Sebastyijan/gdpr-enforcement-sample huggingface dataset:
Authority: Netherlands
The Rotterdam Court of First Instance ordered the defendants in a family dispute to refrain from sharing the personal data of the claimants, including via emails, websites, and social media posts written on the dispute, as there is no legal basis for this processing. Since it was a family matter, the Court did not impose a penalty.
Authority: Norwegian Supervisory Authority (Datatilsynet)
Company: Coop Finnmark SA
The Norwegian DPA (Datatilsynet) fined Coop Finnmark SA NOK 400,000 (EUR 38,600). The manager of the store in question recorded CCTV footage with a mobile phone and shared the video. The Norwegian DPA states that Coop Finnmark had no legal basis for sharing the CCTV footage. The DPA notes that the case is very serious as the footage showed children, which poses a potentially high risk to their privacy.
Authority: APD/GBA (Belgium)
The Belgian DPA found that a public authority infringed the GDPR by disclosing the identity of a complainant to four suspects in the context of a municipal administrative sanction procedure for illegal dumping. Since the public authority adopted measures to avoid future infringements, the Belgian DPA decided not to impose a fine.
Authority: CNIL (France)
Company: Mobius Solutions Ltd
The DPA fined a processor €1,000,000 for failing to delete the personal data of users, processing the data for purposes contrary to contract stipulations, and for failing to keep a record of its processing activities.
Authority: ANSPDCP (Romania)
The Romanian DPA (ANSPDCP) issued a warning against the Bucharest Municipality - District 4 as the General Directorate of 4th District Local Police breached Articles 5(1)(a) and 6(1) GDPR. The warning was issued along with a corrective measure.
Authority: Data Protection Commissioner of Malta
Company: Lands Authority
As a result of the lack of appropriate security measures on the Lands Authority website, over 10 gigabytes of personal data became easily accessible to the public via a simple google search. The majority of the leaked data contained highly-sensitive information and correspondence between individuals and the Authority itself. The Lands Authority chose not to appeal. In Malta, in the case of a breach by a public authority or body, the Data Protection Commissioner may impose an administrative fine of up to €25,000 for each violation and may additionally impose a daily fine of €25 for each day such violation persists.
Authority: Datatilsynet (Denmark)
Company: Dating.dk ApS
The Danish DPA held that an online dating service had not obtained valid consent for its processing of personal data because it asked users to agree to its terms and conditions and privacy policy in the same tick box.
Authority: CNIL (France)
Company: KG COM
The French DPA fined a controller €150,000 because it collected excessive data, including sensitive data, without prior and explicit consent, and did not sufficiently ensure the security of the data.
Authority: Netherlands
The Arnhem-Leeuwarden Court of Appeal upheld its earlier decision: credit registration of the appellants is done under the GDPR legal basis of legal obligation and not legitimate interest. Therefore, their credit records cannot be removed from the Central Credit Information System (CKI). The court has also ruled that the risk of legal process costs is not in the way of the right to an effective judicial remedy guaranteed by article 79 GDPR.
Authority: European Union
Company: EDPB
The General Court affirmed the power of the EDPB to order the Irish DPA to broaden the scope of its investigations by issuing Binding Decisions. The DPA therefore has to issue a new draft decision, now taking into account whether Article 9 data is processed.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Azienda Ospedaliero-Universitaria SS. Antonio e Biagio e Cesare Arrigo
The DPA fined a university hospital €25,000 after a ransomware attack exposed personal data, including health data, of patients, employees and consultants. The hospital had failed to implement appropriate security measures.
Authority: Garante per la protezione dei dati personali (Italy)
The DPA fined a credit repair company €70,000 for multiple GDPR violations, including inadequate data transparency, failure to delete unnecessary data, improper data processing by third parties, and an unsuitable DPO appointment.
Authority: Spanish Data Protection Authority (aepd)
Company: CAJA RURAL DE ARAGÓN, S.C.C.
The Spanish DPA has imposed a fine on CAJA RURAL DE ARAGÓN, S.C.C.. The controller had suffered a cyber attack in which the attackers were able to access customer data due to a security vulnerability in its systems. The DPA found that the company had failed to implement the necessary security measures that could have prevented such an incident. The original fine of EUR 15,000 was reduced to EUR 12,000 due to voluntary payment.
Authority: Belgium
The Justice of Peace of Forest in Brussels decided that the user of the Brussels Public transportation (STIB) with a valid transportation ticket does not have to pay the fine for not having validated his ticket since the processing of data resulting from this validation was at odd with the GDPR.
Authority: AEPD (Spain)
Company: FOURTH PARTY LOGISTICS, S.L.
The Spanish DPA sanctioned a processor for violating GDPR Articles 28(2) and 28(3). This was despite the fact that no written contract existed between the processor and the subprocessors and the controller had not been told of the subprocessors' involvement in data processing activities.
Authority: Italian Data Protection Authority (Garante)
Company: Cat s.r.l.
The Italian DPA has fined Cat s.r.l. EUR 10,000. Cat s.rl. had installed CCTV systems near waste garbage cans on behalf of the municipality of Modica in order to combat illegal waste disposal. During its investigation, the DPA found that Cat processed personal data collected by the cameras without a valid legal basis.
Authority: Datatilsynet (Norway)
Company: Norges idrettsforbund og olympiske og paralympiske komité (NIF)
The Norwegian DPA (Datatilsynet) fined the Norwegian Olympic and Paralympic Committee and Confederation of Sports (NIF) about €123,656 (NOK 1,250,000) for a data breach in which the personal data of 3.2 million people was exposed online.
Authority: Netherlands
Company: Enschede municipality
A court ruled that the Dutch DPA did not prove that the MAC addresses constituted personal data (cf Article 4(1) GDPR), because it did not sufficiently prove that the controller would be able to identify persons connected to the MAC addresses.
Authority: Germany
The VG Regensburg holds that Article 79 GDPR excludes further judicial remedies against controllers and processors. Therefore, actions for injunctive relief under §§ 1004 (1), 823 (2) German Civil Code (BGB) in the area of data protection should in principle no longer be possible.
Authority: Spanish Data Protection Authority (aepd)
Company: Private individual
The Spanish DPA (AEPD) has imposed a fine of EUR 1,200 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space. The DPA considered this to be a violation of the principle of data minimization. In addition, the controller had not properly informed about the video surveillance.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Trasporto Passeggeri Emilia-Romagna S.p.A. (TPER)
The DPA fined a public transport service company €50,000 and ordered the controller to bring the processing operations into conformity with principle of storage limitation by setting data retention period to 24 months for marketing purposes and 12 months for data relating to profiling.
Authority: Germany
The Regional Court of Landshut (LG Landshut) held that it is not possible to claim damages against a Data Protection Officer (DPO) under Article 82 (1) GDPR, because they are not a controller in the meaning of Article 4(7) GDPR.

The Court also found that pursuant to §§ 13, 14 WEG, other condominium owners have a right to know in which flat a legionella inspection is or was carried out, if there was a legionella infestation and to what extent. In this respect, the naming of the flat, its owner and the test results is permissible. The legal basis for the above processing was Article 6(1)(b) GDPR and Article 6(1)(c) GDPR.
Authority: ICO (UK)
Company: First Choice Selection Services Limited
The ICO held that a recruitment consultancy contravened Article 15 GDPR for failing to comply with the data subject's access request under Article 15 GDPR, as the company could not evidence its claim that the Employment Tribunal instructed them not to provide any documentation.
Authority: Datatilsynet (Denmark)
The Danish Data Protection Authority (Datatilsynet) criticised a housing association which refused to grant a resident access to information related to complaints filed against them by other residents. The handling of the request for access was not in accordance with Article 12(2) and (3) GDPR, or Article 15(1) GDPR.
Authority: UODO (Poland)
The Polish DPA imposed a fine of approximately €120,000 on a bank for failing to notify data subjects of a personal data breach, in violation of Article 34(1) GDPR.
Authority: Spanish Data Protection Authority (aepd)
Company: Private individual
The Spanish DPA has fined a private individual EUR 600 for installing a video surveillance camera that captured parts of a commonly shared garage. The DPA considered this a violation of the principle of data minimization. In addition, the controller had not properly informed the data subjects about the processing of the data by the video surveillance and thus violated its duty to inform.
Authority: Italian Data Protection Authority (Garante)
Company: Poste Vita S.p.a.
The Italian DPA has imposed a fine on Poste Vita S.p.a. The controller failed to implement adequate technical and organisational measures to ensure data security. This resulted in a third party successfully tricking an employee into forwarding sensitive personal data, which was then used against the data subject.
Authority: Poland
A court awarded PLN3,000 (€709,95) in damages to a data subject for the unlawful processing of the data subject personal data by a credit institution.
Authority: Norwegian Supervisory Authority (Datatilsynet)
The Norwegian DPA (Datatilsynet) fined a company NOK 250,000 (EUR 24,400). The controller ordered an employee to set up an automatic forwarding of his/her employee email account to a shared company account. The reason given for this was to improve the company's operations. The DPA found that the controller had no legal basis to order such automatic forwarding. It therefore acted unlawfully.
Authority: Spanish Data Protection Authority (aepd)
Company: QUALITY-PROVIDER S.A.
The Spanish DPA has fined QUALITY-PROVIDER S.A. EUR 20,000 for failing to provide information requested by the DPA during an investigation.
Authority: Poland
A court held an individual criminally liable for processing their employers’ clients’ personal data for their own business purposes without a legal basis, and ordered them to pay PLN 2,000 in total (approximately €470).
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Roumasport S.R.L
The Romanian DPA has imposed a fine of EUR 10,000 on Roumasport S.R.L The controller failed to implement adequate technical and organisational measures, resulting in multiple cyber incidents.
Authority: Germany
A language test provider can refuse to provide an applicant with a perfect copy of their test insofar as its interest in secrecy of the questions outweights the right to access of the applicant.
Authority: Data Protection Commision of Bulgaria (KZLD)
Company: T.K. EOOD
The fine of ca. EUR 2,557 was imposed on T.K. EOOD for unlawful processing of personal data of data subject I.S. by failure to adopt technical and organizational measures to ensure the information security. T.K. EOOD processed the personal data of I.S. unlawfully nine times in duration of five months. The breaches caused damages to the data subject.
Authority: HDPA (Greece)
Company: Εθνική Υπηρεσία Πληροφοριών (National Intelligence Service)
The DPA fined the National Intelligence Service €5,000 for unlawfully transferring personal data of an employee to other authorities, thus violating the principles of lawfulness, fairness and transparency under Article 5(1)(a) GDPR.
Authority: Italian Data Protection Authority (Garante)
Company: Gedi Gruppo Editoriale S.p.A.
The Italian DPA (Garante) has fined Gedi Gruppo Editoriale S.p.A. 20,000 euros. The controller had published photos in its newspaper of people who were in custody in connection with a murder. The photos showed the accused in handcuffs and had been taken without their consent. Although some of the photos had been pixelated around the handcuffs, the faces of the defendants remained visible, allowing them to still be identified. The DPA had ordered the controller in advance to refrain from further use of these photos. The DPA imposed the fine because the controller had not complied with this order.
Authority: European Union
The CJEU ruled when administrative fines can be considered criminal. It also ruled that the doctrine of ne bis in idem (the prohibition of double jeopardy) overrides national legislation.
Authority: Germany
Company: Google
The Regional Court of Itzehoe (LG Itzehoe) held that the data subject had to accept images of his property being shown on Google Maps and Google Earth because Google had a legitimate interest under Article 6(1)(f) GDPR.
Authority: Hellenic Data Protection Authority (HDPA)
Company: Pediatric psychologist
The Hellenic DPA has fined a pediatric psychologist EUR 3,000. The psychologist had not properly cooperated with the DPA during an investigation.
Authority: Italian Data Protection Authority (Garante)
Company: Physician
The Italian DPA (Garante) has fined a physician EUR 2,000. A patient had complained to the DPA that the doctor had disclosed his personal data to third parties without authorization. The doctor had recommended medical products to the data subject as part of his treatment. A few days later, the data subject received a call from the marketing consultant behind the recommended products. The data subject pointed out that he had never given his consent to the disclosure of his data. 

The Garante states that no specific consent is required for the processing of personal data necessary for medical treatment. Here, however, the data was processed for the purpose of product promotion, and therefore explicit consent would have been required under Art. 9 GDPR. The physician thus processed the data unlawfully.
Authority: Persónuvernd (Iceland)
Company: unknown (Complainant)
The Icelandic Data Protection Authority (Persónuvernd) held
Authority: Italy
Company: Data subject against COMET S.P.A.
The Tribunal of Bologna held that a copy of data as described in Article 15(3) GDPR was not limited to personal data, but also extended to documentation related to the processing (for example including documentation signed by the data subject, e.g. the release of privacy consents in the paper forms).
Authority: Data Protection Authority of Ireland
Company: Vodafone Ireland Limited
The Irish DPA has fined Vodafone Ireland Limited EUR 1,400. Vodafone had in several cases sent marketing SMS and emails and made telephone calls without the consent of the data subjects. Despite several revocations by the data subjects, they continued to receive unsolicited advertising. In one case, a former customer had contacted Vodafone seven times and asked not to receive any more advertising calls on his cell phone. Despite his request, he continued to receive advertising calls. In another case, a customer received an advertising call on his cell phone number and informed Vodafone during the conversation that he did not want to receive any more advertising calls. Despite his request, Vodafone made twelve more marketing calls to his cell phone. In another case, the data subject filled out a form clearly stating his wish not to receive marketing calls from Vodafone. However, the employee who processed the request failed to register the customer's marketing preferences. As a result, the customer subsequently received fourteen more unsolicited commercial messages - seven emails and seven text messages.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Compania de Apa Oltenia S.A.
The Romanian DPA has imposed a fine of EUR 1,000 on Compania de Apa Oltenia S.A. The controller failed to implement adequate technical and organisational measures to ensure data security, resulting in personal data beeing leaked on social media.
Authority: France
The Supreme Administrative Court rejected an application for interim suspension of the use and transfer of health data of French citizens to Microsoft servers for inclusion in a study by the European Medicines Authority on the incidence and prevalence of certain pathologies.
Authority: Netherlands
The Council of State held that the Dutch Minister for Legal Protection has failed to provide sufficient reasoning that the provision of documents containing information about appellant to her former partner is in accordance with Article 15(4) GDPR.
Authority: Norway
Company: Human-Etisk Forbund (the Norwegian Humanist Association )
The Data Protection Board dismissed a data subject’s appeal against the DPA’s decision to reprimand the Church of Norway. The Appeals Board held that the data subject had no right to appeal against corrective measures they consider too lenient.
Authority: Germany
The Regional Labour Court of Berlin-Brandenburg awarded a data subject damages in the amount of €2,000 following the insufficient compliance with his access request pursuant to Article 15(1) GDPR.
Authority: Belgian Data Protection Authority (APD)
Company: Landlord
The Belgian DPA has imposed a fine of EUR 9,700 on a Landlord. The controller installed video surveillance in and around a student residence. However, the surveillance was too invasive, resulting in it not being lawful.
Authority: Garante per la protezione dei dati personali (Italy)
An Italian doctor made critical statements concerning covid-19 health measures. The Rome Provincial Order of Surgeons communicated, on TV and in a press release, information regarding disciplinary action against the doctor. The Italian DPA reprimanded the Order for violating Articles 5(1)(a) and 6 GDPR.
Authority: Netherlands
Company: Unknown telecommunication carrier
The District Court of Rotterdam set aside a €5000 administrative fine imposed by the Dutch Telecommunications Authority against a telecommunications provider that failed to make its customer database available, since the authority had not properly clarified the provider's legal liability.
Authority: Germany
Company: Private Individual
The Administrative Court of Wiesbaden held that the Hessian DPA was in the wrong for rejecting data subject's complaint, which concerned an erasure request from the database of SCHUFA Holding AG.
Authority: Datatilsynet (Norway)
Company: Stavanger Arbeiderparti
The DPA issued a reprimand to a political party after it sent political advertisements to data subjects via emails. Even though the email addresses were obtained lawfully through a freedom of information request, the DPA found that the processing had no legal basis.
Authority: Spanish Data Protection Authority (aepd)
Company: TELEFÓNICA MÓVILES ESPAÑA, S.A.U.
A former customer had received e-mails containing electronic bills even after they had terminated their contract with the company resulting in a processing of personal data without sufficient legal basis.
Authority: HDPA (Greece)
Company: Dating agency under the name ANOIXIS
The DPA imposed a fine of €45,000 on a dating agency after it repeatedly sent unsolicited SMS to data subjects. The DPA found that the dating agency thus violated the Greek e-privacy implementation and failed to cooperate and comply with the DPA's (prior) actions against them.
Authority: DSB (Austria)
Company: Google LLC
The DPA upheld a complaint regarding an access request, and ordered Google LLC to provide the data subject with a full copy of their personal data on YouTube.
Authority: AZOP (Croatia)
A controller that collected and stored copies of both sides of data subjects' credit cards was fined €380,000 for violating Articles 6(1), 13(1) and (2), and 25(1) and (2) and 32(1)(a) and (d) GDPR.
Authority: IDPC (Malta)
The Maltese DPA found that a controller failed to react to an access request within one month as the GDPR foresees, and failed to provide the data subject with a copy of their personal data.
Authority: AEPD (Spain)
Company: Intercambiador detransportes avenida de america, S.A.U.
The AEPD approved a transport hub's compliance with Articles 32 and 33 GDPR after having used its investigation powers.
Authority: APD/GBA (Belgium)
The DPA reprimanded a politician for collecting a data subject’s email address from a public source and sending them political marketing, in violation of the principles of lawfulness, purpose limitation and transparency.
Authority: Spanish Data Protection Authority (aepd)
Company: SERVICIOS INTEGRALES DEL HOGAR TENERIFE, S.L.
The Spanish DPA has imposed a fine on a SERVICIOS INTEGRALES DEL HOGAR TENERIFE, S.L.. A former employee had filed a complaint with the DPA due to the controller's unauthorized disclosure of their personal data via Whatsapp after they left the company. The original fine of EUR 5,000 was reduced to EUR 3,000 due to voluntary payment and admission of responsibility.
Authority: Spain
A court held that an employer cannot process their employees’ personal phone numbers for 2-factor authentication purposes, as Spanish law imposes on the controller an obligation to provide working devices for the said purpose.
Authority: CNIL (France)
Company: Carrefour Banque
The French DPA (CNIL) fined Carrefour Banque € 800000 for several violations of the GDPR and French data protection law. The breaches concerned loyalty and transparency of data processing, accessibility and content of information concerning processing and illicit use of cookies.
Authority: Germany
A German court held that test questions do not constitute personal data under the GDPR and thus shall not be included in a copy of the data provided to a data subject in the context of an access request under Article 15(3) GDPR.
Authority: AEPD (Spain)
The Spanish DPA (AEPD) imposed a fine of €10000 on the web page banderacatalana.cat for a violation of Articles 13, 6(1)(a) and 8 GDPR as well as Article 7 of the Spanish Law on Personal Data Protection (LOPDGDD).
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: V&M Contab & Management SRL
The Romanian DPA has imposed a fine of EUR 10,000 on V&M Contab & Management SRL. The controller failed to implement sufficient technical and organisational measures to ensure data securtiy resulting in a data breach. Also the company failed to respond to a request by the DPA.
Authority: IMY (Sweden)
Company: If Skadeförsäkring AB
Sending an e-mail containing sensitive data with enforced TLS-encryption instead of end-to-end encryption was deemed insufficient secured under Article 32(1) GDPR. The controller received a reprimand instead of a fine as it had increased the security of its communication solutions.
Authority: Garante per la protezione dei dati personali (Italy)
Company: University "La Sapienza" Rome
On December 2020, 23rd the Italian Data Protection Authority imposed a fine of 30 000 Euro on the university of Rome “la Sapienza”, acting as a data controller under the GDPR. The data controller did not process personal data with an appropriate level of security, as required by article 32, read in conjunction with article 33 GDPR.
Authority: Spanish Data Protection Authority (aepd)
Company: Hairdressing salon
The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on a hairdressing salon. The controller had installed video surveillance cameras and had not properly informed the data subjects about the processing of the data by the cameras.