Sebastyijan/gdpr-enforcement-sample huggingface dataset:
Authority: Data Protection Authority of Hamburg
Company: Vattenfall Europe Sales GmbH
The DPA from Hamburg has imposed a fine of EUR 900,000 on Vattenfall Europe Sales GmbH. The fine is related to data matching, which the controller had carried out in the period from August 2018 to December 2019 in the course of contract inquiries for special contracts. The special contracts served to attract new customers and were accompanied by bonus payments for the customers. The controller compared personal data of prospective customers who had submitted an inquiry for a special contract with contracts concluded by existing customers. If this revealed that an applicant had already signed a contract with the controller, then switched to another supplier and now wanted to sign a contract again, the controller could reject the application for the special contract if necessary. This was intended to prevent 'bonus shopping', which is not lucrative for the companies. However, the controller had not properly informed the customers that such comparisons would be made. The DPA considered this to be a violation of the company's transparency and information obligations. Around 500,000 people were affected.
Authority: Spanish Data Protection Authority (aepd)
Company: DELAFRUIT, S.L.
The Spanish DPA has imposed a fine of EUR 3,600 on DELAFRUIT, S.L. The controller installed video surveillance in the staff break area and dining room, but did not put up the necessary information signs. The original fine of EUR 6,000 was reduced to EUR 3,600 due to immediate payment and admission of responsibility by the controller.
Authority: Sweden
Company: Google LLC
The Administrative Court of Stockholm ( FiS ) rejected Google's request to overturn the Swedish DPA's decision on the company's Article 17 violations. However, the court reduced the fine imposed by the DPA from €7 million to €5,091,000.
Authority: ICO (UK)
ICO holds that information relating to a grievance process must not be disclosed by the public authority under the UK Freedom of Information Act 2000 (FOIA) since the information is protected by data protection law.
Authority: Garante per la protezione dei dati personali (Italy)
Company: OpenAI
The DPA fined OpenAI €15,000,000 for the non-transparent processing of personal data without correctly identifying an adequate legal basis. It also mandated a six-month public campaign to raise awareness about ChatGPT’s data processing practices and user rights under the GDPR.
Authority: Czech Data Protection Auhtority (UOOU)
Company: Legal Person
The Czech DPA has imposed a fine of EUR 4,800 on a legal person. In the course of the business activities, the accused contacted business entities, owners of industrial rights, with a form offering to register them in private registers containing data on entrepreneurs and companies.
Authority: Dutch Supervisory Authority for Data Protection (AP)
Company: Transavia
The Dutch DPA has fined airline Transavia EUR 400,000. 
In 2019, the airline suffered a data breach, in which a hacker gained access to Transavia's systems through two accounts held by the company's IT department. This could have potentially allowed the hacker to access data such as names, dates of birth, gender, email addresses, phone numbers, flight information and booking numbers of 25 million passengers. It was found that the hacker actually downloaded the personal data of 83,000 people. In 367 cases, the data included medical information of people who had requested, for example, wheelchair transportation or additional services because they were blind or deaf. The DPA noted that a lack of security measures allowed the hacker to access the systems. Thus, it was possible to access the airline's systems simply by entering the password. The systems did not incorporate multi-factor authentication. Furthermore, the access rights of the accounts were not limited to necessary systems, allowing the hacker to use them to gain access to multiple Transavia systems. The DPA found that Transavia had breached its duty to implement technical and organizational measures to ensure a level of security appropriate to the risk to data subjects.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Banca Comercială Română SA
The data protection authority finds that the company has not taken adequate technical and organisational measures to ensure an adequate level of information security. This applies in particular to the collection and transmission of copies of customers' identification documents via WhatsApp.
Authority: HDPA (Greece)
The Hellenic DPA reprimanded electricity supplier, "VOLTON Hellenic Energy Joint Stock Company," because they failed to adequately respond to three access requests.
Authority: ICO (UK)
Scottish company was fined £500,000 for making more than 193 million automated nuisance calls. The ICO found that people who received the calls had not given their consent, had not been provided with a valid opt-out option and couldn't identify who was making the calls. This way the company violated Section 40 of the Data Protection Act 1998 and Regulations 19 and 24 of Privacy and Electronic Communication Regulations 2003.
Authority: HDPA (Greece)
Company: «ΚΑΡΙΕΡΑ Α.Ε.»
The Greek DPA fined a service provider €5000 for failure to properly execute a data's subject request for erasure due to a technical error which meant that their personal data had been duplicated on the company's servers. The DPA found that 79 other data subjects had also been affected by this error.
Authority: DPC (Ireland)
Company: Archbishop of Dublin
The Archbishop should now make clear that all personal data collected and recorded and otherwise processed for the purposes of the administration of sacraments is permanently retained.
Authority: HDPA (Greece)
Company: National Bank of Greece
In an ex-officio procedure the DPA investigated the Greek National Bank's procedures for responding to Article 15 GDPR access requests. The DPA found that the responses were systemically delayed and improperly handled. The DPA thus fined the controller €200,000.
Authority: HDPA (Greece)
The DPA reprimanded an employer for the usage of vague language in its privacy policy creating the false impression that the processing of employment data is based on consent rather than the performance of the employment contract.
Authority: Datatilsynet (Denmark)
Company: Helsingor Municipality
The Danish DPA reprimanded the Municipality of Helsingor for violating Articles 5(2), 24, 35(1) and 44 GDPR by its use of Google Chromebooks and Google Workspace for Education in primary schools. It banned such processing of personal data until it is brought in line with the GDPR and suspended any related data transfers to the United States.
Authority: Lithuania
Company: Valstybinė duomenų apsaugos inspekcija
A court ruled that a legal person performing state or municipal functions is equivalent to a public authority and, therefore, cannot rely on legitimate interest as a legal basis.
Authority: Italian Data Protection Authority (Garante)
Company: Intesa Sanpaolo S.p.A
The Italian DPA has imposed a fine of EUR 100,000 on Intesa Sanpaolo S.p.A.. The bank had unlawfully disclosed data of the data subject to unauthorized third parties (the father of the data subject ). The data subject's father, a former employee of the bank, had been authorized to access his daughter's bank data until she reached the age of majority. However, the father had demanded access to his daughter's data, who in the meantime had already reached the age of majority. An employee of the bank suspected that the father still had authorization and for this reason passed on the daughter's data.
Authority: ANSPDCP (Romania)
Company: Roumasport SRL
The DPA fined a company RON 50,920 (€10,000) for failing to implement appropriate technical and organisational measures in light of repeated data breaches affecting its customers.
Authority: Italian Data Protection Authority (Garante)
Company: Region of Campania
Publication of an enforcement order in civil proceedings on the Region's website. The document listed the names and place of residence and the amount of the claim.
Authority: Italian Data Protection Authority (Garante)
Company: Supermarket
The operator of a supermarket displayed the letter of dismissal to the personnel manager on the publicly visible notice board of the supermarket.
Authority: Italian Data Protection Authority (Garante)
Company: Nimbus s.r.l.
The Italian DPA has imposed a fine of EUR 5,000 on Nimbus s.r.l.. The controller had introduced a biometric attendance system at the workplace without adequately informing the employees and obtaining their consent.
Authority: Datatilsynet (Denmark)
Company: DBA
The Danish DPA rejected the data subject’s complaint and erasure request because it found that the controller’s legitimate interest to retain the personal data, outweighed the interests of the data subject.
Authority: Datatilsynet (Denmark)
Company: The muncipalities "Gladsaxe Kommune" and "Hørsholm Kommune".
The Danish DPA imposed fines on two municipalities for the lack of data security on laptops. The accumulated amount of the fines is DKK 150,000 (approx. EUR 20,000).
Authority: Spanish Data Protection Authority (aepd)
Company: Private individual
The Spanish DPA has imposed a fine of EUR 300 on a private individual. The individual had installed a video surveillance camera which also recorded the entrance area of the neighboring apartment. The DPA considered this to be a violation of the principle of data minimization.
Authority: Spanish Data Protection Authority (aepd)
Company: MEETING PUERTO C.B.
The Spanish DPA has imposed a fine of EUR 2,000 on MEETING PUERTO C.B.. The data controller had unlawfully published a picture of the complainant with his partner on Facebook and Instagram, which was accompanied by insulting comments.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Vodafone Romania S.A.
The Romanian DPA has imposed a fine of EUR 15,000 on Vodafone Romania S.A. Personal data such as names, email addresses and customer numbers were repeatedly disclosed due to inadequate security measures, e.g. the unauthorized sending of invoice details or  incorrect use of the “BCC” function. During its investigation, the DPA found that the controller had failed to implement appropriate technical and organizational measures to protect personal data.
Authority: Spanish Data Protection Authority (aepd)
Company: Asesoría Alpi-Clúa S.L.
The Spanish DPA (AEPD) imposed a fine of EUR 3,000 on Asesoría Alpi-Clúa S.L.. A client had requested documents from the controller to submit them to the tax authorities. The controller sent her an e-mail that, however, did not contain the documents she had requested, but documents from another client.
Authority: APD/GBA (Belgium)
Company: Commissariat Général aux Réfugiés et Apatrides (CGRA)
An employee using a personal phone to take pictures of an asylum seeker's social medias to use it in the asylum procedure is not violating the GDPR, even if the asylum office prohibited the use of private devices at work.
Authority: AEPD (Spain)
Company: Avilon Center 2016, SL
The Spanish DPA (AEPD) imposed a fine on Avilon Center SL for making a commercial call to a individual registered on the Robinson List in breach of Article 48(1)(b) LGT and Article 21 GDPR in conjunction with Article 23(4) LOPDGDD. Avilon Center SL made an voluntary, early and guilty payment of €12,000.
Authority: AEPD (Spain)
The Spanish DPA issued a warning to the former worker of a business that processed personal data of their clients from a previous employment relationship without any legitimate basis.
Authority: European Union
The CJEU held that data relating to criminal convictions contained in a court’s filing system cannot be disclosed for the purpose of ensuring public access to documents if the person requesting the disclosure does not establish that they have a “specific interest” in obtaining said data.
Authority: Spanish Data Protection Authority (aepd)
Company: Notary
The Spanish DPA has fined a notary. The controller had consulted the land register of a property belonging to the data subject without an order requiring the consultation of this data or the consent of the data subject. The original fine of EUR 10,000 was reduced to EUR 8,000 due to voluntary payment.
Authority: Icelandic data protection authority ('Persónuvernd')
Company: Breiðholt Upper Secondary School
In violation of Art. 32 GDPR, a teacher had sent an e-mail to his students and their parents with an attachment containing data on their well-being, academic performance and social conditions.
Authority: Norway
Company: Grindr
A court upheld the DPA's fine of €6,4 million (NOK 65 million) against Grindr for not having a valid legal basis under Article 6(1) GDPR and disclosing special categories of personal data to advertising partners in violation of Article 9(1) GDPR.
Authority: Austria
Company: unknown data subject (complainant before the DSB)
The Federal Administrative Court (BVwG) remitted a case to the Austrian DPA (DSB) because the DSB had failed to establish the facts of the case properly and merely invited the parties to exchange submissions.
Authority: Spanish Data Protection Authority (aepd)
Company: Automoción
An employee created a fake profile about a female colleague on an erotic portal, which contained, among other things, her contact details, a photo of her and information about her sexual nature. Based on the profile, the data subject received several phone calls from people who wanted to contact her regarding the information provided on the website. As the private person was found to have a personality disorder, the fine was reduced from initial EUR 1000 to EUR 800.
Authority: Persónuvernd (Iceland)
The Icelandic DPA rejected a data subject's claim that their employer failed to comply with an access request they made, because of a lack of evidence of a breach and the fact that labour law should be applied instead of data protection law.
Authority: AEPD (Spain)
The DPA fined a hospital €1,200,000 for unlawfully deleting a patient’s medical data and for failing to comply with the principle of data protection by design and by default.
Authority: AEPD (Spain)
Company: CREATOR ENERGY. S.L.
The Spanish DPA fined an energy supply company €6000 for processing personal data without a legal basis. The DPA held that the company could not rely on Article 6(1)(b) GDPR where it had not entered into a valid legal contract with the data subject.
Authority: Spanish Data Protection Authority (aepd)
Company: Private individual
The Spanish DPA (AEPD) has fined a private individual EUR 300 for failing to provide sufficient information about a video surveillance system installed at their property.
Authority: AP (The Netherlands)
Company: DPG Media
The Dutch DPA issued a €525,000 fine against a media company for a violation of Article 12(2) GDPR by asking data subjects to upload a copy of their ID to verify their identity in order to exercise their rights of access and erasure.
Authority: Spanish Data Protection Authority (aepd)
Company: ASOCIACIÓN ESCUELA NACIONAL DE EQUITACIÓN
The Spanish DPA has imposed a fine of EUR 750 on the ASOCIACIÓN ESCUELA NACIONAL DE EQUITACIÓN. The controller failed to certify compliance with the corrective measures imposed by the DPA, resulting in the DPA issuing a fine.
Authority: APD/GBA (Belgium)
The DPA reprimanded an employer for unlawfully processing allegations regarding the assault of a minor by an employee in the context of a disciplinary action. The controller was ordered to implement appropriate measures to ensure future GDPR compliance.
Authority: CNIL (France)
Company: TikTok
The French DPA fined TikTok €5,000,000 for implementing advertising identifiers on users' devices without prior consent. TikTok's cookie banner was also found insufficiently informative.
Authority: Germany
Company: anonymous
The German Federal Court of Justice ruled on the disclosure of personal data for the enforcement of civil law claims.
Authority: ICO (UK)
Company: Parkside Community Primary School
A reprimand has been issued to Parkside Community Primary School in relation to the infringements of Article 5 (1)(f), Article 24 (1) and Article 32 of UK GDPR.
Authority: DPC (Ireland)
Company: Microsoft Operations Ireland Limited
In the context of a procedure under Article 60 GDPR, the Irish DPC reprimanded Microsoft Operations Ireland Limited for violations of Article 12(4) GDPR and Article 17 GDPR.
Authority: HDPA (Greece)
Company: Hellenic Police 
The DPA issued a warning against the deployment of a “Smart Policing” system by the Hellenic Police, involving smart portable devices used by patrols to determent and verify the identity of citizens subject to on-the-spot checks via the use of biometric data. The DPA considers this processing of personal data unlawful.
Authority: European Union
The CJEU held that Vehicle Identification Numbers taken as such, are not personal in nature. However, they become personal data when someone (a natural person) who has access to it has the means to identify the owner of the vehicle.
Authority: Spanish Data Protection Authority (aepd)
Company: DESPACHO TEJEDOR INFANTES CONSULTORES ASESORES
The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on DESPACHO TEJEDOR INFANTES CONSULTORES ASESORES, S.L.. The controller had forwarded two emails containing personal data (payroll and extension of working hours) of the data subject to an employee.
Authority: Spanish Data Protection Authority (aepd)
Company: ESTUDIO ALCAZAR DEL GENIL 2022, S.L.
The Spanish DPA imposed a fine on ESTUDIO ALCAZAR DEL GENIL 2022, S.L. The controller collected property data by having its employees visit and photograph the properties, including the name on the mailbox. The controller lacked a sufficient legal basis for the data and failed to inform the data subjects about the data processing. The original fine of EUR 20,000 was reduced to EUR 12,000 due to immediate payment and admission of responsibility by the controller.
Authority: Datatilsynet (Norway)
The Norwegian DPA (Datatilsynet) has issued the company Odin Flissenter with a fine of NOK 150 000 (approx 13700 EUR) for the credit rating of a single-person enterprise with no legal basis for such processing.
Authority: Norwegian Supervisory Authority (Datatilsynet)
Company: Norwegian Parliament
The Norwegian DPA has fined the Norwegian Parliament EUR195,000. 

The parliament had suffered a data breach in which unauthorized persons gained access to the email accounts of members of parliament and parliamentary administrative staff. The attackers had succeeded in siphoning off the data, including personal data on bank accounts, dates of birth and health-related data.
During its investigation, the DPA found that the parliament did not incorporate sufficient security mechanisms, such as two-factor authentication, even though a risk analysis in 2020 had found that this posed a high privacy risk. 
 
For this reason, the DPA found that the parliamentary administration had not taken appropriate technical and organizational measures to achieve a sufficient level of security.
Authority: Datatilsynet (Norway)
Company: Bergen municipality
In 2019, the Norwegian DPA fined a municipality about €158,315 (NOK 1,600,000) for lacking security measures, as discovered by a 12 year old pupil at the school. The school pressed charges against the pupil, but withdrew them after massive media pressure.
Authority: Germany
Company: Ex-employee (data subject)
A court upheld the decision of a DPA not to pursue a complaint because an employee had waived the right of access under Article 15 GDPR in a court settlement that ended the employment relationship.
Authority: Spanish Data Protection Authority (aepd)
Company: Amalfi Servicios de Restauracion S.L.
Video surveillance of public space and thus violation of the principle of data minimization. Furthermore: Violation of information obligations, as insufficient information has been provided about video surveillance.
Authority: Persónuvernd (Iceland)
Company: Landspítali – The National University Hospital of Iceland
The Icelandic DPA issued a reprimand against a hospital appointed to carry out COVID-19 tests for failing to conduct a Data Protection Impact Assessment in violation of Article 35(1) GDPR when relocating part of their staff to another medical centre.
Authority: HDPA (Greece)
Company: 401 Athens General Military Hospital 
The Hellenic Data Protection Authority (HDPA) found itself competent to decide over case concerning personal data processed by the 401 Athens General Military Hospital, insofar this data is not classified information related to activities concerning national security. The HDPA found the processing lawful but ordered the Hospital to appoint a DPO.
Authority: Germany
Company: Vodafone
A court dismissed a non-material damages claim following a data transfer from a telecommunications company to a credit rating agency because the data subject had consented to this data transfer.
Authority: Data Protection Authority of Ireland
Company: Sligo County Council
The Irish DPA has imposed a fine of EUR 29,500 on the Sligo County Council. The controller used video surveillance but failed to ensure compliance with the GDPR. They failed to provide adequate information to data subjects, failed to implement sufficient technical and organisational measures to ensure GDPR compliance, failed to ensure adequate data security and stored the recorded data for longer than necessary.
Authority: APD/GBA (Belgium)
Company: Anonymous (Complainant - physical person)
The Belgian DPA (APD/GBA) imposed a fine of €50,000 and €15,000 on two different data controllers for breaching various principles of the GDPR, such as the principles of lawfulness, data minimisation and  accountability.
Authority: APD/GBA (Belgium)
The Belgian DPA issued a fine of €100,000 against Brussels South Charleroi Airport for carrying out temperature checks with thermal cameras on passengers without a valid legal basis, adequate information provided to data subjects, and an appropriate data protection impact assessment.
Authority: Persónuvernd (Iceland)
Company: Creditinfo
The Icelandic DPA ruled that a credit scoring company had violated the GDPR by assigning a credit score to an individual on the basis of information that was more than 4 years old. The Icelandic DPA therefore ordered the controller to delete the personal data in question.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Comune di Forlì
The DPA fined a municipality €15,000 as it developed a mobile app for safety purposes without conducting a DPIA and without stipulating a written binding agreement with its processor.
Authority: CNIL (France)
Company: University of Bordeaux
Following a request for prior consultation under Article 36 GDPR, the French DPA authorised the University of Bordeaux to implement automated processing of personal data for a study comparing health trajectories leading to cardio-metabolic diseases, to evaluate the interoperability of European health data.
Authority: National Commission for Data Protection (CNPD)
The DPA from Luxembourg (CNPD) has imposed a fine of EUR 6,800 on a company. The company had installed a video surveillance system to protect the company's assets, prevent intrusion by unauthorized persons and prevent accidents. However, the cameras also captured parts of an employee's work area, the smoking area that employees frequently used and parts of the public space. The DPA states that the controller thus violated the principle of data minimization under Art. 5 (1) c) of the GDPR. Furthermore, the DPA found a violation of the information obligations set out in Art. 13 GDPR, by not properly informing its employees and third parties about the video surveillance.
Authority: AEPD (Spain)
Company: CAM4
In a case regarding the processing of sexual images by a sex webcam website, the Spanish DPA concluded that by ticking a box attesting that they agreed with the controller's terms and conditions, the data subject had handed over the rights to their image to the controller, which thus had a legal basis for processing.