Sebastyijan/gdpr-enforcement-sample huggingface dataset:
Authority: ANSPDCP (Romania)
Company: Continental Automative Products SRL 
The DPA fined a company RON 25,455 (€5,000) for the internal distribution of a spreadsheet containing health-related data of current and former employees. Furthermore, the DPA fined the controller RON 50,911 (€10,000) for failing to implement sufficient security measures for its processing activities.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Continental Automotive Products SRL
The Romanian DPA has imposed a fine of EUR 15,000 on Continental Automotive Products SRL. The controller failed to implement adequate technical and organisational measures, resulting in a cyber incident.
Authority: Spanish Data Protection Authority (aepd)
Company: Dental Clinic
The Spanish DPA has imposed a fine of EUR 1,200 on a dental clinic. The controller used video surveillance in its clinic for security purposes, including a camera in the doctor's office where patients were treated. This resulted in excessive data processing. The original fine of EUR 2,000 was reduced to EUR 1,200 due to immediate payment and admission of responsibility by the controller.
Authority: Datatilsynet (Norway)
The DPA imposed a fine of NOK 250,000 (€25,000) on a provider of a time-recording systems which claimed to be just a processor when in fact it was determining the purposes and means of the processing. Further, the provider failed to provide 80 data subjects with access to their time records after their employer went bankrupt.
Authority: Garante per la protezione dei dati personali (Italy)
The DPA found a local business in breach of GDPR for the non-compliant installation of security cameras. The DPA fined data controller for €1,500, and ordered to provide information on processing and to stop the filming of public spaces
Authority: Croatia
A court awarded €3,000 to a data subject after finding a news portal violated her privacy under [[Article 5 GDPR]] by publishing her personal data unnecessarily and disproportionately, despite claims of public interest.
Authority: Norwegian Supervisory Authority (Datatilsynet)
Company: Timegrip AS
The Norwegian DPA has imposed a fine of EUR 21,650 on Timegrip AS. The controller had been tracking the working hours of employees at a company that went bankrupt. A former employee requested that the controller send the working hours to the data subject so that they could claim their unpaid wages from the bankruptcy estate. Furthermore, the bankruptcy estate itself requested the data, but the controller refused to send it to them.
Authority: AEPD (Spain)
Company: Telefónica Móviles España, S.A
The DPA fined a telephone operator €200,000 for issuing a duplicate SIM without properly identifying its customer which allowed for a SIM-swap fraud and resulted in harm to the customer.
Authority: Italy
Company: Facebook Inc.
The Italian Council of State found that Facebook failed to provide its users with transparent information concerning the commercial exploitation of their personal data. At the same time, it found that the opt-out approach used for registering users to the platform did not constitute an aggressive conduct.
Authority: Netherlands
A court reduced a fine by the DPA concerning the controller’s live streaming of a village from €500 to €375. The reason for the reduction of the fine was the excessive duration of the procedure, i.e. almost 4.5 years.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: Vellea Home SRL
The Romanian DPA has imposed a fine of EUR 5,000 on Vellea Home SRL. The controller failed to implement adequate technical and organisational measures, resulting in a data breach.
Authority: Czech Data Protection Auhtority (UOOU)
Company: Legal Person
The Czech DPA has imposed a fine of EUR 4,010 on a legal person. The order was issued based on the carried out inspection. The accused failed to respond to numerous requests to delete the personal data from its website.
Authority: Spanish Data Protection Authority (aepd)
Company: ODRIA COSTAS INTERNACIONAL, S.L.
The Spanish DPA has imposed a fine on ODRIA COSTAS
INTERNACIONAL, S.L. A data subject had filed a complaint with the DPA because the controller had published a picture of their residence on their website, which, however, also showed their underage daughters. The data subject had not consented to the publication of the children's images. The original fine of EUR 10,000 was reduced to EUR 6,000 due to voluntary payment and acknowledgement of responsibility.
Authority: Denmark
Company: Meta Platforms Inc.
The Danish Agency for Digital Government held that Meta breached the national implementation of Art. 5(3) of the ePrivacy Directive, ordering them to allow users to give separate consent for each overarching purpose, immediately withdraw consent, and to provide clear information about all cookies.
Authority: French Data Protection Authority (CNIL)
The French DPA has imposed a fine on a data controller for lack of cooperation.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Ministero dell'Interno
The DPA reprimanded the Interior Ministry after it failed to reply to an erasure request. The DPA highlighted that a controller must always act on such a request and reply to the data subject, even if the request is unfounded.
Authority: Persónuvernd (Iceland)
The Icelandic DPA (Persónuvernd) held that the online publication of an Ombudsman's opinion containing the unredacted name and personal details of an individual was a breach of Articles 5 and 6 of the GDPR.
Authority: AEPD (Spain)
The DPA fined an insurance company €300,000 for instructing its processor to unlawfully access customers' driving penalty points in order to then offer discounts for customers with a low penalty point balance.
Authority: Czech Data Protection Auhtority (UOOU)
Company: Legal Person
The Czech DPA has imposed a fine of Eur 2,000 on a legal person. The accused failed to comply with the request to erase the auction notice with the personal data and failed to respond to the notice from the Office for personal data protection.
Authority: Netherlands
Company: Autoriteit Persoonsgegevens
The preliminary relief judge of Council of State declared unfounded the applicant’s request to urgently force Autoriteit Persoonsgegevens (Dutch DPA) to investigate the abolishing by the European travel companies of the so-called ATB ticketing system. Applicant finds that it should be possible to buy international train tickets without having to provide personal data.
Authority: Datatilsynet (Norway)
Company: Østre Toten municipality
The Norwegian DPA fined a municipality €409,768 (NOK 4,000,000) for breaches of Article 5(1)(f) GDPR, Article 24 GDPR and Article 32 GDPR after a serious ransomware attack led to highly sensitive personal data being irreparably lost and sold on the dark web.
Authority: ICO (UK)
Company: Advanced Computer Software Group Limited
A software company was fined £3.07 million (€3.68 million) for failing to implement appropriate security measures in light of a ransomware attack where the personal data of 79,404 data subjects was compromised.
Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Company: La Santrade S.R.L.
The Romanian DPA (ANSPDCP) has fined La Santrade S.R.L. EUR 2,000 for failing to provide information requested by the DPA during an investigation.
Authority: Spanish Data Protection Authority (aepd)
Company: RODALI GESTIÓN INMOBILIARIA, S.L.
The Spanish DPA has imposed a fine of EUR 5,000 on RODALI GESTIÓN INMOBILIARIA, S.L.. An individual had filed a complaint with the DPA due to the fact that the controller had not informed them about the processing of their personal data in the context of an apartment acquisition. For this reason, the DPA found that the controller had violated its information obligations under Art. 13 GDPR.
Authority: French Data Protection Authority (CNIL)
Company: SAMARITAINE SAS
The French DPA has imposed a fine of EUR 100,000 on SAMARITAINE SAS. After multiple theft incidents, the controller installed security cameras disguised as smoke detectors to monitor its employees. The cameras were installed without consulting the DPO and outside the existing surveillance system. After dismantling the 'test cameras', employees kept SD cards containing recordings, which constitutes a data breach that the controller did not report to the DPA.
Authority: Germany
Das Gericht (VG_SH) verneint in seinem Urteil die vom Kläger begehrte Verpflichtung der Aufsichtsbehörde (ULD_SH) gegenüber einer Arztpraxis eine vom Kläger beantragte Anweisung gemäß DSGVO (58)(2)(c) auszusprechen (Verpflichtungsklage), in der die Arztpraxis verpflichtet wird, eine vom Kläger beantragte Berichtigungsmitteilung gemäß DSGVO Art 16 vom 29.10.2022 zu bestätigen, wonach der Kläger am 06.07.2022 zu keinem Zeitpunkt eine Einwilligung zur Übertragung seines PCR-Testergebnisses an die Server der Corona-Warn-App erteilt hatte.
Authority: Polish National Personal Data Protection Office (UODO)
Company: Polskie Radio Szczecin
The Polish DPA fined Polskie Radio Szczecin (Polish Radio Szczecin) EUR 13,400. Due to the lack of sufficient technical measures, Polskie Radio Szczecin failed to protect the rights of individuals featured in its publications. As a result, there was a risk that information concerning the private life of individuals would be published without their consent. As an example, the DPA cited a case in which a journalist from Polskie Radio Szczecin disclosed that the minor child of a MP (who does not participate in public life) was a victim of sexual abuse. The report was specific enough to allow third parties to identify the victim, which led to the victim's suicide. During an inspection, the DPA found several shortcomings in data processing and that the deficiencies were systemic. The DPA ordered Polskie Radio Szczecin to rectify the organisational and technical shortcomings within 60 days.
Authority: Dutch Supervisory Authority for Data Protection (AP)
Company: International Card Services B.V.
The Dutch DPA has imposed a fine of EUR 150,000 on International Card Services B.V. (ICS). ICS failed to carry out a data protection impact assessment before starting the digital identification of customers in the Netherlands in 2019. The identity check covered around 1.5 million people and involved sensitive personal data such as pictures of the data subjects.
Authority: Italian Data Protection Authority (Garante)
Company: Limit Call S.r.l.s.
The Italian DPA has imposed a fine of EUR 60,000 on Limit Call S.r.l.s. for unauthorized telemarketing. The controller had acquired lists of personal data without checking the legality of the data transfer, e.g. whether the data could also be used for commercial purposes or whether the data subjects had given their consent. In addition, it was not checked whether the telephone numbers called were entered in the public objection register.
Authority: UODO (Poland)
Company: Fortum Marketing and Sales Polska S.A. 
The Polish DPA imposed on Fortum Marketing Sales Polska S.A. as a controller and on PIKA Spółka z o.o. as its processor administrative fines of about €1,000,000 and €53,000 respectively for the breach of data confidentiality and the lack of sufficient security measures.
Authority: Italian Data Protection Authority (Garante)
Company: Iren Mercato S.p.A.
The Italian DPA (Garante) fined Iren Mercato S.p.A. EUR 2,856,169 for failing to verify that all transfers of data of recipients of promotional activities were covered by consent. Several data subjects filed complaints with the DPA against the controller because they had received unsolicited advertising to which they had never consented. In its investigation against the cotroller, the DPA found that the cotroller had in fact processed personal data for telemarketing activities that it had not collected directly but had acquired from other sources. It had not checked whether valid consents had been obtained from the advertising addressees for all transfers of the data. The controller had received lists of personal data from one company, which in turn had acquired them from two other companies. The latter companies had obtained the consent of potential customers for the telemarketing carried out by them and by third parties, but this consent did not include the transfer of customer data to the controller. In this context, the DPA emphasized that consent given by a customer to a company for third-party promotional activities cannot extend its effectiveness to subsequent transfers to other operators.
Authority: Italian Data Protection Authority (Garante)
Company: FT Solutions S.r.l.
The Italian DPA has imposed a fine of EUR 5,000 on FT Solutions S.r.l. The fined entity had been active in direct marketing activities as a data processor. During these activities, the processor used personal data for this purpose without sufficient legal basis, obtained from a third party that also collected the data in violation of data protection principles. Furthermore, the processor failed to inform data subjects regarding the processing and to implement adequate data protection measures.
Authority: Cypriot Data Protection Commissioner
Company: AC Omonia
The Cypriot DPA has imposed a fine of EUR 40,000 on the soccer club AC Omonia. Due to a lack of security measures in the club's ticket sales system, it was possible for an unauthorized person to access and disclose personal data of fans on the club's website. This data involved the name, the fan card number and the ID number of the data subjects. The DPA concluded that the club failed to implement adequate technical and organizational security measures. In separate proceedings, the DPA fined APOEL FC and Hellenic Technical Enterprises Ltd. for the same violations.
Authority: EDPS
Company: European Commission
The EDPS reprimanded the Commission and ordered to bring processing related to use of Microsoft 365 in line with EU data protection rules and suspended the data flows to countries for which there is no adequacy decision with effect 9th December 2024
Authority: AZOP (Croatia)
The Croatian Personal Data Protection Agency (AZOP) has decided that Raiffeisen bank was in violation of the GDPR by asking its clients to pay approx. 200 HRK (approx. 30 EUR) for delivering documentation regarding a home loan. The client needed it to initiate proceedings for reimbursement of overcharged debt. The Bank says it will not give up its current practice.
Authority: AEPD (Spain)
Company: Telefónica Móviles España, S.A.U.
The Spanish DPA (AEPD) sanctioned the telecommunications company Telefónica Móviles España, S.A.U. with a fine of €75,000 for violating Article 6(1) GDPR.
Authority: AEPD (Spain)
Company: Xfera Móviles SA
The Spanish DPA (AEPD) held that the complainant could request access to voice recordings from the data controller, Xfera Moviles, under Article 15 GDPR.
Authority: Spanish Data Protection Authority (aepd)
Company: BEEPING FULFILMENT S.L.
The Spanish DPA (AEPD) has fined BEEPING FULFILMENT S.L. in the amount of EUR 2,000. The controller had not provided the required information about the purposes and characteristics, of the data processing in the privacy policy of a website it operates. The data protection authority considered this to be a violation of Art. 13 GDPR.
Authority: Germany
Adhering to a preliminary ruling by the CJEU, which ruled that a German provision, that grants DPOs protection from dismissals without an observed notice period nor good cause, is compatible with Article 38(3) GDPR, the German Federal Labour Court upheld a decision my a lower court deeming that organizational "restructuring measures" do not constitute "good cause."
Authority: APD/GBA (Belgium)
The DPA found a recruitment agency to have breached Article 12 GDPR and Article 17 GDPR for contacting the data subject even after a deletion was confirmed to the data subject.
Authority: Garante per la protezione dei dati personali (Italy)
Company: XX (data subject) 
The Italian DPA issued a reprimand to the municipality of Brindisi for failing to fully comply with the GDPR rules regarding the concealing of data pertaining to a man and his son's legal proceedings against the aforesaid municipality.
Authority: Germany
Company: Transporting Company
The Regional Labour Court of Hessen decided that an employer who cannot prove the existence of overriding confidentiality interests has to provide information pursuant to Article 15 GDPR to an employee, even if such information can be used in defence against criminal proceedings initiated by the employer.
Authority: APD/GBA (Belgium)
The Belgian DPA issued a warning to a hospital group for non-compliance of Article 32 GDPR and Article 24 GDPR, as the hospital group had failed to implement the appropriate internal data security measures.
Authority: Netherlands
Company: Manfield Schoenen B.V.
The Amsterdam Court of First Instance decided that the shoe store Manfield cannot compel an employee to use a fingerprint-based authorization system for the cash register.
Authority: Italian Data Protection Authority (Garante)
Company: Pioneer Hi-Bred Italia Sementi s.r.l.
The Italian DPA has imposed a fine of EUR 120,000 on Pioneer Hi-Bred Italia Sementi s.r.l. The controller installed satellite telematics tracking devices to monitor driving behaviour and provide drivers with scores.
Authority: IP (Slovenia)
Company: anonymous
The Slovenian Supervisory Authority (IP) issued an opinion as foreseen under Article 58(3) GDPR on the issue of  the validity of consent to access digital content and online classrooms during the state of emergency in the Slovenia. The IP found that the consent may be given in writing, electronically or in another appropriate manner, and in any case should fulfill the requirements under Article 7 and Article 8 GDPR.
Authority: Czech Data Protection Auhtority (UOOU)
Company: Legal Person
The Czech DPA has imposed a fine of EUR 2,000 on a legal person. The accused circumvented the law when, instead of providing social services with proper authorization, it did so without it in the context of providing accommodation and health-care services. Consequently, it lacked sufficient legal basis to process personal data.
Authority: Ireland
An employer violated Articles 5 and 6 GDPR for recording their employee during their work leave at home and dismissing them as a result.
Authority: European Union
Company: La Quadrature du Net
The CJEU held that national provisions which provide for general and indiscriminate retention of traffic and location data for national security purposes are generally precluded except in certain circumstances.
Authority: Netherlands
Company: Municipality of Amersfoort
The Dutch District Court of Midden-Nederland held that a municipality was not obliged to disclose the name and address details of data subjects looking for paranormal activity at a cemetery to the parents of two deceased children buried there.
Authority: Spanish Data Protection Authority (aepd)
Company: Attorney
The Spanish DPA has imposed a fine of EUR 4,000 on an attorney. The attorney had sent a court ruling containing personal data of a data subject to several individuals via WhatsApp without the consent of the data subject.
Authority: Spanish Data Protection Authority (aepd)
Company: Private individual
The Spanish DPA has fined a private individual EUR 5,000 for repeatedly publishing personal data of various data subjects on a public Telegram channel without a valid legal basis.
Authority: Netherlands
Company: STAAT DER NEDERLANDEN (Ministerie van Volksgezondheid, Welzijn en Sport),
The ICAM foundation has filed a collective action against the State and public health institutions on behalf of 6.5 million Dutch citizens affected by the GGD data breach. The claim is based on Article 82, paragraph 1 of the GDPR.
Authority: Garante per la protezione dei dati personali (Italy)
Company: Istituto Comprensivo Statale “F.S. Cabrini
The Italian DPA received a complaint from Ms. XX against the Istituto Comprensivo Statale “F.S. Cabrini” regarding the publication on the institutional website of some determinations. The Italian DPA fined the Istituto €2,000.
Authority: IP (Slovenia)
Company: anonymous
The IP issues an opinion on the lawful installation and operation of video-surveillance systems. It stresses that the operators are the data controllers and the ones who must be able to prove the lawfulness of the system. According to national law, if the system is to be installed in an apartment complex, all owners of property must give their consent.
Authority: DSB (Austria)
Company: Meta Platforms Inc.
An Austrian website using Facebook tracking tools was found in breach of Article 44 GDPR for the transfer of data to the US without any legal basis. The fact that the tools were deactivated after the complaint was considered irrelevant.
Authority: Spanish Data Protection Authority (aepd)
Company: MARINA SALUD, S.A.
The Spanish DPA has imposed a fine of EUR 500,000 on MARINA SALUD, S.A. Marina Salud, acting as a processor for a health authority, engaged sub-processors without obtaining the health authority’s prior consent.
Authority: Italian Data Protection Authority (Garante)
Company: l’Istituto Alberghiero Mediterraneo di Pulsano
The Italian DPA imposed a fine of EUR 2,000 on l’Istituto Alberghiero Mediterraneo di Pulsano. The controller, a school, published a christmas video on the video platform YouTube, which included some minor pupils without the consent of their parents.
Authority: Spanish Data Protection Authority (aepd)
Company: Private individual
The Spanish DPA (AEPD) has imposed a fine of EUR 500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space and furthermore published the recorded images on Facebook. The DPA considered this to be a violation of the principle of data minimization.
Authority: AEPD (Spain)
Company: Servicios Especiales S.A.
An employer was fined €120,000 for failing to protect the identity of the complainants and the accused in a workplace harassment complaint in violation of Article 5(1)(f) GDPR.
Authority: DVI (Latvia)
Company: LocateFamily
The Latvian DPA ordered a website to delete information about more than 13,000 people whose data were scraped online from publicly available sources, considering that the processing violated the principle of purpose limitation.
Authority: Deputy Data Protection Ombudsman
Company: Suomen Asiakastieto Oy
The Finnish DPA has imposed a fine of EUR 440,000 on Suomen Asiakastieto Oy for failing to comply with an order issued by the DPA. During an investigation, the DPA found that the company had unlawfully stored financial data of data subjects. The DPA therefore ordered the company to remove the data, which the company did not comply with.
Authority: AP (The Netherlands)
Company: Stichting Ondersteuning Provinciale Fractie Overijssel Partij voor de Vrijheid
The Dutch DPA fined a provincial political party €7,500 for the unauthorised disclosure of a mailing list containing 101 email addresses, and for failing to notify this breach to the DPA. The email addresses constituted special category data revealing political party opinions.
Authority: AEPD (Spain)
Company: SERVICIO CANARIO DE LA SALUD 
The Spanish DPA issued a reprimand to Servicio Canario De La Salud. Medical records had been improperly accessed and the diagnosis disclosed to third parties, violating Article 5(1)(f) and Article 32 GDPR.