Sebastyijan/gdpr-enforcement-sample huggingface dataset:
Authority: Datatilsynet (Denmark)
The Danish DPA held that an access request by a data subject asking his previous employer to provide all emails, notes and letters sent or signed by him was excessive according to Article 12(5)(b) GDPR, since it comprised a very large amount of personal data predominantly connected to his duties and not personal attributes.
Authority: Germany
Company: Tax Authority
The Financial Court of Berlin-Brandenburg held that data subjects must specify the data requested under Article 15(1) GDPR when the controller processes large amounts of data, and that a request concerning any type of data over a period of more than 50 years is excessive.
Authority: Information Commissioner (ICO)
Company: Cabinet Office
The UK DPA (ICO) has fined the Cabinet Office EUR 585,000. 

On December 27, 2019, the Cabinet Office published a file on GOV.UK containing the names and uncensored addresses of more than 1,000 individuals who had received New Year's honors. Individuals from a wide range of professions across the United Kingdom were affected, including individuals with a high public profile.

After learning of the data breach, the Cabinet Office removed the web link to the file. However, the file was still in the cache and was accessible online to people who had the exact website address.

The disclosed personal data was available online for two hours and 21 minutes and had been accessed 3,872 times.

The breach occurred due to an error in the setup of the Cabinet Office's new IT system. 

The ICO found that the Cabinet Office failed to take appropriate technical and organizational measures to ensure a level of protection appropriate with the risk to data subjects.
Authority: AEPD (Spain)
Company: ID Finance
The DPA fined a controller €180,000 because it lacked a legal basis to transfer data concerning a contested debt to a central solvency register and failed to erase the debt from the data subject's financial records.
Authority: Spanish Data Protection Authority (aepd)
Company: IBERCAJA BANCO, S.A.
The Spanish DPA imposed a fine of EUR 42,000 on IBERCAJA BANCO, S.A. During a bank transfer, the controller transmitted more data then necessary to the recipient of the payment. The original fine of EUR 70,000 was reduced to EUR 42,000 due to immediate payment and admission of responsibility by the controller.
Authority: Austria
Company: 1. unknown data subject (co-participant and complainant in the procedure before the DSB)
The Federal Administrative Court of Austria held that the Austrian DPA has to perform its own investigations when confronted with complaints and substantiate its decision accordingly.
Authority: AEPD (Spain)
Company: Novates Alimentacion Madrid 
A store was fined €12,000 for failing to implement appropriate access restrictions regarding CCTV footage, in violation of Article 32 GDPR.
Authority: Italian Data Protection Authority (Garante)
Company: I.N.P.A.S.
The Italian DPA has imposed a fine of EUR 3,000 on I.N.P.A.S. (Istituto Nazionale di Previdenza e di Assistenza Sociale). During its investigation, the DPA found that a former employee had access to databases containing personal data even after the termination of their employment relationship.
Authority: AEPD (Spain)
Company: PLATAFORMA CABANILLAS SA 
The DPA fined a logistics company €100,000 for requiring potential job candidates to provide criminal records and civil status documents prior to a job interview, in violation of the principle of data minimisation.
Authority: National Commission for Data Protection (CNPD)
The DPA of Luxembourg has imposed a fine of EUR 18,000 on a company. According to the DPA, the controller firstly failed to involve the data protection officer in all matters relating to the protection of personal data. Secondly, the controller failed to provide the data protection officer with the necessary resources to perform his duties.
Authority: French Data Protection Authority (CNIL)
Company: CALOGA
The French DPA imposed a fine of EUR 80,000 on CALOGA. The controller is a company obtaining data from data brokers to use those for marketing purposes. The DPA found multiple infingements against the GDPR and the French Post and Electronic Communications Code. The controller failed to have sufficient legal basis for transferring data to third parties for advertising purposes. Additionally, the controller retained data longer than necessary.
Authority: Datainspektionen (Sweden)
Company: Aleris  Sjukvård AB
The Swedish DPA (Datainspektionen) imposed a €1.466 million (approximately) fine on the healthcare provider "Aleris Sjukvård AB" for not carrying out the risk assessments required by the Patient Data Act and for granting their employees access to all personal data in the patients' journal system in breach of Article 32 GDPR.
Authority: Netherlands
The data subject launched an appeal seeking access to an anonymous tip that led to an investigation into her benefits. The court upheld the initial refusal.
Authority: Hellenic Data Protection Authority (HDPA)
Company: ALFA BANK S.A.
The Hellenic DPA has imposed a fine of EUR 20,000 on ALFA BANK S.A.. In the context of the use of certain debit/credit cards, information of the last 10 transactions were stored on the chip of the card without the customers' explicit consent. This information could be read out later. The DPA found that the bank had failed to inform affected customers about this storage of transaction information and therefore violated Art. 13 GDPR.
Authority: Austria
A court held that an online casino-game provider wrongfully dismissed an access requests by demanding a power of attorney signed with ink or with a qualified electronic signature, thus violating Article 12 GDPR.
Authority: ICO (UK)
Company: Yes Consumer Solutions Ltd
The UK DPA fined a controller approximately €200,000 (£170,000) for contacting almost 200,000 individuals who had registered their intent not to receive marketing calls with the Telephone Preference Service ('TPS'). In particular, the controller had failed to check datasets purchased from 11 third-party data providers against the TPS.
Authority: IP (Slovenia)
The Slovenian DPA found that a controller failed to display its video surveillance notice on its premises in a way that adequately notified data subjects of the video surveillance. As a result, the controller had failed to meet its informational obligations under domestic law.
Authority: Spanish Data Protection Authority (aepd)
Company: Homeowners Association
Usage of CCTV camera which also captured the public space in violation of the principle of data minimisation.
Authority: Netherlands
The Court of Appeal of Amsterdam ruled that the COVID-19 pandemic constituted a special situation that allowed the University of Amsterdam to introduce mandatory electronic surveillance during online exams. Neither the student council nor the faculty council had the right to be involved in the decision-making process.
Authority: Austria
Company: Data Subject versus Dun & Bradstreet Austria GmbH
The Supreme Administrative Court held that a credit information agency violated Article 15(1)(h) GDPR by failing to provide meaningful information about the logic and weighting of factors in its automated credit scoring process. Further, the Court found that the existence of trade secrets could not justify the refusal to provide such information.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Telekom Romania Mobile Communications S.A.
The Romania DPA (ANSPDCP) has fined Telekom Romania Mobile Communications S.A. EUR 10,000 for failing to implement adequate security measures to ensure the security of personal data processing. In particular, the ANSPDCP's investigation revealed that the controllers' failure to implement adequate security measures resulted in the unauthorized disclosure of the data of 99,210 data subjects, including their customer number, gender and telephone number, as well as unauthorized access to the personal data stored in the accounts of 413 customers. On this basis, the ANSPDCP ruled that the controller violated Art. 32 (1) and (2) GDPR.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Tensa Art Design S.A.
The Romanian DPA has imposed a fine of EUR 15,000 on Tensa Art Design S.A. The controller contacted a data for direct marketing purposes without consent. The controller also failed to adequately respond to a request from the data subject to exercise their rights.
Authority: Datatilsynet (Denmark)
Company: KMD A/S
The Danish DPA reprimanded a processor for violating Article 32(1) GDPR by not testing a new system functionality sufficiently, which led to foster parents gaining access to information about foster children.
Authority: UODO (Poland)
The Polish DPA (PUODO) imposed a fine of EUR 20,000 on a health care entrepreneur for failure to comply with an order imposed on him in an administrative decision. This decision had instructed the entrepreneur to notify its patients of the breach of their personal data and to provide them with recommendations on how to minimise the negative effects.
Authority: Austria
The Austrian Supreme Court rejected an erasure request by a data subject to delete approximately 3 years old data on unpaid invoices processed by a credit scoring agency for the purpose of creditworthiness assessments. The court found no violation of the principle of storage limitation or overriding interests of the data subject that would require the erasure of the data.
Authority: DPC (Ireland)
Company: WhatsApp Ireland Limited
The Irish DPA fined WhatsApp Ireland Limited €225,000,000 for negligently violating Articles 5(1)(a), 12, 13 and 14 GDPR. It ordered the company to bring its processing operations into compliance within 3 months.
Authority: Data Protection Authority of Ireland
Company: Limerick City and County Council
The Irish DPA has fined Limerick City and County Council EUR 110,000. As part of an investigation, the DPA conducted an audit of the processing of personal data by the council or on its behalf using video surveillance systems, automatic license plate recognition, body-worn cameras and other technologies that can be used to monitor individuals. In doing so, it found that the Council had violated a number of data protection laws in its use of the technologies. However, the fine was issued due to GDPR violations. 

The DPA found that the Council violated Art. 13 GDPR in relation to the processing of data by traffic cameras. The Council had failed to provide information on the identity of the data controller, the contact details of the data protection officer, the purposes of the processing and the bodies from which further information required under Art. 13 GDPR may be obtained.  In addition, the Council failed to provide this information in an easily accessible manner such as on signs near the cameras.

Further, the DPA concluded that the Council failed to post a video surveillance policy in an clear and plain language as well as in an easily accessible area of the Council's website. The DPA thus found an infringement of Art. 12 GDPR. 

Lastly, the Council has denied requests for access to personal data processed by surveillance cameras used in traffic management. For this reason, the DPA found that the Council violated Art. 15 GDPR.
Authority: Italian Data Protection Authority (Garante)
Company: Roma Capitale
The Italian DPA imposed a fine of EUR 176,000 on Roma Capitale. The city had provided data of women who had abortions to the company in charge of the funeral, which included the data on boards placed on the graves of the fetuses.  During its investigation, the DPA found that the disclosure of the women's personal data was unlawful, as the related law only provides for the provision of the data of the deceased.
Authority: DSB (Austria)
The DPA ordered the controller to change its cookie banner to include an option to reject consent on the first layer. The GDPR was considered applicable even if the website did not offer good or services in the EU, as cookies monitor the behaviour of data subject in Europe.
Authority: APD/GBA (Belgium)
The DPA dismissed a cookie complaint regarding the absence of a “Reject all” button on the first layer of the cookie banner, as the “Confirm my choices” button meant that no cookies were placed since none of the categories of non-essential data were ticked by default.
Authority: Dutch Supervisory Authority for Data Protection (AP)
Company: Booking.com B.V.
The Dutch DPA (Autoriteit Persoonsgegevens) has fined Booking.com EUR 475,000 for not reporting a data breach to the DPA in a timely manner. In December 2018, criminals gained access to the data of 4,109 people who had booked a hotel room through the booking site. That included their names, addresses and phone numbers, as well as details about their booking. The criminals also accessed the credit card data of 283 people and managed to access the credit card's security code in 97 cases. Furthermore, they tried to get other victims' credit card details by pretending to be Booking.com employees via email or phone. Booking.com was notified of the data breach on January 13, 2019, but did not report it to the DPA until February 7, 2019. The controller was thus 22 days late in reporting the data breach, as it is required to report a data breach to the DPA within 72 hours.
Authority: Datatilsynet (Denmark)
In August 2020, the Danish Data Protection Authority completed a planned inspection at Varde Municipality. The audit focused on the municipality's compliance with the requirement to keep records of processing activities, including in particular whether the municipality's records could be used for the purposes on which the requirement to keep records is based.
Authority: Spanish Data Protection Authority (aepd)
Company: BANQUETES SANTA ANA, S.L.
The Spanish DPA has imposed a fine of EUR 5,000 on BANQUETES SANTA ANA, S.L.. The controller had asked a couple celebrating their wedding at its premises to provide the personal data of their guests, including ID card numbers, for the purpose of contact tracing in the context of the Covid-19 pandemic. The DPA determined that such a broad request for personal information was not necessary for contact tracing purposes and that the provision of the names, for example, would have been sufficient.
Authority: Italian Data Protection Authority (Garante)
Company: Autostrade per l’Italia S.p.A.
The Italian DPA has fined Autostrade per l’Italia S.p.A. EUR 100,000 for failing to adequately respond to requests from employees for access to their personal data.
Authority: Datatilsynet (Norway)
Company: Meta
The Oslo District Court rejected Meta’s request to issue a temporary injunction against the Norwegian DPA’S earlier ban on behavioural advertisement under Article 6(1)(b) and (f) GDPR.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Istituto di Istruzione Superiore “G. Renda” di Polistena, Reggio Calabria 
On 20 October 2022, the Italian Data Protection Authority issued an injunction against a Higher Education Institute, imposing an administrative penalty of €900, for publishing the personal data of one of its employees on its institutional website.
Authority: Finland
Company: Ministry of Foreign Affairs
The Supreme Administrative Court held that the Finish Ministry for Foreign Affairs failed to notify the Data Protection Ombudsman without undue delay about a data breach related to spyware found on Finnish diplomats´ phones.
Authority: APD/GBA (Belgium)
The Belgian DPA (APD/GBA) ordered an employer to delete the HR evaluation data on its employees. The decision comes after a complaint filed by an employee concerning an access request on his emails, IT logs and other films processed by the employer.
Authority: Italy
Company: Banca Widiba S.P.A.
The Italian Supreme Court upheld the ruling of the Court of Appeal of Milan, which found the dismissal of an employee by an Italian bank illegitimate due to unlawful monitoring of company e-mails and tailing.
Authority: Spanish Data Protection Authority (aepd)
Company: SCF ZHU, S.L.
The Spanish DPA has fined SCF ZHU, S.L. due to a lack of sufficient data processing information in relation to video surveillance on business premises. The original fine of EUR 1,000 was reduced to EUR 600 due to immediate payment and admission of responsibility.
Authority: Italian Data Protection Authority (Garante)
Company: Private individual
The Italian DPA has fined a private individual EUR 400 for unlawfully operating video surveillance cameras on their property.
Authority: Estonian Data Protection Authority (AKI)
Company: Housing Association
Fine of EUR 500 against a housing association for publishing photos showing members of the association without their consent.
Authority: Garante per la protezione dei dati personali (Italy)
Following an ex officio investigation, the DPA warned a business for failing to provide sufficient information about the cookies on its website.
Authority: ANSPDCP (Romania)
Company: Compania de Apă Oltenia S.A.
The DPA fined a municipal water supply company RON 5,084 (€1,000) for failing to implement sufficient security measures and to prevent the unlawful disclosure of a client's financial information on social media by an employee.
Authority: Spanish Data Protection Authority (aepd)
Company: RAMONA FILMS, S.L.
The Spanish DPA (AEPD) has fined RAMONA FILMS, S.L.
for failing to provide information requested by the DPA during an investigation. The original fine of EUR 30,000 was reduced to EUR 18,000 due to immediate payment and acknowledgement of guilt.
Authority: Italian Data Protection Authority (Garante)
Company: Convitto Nazionale Statale 'Giordano Bruno' di Maddaloni (boarding school)
The Italian DPA has imposed a fine of EUR 1,000 on the Convitto Nazionale Statale 'Giordano Bruno' di Maddaloni (CE) boarding school. The boarding school had published a document on its website containing personal data of the data subject without legal basis.
Authority: Austria
Company: 1) unknown data subject (complainant before the DSB)
The Austrian Federal Administrative Court held that a credit reference agency cannot base the processing of negative payment experience data on a data subject on Article 6(1)(f) GDPR if the underlying debt is insignificant (in this case EUR 38,83).
Authority: DSB (Austria)
An individual (controller) was ordered to delete photos of individuals that they had taken and published online. The photos included those of children, one taken from an angle revealing a woman’s cleavage, one revealing the subjects’ religious beliefs, and one of people dining in a restaurant.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Comune di Bologna
The municipality of Bologna accidentally forwarded a document with the names of special needs students and information about their health to unauthorized staff as well as 53 families. The DPA fined the municipality €40,000.
Authority: Austria
Company: unknown
The Higher Regional Court of Linz held that, in certain situations, a data subject can be entitled to claim the costs of successful legal representation in a procedure under Article 77 GDPR as a damage under Article 82 GDPR from the controller.
Authority: HDPA (Greece)
Company: Δήμος Αθηναίων - Municipality of Athens
The DPA fined a controller €5,000 after its DPO failed to reply to questionnaire sent by the DPA.
Authority: Polish National Personal Data Protection Office (UODO)
Company: Fortum Marketing and Sales Polska S.A.
The Polish DPA has imposed a fine of EUR 1 million on Fortum Marketing and Sales Polska S.A.. 

The company had reported a data breach to the DPA in accordance with Art. 33 GDPR. During its investigation, the DPA found that unauthorized persons had managed to access and siphon off customer data. The data breach occurred at the time of the introduction of a change in the company's IT environment. The change was made by a processing agent. As part of the change, an additional Fortum customer database was created. However, the server on which the database was stored did not have sufficient security measures, which is why the unauthorized persons succeeded in accessing the data. 


The DPA also found that the processor failed to pseudonymize and encrypt the data. In addition, the processing agent had been using real customer data, rather than test data, to test the changes to the system. 


For this reason, the DPA concluded that the controller failed to take appropriate technical and organizational measures to ensure the protection of personal data. In addition, the DPA found that the controller would have been required to monitor the work of the processor to ensure that the protection of personal data is continuously guaranteed.
Authority: AEPD (Spain)
Company: Ibercaja Banco
The DPA fined a bank €180,000 for accessing the data of a former customer more than 47 times without any legal basis under Article 6(1) GDPR after the contractual relationship had ended.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Tensa Art Design SA
The Romanian data protection authority (AEPD) has imposed a fine of EUR 1,000 on Tensa Art Design SA. A data subject had objected to a further newsletter subscription and however had continued to receive advertisements from the data controller.
Authority: Germany
The Federal Court of Justice held that the impact on the data subject's creditworthiness and the loss of control over their data were deemed immaterial damages. The case was referred back to the previous instance for a decision on the merits.
Authority: Spanish Data Protection Authority (aepd)
Company: APOLLONIA TOPCO, S.L.
The Spanish DPA has imposed a fine of EUR 30,000 on APOLLONIA TOPCO, S.L..
An individual had filed a complaint with the DPA due to the fact that, in order to receive a refund, they were required to send in their driving license as proof of identity. The DPA considered this to be a violation of the principle of data minimization, as the processing of the data on the driver's license was not necessary for the refund and the identity check could have been carried out with less intrusive means for the privacy of the data subject. In addition, the controller's data protection officer failed to properly respond to a request from the data subject.
Authority: Garante per la protezione dei dati personali (Italy)
The Italian DPA fined a health authority €55,000 for the unlawful processing of special category health data. The controller sought to compile a list of patients vulnerable to major complications from Covid-19 infection.
Authority: Persónuvernd (Island)
Company: Landsbankinn hf.
The Icelandic DPA held that a bank requiring uniquely identifying information (i.e. a social security number) to avoid anonymous transactions did not violate the GDPR as the bank had a statutory obligation to do so.
Authority: European Union
Company: MK
The CJEU found that the former guardian of a natural person, acting in the context of their professional activity and appointed according to national law, is a controller within the meaning of Article 4(7) GDPR.
Authority: AEPD (Spain)
Company: Private Party (A.A.A)
The Spanish DPA fined an amateur football association €3,000 because its website lacked a privacy policy despite the fact that it collected various personal data.
Authority: Spanish Data Protection Authority (aepd)
Company: MERCEDES GERENCIA, S.L.
The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on MERCEDES GERENCIA, S.L.. The controller failed to respond to a request for information from the DPA in a timely manner.
Authority: APD/GBA (Belgium)
The Belgian DPA (APD/GBA) dismissed a complaint regarding the use of surveillance cameras in a car wash due to a procedural defect. The plaintiff, who wished to remain anonymous, lacked any personal interest in the issue raised.
Authority: Spanish Data Protection Authority (aepd)
Company: ALPA 57 PRODUCCIONES
The Spanish DPA has imposed a fine of EUR 10,000 on ALPA 57 PRODUCCIONES. A data subject had filed a complaint with the DPA because the controller had unlawfully transmitted their data to third parties for marketing purposes.