Sebastyijan/gdpr-enforcement-sample huggingface dataset:
Authority: ANSPDCP (Romania)
The Romanian DPA sanctioned the local municipality of 1st district, Bucharest, €2,010.38 for the failure to comply with the requests of the DPA to provide information and obtain access to personal data and information necessary for performing its tasks, pursuant to Article 58(1)(a) and (e) GDPR.
Authority: Garante per la protezione dei dati personali (Italy)
The DPA found that an employer unlawfully monitored its employees’ driving behavior through a satellite telematic system. The controller was ordered to delete the collected data and pay a €120,000 administrative fine.
Authority: ANSPDCP (Romania)
The Romanian DPA found a physician to have breached Article 5 GDPR, Article 6(1) GDPR and Article 9 GDPR for recording a patient on his personal telephone, without her consent, and posting the video on his Facebook page. The DPA issued a fine of 9919.2 RON (equivalent to €2000).
Authority: AEPD (Spain)
Company: Data subject
Spanish DPA fines controller for continuous sending of emails containing personal data for members and non-members of a Personnel Board. The DPA ruled that there is no legal basis for this processing, especially after the data subject's opposition.
Authority: Netherlands
A court held that the DPA insufficiently justified its refusal to act against a cinema that no longer accepted cash payments, failing to demonstrate that mandatory card payments pursued a sufficiently concrete and justified purpose under the GDPR.
Authority: VDAI (Lithuania)
The DPA partially upheld a complaint and issued a reprimand against a travel company for unlawful direct marketing, excessive passport copy collection, inaccuracies in travel documents, lack of transparency, and an incomplete access response.
Authority: Spanish Data Protection Authority (aepd)
Company: Landlord
The Spanish DPA has imposed a fine of EUR 1,800 on a Landlord. The landlord used video surveillance in rental apartments without having a sufficient legal basis. The original fine of EUR 3,000 was reduced to EUR 1,800 due to immediate payment and admission of responsibility by the controller.
Authority: ANSPDCP (Romania)
Company: SC Tensa Art Design SRL
The DPA fined a website operator RON 101,794 (€20,000) for failing to respond to the DPA’s inquiries following a complaint alleging that the operator’s website unlawfully placed tracking and behavioural marketing cookies on users’ devices.
Authority: APD/GBA (Belgium)
Company: FPS Finances Belgium
The DPA issued a warning to the Federal Public Service for Finances to ensure compliance with security of personal data processing after an employee accessed the address of an individual and visited her at her home.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Tensa Art Design S.A
The Romanian DPA has imposed a fine of EUR 20,000 onTensa Art Design S.A.The DPA began investigating the controller's data processing activities, but the controller failed to respond to the DPA's requests.
Authority: Information Commissioner (ICO)
Company: MediaLab.AI, Inc.
The UK DPA has imposed a fine of GBP 247,590 (EUR 284,450) on MediaLab.AI, Inc.The controller of the image-sharing and hosting platform Imgur failed to implement age verification. This resulted in the controller processing children's data without sufficient legal basis, as the consent given was not provided by the children's parents or carers.
Authority: ANSPDCP (Romania)
Company: Genpact Romania SRL
The DPA fined a company RON 50,899 (€10,000) for failing to implement appropriate security measures following a data breach disclosing the personal data of a significant number of employees.
Authority: Romania
Company: The Institution of the Romanian President
The Constitutional Court held that a legal provision establishing a register for contagious diseases was unconstitutional because it failed to ensure appropriate safeguards for the protection of the fundamental rights and liberties of the individual.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: GENPACT ROMANIA SRL
The Romanian DPA has imposed a fine of EUR 10,000 on GENPACT ROMANIA SRL. The controller suffered a successful cyber attack due to insufficient technical and organisational measures. The attacker was able to exploit vulnerabilities in some passwords and in the way user accounts' authentication could be reset.
Authority: Germany
Company: Meta
A court awarded €1,500 in non-material damages to a data subject after finding that Meta unlawfully tracked users across third-party websites and apps via its Business Tools without valid consent.
Authority: Tietosuojavaltuutetun toimisto (Finland)
Company: Wolt
The DPA found that Wolt violated Article 12 GDPR by failing to respond properly and in time to a data subject’s access request, thus failing to facilitate the exercise of rights or provide a timely refusal.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Alliance for the Union of Romanians (AUR) Party
The Romanian DPA has imposed a fine of EUR 1,000 on the Alliance for the Union of Romanians (AUR) Party. The controller failed to react adequately to a data subject's request to exercise their rights regarding a personal letter containing electoral information.
Authority: Dutch Supervisory Authority for Data Protection (AP)
Company: Municipality of Delft
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Delft. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up measures against Salafist and ideological threats to the democratic legal order posed by Islamic radicals. One of these measures was a robust local approach to tackling radicalisation and travel to jihadist conflict areas. Municipalities played a central role in these measures but found that they lacked sufficient insight into Islamic communities. This resulted in some municipalities, including the controller, using an external research agency to collect the necessary data. The agency then used the so-called force field analysis method to map out social structures and key figures. This data processing took place without a sufficient legal basis, particularly as the processing focused on religious and political beliefs, and therefore on special category data.
Authority: Dutch Supervisory Authority for Data Protection (AP)
Company: Municipality of Ede
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Ede. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up measures against Salafist and ideological threats to the democratic legal order posed by Islamic radicals. One of these measures was a robust local approach to tackling radicalisation and travel to jihadist conflict areas. Municipalities played a central role in these measures but found that they lacked sufficient insight into Islamic communities. This resulted in some municipalities, including the controller, using an external research agency to collect the necessary data. The agency then used the so-called force field analysis method to map out social structures and key figures. This data processing took place without a sufficient legal basis, particularly as the processing focused on religious and political beliefs, and therefore on special category data.
Authority: Dutch Supervisory Authority for Data Protection (AP)
Company: Municipality of Eindhoven
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Eindhoven. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up measures against Salafist and ideological threats to the democratic legal order posed by Islamic radicals. One of these measures was a robust local approach to tackling radicalisation and travel to jihadist conflict areas. Municipalities played a central role in these measures but found that they lacked sufficient insight into Islamic communities. This resulted in some municipalities, including the controller, using an external research agency to collect the necessary data. The agency then used the so-called force field analysis method to map out social structures and key figures. This data processing took place without a sufficient legal basis, particularly as the processing focused on religious and political beliefs, and therefore on special category data.
Authority: Dutch Supervisory Authority for Data Protection (AP)
Company: Municipality of Gooise Meren
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Gooise Meren. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up measures against Salafist and ideological threats to the democratic legal order posed by Islamic radicals. One of these measures was a robust local approach to tackling radicalisation and travel to jihadist conflict areas. Municipalities played a central role in these measures but found that they lacked sufficient insight into Islamic communities. This resulted in some municipalities, including the controller, using an external research agency to collect the necessary data. The agency then used the so-called force field analysis method to map out social structures and key figures. This data processing took place without a sufficient legal basis, particularly as the processing focused on religious and political beliefs, and therefore on special category data.
Authority: Dutch Supervisory Authority for Data Protection (AP)
Company: Municipality of Haarlemmermeer
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Haarlemmermeer. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up measures against Salafist and ideological threats to the democratic legal order posed by Islamic radicals. One of these measures was a robust local approach to tackling radicalisation and travel to jihadist conflict areas. Municipalities played a central role in these measures but found that they lacked sufficient insight into Islamic communities. This resulted in some municipalities, including the controller, using an external research agency to collect the necessary data. The agency then used the so-called force field analysis method to map out social structures and key figures. This data processing took place without a sufficient legal basis, particularly as the processing focused on religious and political beliefs, and therefore on special category data.
Authority: Dutch Supervisory Authority for Data Protection (AP)
Company: Municipality of Hilversum
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Hilversum. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up measures against Salafist and ideological threats to the democratic legal order posed by Islamic radicals. One of these measures was a robust local approach to tackling radicalisation and travel to jihadist conflict areas. Municipalities played a central role in these measures but found that they lacked sufficient insight into Islamic communities. This resulted in some municipalities, including the controller, using an external research agency to collect the necessary data. The agency then used the so-called force field analysis method to map out social structures and key figures. This data processing took place without a sufficient legal basis, particularly as the processing focused on religious and political beliefs, and therefore on special category data.
Authority: Dutch Supervisory Authority for Data Protection (AP)
Company: Municipality of Huizen
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Huizen. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up measures against Salafist and ideological threats to the democratic legal order posed by Islamic radicals. One of these measures was a robust local approach to tackling radicalisation and travel to jihadist conflict areas. Municipalities played a central role in these measures but found that they lacked sufficient insight into Islamic communities. This resulted in some municipalities, including the controller, using an external research agency to collect the necessary data. The agency then used the so-called force field analysis method to map out social structures and key figures. This data processing took place without a sufficient legal basis, particularly as the processing focused on religious and political beliefs, and therefore on special category data.
Authority: Dutch Supervisory Authority for Data Protection (AP)
Company: Municipality of Tilburg
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Tilburg. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up measures against Salafist and ideological threats to the democratic legal order posed by Islamic radicals. One of these measures was a robust local approach to tackling radicalisation and travel to jihadist conflict areas. Municipalities played a central role in these measures but found that they lacked sufficient insight into Islamic communities. This resulted in some municipalities, including the controller, using an external research agency to collect the necessary data. The agency then used the so-called force field analysis method to map out social structures and key figures. This data processing took place without a sufficient legal basis, particularly as the processing focused on religious and political beliefs, and therefore on special category data.
Authority: Dutch Supervisory Authority for Data Protection (AP)
Company: Municipality of Veenendaal
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Veenendaal. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up measures against Salafist and ideological threats to the democratic legal order posed by Islamic radicals. One of these measures was a robust local approach to tackling radicalisation and travel to jihadist conflict areas. Municipalities played a central role in these measures but found that they lacked sufficient insight into Islamic communities. This resulted in some municipalities, including the controller, using an external research agency to collect the necessary data. The agency then used the so-called force field analysis method to map out social structures and key figures. This data processing took place without a sufficient legal basis, particularly as the processing focused on religious and political beliefs, and therefore on special category data.
Authority: Dutch Supervisory Authority for Data Protection (AP)
Company: Municipality of Zoetermeer
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Zoetermeer. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up measures against Salafist and ideological threats to the democratic legal order posed by Islamic radicals. One of these measures was a robust local approach to tackling radicalisation and travel to jihadist conflict areas. Municipalities played a central role in these measures but found that they lacked sufficient insight into Islamic communities. This resulted in some municipalities, including the controller, using an external research agency to collect the necessary data. The agency then used the so-called force field analysis method to map out social structures and key figures. This data processing took place without a sufficient legal basis, particularly as the processing focused on religious and political beliefs, and therefore on special category data.
Authority: Spanish Data Protection Authority (aepd)
Company: FREE TECHNOLOGIES EXCOM, S.L.
The Spanish DPA has imposed a fine of EUR 10,000 on FREE TECHNOLOGIES EXCOM, S.L. The controller had reset user passwords and communicated the new passwords to the clients via email. However, the email was not encrypted and did not implement any other appropriate security measures.
Authority: APD/GBA (Belgium)
The DPA ordered a company to erase the data provided by potential tenants after not entering into a lease agreement with them.
Authority: ANSPDCP (Romania)
The DPA fined a website operator a total of RON 50,890 (€10,000) for illegally publishing the personal data of alleged scammers, for failing to provide information to data subjects, to comply with a request for erasure, and to respond to the DPA’s inquiry.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Natural Person
The Romanian DPA has imposed a fine of EUR 10,000 on a natural person. The controller operated a website on which identity cards containing personal data, including special category data, possible criminal convictions, data on the intimate lives of data subjects and possible debts, were published. The processing of this data was not based on a sufficient legal basis, and the controller did not ensure that the data was correct, complete or transparent. Furthermore, the controller did not adequately respond to requests by data subjects to delete their data. Furthermore, the DPA found that the controller did not provide the necessary information on its website, nor did it respond to requests from the DPA.
Authority: Datatilsynet (Denmark)
Company: Danish Municipalities
The DPA issued a reprimand to 51 municipalities and simultaneously warned them regarding their use of Google’s products in primary and lower secondary schools. In particular, the DPA found that the municipalities had not adequately demonstrated an adequate level of protection for personal data processed outside the EU.
Authority: Germany
A court held that under Article 15(3) GDPR controllers may lawfully redact third-party data as long as the data subject’s information remains complete and understandable.
Authority: APD/GBA (Belgium)
The DPA issued a warning to an employer to ensure compliance of its processing activities after one of its managers shared an employee’s resignation in a work-related group chat.
Authority: IMY (Sweden)
Company: Sportadmin i Skandinavien AB
The DPA fined a digital service provider SEK 6,000,000 (€560,000) after a cyberattack exposed personal data of over 2.1 million people, and the processor was found to have insufficient security measures in violation of Article 32 GDPR.
Authority: Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)
Company: Sportadmin i Skandinavien AB
The Swedish DPA has imposed a fine of EUR 565,500 on Sportadmin i Skandinavien AB. The controller suffered a sucessfull cyber attack, resulting in personal and special category data of 2,126,075 individuals, including minors, beeing published in the darknet. The attack happend due to an succesfull SQL injection on one of the controllers websites, which had not been protected against this kind of attack, granting the attacker access to the controllers server, allowing him to exfiltrate said data.
Authority: CNIL (France)
Company: FRANCE TRAVAIL
The DPA held that a public national institution failed to implement appropriate technical and organizational measures under Article 32 GDPR, leading to a serious data breach, and imposed a €5,000,000 fine, an injunction to strengthen security and access controls, and a daily penalty of €5,000 for non-compliance.
Authority: Italy
A court annulled a DPA decision imposing a €150,000 fine on a news programme diffusing personal data of a minister for information purposes. The court concluded that public interest was overriding the right to privacy.
Authority: French Data Protection Authority (CNIL)
Company: FRANCE TRAVAIL
The French DPA has imposed a fine of EUR 5,000,000 on FRANCE TRAVAIL. The controller suffered a successful cyber attack due to insufficient technical and organisational measures, resulting in the leak of personal and special category data concerning 38,820,828 individuals. The attack was carried out using the 'social engineering' method, meaning that the attacker obtained goods or information by exploiting the trust, ignorance or credulity of third parties.
Authority: DSB (Austria)
Company: Microsoft Corporation
The DPA ruled that Microsoft Corporation unlawfully installed tracking cookies on a pupil’s device when using Microsoft 365 Education without valid consent and ordered the company to cease such processing.
Authority: Norway
The Ombudsman held that under Article 78 GDPR, data subjects have a right to an effective judicial remedy against all aspects of a data protection authority’s decision, including the choice of corrective measures.
Authority: Germany
The court held that the mere automated creation of a score value does not trigger Article 22 GDPR unless it directly leads to a legally or similarly significant decision about the data subject.