Sebastyijan/gdpr-enforcement-sample huggingface dataset:
Authority: Garante per la protezione dei dati personali (Italy)
Company: Vodafone Italy S.p.A
The Italian DPA (Garante) imposed a fine of €12.25 million on Vodafone Italia S.p.A, following an inquiry into their telemarketing practices which revealed that Vodafone was in violation of several GDPR articles. Vodafone was ordered to implement more appropriate measures to prevent the unauthorized access of customer databases and to ban the further processing of personal data.

The Garante initiated the inquiry after multiple complaints from people who received constant unwanted phone-calls from Vodafone telemarketers. Among other things, the inquiry found that Vodafone was using contacts lists purchased from external providers without user consent for telemarketing, and that the security measures implemented by Vodafone to protect their client’s data were inappropriate, as unauthorized parties were calling customers and requesting IDs by pretending to be Vodafone.
Authority: Netherlands
A Dutch Court of Appeal ordered Uber to provide drivers with access to their personal data and information about automated decision-making. The Court subjected the controller to a penalty of €4,000 per day until compliance.
Authority: Datatilsynet (Denmark)
Company: Bankernes EDB Central (BEC)
The Danish software supplier BEC received serious criticism from the Danish Data Protection Authority (Datatilsynet) for the accidental disclosure of personal data based on a system error.
Authority: ICO (UK)
The Information Commissioner's Office (ICO) decided not to take further actions over the Department for Digital, Culture, Media & Sport (DCMS) for its management of a UK citizen's (the complainant) request of information on which articles of the (now repealed) Directive 95/46/EC, according to the European Commission, had not been properly implemented by the UK government at the (now repealed) Data Protection Act 1998.
Authority: Garante per la protezione dei dati personali (Italy)
Company: A municipality
The DPA warned a municipality for unlawfully publishing personal data of a former town councilor and clarified that the publication was not covered by transparency obligations under national administrative law.
Authority: DSB (Austria)
The Austrian DPA imposed a fine of €20,000 on a controller for unlawfully making use of cameras recording its employees at work and for failing to maintain a record of its processing activities under Article 30 GDPR.
Authority: DSB (Austria)
Company: Anonymous
The DSB found that a fee of €30 for a copy of historic bank transaction data, that is not available via online banking anymore, violates the right to access under Article 15 GDPR. GDPR is also applicable to cases that were brought under Directive 95/46 but were pending before the DPA on 25. 5. 2018.
Authority: Spanish Data Protection Authority (aepd)
Company: SERVICIOS FINANCIEROS CARREFOUR, E.F.C.
The Spanish DPA has imposed a fine of EUR 1,500,000 on SERVICIOS FINANCIEROS CARREFOUR, E.F.C. The controller suffered a successfull cyberattack due to insufficient technical and organisational measures. The original fine of EUR 2,500,000 was reduced to EUR 1,500,000 due to immediate payment and admission of responsibility by the controller.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Vreau Credit SRL
Raiffeisen Bank Romania carried out scoring assessments on the basis of personal data of individuals registered on the Vreau Credit platform provided by the platform's staff via WhatsApp and then returned the result to Vreau Credit using the same means of communication.
Authority: APD/GBA (Belgium)
Company: X
The complainant submits a complaint to the DPA after having repeatedly unsuccessfully addressed the controller to exercise his right to data portability in the context of switching to a new health insurance fund. The DPA rejects the complaints since the conditions in order to exercise the right to data portability were not met.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Alpha Exploration Co. Inc.
The Italian DPA fined Alpha Exploration €2,000,000 for operating the Clubhouse social network in violation of the GDPR provisions on lawfulness and transparency, for failing to assess the risks arising from the processing and for appointing an EU representative without the required mandate to act on behalf of the controller.
Authority: Tietosuojavaltuutetun toimisto (Finland)
Company: City of Helsinki
The DPA reprimanded the City of Helsinki for making user profiles publicly searchable and visible to all through the platform's own search function when this was not necessary.
Authority: Italian Data Protection Authority (Garante)
Company: Menarini Silicon Biosystems SpA
The Italian DPA has imposed a fine of EUR 21,000 on Menarini Silicon Biosystems SpA. The controller is conducting oncological research and has developed a software that is able to classify human cells. The controller used pseudonymised health data from an American company which is part of the same group. The controller failed to ensure, that data subjects received adequate information and to ensure adequate data storage limitation. The controller also failed to demonstrate compliance with the general data processing principles.
Authority: Austria
Company: Austrian Data Protection Authority
The Supreme Administrative Court found that a credit ranking agency cannot store data originally collected from an insolvency registry after a judicial decision ordered the erasure of the data from the latter.
Authority: AEPD (Spain)
Company: ORANGE ESPAGNE, S.A.U.
The Spanish DPA fined Orange €50,000 (reduced to €30,000) for processing personal data without a valid legal basis, since processing was based on a fraudulent telephone portability contract. The DPA stated that Orange  did not have an adequate identity verification system for portability requests.
Authority: Spanish Data Protection Authority (aepd)
Company: Just Landed S.L.
Just Landed was fined with EUR 3000 for insufficient cookie information according to national data protection laws and at the same time warned due to insufficient fulfilment of information obligations according to Art. 13 GDPR (privacy policy only in English language).
Authority: AEPD (Spain)
An association that disclosed personal data of one of its members in a Whatsapp group was fined €3,000 for violating Articles 5(1)(f) and 32 GDPR.
Authority: European Union
The CJEU decided that the LED does not allow for data to be stored and processed indefinitely. The controller has an obligation to review periodically whether the data is necessary and must grant the data subject their rights when the data is no longer necessary to the purposes of processing.
Authority: CNIL (France)
Company: Ministry of Interior
The French DPA (CNIL) ordered the Ministry of Interior to cease the use of drones equipped with cameras by police forces. The Ministry violated its obligations to process personal data only where authorised by a specific legal provision and to conduct a privacy impact assessment.
Authority: Norwegian Supervisory Authority (Datatilsynet)
Company: Lillestrøm Municipality
The Norwegian DPA has imposed a fine of EUR 30,000 on Lillestrøm Municipality.

The municipality had accidentally published a document in which 10 out of 21 attachments contained personal data of students. The data included information on student names, date of birth, test results, assessments of student behavior and student challenges. This error was not detected by the responsible administrator and went through two more manual quality checks at the documentation center without the error being detected there as well.
It was only a journalist who later drew attention to the data breach. 

During its investigation, the DPA found that the municipality had not taken sufficient technical and organizational measures to protect personal data. 
Also, the fact that the incident was discovered not by the municipality, but by a third party, indicates inadequate routines in this area.
Authority: Garante per la protezione dei dati personali (Italy)
Company: XX (the data subject)
The Italian DPA imposed a €5,000 fine on Fondazione Teatro Regio of Torino for having published on its website health data relating to one of their ex-employees.
Authority: Spanish Data Protection Authority (aepd)
Company: Vodafone España, SAU
The Spanish DPA (AEPD) imposed a fine of EUR 200,000 on Vodafone España, S.A.U. A former customer had received e-mails containing electronic bills even after he had terminated his contract with the controller resulting in a processing of personal data without sufficient legal basis. The data subject states that he still receives e-mails from the controller, although he has already objected to this several times and the controller has already received a fine twice for exactly these facts. The fine imposed this time is this high because the infringement was classified as very serious by the Spanish DPA. Among other things, because this was already the third violation in this matter. The original fine of EUR 200,000 was reduced for both immediate payment and admission of responsibility to EUR 120,000.
Authority: Datatilsynet (Norway)
Company: anonymous
The Norwegian DPA fined the Norwegian Labour Inspection Authority approximately €14,679 (150,000 NOK) for credit rating a data subject without a legal basis. The DPA also reprimanded the controller for falsely informing the data subject that their data had not been processed.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: SC Class IT Outsourcing SRL
The Romanian DPA has imposed a fine of EUR 1,000 on SC Class IT Outsourcing SRL for failing to respond to a data subject's request for the deletion of their personal data in a timely manner..
Authority: AEPD (Spain)
Company: AGRUPACION DE LOS CUERPOS DE LA ADMINISTRACION DE INSTITUCIONES PENITENCIARIAS
The Spanish DPA reprimanded the General Secretariat of Penitentiary Institutions of Spain for the leak of images captured by the video surveillance system of the penitentiary center of Villena (Alicante), violating Article 32 GDPR.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Azienda Ospedaliero Universitaria Città della Salute e della Scienza di Torino
Following a request for prior consultation under Article 36 GDPR, the Italian DPA authorised a Hospital to process the health data of deceased patients in two medical studies.
Authority: Datatilsynet (Denmark)
The Danish DPA (Datatilsynet) declared itself incompetent for deciding about the processing of traffic data since the storage limitation in the telecommunication act is lex specialis to the general provision on storage in Article 5 (1)(e) GDPR.
Authority: Cypriot Data Protection Commissioner
Company: Hellenic Technical Enterprises Ltd.
The Cypriot DPA has imposed a fine of EUR 25,000 on Hellenic Technical Enterprises Ltd.. The controller hat designed the ticket sales system of the soccer clubs AC Omonia and APOEL FC. Due to a lack of security measures in the ticket sales system, it was possible for an unauthorized person to access and disclose personal data of fans on the club's website. This data involved the name, the fan card number and the ID number of the data subjects. The DPA concluded that the controller failed to implement adequate technical and organizational security measures. In separate proceedings, the DPA fined APOEL FC and AC Omonia for the same violations.
Authority: National Commission for Data Protection (CNPD)
The DPA from Luxembourg (CNPD) has imposed a fine of EUR 1,500 on a company. The company had installed a video surveillance system to ensure that their customers would not have to wait when their front desk staff was not present.
However, the cameras also constantly captured parts of two employee's work areas. The DPA states that the controller thus violated the principle of data minimization under Art. 5 (1) c) of the GDPR. Furthermore, the DPA found a violation of the information obligations set out in Art. 13 GDPR, by not properly informing its employees and third parties about the video surveillance.
Authority: Italian Data Protection Authority (Garante)
Company: GFB One s.r.l.
The Italian DPA has imposed a fine of EUR 90,000 on GFB One s.r.l.. An individual had filed a complaint with the DPA because SIM cards were registered in their name, although they had never requested this. The individual had received two emails and an SMS notifying them that a Vodafone business, which belongs to the controller, had activated two SIM cards in their name. 

The individual, after requesting the phone company to block the SIM cards, had reconstructed that the cards had been activated with a barely legible photocopy of their ID card. During its investigation, the DPA found that the controller had neither requested an original ID card for registration nor verified the legitimacy of the data. The controller also failed to inform the data subject how he had obtained the photocopies of his ID.
Authority: Czech Data Protection Auhtority (UOOU)
The Czech DPA (UOOU) imposed a fine against a company for processing personal data without a sufficent legal basis. Several individuals were contacted by the sales staff of the controller for advertising purposes. The data subjects had used the services of the sales staff in the past (until around 2016) to conclude insurance or financial contracts. However, at that time, the sales staff were working for a different company with which they had concluded an agency contract. The DPA notes that on the one hand the use of the personal data known to the representatives from their previous activity constitutes a breach of the contract concluded with the previous company, and on the other hand no legal basis existed for the further processing of the data for advertising purposes in favour of the controller.
Authority: Spanish Data Protection Authority (aepd)
Company: TNT EXPRESS WORLDWIDE SPAIN, S.L.
The Spanish DPA (AEPD) has imposed a fine of EUR 10,000 on TNT EXPRESS WORLDWIDE SPAIN, S.L.. The data subject had placed a private order with the controller and had entered the address of his workplace as the delivery address. The delivery was correctly delivered, but the invoice was issued to the company where the data subject was employed and not to the data subject. Both the invoice and the delivery bill contained various personal data of the data subject. These were disclosed to his employer as a result of the incident.
Authority: Italian Data Protection Authority (Garante)
Company: Auto Hi-Fi System S.n.c
The Italian DPA has fined Auto Hi-Fi System S.n.c in the amount of EUR 2,000. The controller had installed a video surveillance system that covered not only the public road but also a private property. The DPA considered this a violation of the principle of data minimization. Also, the controller had not posted a sign with information about the video surveillance. The DPA considered this to be a violation of Art. 13 GDPR.
Authority: Austria
Company: Max Schrems
The Supreme Court of Austria requested the CJEU's preliminary ruling on several questions, including whether processing operations for the provision of personalised advertising are to be assessed under the requirements of Article 6(1)(a) GDPR, or whether they can be replaced by relying on Article 6(1)(b) GDPR.
Authority: AEPD (Spain)
Company: Sean Serios S.L
The Spanish DPA fined a training academy €12,000 for a violation of Article 6(1) GDPR by unlawfully publishing a ranking list which included the results of a selection process and sensitive health data.
Authority: DPC (Ireland)
Following a complaint filed by an Austrian Facebook user, the Irish DPA found Meta IE’s processing of personal data for behavioral advertising to be unlawful, and fined the company €210 million.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Comune di Trento
The Italian DPA imposed a fine in the amount of €50,000 on the municipality of Trento for making use of AI systems of surveillance for scientific research in violation of several GDPR provisions.
Authority: Austria
A court held that a divorce lawyer could base the emailing of video material to the opposing side's lawyer on a legitimate interest under Article 6(1)(f) GDPR and the exercise of legal claims under Article 9(2)(f) GDPR. The video material showed the data subject’s extramarital affair.
Authority: Tietosuojavaltuutetun toimisto (Finland)
Company: Social and Health Services in Kymenlaakso (Kymsote)
The Finnish DPA held that a social services entity violated Article 6(1) and Article 10 GDPR by requiring potential foster parents to provide criminal record certificates following the wrong national law procedure specifically established for this purpose.
Authority: Germany
The Regional Court of Berlin held that a right to information under Article 15 GDPR cannot be enforced by way of an interim injunction, since there is no legal principle which establishes that granting the right of access is necessarily an urgent matter.
Authority: AEPD (Spain)
Company: Caixabank SA
A bank was fined €3,500,000 for failing to implement appropriate technical and organisational measures after customers were given access to accounts they were not authorised to access.
Authority: European Union
Company: Constantin Film Verleih GmbH
The Advocate General Saugmandsgaard Øe issued his opinion on the Bundesgerichtshof’s (Federal Court of Justice, Germany) request for a preliminary ruling on the interpretation of "addresses" in the context of Youtube's & Google's obligation to disclose the email address, the telephone number and the IP addresses used to upload files in breach of intellectual property rights to the holder of these rights.
Authority: Hellenic Data Protection Authority (HDPA)
Company: Hestia Publishers & Booksellers I. D. Kollaros & Co. S.A.
The Greek DPA has imposed a fine of EUR 9,000 on Hestia Publishers & Booksellers I. D. Kollaros & Co. S.A. The controller disclosed the identity of an anonymous author by including their legal name alongside other personal data and the pseudonym under which their work was published.
Authority: Italian Data Protection Authority (Garante)
Company: Municipality of Cori
The Italian DPA has imposed a fine of EUR 2,000 on the Municipality of Cori. The controller published the names of those receiving food cards intended for people in need on its institutional website.
Authority: Ireland
Company: Superintendent Stephen McCauley
A court found that a government office responsible for granting taxi licenses breached a data subject’s EU Charter Right to protection of personal data when it obtained immigration data from a ministry without a legal basis.
Authority: Belgian Data Protection Authority (APD)
Company: School
The Belgian DPA (APD) fined a school EUR 1,000. The controller had conducted a survey on student well-being via a smartschooling system. The DPA states that the controller did not obtain the consent of the parents of the minor students and violated the principle of data minimization. The original fine of EUR 2,000 was reduced to EUR 1,000 after the controller appealed the APD's decision.
Authority: Tietosuojavaltuutetun toimisto (Finland)
Company: Finnish Golf Union
The DPA reprimanded the Finnish Golf Union for failing to implement adequate security measures in its golfing app. The app did not use multi-factor authentication and used people's dates of birth as default passwords.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: FAN Courier Express SRL
The fine was imposed because the controller failed to take appropriate technical and organisational measures leading to the loss and unauthorised access to personal data (name, bank card number, CVV code, cardholder's address, personal identification number, serial and identity card number, bank account number, authorised credit limit) of approximately 1,100 data subjects.
Authority: Spanish Data Protection Authority (aepd)
Company: Recambios Villalegre S.L.
The Spanish DPA (AEPD) fined the company for posting photos of a person on Facebook and WhatsApp and
accusing the individual of theft in related posts. The photos were obtained
through the company's video surveillance system. The company further encouraged
other users to share both the photos and the postings. The postings resulted in
hundreds of humiliating, insulting and even threatening comments. The AEPD
imposed a fine of  EUR 10,000 for publishing the photos and EUR 2,000 for not
installing the sign required for video surveillance of the store.
Authority: Datatilsynet (Denmark)
Company: Lolland Kommune
The Danish DPA proposed a €6,700 fine against a municipality for not preventing its employees from manually disabling access codes on their mobile phones that contained citizens' personal data, thereby exposing them to unnecessary risk. The police will investigate the case before a final decision is made in the courts.
Authority: Italian Data Protection Authority (Garante)
Company: Azienda Usl della Romagna
The Italian DPA (Garante) has fined Azienda Usl della Romagna EUR 120,000. The local health authority of Romagna had accidentally transmitted a patient's report regarding an abortion to a general practitioner. However, the patient had asked not to inform her general practitioner about it. The transmission of the report was made through the regional network 'Sole'. The investigation by Garante revealed that the data had been accidentally transmitted due to an error in the software that manages patient admissions, discharges and transfers.
Authority: Germany
Company: Meta Platforms Ireland Limited
A court refused to grant an interim injunction restraining Meta from using personal data from its users' profiles to train artificial intelligence.
Authority: UODO (Poland)
Company: Virgin Mobile Polska Sp. z o. o.
The Polish DPA fined Virgin Mobile €460,000 for lack of appropriate technical and organisational measures, which resulted in a data breach affecting over 114,000 persons.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Signore XX (the data subject)
Areti S.p.A, a Rome-based electricity distributor, was fined €1,000,000 for affecting thousands of customers in the switch to another provider owing to erroneous data and systems that classified the customers as insolvent.
Authority: ANSPDCP (Romania)
Company: Vodafone România 
The Romanian DPA fined Vodafone Romania approximately €1,000 (RON 5,000) for not taking the necessary measures to prevent a data breach that lead to the transmission of certain customers' invoices to third parties.
Authority: Italian Data Protection Authority (Garante)
Company: Comune di Monte Sant'Angelo
The Italian DPA has imposed a fine of EUR 3,000 on Comune di Monte Sant'Angelo. A person who had participated in a selection procedure had filed a complaint with the DPA due to the fact that the municipality had published a list of candidates and their results in the selection procedure on its website. In its investigation, the DPA found that the municipality did not have a valid legal basis to publish the results and the personal data of the applicants. In addition, the DPA found that the controller failed to comply with the data subject's request for deletion of their personal data.
Authority: ICO (UK)
Company: EB Associates Group Limited
The UK DPA (ICO) fined EB Associates Group Limited approximately €164,500 (GBP 140,000) for instigating over 107,000 illegal cold calls to individuals about pensions schemes.
Authority: AKI (Estonia)
The Estonian DPA upheld a complaint filed by noyb and declared that the controller transferred personal data to the U.S. in lack of any legal basis under the GDPR. The controller was ordered to stop the processing.