Sebastyijan/gdpr-enforcement-sample huggingface dataset:
Authority: Data Protection Authority of Berlin
Company: Delivery Hero
According to the findings of the Berlin data protection officer, Delivery Hero Germany GmbH had not deleted accounts of former customers in ten cases, even though those data subjects had not been active on the company's delivery service platform for years - in one case even since 2008. In addition, eight former customers had complained about unsolicited advertising e-mails from the company. A data subject who had expressly objected to the use of his data for advertising purposes nevertheless received further 15 advertising e-mails from the delivery service. In further five cases, the company did not provide the data subjects with the required information or only after the Berlin data protection officer had intervened.
Authority: Italian Data Protection Authority (Garante)
Company: Comune di Venezia
The Italian DPA has imposed a fine of EUR 10,000 on the Comune di Venezia. The controller implemented a tourist tax, which includes exceptions for certain groups of visitors. When determining whether a person was entitled to be excluded from the tourist tax, the controller's data processing did not comply with the basic principles of the GDPR.
Authority: Spanish Data Protection Authority (aepd)
Company: Xfera Moviles S.A.
The company had changed a contract for a mobile phone connection to a new owner, whereby the personal data of a data subject such as his address and telephone numbers were freely accessible. This constituted a violation of the principles of confidentiality and integrity.
Authority: Germany
The Higher Regional Court of Köln held that an access request of an insurance holder aimed to verify the lawfulness of premium increases - and not the lawfulness of the data processing - cannot be considered excessive under Article 12(5) GDPR.
Authority: Spanish Data Protection Authority (aepd)
Company: Private Individual
The Spanish DPA (AEPD) imposed a fine of EUR 1,000 on a private individual for the unauthorized installation of a video surveillance camera on their car. The car had been parked on a public street, and therefore the camera was also recording public space. The AEPD found that video surveillance of public space represented a violation of the principle of data minimization.
Authority: Germany
A court held, that 1. forwarding of chat traffic by a work council chairman to the HR of a company is lawful insofar it's relevant for examining a complaint and 2. work council members are not controllers when acting within their capacity.
Authority: Italian Data Protection Authority (Garante)
Company: Store owner (Joy Unique Collection)
The Italian DPA has fined the owner of the store 'Joy Unique Collection' EUR 6,000 . The controller had operated video surveillance cameras in its premises without the required authorization.  Furthermore, the DPA found that information signs regarding the processing of personal data by the cameras were missing.
Authority: Spanish Data Protection Authority (aepd)
Company: Chamber of Commerce, Industry, Services and Navigation of Spain
The Spanish DPA has imposed a fine of EUR 500,000 on the Chamber of Commerce, Industry, Services and Navigation of Spain. Due to its function within the Spanish Executive, the controller has access to the basic data of all Spanish companies, including information regarding solvency, contact details, tax numbers and more. Self-employed persons are also included. The controller has decided to make this information available to the public. For this purpose, the controller created the legal entity CAMERDATA S.A. (ETid: 2838), which acts as a data processor. The controller transferred the aforementioned data to the processor so that it could be distributed. However, the transfer was not based on a valid legal basis. The amount and kind of data transferred infringed the principles of data minimisation and confidentiality. Furthermore, the manner in which the data was transferred infringed the principle of fairness, and the controller failed to inform the data subjects regarding the data processing.
Authority: Austrian Data Protection Authority (dsb)
Company: Austrian Post
The Austrian DPA imposed a fine of EUR 9.5 million on the Austrian Post on September 28, 2021. The main accusation is that, in addition to the contact options used by Austrian Post via mail, web contact form and customer service, data protection-related inquiries should also be allowed via e-mail. According to the newspaper 'Der Standard', the Austrian Post had only introduced a contact form for data protection inquiries, in order to automate the process of inquiries and to obtain all information necessary for processing the inquiries.
Authority: Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)
Company: Digi Telecommunications and Services Ltd.
The Hungarian DPA has imposed a fine of EUR 205,000 against Digi Telecommunications and Services Ltd. The controller had suffered a data breach in which an unauthorized party managed to access personal data of data subjects (e.g. customers and newsletter subscribers) via the controller's website. During its investigation, the DPA found that the controller had failed to implement appropriate technical and organizational measures to protect personal data, which facilitated such an incident.
Authority: Persónuvernd (Iceland)
Company: Akureyri Hospital
The Icelandic DPA reprimanded a hospital for sending medical data of a complainant and her child to the wrong address.
Authority: Spanish Data Protection Authority (aepd)
Company: Electrotecnica Bastida S.L.
The Spanish DPA (AEPD) has fined Electrotecnica Bastida S.L. EUR 3,000. Police officers had found 29 envelopes addressed to the controllers' respective employees on a vacant lot in the local industrial area. Two envelopes had already been opened. The envelopes contained results of medical examinations. The AEPD considered this to be a breach of the controller's duty to implement adequate technical and organizational measures to protect the processing of personal data.
Authority: AEPD (Spain)
Company: Sindicato Aragonés de Transporte
The Spanish DPA imposed a €3,000 fine on a workers' union for violating Articles 5(1)(f) and 32 GDPR by publishing the personal data of members of the strike committee on social media networks without a valid legal basis.
Authority: Garante per la protezione dei dati personali (Italy)
Company: aiComply S.r.l.
The Italian DPA fined a processor €20,000 for failing to implement adequate technical and organisational measures within a whistleblowing application it provided to the Airport of Bologna, and for failing to inform the airport about the involvement of two sub-processors responsible for the application's maintenance.
Authority: CNIL (France)
Company: HUBSIDE.STORE
The DPA imposed €525,000 to HUBSIDE.STORE for carrying out canvassing campaigns using personal data obtained via forms that were deceptive by design and did not allow the controller to collect valid consent.
Authority: Datatilsynet (Norway)
Company: Datatilsynet
The Norwegian Privacy Appeals Board (Personvernrådet) overturned the Norwegian DPA's (Datatilsynet) decision to reprimand a local missionary organization's use of private camera surveillance footage under Article (6)(1)(f).
Authority: Germany
Company: Data Subject versus Telecommunications Company
A court upheld that the transmission of non-adverse contractual information data from a telecommunications company to SCHUFA for purposes of fraud prevention is lawful under legitimate interest.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Agricola International SA
The Romanian DPA has imposed a fine of EUR 5,000 on Agricola International SA. The controller failed to implement sufficient technical and organisational measures, resulting in a cyber attack.
Authority: Czech Data Protection Auhtority (UOOU)
Company: Legal Person
The Czech DPA has imposed a fine of EUR 8,340 on a legal person. During the state of emergency (COVID-19 pandemic), the accused sent unsolicited marketing communications for a period of at least one month to data mailbox holders, which is an aggravating factor.
Authority: AP (The Netherlands)
Company: Uber Technologies Inc. and Uber B.V.
The Dutch DPA, in the context of an Article 60 GDPR decision, issued a fine in the amount of €10,000,000 on Uber for a lack of transparency in its privacy policy and for failing to allow data subjects to exercise their rights in an accessible manner, in violation of several GDPR provisions.
Authority: Spanish Data Protection Authority (aepd)
Company: Colegio Arenales Carabanchel (School)
The decision of the data protection authority states that the school transferred pictures (and therefore personal data) to third parties, who published them without legal basis.
Authority: DSB (Austria)
Company: gynaecologist
The DPA imposed a fine of €10,000 on a gynaecologist after he disclosed the data subject's diagnosis in a public response to an online negative review by the data subject.
Authority: Spanish Data Protection Authority (aepd)
Company: LÃSER METALPRINT 3D, S.L.
The Spanish DPA imposed a fine on LÃSER METALPRINT 3D, S.L. The controller hired a third company to install and maintain a surveillance system. The controller and the hired company had a data processing agreement. However not the hired company but another company processed the data. The controller and the processing (third) company did not have a data processing agreement, even though one was needed. The original fine of EUR 6,000 was reduced to EUR 10,000 due to immediate payment and admission of responsibility by the controller.
Authority: IP (Slovenia)
The controller, a Slovenian Ministry, was found to have infringed Article 15 GDPR in conjunction with Articles 12 and 14 of the Slovenian Data Protection Act since, at the time of the data subject's complaint with the Slovenian DPA, it did not fully comply with the complainant’s access request.
Authority: European Union
Company: EDPB
The AG opined that pseudonymised data can fall outside the concept of ‘personal data’ for a recipient of the data when it is virtually impossible for the recipient to identify any data subjects from the data – even if it would be possible for the sender of the information.
Authority: Spanish Data Protection Authority (aepd)
Company: Company
The Spanish DPA has imposed a fine of EUR 3,000 on a company. The controller had installed a video surveillance system that also recorded the voices of both employees and customers. During its investigation, the DPA found that the controller did not have a valid legal basis for processing the information of the voices as part of the video surveillance. In addition, the DPA found that the controller failed to provide sufficient information about the video surveillance, including information about the processing, the identity of the controller, and the exercise of data subjects' rights.
Authority: Spanish Data Protection Authority (aepd)
Company: FONTANORTE, S.L.
The Spanish DPA has imposed a fine on FONTANORTE, S.L.. The controller had disposed of documents containing personal data in publicly accessible trash containers. The original fine of EUR 2,000 was reduced to EUR 1,200 due to voluntary payment and admission of responsibility.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Fabio Giovanni Petta (data controller of the website www.inelenco.com)
The Italian DPA fined the website www.inelenco.com 50,000€. Among many GDPR infringements, this online telephone directory had no legal basis and processed and published the data of 357,046 data subjects without their knowledge and consent.
Authority: CNIL (France)
The French DPA (CNIL) imposed a €150,000 fine on an undisclosed data controller operating an online shopping for failing to properly secure personal data (Article 32 GDPR). For almost two years the controller suffered several "credential stuffing" attacks and failed to detect or block them. The CNIL also imposed a € 75,000 fine on the data processor.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Kaufland Romania SCS
The Romanian DPA has imposed a fine of EUR 3,000 on Kaufland Romania SCS. The controller had reported a data breach to the DPA according to Art. 33 GDPR. 
An employee had taken pictures of the CCTV recordings with their cell phone and transmitted them to a third party. The third party then published the images on which two people and a license plate could be identified on the website of a local newspaper. The DPA found that the controller had failed to implement adequate technical and organizational measures to protect personal data.
Authority: Spanish Data Protection Authority (aepd)
Company: AXA REAL ESTATE INVESTMENT MANAGERS IBERICA S.A. y SEUR GEOPOST, S.L.
The Spanish DPA has imposed a fine on AXA REAL ESTATE INVESTMENT MANAGERS IBERICA S.A. y SEUR GEOPOST, S.L.. The controller had suffered a security incident which, according to the DPA, had occurred due to the company's failure to implement appropriate technical and organizational measures to protect personal data. The original fine of EUR 100,000 was reduced to EUR 80,000 due to voluntary payment.
Authority: Italian Data Protection Authority (Garante)
Company: Azienda Universitaria Friuli Occidentale
The Italian DPA has imposed a fine of EUR 55,000 on Azienda Universitaria Friuli Occidentale. The health authority has created patient profiles using algorithms and personal patient data to indicate the risk of having complications in the event of a Covid 19 infection. This was intended to identify appropriate diagnostic and therapeutic pathways in a timely manner in the event of complications. However, the DPA found that the health authority did not have a valid legal basis to process patients' personal data for profiling. In addition, the DPA found that the health authority had failed to conduct a data protection impact assessment. In calculating the fine, the DPA took into account the aggravating factor that a large number of individuals were affected.
Authority: Spanish Data Protection Authority (aepd)
Company: Private investigator
The Spanish DPA has fined a private investigator EUR 2,000. An individual who had hired the investigator filed a complaint with the DPA. They stated that the controller had failed to inform them sufficiently about the processing of their personal data conducted as part of the investigation. In addition, the DPA found that the controller had a contact form on its website with no reference to the privacy policy.
Authority: Germany
The Federal Court of Justice found that a data subject has no right to a copy of documents justifying premium increases in an insurance contract, unless they show how these documents are necessary to contextualise and ensure the comprehensibility of their personal data.
Authority: NAIH (Hungary)
Company: „ROBINSON-TOURS” Tourism and Service Ltd.
The Hungarian DPA (NAIH) fined a travel agency €55,000 for not implementing appropriate technical and organisational measures, leading to the exposure of the personal data of its customers on a website and a search engine.
Authority: Deputy Data Protection Ombudsman
Company: Company
The Finnish DPA has imposed a fine of EUR 1,600 on a company providing psychotherapy services. A customer had submitted a request for access to their stored personal data. However, the company had not informed the customer of the reason why the records of the psychotherapy sessions could not be provided.
Authority: Norwegian Supervisory Authority (Datatilsynet)
Company: Odin Flissenter AS
The company assessed the credibility of another company and thereby, according to Datatilsynet, processed personal data relating to a natural person (the owner of the company assessed) without there being a sufficient legal basis for doing so.
Authority: AEPD (Spain)
Company: VODAFONE ESPAÑA S.A.U.
The Spanish DPA (AEPD) terminated a sanctioning procedure against VODAFONE ESPAÑA S.A.U. for infringing Article 6(1) GDPR. Vodafone, recognising its responsibility, made an early payment of €42000 (reduced from the original €70000 fine).
Authority: Czech Data Protection Auhtority (UOOU)
Company: Legal Person
The Czech DPA has imposed a fine of EUR 80 on a legal person. The accused was sending commercial communications to the complainant, despite their objection to the processing of personal data and the notification from the authority.
Authority: Data Protection Authority of Ireland
Company: TikTok Technology Limited
The Irish DPA (DPC) has fined TikTok EUR 530 million. In its decision, the DPC found, that TikTok infringed Art. 13 (1) f) GDPR and Art. 46 (1) GDPR due to the unlawful transfer and storage of personal data from users in the EEA on Chinese servers. TikTok was unable to verify, guarantee and demonstrate that the supplementary measures and the Standard Contractual Clauses were effective to guarantee that the data afforded a level of protection, which is equivalent of the level of protection guaranteed in the EU. TikTok also failed to inform the data subjects, that their personal data is transferred to a third country. The fine consists of a fine of EUR 45 million for the failure to inform the data subjects and a fine of EUR 485 million for the infringement of Art. 46 (1) GDPR. The DPC also ordered TikTok to bring their processes into compliance with the GDPR within 6 months after the period allowed for an appeal against the DPCs final decision.
Authority: Austria
The Austrian Federal Administrative Court ruled that the storage of personal data on an identity document is justified for the entire duration of its validity, in particular to detect forgeries. In contrast, personal data from an old identity document must be deleted even if the data is the same as that of a new identity document.
Authority: France
Company: Futura Internationale
The French Supreme Administrative Court (Conseil d'Etat) rejected Futura Internationale's appeal against the French DPA's decision of administrative fine of € 500,000. The Conseil d'Etat rejected the argument that the CNIL infringed the constitutional principle of non-retroactivity of the law by applying the GDPR and considered the fine proportionate.
Authority: Italian Data Protection Authority (Garante)
Company: Comune di Ustica
The Italian DPA has imposed a fine of EUR 500 on Comune di Ustica. The municipality had published a document, containing personal data (including health data) of private individuals. In the course of its investigation, the DPA found that the municipality had published the data without a valid legal basis and therefore had acted unlawfully.
Authority: Czech Data Protection Auhtority (UOOU)
Company: Legal Person
The Czech DPA has imposed a fine of EUR 800 on a legal person. The accused did not respond to the complainant's repeated requests for copies of the telephone recordings.
Authority: Spanish Data Protection Authority (aepd)
Company: Centro Internacional De Crecimiento Laboral Y Profesional S.L.
Sending commercial messages without consent and without the possibility to object.
Authority: Spanish Data Protection Authority (aepd)
Company: Private individual
The Spanish DPA has imposed a fine of EUR 600 on a private individual. The controller had installed a video surveillance camera which recorded a communal area without this having been approved by the owners' meeting.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Rețele Electrice Muntenia SA.
The Romanian DPA has imposed a fine of EUR 3,000 on Rețele Electrice Muntenia SA. A user who logged into their account was able to access the personal data of other customers. During its investigation, the DPA found that the controller had failed to implement appropriate technical and organizational measures to protect personal data.
Authority: Deputy Data Protection Ombudsman
Company: Otavamedia Oy
The Finnish DPA has imposed a fine of EUR 85,000 on Otavamedia Oy. 

The DPA had received eleven complaints regarding Otavamedia between 2018 and 2021. Namely, the complaints primarily concerned the lack of response to inquiries from data subjects.  

Otavamedia explained that some of the privacy requests had not been fulfilled due to a technical problem with email management. During the incident, messages received in the privacy inquiry email box were not forwarded to customer service representatives. The situation had only been discovered after seven months. 

In this context, the DPA noted that Otovamia should have tested the new e-mail system before using it in order to be able to guarantee the response to the requests and the rights of the data subjects. 

Analogous request were possible, but the request form had to be signed by the data subjects for identification purposes. However, Otavamedia was not processing the signature data in any other contexts, so the signature could not even be cross-checked. 
The DPA concluded that Otavamedia thereby collected an unnecessarily large amount of data for identification purposes and made the exercise of data subject rights harder by requiring signatures.
Authority: Spanish Data Protection Authority (aepd)
Company: Private individual
The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space. The DPA considered this to be a violation of the principle of data minimization. The original fine of EUR 300 was reduced to EUR 180 due to voluntary payment and admission of responsibility.
Authority: Austria
Company: unknown (claimant)
The Austrian Supreme Court held that a declaratory judgment on the controller's obligation to provide access to certain data in case of further access requests by the same data subject is not feasible if the controller had already fulfilled the data subject's requests under Article 15 and 21 GDPR.
Authority: ANSPDCP (Romania)
Company: Vodafone România S.A. 
The Romanian DPA (ANSPDCP) fined Vodafone €4000 for not responding to access and erasure requests in breach of Articles 12, 15, and 17 GDPR.
Authority: Danish Data Protection Authority (Datatilsynet)
Company: Favrskov municipality
The Danish DPA has imposed a fine of EUR 10,000 on Favrskov municipality. 

On August 19, 2020, the DPA received a notification from Favrskov Municipality of a personal data breach under Art. 33 GDPR.  The notification stated that during a break-in at the municipality's premises, a laptop was stolen which contained a program that provided an overview of the municipality's care facilities and thus information on the names and personal identity numbers of approximately 100 individuals with physical or mental disabilities.

The computer hard drive in question was not encrypted and the program in question, which contained confidential and sensitive personal data, was not equipped with security measures.

In reviewing the case, the DPO found that Favrskov Municipality had not ensured the encryption of the hard drives of the municipality's laptops for a long period of time prior to August 12, 2020, resulting in an inadequate level of security.

The DPA considered this to be a violation of Art. 32 GDPR, as the municipality had failed to implement appropriate technical and organizational measures to ensure a level of protection commensurate with the risk.
Authority: Garante per la protezione dei dati personali (Italy)
The DPA fined a general practitioner €20,000 for breaching their duty of confidentiality by installing outside their office an unlocked box where patients could find medical prescriptions to pick up.