Sebastyijan/gdpr-enforcement-sample huggingface dataset:
Authority: Spanish Data Protection Authority (aepd)
Company: Patio Ancestral S.L.
The Spanish DPA (AEPD) imposed a fine of EUR 5,000 on Patio Ancestral S.L.. The complainant worked for a construction company and had carried out some renovation work for the controller. During these works, damage had been caused to the controller's properties. The controller had then sent a letter with claims for damages not only to the complainant but also to the complainant's father, who had previously been employed by the same construction company. However, the father was an uninvolved third party in this case. The Spanish DPA found that the processing of the father's personal data for this reason had taken place without a legal basis. The original fine was reduced to EUR 3,000 due to immediate payment and admission of responsibility.
Authority: NAIH (Hungary)
The DPA found that a controller violated Article 17(1)(c) GDPR by failing to timely comply with an erasure request by a previous subscriber to its newsletter. Although the data were eventually deleted, the delay constituted an infringement.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Confalonieri S.r.l.
Following an ex officio investigation, the DPA warned a car retailer for violations relating to its website's cookies. In particular, the controller failed to inform data subjects that they could reject cookies by closing the cookie banner.
Authority: AEPD (Spain)
The Spanish DPA fined an insurance company €24,000 for violating Article 6(1) GDPR due to the processing of personal data without a legal basis. The company claimed to have implied consent of the data subject.
Authority: Italian Data Protection Authority (Garante)
Company: Wind Tre S.p.A.
Fines for several unlawful data processing activities relating to direct marketing. Hundreds of data subjects claimed to have received unsolicited communications sent without their prior consent by SMS, e-mail, telephone calls and automated calls. The data subjects were not able to exercise their right to withdraw their consent and object to processing for direct marketing purposes because the information contained in the Data Protection Policy was incomplete in relation to the contact details. Furthermore, the data protection authority stated that the data of the data subjects were published on public telephone lists despite their objection. In addition, several apps distributed by the company were set up in such a way that the user had to give his consent to various processing activities each time he accessed them, with the possibility of withdrawing consent given only after 24 hours.
Authority: Spanish Data Protection Authority (aepd)
Company: EUROPYMES SERVICIOS INTEGRALES S.L.
The Spanish Data Protection Authority has imposed a fine on EUROPYMES SERVICIOS INTEGRALES S.L.. The controller has not properly complied with the data subject's request for erasure of their personal data. The original fine of EUR 1000 was reduced to EUR 800 due to voluntary payment.
Authority: Datatilsynet (Denmark)
Company: City of Copenhagen
The DPA found that each new citizen's subscription including collection of their personal data for the purpose of handling deletion requests in the Copenhaguen Civil Registration System (CPR) was not necessary for the performance of a task carried out in the plublic interest, under the data minimisation principle and Article 6(1)(e) GDPR.
Authority: Italian Data Protection Authority (Garante)
Company: Pro Loco Tourist Association of Cittareale
The Italian DPA has imposed a fine of EUR 600 on the Pro Loco Tourist Association of Cittareale. The controller published personal data of its members on its website without a sufficient legal basis.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Mensajero SRL
The Romanian DPA has imposed a fine of EUR 3,000 on Mensajero SRL. 
The controller had suffered a data breach where a link on the controller's website was publicly accessible allowing numerous files containing customer data to be viewed and downloaded. The DPA found that the controller had failed to implement adequate technical and organizational measures to protect personal data and prevent such incidents.
Authority: Italian Data Protection Authority (Garante)
Company: Istituto Nazionale di Previdenza Sociale
The Italian DPA has imposed a fine of EUR 20,000 on the Italian National Institute of Social Security (INPS). The controller had published personal data of participants in a competitive selection procedure on its website without an appropriate legal basis.
Authority: European Union
Company: juris GmbH
The CJEU held that a controller is not exempted from liability for damages under the GDPR, for the mere fact that a person acting under its authority failed to follow its instructions. To assess the amount of damages due as a compensation, the criteria set out for setting administrative fines shall not be taken into account.
Authority: Spanish Data Protection Authority (aepd)
Company: Vodafone España, SAU
The Spanish DPA (AEPD) has imposed a fine on Vodafone España SAU. A data subject had filed a complaint with the AEPD against the data controller. The data subject states that he had received invoices and debits on his bank account for the payment of Vodafone services that he had not booked himself. The data subject also stated that he had been asked to pay for these services by the debt collection company I.S.G.F. Informes Comerciales, S.L.. As it turned out, fraudsters had used the data subject's personal data to conclude a service contract. Vodafone had subsequently canceled the contract for the booked services. Due to a system error, however, the outstanding invoices had not been canceled, which is why they had been forwarded to the collection agency. The AEPD determined that this transmission was unlawful due to the non-existence of a valid contract. The original fine of EUR 50,000 was reduced to EUR 30,000 due to voluntary payment and admission of guilt.
Authority: Garante per la protezione dei dati personali (Italy)
Italy's DPA reprimanded a website operator for failing to provide appropriate safeguards for the transfer of personal data to the US through Google Analytics, ordering it to comply with Article 46 GDPR or suspend data transfers to Google LLC.
Authority: AEPD (Spain)
Company: Supervista Optics Spain
The DPA fined an optician €20,000 for sending a former customer a marketing email even though she had expressly objected to this form of processing.
Authority: Netherlands
Company: Servicekosten Consultancy V.O.F. 
A court ruled that a credit card issuer can request its clients to provide a non-watermarked copy of their ID card for anti-money laundering purposes. This processing activity can be based on a legal obligation in accordance with Article 6(1)(c) GDPR.
Authority: Germany
The Financial Court of Munich held that documents in tax dossiers were not personal data. Consequently, Article 15(1) GDPR was not applicable.
Authority: AEPD (Spain)
Company: UNIQUE HOTEL APARTMENT. S.L.
Spain's supervisory authority (the AEPD) fined a hotel €2,000 for scanning the ID cards of its customers where not required by applicable law and, therefore, in breach of the Article 5(1)(c) GDPR on the principle of minimisation.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: SC Travel Planner SRL
The Romanian DPA has imposed a fine of EUR 6,000 on SC Travel Planner SRL. The controller failed to implement sufficient technical and organisational measures, resulting in a data breach. The controller also failed to notify the DPA of the breach.
Authority: France
Company: Amazon Europe Core
The Conseil d'Etat confirmed a prior sanction by the French DPA. In this prior decision, the French DPA fined Amazon Europe Core €35,000,000 for the unlawful use of cookies on its websites.
Authority: Data Protection Commision of Bulgaria (KZLD)
Company: National Revenue Agency
The pecuniary sanction of EUR 28, 121 was imposed on the National Revenue Agency for unlawful processing of the personal data of data subject G.B.I. The personal data of G.B.I. was unlawfully collected and subsequently used to form an enforcement case against her for recovery of the sum of EUR ca. 86, 569. In relation to the enforcement case formed, additional data concerning the bank accounts of G.B.I was collected by the National Revenue Agency from the register of the Bulgarian National Bank. The additional collected data was also unlawfully processed by the National Revenue Agency in sending distraint orders to the banks with which G.B.I. had bank accounts.
Authority: ANSPDCP (Romania)
Company: S.P.E.E.H. Hidroelectrica S.A.
The Romanian DPA fined a controller approx €5.000, issued a warning and applied two corrective measures, as sanctions for a data breach and for processing personal data without a legal base, in breach of Article 32(1)(b), Article 32(2), Article 5(1)(a), and Article 6(1) GDPR.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Medstar S.R.L.
The Romanian DPA imposed a fine of EUR 2,000 on Medstar S.R.L. The controller had mistakenly sent a patient's health data via unsecured email to another patient. The DPA found that the controller had failed to implement appropriate technical and organizational measures to protect personal data and prevent such an incident.
Authority: Garante per la protezione dei dati personali (Italy)
Company: GF
The DPA held that the customer of a company had a right to revoke her consent to the use of her image for the company's advertising. The DPA also clarified that consent can be revoked regardless of negative economic consequences for the controller.
Authority: Norwegian Supervisory Authority (Datatilsynet)
Company: Aquateknikk AS
The Norwegian DPA (Datatilsynet)  fined Aquateknikk AS NOK 100,000 (EUR 9,700). The controller had carried out a credit rating on an individual without there being a customer relationship or other affiliation. The personal data of the data subject was thus processed without a legal basis.
Authority: Czech Data Protection Auhtority (UOOU)
Company: Legal Person
The Czech DPA has imposed a fine of EUR 1,000 on a legal person. For at least two months, the accused incorrectly included 50 entities in the published list of processors, even though they were not actually processors.
Authority: CNIL (France)
Company: LES PUBLICATIONS CONDE NAST
The DPA fined a publisher €750,000 for placing optional cookies without consent on users' devices, failing to provide clear information on “necessary” cookies, and for ineffective mechanisms for refusing and withdrawing consent.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Automobilus International S.R.L.
The Romanian DPA has imposed a fine of EUR 5,000 on Automobilus International S.R.L. The controller failed to implement sufficient technical and organisational measuresto ensure data security, resulting in a data breach.
Authority: IP (Slovenia)
Company: Anonymous
The Slovenian DPA (IP) issued a non-binding opinion about employees' personal data that an employer can process during work from home. The IP emphasised that the principles of data minimisation and transparency must be respected as well as the information obligations according to Articles 13 and 14 GDPR.
Authority: Spanish Data Protection Authority (aepd)
Company: Private individual
The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space. The DPA considered this to be a violation of the principle of data minimization. In addition, the controller had not properly informed data subjects about the processing of the data by the video surveillance and thus violated its duty to inform.
Authority: Italian Data Protection Authority (Garante)
Company: Municipality of Nepi
The Italian DPA has imposed a fine of EUR 20,000 on the municipality of Nepi. The controller had published a document containing the ranking list of a pre-selection test for a public competition, which included personal data of the participants. During its investigation, the DPA found that the controller did not have a valid legal basis for publishing this personal data.
Authority: Spanish Data Protection Authority (aepd)
Company: URBANO DIVERTIA, S.L.
The Spanish DPA has imposed a fine on URBANO DIVERTIA S.L.. A customer had filed a complaint with the DPA, for having received a document from the controller with data relating to the previous tenant of the apartment they were now renting from the controller. The DPA considered this to be a violation of the principle of integrity and confidentiality. The original fine of EUR 2,000 was reduced to EUR 1,200 due to voluntary payment and admission of responsibility.
Authority: Datatilsynet (Denmark)
Company: Danish Agency for Digitisation
The Danish DPA held that a controller had not adopted appropriate technical and organisational measures pursuant to Article 32(1) GDPR, which led to a personal data breach caused by an employee's error.
Authority: DPC (Ireland)
Company: Meta Platforms
The Irish DPA fined Meta Platforms (formerly Facebook Ireland Limited) €17,000,000 for failing to implement appropriate technical and organisational measures in order to protect EU users' data, in violation of Articles 5(2) and 24(1) GDPR.
Authority: Hellenic Data Protection Authority (HDPA)
Company: Municipality of Athens
The Hellenic DPA has imposed a fine of EUR 5,000 on the municipality of Athens for failing to sufficiently cooperate with the DPA.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Servizio Idrico Integrato S.c.p.a.
The Italian DPA imposed a €15,000 fine on a company providing water services for the use of an insecure network protocol and the lack of encryption on its website.
Authority: Spanish Data Protection Authority (aepd)
Company: CUBILLO GALLEGO, S.L.
The Spanish DPA imposed a fine of EUR 540 on CUBILLO GALLEGO, S.L. The controller failed to comply with an order issued by the DPA, as well as failing to react adequately to communication from the DPA. The original fine of EUR 900 was reduced to EUR X540 due to immediate payment and admission of responsibility by the controller.
Authority: European Union
The CJEU held that a person’s fear that their personal data have been disclosed to third parties is sufficient to give rise to compensation if the fear, with its negative consequences, is duly proven.
Authority: Italian Data Protection Authority (Garante)
Company: Store owner
The Italian DPA  has fined a store owner EUR 2,000 for failing to provide sufficient information pursuant to Art. 13 GDPR about CCTV surveillance in their premises.
Authority: APD/GBA (Belgium)
The DPA reprimanded an employer for unlawfully maintaining the email accounts of a former employee and for a failure to comply with the employee’s access and deletion requests.
Authority: AEPD (Spain)
Company: UNITED PARCEL SERVICE ESPAÑA LTD Y COMPAÑIA SRC
The Spanish DPA fined UPS €70,000 for leaving a parcel with a neighbour of the data subject without their previous consent, thus unlawfully disclosing the recipient's data to a third person.
Authority: Commissioner (Cyprus)
Company: Freedom Finance Europe Ltd
The Cypriot DPA reprimanded the controller, Freedom Finance Europe Ltd, fro breaching Article 12(3) GDPR, since it failed to notify the data subject that her erasure request was satisfied, as well as Article 24(1) GDPR, given that the controller should have implemented appropriate measures to tackle GDPR requests.
Authority: AEPD (Spain)
Company: Vodafone
Vodafone has been fined € 44.000 for accidentally disclosing personal data to a third party.
Authority: AP (The Netherlands)
Company: Koninklijke Nederlandse Lawn Tennisbond (KNLTB)
The Royal Dutch Lawn Tennis Association (KNLTB) was fined €525,000  for providing personal data of its members to two sponsors, for direct marketing purposes without a lawful basis or proper consent.
Authority: Ireland
Company: The Data Protection Commissioner
The Irish Court of Appeal, in an appeal brought by the Irish DPC, ruled that personal data that was collected through CCTV for the purpose of crime prevention, could not be lawfully used for staff monitoring and disciplinary proceedings. This subsequent, secondary purpose, was incompatible with its original purpose.
Authority: Austria
An Austrian Court upheld a decision of the Austrian DPA affirming that the publication of personal data without given consent on the controllers’ websites for advertising purposes was contrary to Article 6(1) GDPR.
Authority: ANSPDCP (Romania)
Company: CDI Transport Intern și Internațional SRL
The Romanian DPA issued a warning to a passenger transportation company for an insufficient privacy statement on its website and ordered it to rectify the situation. The DPA further fined the company €7,000 for its lack of collaboration during the investigation.
Authority: HDPA (Greece)
Company: Anonymous
The Hellenic DPA (HDPA) fined a politician €2000 for unsolicited political communication (SMS), although the complainant eventually withdrew their complaint.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Proleasing Motors SRL
The company had failed to take adequate technical and organisational measures to ensure data security, which led to the publication on Facebook of a document containing a password for access to personal data of 436 customers.
Authority: Spanish Data Protection Authority (aepd)
Company: EDP Comercializadora, S.A.U.
The company processed personal data in connection with a gas contract without the consent of the applicant. The decision finds that the applicant received an invoice for a gas contract which he did not sign and that EDP Comercializadora claims that the applicant is party to a contract with another energy company which has a supply contract with EDP Comercializadora and that the processing of data is therefore justified. The AEPD stated that EDP Comercializadora had to prove that the plaintiff had agreed to a contract with a second entity and not only with its direct energy supplier.
Authority: Datatilsynet (Norway)
Company: Høylandet kommune (municipality)
The Norwegian DPA fined a municipality €40,478 (NOK 400,000) for not managing a breach in which people with no affiliation to the municipality had their highly sensitive personal data exposed, thus breaching Article 32(1)(b) GDPR and Article 32(2), cf. Article 24.
Authority: Spanish Data Protection Authority (aepd)
Company: Restaurant
Installation of CCTV surveillance cameras that were also monitoring the public space and without proper information.
Authority: Datatilsynet (Denmark)
Company: Høje-Taastrup Municipality
The Danish DPA found that the Høje-Taastrup Municipality violated Article 32(1) GDPR because it did not have guidelines or objective criteria in place to assess which users have access to a database containing personal data.
Authority: Austria
A court found an individual had a legitimate interest in monitoring a shared path via CCTV to bring cases against people misusing that path.
Authority: Spanish Data Protection Authority (aepd)
Company: Private individual
The Spanish DPA has imposed a fine of EUR 300 on a private individual. The individual had installed a video surveillance camera which, among other things, also recorded public spaces. In addition, the person forwarded the recordings via WhatsApp. The DPA considered this to be a violation of the principle of data minimization.
Authority: APD/GBA (Belgium)
Publicly available information of tens of thousands of doctors across Belgium were collected and processed without a legitimate basis. Their information were published on an online platform consisting of profiles for doctors. The interests of the data subjects outweighed the controller’s interests. The controller was fined 10,000 EUR for its GDPR violations.
Authority: Polish National Personal Data Protection Office (UODO)
The Polish DPA has fined a data controller EUR 2,300 for failing to report a data breach to the DPA and data subjects in a timely manner.
Authority: Spanish Data Protection Authority (aepd)
Company: OCI CINE, S.L.
The Spanish DPA imposed a fine of EUR 18,000 on OCI CINE, S.L. The controller had implemented insufficient technical and organisational measures to ensure data security, resulting in customers having temporary access to the data of unrelated customers. The original fine of EUR 30,000 was reduced to EUR 18,000 due to immediate payment and admission of responsibility by the controller.
Authority: Datatilsynet (Denmark)
Company: Erhvervsstyrelsen (Danish Business Authority)
The Danish DPA held that the general recording of phone calls by the Danish Business Authority without prior consent was a breach of the GDPR. It found that consent is the only legal basis for such recordings, which were used for the purpose of documenting the intimidation of employees and internal training.
Authority: Persónuvernd (Iceland)
The Persónuvernd  (Icelandic DPA) held that a bank's planned publication of photographs including children  on its Facebook page was not in compliance with the GDPR.
Authority: Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)
Company: Car importer
The Hungarian DPA imposed a fine of EUR 13,500 on a car importer. A customer of one of the company's authorized repair shops filed a complaint with the DPA due to receiving unsolicited emails related to customer surveys from the company after a car inspection. The Hungarian DPA found that the controller did not have a valid legal basis to contact the data subject. It also found that the controller had not complied with its duty to inform under Art. 12 GDPR and Art. 13 GDPR. The emails did not contain any contact information of the controller, for example.
Authority: Italian Data Protection Authority (Garante)
Company: Noi Compriamo Auto.it S.r.l.
The Italian DPA has imposed a fine of EUR 45,000 on Noi Compriamo Auto.it S.r.l. The controller contacted the data subject multiple times for direct marketing purposes via different email addresses. The controller had no legal basis for the processing and failed to implement sufficient technical and organizational measures to demonstrate its lawfulness. Additionally, the controller failed to allow the data subject to easily exercise his rights.
Authority: DPC (Ireland)
The Irish Data Protection Commissioner (DPC) fined Tusla (the Irish Child and Family Agency) €75000 for “unintentionally providing” the personal data of children to third parties in three separate incidents.
Authority: France
Company: CNIL
The Conseil d'Etat dismissed an appeal for understanding that CNIL was correct in closing the Data Subject complaint since Irish DPA is the Supervisory Authority with competence to deal with the cross-border case, based on Article 56(2) GDPR.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: SC Diamir SRL
The Romanian DPA has imposed a fine of EUR 1,000 on SC Diamir SRL. The controller failed to properly cooperate with the supervisory authority and also disclosed personal data to third parties without a sufficient legal basis.
Authority: Germany
Company: Data Subject v. Music Streaming Service (and its processor and sub-processor)
A court awarded €200 in non-material damages to a data subject following a data breach caused by the controller’s failure to ensure proper and timely deletion of personal data processed by its sub-processor.
Authority: ICO (UK)
Company: Emailmovers Limited
The UK DPA found that an email data and marketing service violated the lawfulness, fairness, and transparency principle, since its email address database had no clear lawful basis and individuals were not informed that the service had acquired their personal data. Among other things, the DPA ordered the service to notify individuals whose data it processes of the information under Article 14 GDPR.