Private individual
The Spanish DPA (AEPD) has imposed a fine of EUR 240 on a private individual. The controller had installed video surveillance cameras without properly informing data subjects.
Authority: HDPA (Greece)
The HPDA found that a Nautical Club unlawfully processed biometric data via an access control system and failed to conduct a DPIA, imposed €56,000 in fines, and ordered suspension of processing until a DPIA is completed.
Authority: DSB (Austria)
The Austrian DPA held that the operator of a search engine must delete a link to a database which contains the home address of the data subject if the latter fears for his physical integrity after receiving a death threat.
Authority: UODO (Poland)
The Polish DPA (UODO) find the company Morele.net €660000 for violating the principle of data confidentiality and failing to ensure the security and confidentiality of personal data processed.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Bitfactor SRL
The Romanian DPA has imposed a fine of EUR 2,000 on Bitfactor SRL. 
The controller had notified the DPA of a data breach pursuant to Art. 33 GDPR. 
Due to a malfunction of an application of the controller, marketing messages were sent to users of the website, resulting in a breach of confidentiality of the personal data concerning 1757 data subjects.
During its investigation, the DPA found that the controller did not take adequate technical and organizational measures to protect the personal data of the data subjects.
Authority: European Union
The CJEU held that when a data breach has been established, DPAs are not required to exercise a corrective power under Article 58(2) GDPR, where it is not appropriate, necessary or proportionate to remedy the shortcoming found.
Authority: Commissioner (Cyprus)
Company: Housing Finance Corporation
The DPA fined a bank €10,000 for storing inaccurate data of the data subject beyond the statutory retention period. As well as for failing to implement meaningful and effective measures to ensure compliance with the GDPR.
Authority: Spanish Data Protection Authority (aepd)
Company: Vodafone España, S.A.U.
The Spanish DPA has imposed a fine of EUR 200,000 on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an unauthorized fraudulent third party without their consent. During its investigation, the DPA found that the company failed to verify the identity of the third party or obtain the data subject's consent to share their data. This allowed the fraudsters to gain access to the data subject's bank account and make unauthorized transactions.
Authority: AEPD (Spain)
Company: AYUNTAMIENTO DE TOBAR
The Spanish DPA (AEPD) issued a warning to the Town Hall of Tobar for publicly posting a list with the personal data of citizens on jury duty on a street. The DPA considered this a breach of Article 5(1)(f) GDPR.
Authority: AZOP (Croatia)
The Croatian DPA fined a car dealership approximately €4,000 for processing of personal data by a video surveillance system without prior notice.
Authority: Dutch Supervisory Authority for Data Protection (AP)
Company: Dutch Social Insurance Institution (SVB)
The Dutch DPA has imposed a fine of EUR 150,000 on the Dutch Social Insurance Institution (SVB). The controller had suffered a data breach in which a client's data had been leaked to unauthorized third parties. An unknown third party had succeeded in requesting benefit information via the controller's telephone helpdesk. In the course of its investigation, the DPA found that the controller had failed to implement sufficient technical and organizational measures to protect personal data. For example, the DPA found that the system for verifying the identity of callers was inadequate and verification questions were too simple.
Authority: BlnBDI (Berlin)
Company: Healy 
In an Article 60 GDPR decision, the Berlin DPA reprimanded a controller for the violation of Articles 6, 12(3) and 17 GDPR. In order to comply with an erasure request, the controller requested the data subject to log in with her customer account, which she did not have, because she was never a customer.
Authority: Italian Data Protection Authority (Garante)
Company: Immobiliare Riscostruzione Meloria s.r.l.
The Italian DPA has imposed a fine of EUR 2,000 on Immobiliare Riscostruzione Meloria s.r.l.. The controller had installed a video surveillance system at its office which covered parts of a common entrance to the building and thus also recorded residents of the building. During its investigation, the DPA found that the information sign regarding the video surveillance did not contain sufficient information on the purpose of the processing of personal data and the contact details of the data controller.
Authority: Italian Data Protection Authority (Garante)
Company: Educationest s.r.l.
The Italian DPA has fined Educationest s.r.l. EUR 1,000. The daycare center had sent an email to the families of the children in its care, informing them of the pregnancy and the maternity leave of one of the educators. The daycare center had written the e-mail to prevent rumors about the teacher's absence ( e.g. a covid illness) and to protect her. However, the educator had not consented to the disclosure of her pregnancy status. The DPA therefore found that Educationest had unlawfully processed the educator's data and violated Art. 5 GDPR and Art. 6 GDPR.
Authority: Spanish Data Protection Authority (aepd)
Company: Auto Desguaces Iglesias S.L.
The company had installed surveillance cameras that recorded the public road and therefore violated the principle of data minimization.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Selgros Cash & Carry SRL
The Romanian DPA has imposed a fine of EUR 3,000 on Selgros Cash & Carry SRL. The controller did not implement sufficient technical and organisational measures to ensure information security, resulting in a data breach.
Authority: UODO (Poland)
The Polish Data Protection Authority (PUODO) imposed a fine of approximately €443,000 on a mobile operator for not complying with the principles of data confidentiality and accountability set out in the GDPR.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Agenzia regionale protezione ambientale Campania
The Italian DPA (Garante per La Protezione Dei Dati Personali) fined the Agenzia Regionale Protezione Ambientale Campania (ARPAC) €8000 for the lack of appropriate security measures to prevent data breach.