Sebastyijan/gdpr-enforcement-sample huggingface dataset:
Authority: AEPD (Spain)
Company: CONSEJERÍA DE EDUCACIÓN, ***IES B.B.B.
The Spanish DPA held that, for an access request to be valid, it should be done through the appropriate channel (in this case, the DPO), and should be properly documented.
Authority: Spanish Data Protection Authority (aepd)
Company: Private individual
The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the neighborly shared acces road. The DPA considered this to be a violation of the principle of data minimization. In addition, the controller had not properly informed the data subjects about the processing of the data by the video surveillance and thus violated its duty to inform.
Authority: Datatilsynet (Denmark)
The Danish DPA reprimanded Jysk Fynske Medier, a media group, for its Pay-or-Okay mechanism. Consenting to cookies would give users only limited access to the website. Instead, if they paid the subscription, they would enjoy all the available content. In this case, consent was not freely given because the available content was not equivalent between the two ways of getting access.
Authority: AEPD (Spain)
Company: Centro Internacional de Crecimiento Laboral y Profesional, S.L.
10 July 2020 - The Spanish Data Protection Agency (AEPD) decided to early finish the sanction procedure against Centro Internacional de Crecimiento Laboral y Profesional, S.L. (the defendant) for the infringement of Article 21 of the Spanish Law on Information Society Services (LSSI) —this is the Spanish law regulating the prohibition to send unsolicited commercial emails without a legal basis, connected to Article 6 of the GDPR—, as the defendant agreed to an early and guilty voluntary payment of the corresponding part (600 €) of the fine suggested by the AEPD (1,000 €).
Authority: Information Commissioner (ICO)
Company: Doorstep Dispensaree Ltd. (Pharmacy)
The company had stored some 500,000 documents containing names, addresses, dates of birth, NHS numbers and medical information and prescriptions in unsealed containers at the back of the building and failed to protect these documents from the elements, resulting in water damage to the documents.
Authority: ANSPDCP (Romania)
Company: S.C. Delivery Solutions S.A.
The Romanian DPA fined the processor S.C. Delivery Solutions S.A. (Sameday) €3,000 for not implementing necessary technical and organisational measures, which led to the disclosure and/or unauthorised access to personal data of 26,566 natural persons after its database was posted on the website 'Raidforums.'
Authority: DSB (Austria)
The Austrian data protection authority found that neither the GDPR nor the Austrian law implementing the GDPR will apply to the transfer of health data between two individuals via WhatsApp, as such processing fall's under the GDPR's household exemption.
Authority: ANSPDCP (Romania)
Company: SC Grupex 2000 SRL
The Romanian DPA fined a news website approximately €1000 after it published video recordings of medical patients in breach of Articles 6 and 9 GDPR.
Authority: Datatilsynet (Denmark)
Company: F.C. Copenhagen
The DPA has granted F.C. Copenhagen’s application to use facial recognition technology at football matches under national law since the intended enforcement of suspensions is a substantial public interest. No permission was given for non-football events.
Authority: NAIH (Hungary)
The Hungarian DPA fined a news service 2,000,000 HUF (approx. €5,080) for processing personal data without valid consent. Data subjects who signed up for the controller's newsletter were automatically signed up to electronic marketing and a prize draw without being sufficiently informed nor being able to give granular consent.
Authority: Spanish Data Protection Authority (aepd)
Company: DELSA ALQUILERES S.L.
The Spanish DPA has imposed a fine of EUR 1,000 on DELSA ALQUILERES S.L.. The controller had installed video surveillance cameras in a residential complex which, among other things, also recorded common areas, although this was not authorized by the homeowners' association. In addition, the controller did not sufficiently comply with its information obligations under Art. 13 GDPR.
Authority: Spanish Data Protection Authority (aepd)
Company: Private individual
The Spanish DPA (AEPD) has imposed a fine of EUR 500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space. The DPA considered this to be a violation of the principle of data minimization.
Authority: Germany
The Federal Court of Justice held that a political party could invoke the privilege of journalistic purposes under Article 85 GDPR when using the name of a different politician in an announcement for a demonstration. Therefore, no legal basis is required and the politician was not entitled to any compensation.
Authority: Germany
A court in Frankfurt (LG Frankfurt am Main) held that according to the terms and conditions of a social network, an operator may ask a user to prove their identity during the registration process. Should the user refuse, the operator is entitled to terminate their account.
Authority: Spanish Data Protection Authority (aepd)
Company: JOYPAZAR, S.A.
The Spanish DPA (AEPD) has imposed a fine of 1,600 on JOYPAZAR, S.A.. The company had installed video surveillance cameras which, among other things, also covered a public playground. The DPA considered this to be a violation of the principle of data minimization.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Money Seeds S.R.L.
The Romanian DPA has imposed a fine of EUR 2,000 on Money Seeds S.R.L. The controller failed to fulfil a data subject's request to exercise their rights.
Authority: Italian Data Protection Authority (Garante)
Company: Ubi Banca spa
The Italian DPA has imposed a fine of EUR 100,000 on Ubi Banca spa (now Intesa Sanpaolo spa). A data subject had filed a complaint with the DPA for receiving a letter from the controller, with the envelope stating 'anomalous credit Chieti'. However, the letter did not contain payment reminders but only information about the transparency of banking and financial services. For this reason, the DPA found that the controller had violated the principles of lawfulness and transparency as well as the principle of data minimization.  After all, the term on the envelope could enable third parties to obtain information about the recipient's financial situation, regardless of the contents in the envelope.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Inteligo Media SA
As part of the registration process on the webseite avocatnet.ro, the operator used an unfilled checkbox, by means of which users could declare that they did not wish to receive information letters via e-mail (opt-out). Without any action, the user was automatically sent information letters via e-mail. This did not fulfil the requirements for a GDPR-compliant consent.
Authority: Netherlands
Company: Autoriteit Persoonsgegevens
The Amsterdam Court of First Instance held that a homeowner association lawfully installed new surveillance cameras in their apartment building because their legitimate interest in the protection of common property outweighed an individual resident's interest in the protection of their privacy (Article 6(1)(f) GDPR).
Authority: Spanish Data Protection Authority (aepd)
Company: Miguel Ibáñez Bezanilla, S.L.
The company's website (license plate seller) requested personal information such as first and last name, copy of ID card and driver's license, and the car's VIN number, but offered neither an encrypted transport protocol ('<a class='blau' href='https'' target='_blank'>link</a> instead of '<a class='blau' href='http')' target='_blank'>link</a> nor an updated data processing policy in accordance with the GDPR.
Authority: Italian Data Protection Authority (Garante)
Company: Mapei S.p.A.
The company had left the e-mail account of the data subject active even after the termination of his employment and had automatically forwarded incoming e-mails. The company did not provide sufficient information about this. In addition, the company did not react to claims for access and erasure.
Authority: AEPD (Spain)
The Spanish DPA (AEPD) imposed fine € 2.000 for violation of Article 32 GDPR.
Authority: France
Conseil d'Etat confirms CNIL's decision to impose a fine of 50 million € on Google for non transparent privacy policy and lack of valid consent to provide personalised ads.
Authority: Netherlands
Company: Council of Mayor and Aldermen of Uithoorn
The Dutch Council of State (RvS) held that if there are easier methods of verifying an identity, it is disproportionate to ask the data subject requesting access to his data to visit the town hall to identify himself in person. The presentation of a copy of a passport is, in principle, sufficient.
Authority: Spanish Data Protection Authority (aepd)
Company: Private individual
The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space. The DPA considered this to be a violation of the principle of data minimization. In addition, the controller had not properly informed data subjects about the processing of the data by the video surveillance and thus violated its duty to inform. The original fine of EUR 1000 was reduced to EUR 800 due to voluntary payment.
Authority: Spanish Data Protection Authority (aepd)
Company: Vodafone España, S.A.U.
The Spanish DPA (AEPD) imposed a fine of EUR 100,00 on Vodafone España, S.A.U. due data processing without a sufficient legal basis. A data subject stated that a prepaid line of which charges were made, had been registered in their name. However, the data subject had never concluded a contract with the company for this line. Rather, the contract in question was concluded by fraudsters using the data subject's personal data. Nevertheless, the personal data was entered into the company's information systems without any verification as to whether the contract had been lawfully and actually concluded by the data subject.
Authority: HDPA (Greece)
Company: Individuals
The Greek DPA imposed a €150,000 fine on Vodafone PANAFON S.A. for the lack of appropriate technical and organisational measures to protect the security of its electronic communication services.
Authority: Spanish Data Protection Authority (aepd)
Company: Owner of a Pharmacy Office
The Spanish DPA has imposed a fine on the owner of a pharmacy office. The controller processed data of residents of two geriatric centers without a sufficient legal basis. The controller also failed to inform the data subjects about the fact, that the controller processed their data and that they obtained the data from a third party. Lastly, the controller failed to use encrypted email services. The original fine of EUR 11,000 was reduced to EUR 6,600 due to immediate payment and admission of responsibility by the controller.
Authority: Polish National Personal Data Protection Office (UODO)
Company: ID Finance Poland Sp. z o.o.
The Polish DPA (UODO) imposed a fine of EUR 235,300 on ID Finance Poland Sp. z o.o. Due to an error while restarting a server, the settings of the software responsible for the server's security were reset, making the personal data of 140 699 customers publicly available. These data contained, for example, information about the first and last name, address, nationality or even marital status of the data subjects. The database located on this server was downloaded and deleted by an unspecified third party, who demanded a fee from the company for the return of the database. The DPA noted that the controller had taken insufficient technical and organizational measures to ensure the protection of the processing, even though there was a high risk for the data subjects due to the nature of the data processed.
Authority: Tietosuojavaltuutetun toimisto (Finland)
Finnish DPA held that a feature that allowed the users of an email service to export their emails one by one did not fulfill the data subject's right to data portability under Article 20 GDPR.
Authority: Spanish Data Protection Authority (aepd)
Company: Laboratorio Octogón, S.L.
Usage of CCTV camera systems that were also monitoring public space (breach of principle of data minimization).
Authority: Czech Data Protection Auhtority (UOOU)
Company: Legal Person
The Czech DPA has imposed a fine of EUR 3,810 on a legal person. The accused unlawfully processed the personal data of an unspecified number of creditors to purchase their claims against a debtor company, without a legal basis. She also failed to inform the data subjects about this processing, having obtained their data from another company rather than directly from them.
Authority: Germany
A court held that the right to access under Article 15 GDPR is strictly personal and non-transferrable. Requesting access for the sole purpose of preparing a lawsuit was considered an "abuse of law".
Authority: HDPA (Greece)
The HPDA of Greece imposed a fine of EUR 3,000 on a candidate of the June 2019 Greek parliamentary elections due to the violation - via the candidate's pre-election manually operated phone calls-made campaign - of the data subject's right to access their data (Article 15 GDPR) and the violation of Article 11(2) Law 3471/2006 that concerns the protection of personal data in the sector of electronic communications and, more especially, the "opt-out" system regarding manually operated phone calls for promotional purposes.
Authority: Italian Data Protection Authority (Garante)
Company: Rinascente S.p.A.
The Italian DPA has fined Rinascente S.p.A. EUR 300,000.

The DPA acted on a complaint from a customer who, following an incident with a store employee, had her long-standing loyalty card cancelled and received a new, unsolicited card that contained offensive information about the complainant in her name. The customer complained that their information had been accessed without their consent. 

During the investigation, the DPA also found that the information on the loyalty card did not specify the retention period of the data for marketing and profiling purposes. In addition, it was not stated that activities were carried out through Facebook-Meta, in which customers' email addresses were forwarded to the American company.

As for the e-commerce activities on the website, it was found that, although broad profiling was carried out, Rinascente had not carried out a data protection impact assessment in accordance with the GDPR.

In setting the fine, the DPA took into account the high number of data subjects (more than 2,000,000 people were registered in the stores or online), the duration of the violations and the financial performance of the company.
Authority: Netherlands
Company: Zakelijk Energie Beheer B.V.
The District Court of Gelderland ordered a controller to provide the data subject with information under Article 14 GDPR, comply with his access request pursuant to Article 15 GDPR, and to erase his personal data pursuant to Article 17(1)(c) GDPR.
Authority: Commissioner (Cyprus)
Company: Breikot Management Ltd
The Cypriot DPA upheld a fine of €3,000 imposed against a local newspaper for the violations of Articles 5(1)(c) and 6 GDPR and Article 29(1) of Law 125(I)/2018. In this case, the Cypriot DPA reviewed one of its previous decisions, following an order by the Administrative Court.
Authority: BlnBDI (Berlin)
The Berlin Commissioner for Data Protection and Freedom (BInBDI) fined a retail group €525,000 for violating Article 38(6) GDPR due to the conflict of interest of their DPO who independently monitored decisions made in their capacity as an executive of the company.
Authority: IMY (Sweden)
Company: CDON AB
The DPA issued a reprimand against a controller for unnecessarily using a burdensome identity verification method when data subjects requested erasure, such as asking data subjects to provide their order number and price of the last order.
Authority: Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)
Company: Bank
The Hungarian DPA has imposed a fine of EUR 72,500 on a bank. An individual had filed a complaint with the DPA. The bank had conducted a credit check on the individual based on a credit application. However, the bank later conducted a second credit check, although the individual had not requested a new credit offer. The DPA therefore found that this second credit check was carried out unlawfully due to the lack of a legal basis.
Authority: Spanish Data Protection Authority (aepd)
Company: Café Restaurante B.B.B
The cafe used CCTV cameras which also captured the public space outside resulting in a violation of the so called principle of data minimisation.
Authority: Belgian Data Protection Authority (APD)
Company: Belgian Order of Pharmacists
The Belgian DPA has imposed a fine of EUR 30,000 on the Belgian Order of Pharmacists. The controller had conducted disciplinary proceedings against the data subject (pharmacist). As part of the disciplinary proceedings, the controller had collected personal data from the data subject in their personnel file. During its investigation, the DPA found that the controller had violated principles of data processing according to the GDPR in this context. For example, the DPA found that storing information on disciplinary actions without distinguishing the severity of the action for the period of the entire career seemde excessive and was therefore unlawful. The DPA also found that the controller had not adequately defined the associated storage purposes when storing the data.
Authority: Germany
The Administrative Court of Ansbach dismissed a complaint Article 77 GDPR on the basis that the alleged breach of the data subject's rights occurred before the GDPR came into force.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Aosom Italy S.r.l.
The Italian supervisory authority investigated the cookie practices of an ecommerce website. The data controller addressed the authority’s concerns during the investigation. The authority issued a warning.
Authority: Poland
A court held that the phone number of a company’s CEO, used by a business partner as the company’s contact data, constituted data relating to a legal person and therefore fell outside the scope of the GDPR.
Authority: Spanish Data Protection Authority (aepd)
Company: UNONO NET 3.0, S.L.
The Spanish DPA has imposed a fine on UNONO NET 3.0, S.L.. The company had forwarded an email to numerous recipients without using the blind copy function, making it possible for all recipients to see the email addresses of the other recipients. The original fine of EUR 1,500 was reduced to EUR 900 due to voluntary payment and admission of responsibility.
Authority: Italian Data Protection Authority (Garante)
Company: Comune di Luino
The Italian DPA (Garante) imposed a fine of EUR 10,000 on the municipality of Luino. The controller had published a document containing personal data of a local council member. In addition to personal data, the document also contained information about a complaint procedure filed against him by the mayor. The freely accessible document could be downloaded without further authentication. Furthermore, the municipality had failed to name a data protection officer and to provide the DPA with his/her contact details.
Authority: CNIL (France)
Company: Free
The French DPA fined a telecommunications provider €300,000 for several GDPR violations. Among other things, the DPA rejected that the controller's sources of personal data were deemed "business secrets" and held that the controller failed to adequately respond to access and erasure requests.
Authority: Spanish Data Protection Authority (aepd)
Company: Private Individual
The Spanish DPA (AEPD) imposed a fine in the amount of EUR 1,200 on a private individual for impersonating a third party on the social networks Tinder and WhatsApp by using images of the third party on their profile. The pictures were used without the consent of the data subject.
Authority: Germany
The Higher Administrative Court Bavaria held that with regard to the exchange of personal data between a controller and an authority acting in its governmental capacity, one must distinguish between the legal basis for the transfer of data by the controller on the one hand and the legal basis for receiving the personal data on the other.
Authority: AEPD (Spain)
The DPA fined a controller €300 for using a video surveillance camera for home security which captured a neighbor’s patio.
Authority: AEPD (Spain)
The Spanish DPA found that websites that do not qualify as "service providers" under the Spanish legislation on e-commerce and information society services, have no obligation to ask for consent before placing analytical cookies.
Authority: Netherlands
Company: College van burgemeester en wethouders van Leeuwarden
The Raad van State held that a municipality was justified in asking a data subject to identify themselves for the purposes of an access request by showing a valid ID, or by re-submitting the request via an online government identity management portal. The municipality had reason to doubt the data subject's identity because the request appeared to have been signed by a "Beneficiary, Authorised Agent, and Representative."
Authority: Spanish Data Protection Authority (aepd)
Company: UNITED PARCEL SERVICE ESPAÑA LTD. Y CIA SRC
The Spanish DPA has imposed a fine on UNITED PARCEL SERVICE ESPAÑA LTD. Y CIA SRC a fine. A person had filed a complaint against the controller because a package addressed to them was delivered to a store and not to their home without their consent, resulting in their postal address and telephone number being disclosed to third parties. The DPA considered this to be a violation of Art. 5 (1) f) GDPR and Art. 32 GDPR. The original fine of EUR 140,000 was reduced to EUR 84,000 due to voluntary payment and admission of guilt.
Authority: Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)
Company: Health insurance provider
The Hungarian DPA has imposed a fine of EUR 1,200 on a health insurance provider. 
The insurer had published the result of a Covid-19 test of the data subject on its website. This would have allowed unauthorized persons to access the personal data of the data subject. In addition, the insurer had not adequately cooperated with the agency during the DPA's investigation.
Authority: National Commission for Data Protection (CNPD)
The DPA from Luxembourg has imposed a fine of EUR 13,200 on a company. According to the DPA, the controller failed to involve the data protection officer in all matters relating to the protection of personal data. Also, the controller did not have a data protection control plan in place to demonstrate that the data protection officer was adequately performing its tasks. Furthermore, the controller failed to provide the data protection officer with the necessary resources to perform his duties. The DPA also noted that the controller's website did not contain a section dedicated to data protection and that the information notice on data protection was only available in English rather than in one of the official languages of Luxembourg.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: PREMIER RESTAURANTS ROMANIA SRL
The Romanian DPA has imposed a fine of EUR 8,000 on PREMIER RESTAURANTS ROMANIA SRL. The controller failed to implement adequate technical and organisational measures, resulting in a cyber incident.
Authority: Italian Data Protection Authority (Garante)
Company: Camedi s.r.l.
The Italian DPA has imposed a fine of EUR 10,000 on Camedi s.r.l. Medical Center. A person had filed a complaint with the DPA because they had received invoices as well as appointment reminders from another patient with the same name as theirs.