Source: https://www.enforcementtracker.com/?mc_cid=5f154b1d5b&mc_eid=764d3162cc
Timestamp: 2020-07-12 01:10:21
Document Index: 538622792

Matched Legal Cases: ['Art. 5', 'Art. 6', 'Art. 12', 'Art. 15', 'Art. 17', 'Art. 58', 'Art. 32', 'Art. 32', 'Art. 6', 'Art. 21', 'Art. 5', 'Art. 6', 'Art. 58', 'Art. 31', 'Art. 58', 'Art. 25', 'Art. 32', 'Art. 25', 'Art. 32', 'Art. 6', 'Art. 6', 'Art. 15', 'Art. 28', 'Art. 15', 'Art. 12', 'Art. 15', 'Art. 28', 'Art. 31', 'Art. 58', 'Art. 37', 'Art. 33', 'Art. 34', 'Art. 5', 'Art. 9', 'Art. 32', 'Art. 5', 'Art. 6', 'Art. 15', 'Art. 5', 'Art. 6', 'Art. 12', 'Art. 13', 'Art. 14', 'Art. 15', 'Art. 35', 'Art. 5', 'Art. 6', 'Art. 6', 'Art. 21', 'Art. 5', 'Art. 6', 'Art. 35', 'Art. 5', 'Art. 6', 'Art. 5', 'Art. 6', 'Art. 13', 'Art. 14', 'Art. 5', 'Art. 15', 'Art. 5', 'Art. 37', 'Art. 58', 'Art. 58', 'Art. 5', 'Art. 32', 'Art. 6', 'Art. 32', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 7', 'Art. 9', 'Art. 13', 'Art. 14', 'Art. 32', 'Art. 5', 'Art. 32', 'Art. 6', 'Art. 5', 'Art. 6', 'Art. 6', 'Art. 15', 'Art. 24', 'Art. 32', 'Art. 5', 'Art. 6', 'Art. 32', 'Art. 5', 'Art. 6', 'Art. 5', 'Art. 6', 'Art. 13', 'Art. 14', 'Art. 5', 'Art. 6', 'Art. 13', 'Art. 14', 'Art. 32', 'Art. 6', 'Art. 32', 'Art. 5', 'Art. 32', 'Art. 5', 'Art. 6', 'Art. 5', 'Art. 6', 'Art. 15', 'Art. 17', 'Art. 21', 'Art. 31', 'Art. 5', 'Art. 6', 'Art. 12', 'Art. 15', 'Art. 5', 'Art. 6', 'Art. 33', 'Art. 34', 'Art. 33', 'Art. 32', 'Art. 5', 'Art. 6', 'Art. 5', 'Art. 6', 'Art. 5', 'Art. 6', 'Art. 5', 'Art. 6', 'Art. 17', 'Art. 5', 'Art. 21', 'Art. 5', 'Art. 6', 'Art. 33', 'Art. 31', 'Art. 58', 'Art. 32', 'Art. 31', 'Art. 58', 'Art. 32', 'Art. 35', 'Art. 12', 'Art. 15']

The Netherlands: New fine in the amount of 830.000 EUR
New fine on Bureau Krediet Registration ('BKR') for insufficient fulfilment of data subjects rights.
Germany: New fine in the amount of 1,240,000 EUR
Fine on AOK Baden-Wuerttemberg for insufficient technical and organisational measures to ensure information security
Spain: Fine against Twitter
Fine on Twitter in the amount of EUR 30.000 for unlawful cookie banner and therefore breach of Spanish data protection laws: link
HUNGARY Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) 2020-03-04 290 Representative of a local government Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR Insufficient legal basis for data processing A local representative took a photo of the director of a company fully owned by the local government depicting the director allegedly tearing off an election poster of the opposition in the company of his child. The local representative uploaded the photo to his Facebook page. The child’s image was blurred, yet it was hinted in the post that she was the daughter of the director. The director told the local representative at the scene that he does not consent to the taking of the photo. NAIH determined that the act of the director was not public information and the photo does not prove that the director torn off an election poster. NAIH also underpinned that only the name of the director of the company fully owned by the local government was public information. link
ROMANIA Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) 2020-03-25 2,000 SOS Infertility Association Art. 58 GDPR Insufficient cooperation with supervisory authority The Association did not provide the data protection authority with the information requested by the latter after the Association had processed personal data without a sufficient legal basis. link
ROMANIA Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) 2020-03-25 3,000 Enel Energie Art. 32 GDPR Insufficient technical and organisational measures to ensure information security The company has sent an email to a client which contained personal data of another client since the company failed to implement adequate technical and organisational measures to ensure an adequate level of information security. link
ROMANIA Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) 2020-03-25 4,150 Vodafone Romania Art. 32 GDPR Insufficient technical and organisational measures to ensure information security The company has sent an email to a customer which contained personal data of another customer due to inadequate technical and organisational measures to ensure information security. link
ROMANIA Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) 2020-03-25 3,000 Dante International Art. 6 GDPR, Art. 21 GDPR Insufficient legal basis for data processing The company has sent a commercial e-mail to a client though the client had previously unsubscribed from commercial communications. link
ITALY Italian Data Protection Authority (Garante) 2020-02-13 4,000 Comune di Urago Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing The local council has published on its website information containing a person's personal data, including health information. link
SPAIN Spanish Data Protection Authority (aepd) 2020-03-25 5,000 Xfera Moviles S.A. Art. 58 GDPR Insufficient cooperation with supervisory authority The company did not provide the data protection authority with the requested information in a timely manner. The AEPD's request was preceded by a request from a data subject for access to its personal data. link
POLAND Polish National Personal Data Protection Office (UODO) 2020-03-09 4,400 Vis Consulting Sp. z o.o. Art. 31 GDPR, Art. 58 GDPR Insufficient cooperation with supervisory authority The company prevented an inspection by the data protection authority. As a result, the company has violated Article 31 in conjunction with Article 58(1)(e) and (f) of the GDPR. link
BULGARIA Data Protection Commision of Bulgaria (KZLD) 2020-02-20 2,560 T.K. EOOD Art. 25 (1) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security The fine of ca. EUR 2,557 was imposed on T.K. EOOD for unlawful processing of personal data of data subject I.S. by failure to adopt technical and organizational measures to ensure the information security. T.K. EOOD processed the personal data of I.S. unlawfully nine times in duration of five months. The breaches caused damages to the data subject. link
BULGARIA Data Protection Commision of Bulgaria (KZLD) 2020-02-20 2,560 L.E. EOOD Art. 25 (1) GDPR, Art. 32 GDPR, Art. 6 GDPR Insufficient technical and organisational measures to ensure information security The fine of ca EUR 2,557 was imposed on L.E. EOOD for unlawful processing of personal data of data subject I.S. without the knowing and the consent of the data subject and also without a valid contractual relationship between L.E. EOOD and I.S. The enterprise processed the personal data of I.S. unlawfully seven times in duration of 3 months by failure to adopt technical and organizational measures to ensure the information security. In addition to the fine, the Commission for Personal Data Protection (“KZLD”) instructed L.E. EOOD to do regular inspections of its data processing activities, to do risk analysis regarding customers and employees and to conduct periodic trainings of the employees. The KZLD also ordered L.E. EOOD to archive and keep the documents containing the personal data only for limited purposes and the timeframe as required by law. link
BULGARIA Data Protection Commision of Bulgaria (KZLD) 2020-01-06 5,110 Utility Company Art. 6 (1) GDPR Insufficient legal basis for data processing The fine of EUR ca. 5,113 was imposed on a Bulgarian utility company for unlawful processing of the personal data of the data subject V.V. The personal data of V.V. was unlawfully processed and subsequently used for initiating an enforcement case against him for outstanding payment obligations. During the enforcement case, the bailiff seized the data subject’s salary, and the latter suffered damages as a result of the unlawful processing. link
GERMANY Data Protection Authority of Brandenburg 2019 50,000 Unknown Company Art. 15 GDPR, Art. 28 GDPR Insufficient fulfilment of data subjects rights The data controller had engaged an external company to carry out the duties of access to data according to Art. 15 GDPR. However, the engaged company conducted the correspondence with the data subjects under its own logo and in English language, so that it was not apparent to the data subjects who was responsible for the data processing. As a result, the data controller infringed the principle of transparency laid down in Art. 12 GDPR and did not sufficiently fulfil its obligations to provide information in accordance with Art. 15 GDPR. In addition, the data protection supervisory authority found that no written contract for data processing had been concluded between the data controller and the external company, thus constituting a further breach of Art. 28 (9) GDPR. link
BELGIUM Belgian Data Protection Authority (APD) 2020-04-28 50,000 Proximus SA Art. 31 GDPR, Art. 58 GDPR, Art. 37 GDPR Lack of appointment of data protection officer According to the data protection authority, the company's data protection officer was not sufficiently involved in the processing of personal data breaches and the company did not have a system in place to prevent a conflict of interest of the DPO, who also held numerous other positions within the company (head of compliance and audit department), which led the DPA to the conclusion that the company's DPO was not able to work independently. link
SWEDEN Data Protection Authority of Sweden 2020-04-29 18,700 National Government Service Centre (NGSC) Art. 33 GDPR, Art. 34 GDPR Insufficient fulfilment of data breach notification obligations The DPA's decision shows that it took almost five months for the company to notify the data subjects of a data breach and almost three months for the DPA to receive a notification of a data breach concerning an security lack of IT systems of the company. link
THE NETHERLANDS Dutch Supervisory Authority for Data Protection (AP) 2020-04-30 725,000 Unknown Organisation Art. 5 GDPR, Art. 9 GDPR Insufficient legal basis for data processing The organisation had required its staff to have their fingerprints scanned to record attendance. However, as the decision of the data protection authority stated, the organisation could not rely on exceptions to the processing of this special category of personal data and the company could also not provide any evidence that the employees had given their consent to this data processing. link
ROMANIA Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) 2020-05-05 5,000 Banca Comercială Română SA Art. 32 GDPR Insufficient technical and organisational measures to ensure information security The data protection authority finds that the company has not taken adequate technical and organisational measures to ensure an adequate level of information security. This applies in particular to the collection and transmission of copies of customers' identification documents via WhatsApp. link
SWEDEN Data Protection Authority of Sweden 2020-05-12 11,200 Health and Medical Board of the Region of Örebro County Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing Publication of personal data of a patient without sufficient legal basis. link
DENMARK Danish Data Protection Authority (Datatilsynet) 2020-05-15 6,700 JobTeam A/S DKK Art. 15 GDPR Insufficient fulfilment of data subjects rights The company has deleted personal data affected by a request for access without legal reason. link
IRELAND Data Protection Authority of Ireland 2020-05-17 75,000 Tusla Child and Family Agency Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing The company has erroneously disclosed personal data, including information about children, to unauthorized persons. In one case, the contact and location data of a mother and a child were disclosed to an alleged offender, and in two other cases, data about children in foster care were improperly disclosed to blood relatives, including in one case to a father in prison. link
FINLAND Deputy Data Protection Ombudsman 2020-05-22 100,000 Posti Group Oyj Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights The decision relates to complaints alleging that data subjects received direct marketing from the company although they had requested that their postal data be deleted. Investigations also revealed that the data protection information provided by the company was not transparent enough. link
FINLAND Deputy Data Protection Ombudsman 2020-05-22 16,000 Kymen Vesi Oy Art. 35 GDPR Non-compliance with general data processing principles Fine for failure to carry out a data protection impact assessment ("DPIA") for the processing of location data of employees with a vehicle information system link
FINLAND Deputy Data Protection Ombudsman 2020-05-22 12,500 Unknown Company Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing Processing of employee data without sufficient legal basis. link
BELGIUM Belgian Data Protection Authority (APD) 2020-05-29 1,000 Non-profit organisation Art. 6 GDPR, Art. 21 GDPR Insufficient fulfilment of data subjects rights The Belgian data protection authority has imposed a fine of EUR 1000 on a non-profit organisation for sending out direct marketing messages, despite the fact that data subjects had exercised their right to erasure and objection. The organisation claimed that it was relying on legitimate interests as a legal basis and not on the explicit consent of the data subjects. The data protection authority, however, denied the existence of any outweighing of legitimate interests. link
FINLAND Deputy Data Protection Ombudsman 2020-05-29 72,000 Taksi Helsinki Art. 5 GDPR, Art. 6 GDPR, Art. 35 GDPR Non-compliance with general data processing principles Among other things, the company had not assessed the risks and consequences of processing personal data before introducing a camera surveillance system that records audio and video in its taxis and had also failed to conduct data protection impact assessments of its processing activities, including the surveillance of security cameras, the processing of location data, automated decision making and profiling as part of its loyalty program. Furthermore, the processing of audio data was not in line with the GDPR principle of data minimization. link
HUNGARY Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) 2020-03-09 870 Creditor Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing Sending of SMS to a data subject as a reminder for a debt, even when the debt has already been paid. link
SPAIN Spanish Data Protection Authority (aepd) 2020-06-09 5,000 Consulting de Seguridad e Investigacion Mira Dp Madrid S.L. Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing A data subject has received marketing messages without having consented. link
SPAIN Spanish Data Protection Authority (aepd) 2020-06-09 540 Chenming Ye (Bazar Real) Art. 13 GDPR, Art. 14 GDPR Insufficient fulfilment of information obligations Usage of CCTV camera in a shop without proper information. link
SPAIN Spanish Data Protection Authority (aepd) 2020-06-09 1,000 Property Owner Art. 5 (1) c) GDPR Non-compliance with general data processing principles Usage of CCTV camera which also captured the public roads outside in a violation of the so called principle of data minimisation. link
SPAIN Spanish Data Protection Authority (aepd) 2020-06-09 75,000 Equifax Iberica, S.L. Art. 15 GDPR Insufficient fulfilment of data subjects rights The Data Subject has requested by e-mail the deletion of his data from the file of the National Association of Financial Credit Institutions ("ASNEF"). Equifax Iberica had replied that the exercise of the complainant's right was excessive due to an earlier request and that therefore the deletion would not be carried out. This was seen as a breach of data subjects rights for erasure under the GDPR as well as a breach of blocking obligations under national data protection laws. link
SPAIN Spanish Data Protection Authority (aepd) 2020-06-09 39,000 Xfera Moviles S.A. Art. 5 (1) f) GDPR Insufficient legal basis for data processing A customer claimed to have received an SMS from Xfera Móviles informing about the non-payment and the resulting suspension of the service in relation to the account of another data subject. link
SPAIN Spanish Data Protection Authority (aepd) 2020-06-09 25,000 Glovoapp23 Art. 37 GDPR Lack of appointment of data protection officer The company had not appointed a Data Protection Officer ('DPO') to whom requests from data subjects could be addressed, and the company's website did not contain information about an appointed DPO. link
SPAIN Spanish Data Protection Authority (aepd) 2020-06-04 4,000 Iberdrola Clientes Art. 58 GDPR Insufficient cooperation with supervisory authority The company was asked to provide the AEPD with specific information in relation to a complaint. However, the company had not replied to the data protection authorities request for information within a certain time frame, in breach of Art. 58 of the GDPR. link
NORWAY Norwegian Supervisory Authority (Datatilsynet) 2020-05-19 283,000 Bergen Municipality Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security Fine due to several security shortcomings and non-compliance with general data processing principles in a module for communication between schools and parents. link
SPAIN Spanish Data Protection Authority (aepd) 2020-06-09 40,000 TELEFONICA MOVILES ESPAÑA, S.A.U. Art. 6 GDPR Insufficient legal basis for data processing A sales representative failed to carefully check the identity of a claimant so that he could appear in the name of the data subject and order a telephone connection for four telephone lines in his name. link
NORWAY Norwegian Supervisory Authority (Datatilsynet) 2020-05-03 134,000 Telenor Norge AS Art. 32 GDPR Insufficient technical and organisational measures to ensure information security Fines for security breaches in a voice mailbox function. link
BULGARIA Data Protection Commision of Bulgaria (KZLD) 2020-04-14 2,000 Political Party Art. 6 GDPR Insufficient legal basis for data processing Forging signatures on a voters' list. link
BELGIUM Belgian Data Protection Authority (APD) 2020-05-14 50,000 Social Media Provider Art. 6 GDPR Insufficient legal basis for data processing The company has sent invitations to contacts uploaded by its users without their consent or any other legal basis. link
ROMANIA Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) 2020-04-23 3,000 Estee Lauder Romania Art. 6 GDPR, Art. 7 GDPR, Art. 9 GDPR Insufficient legal basis for data processing Processing of personal data without sufficient legal basis including health data. link
SPAIN Spanish Data Protection Authority (aepd) 2020-06-09 3,000 Salad Market S.L. (Catering Company) Art. 13 GDPR, Art. 14 GDPR Insufficient fulfilment of information obligations Fines for lack of sufficient data processing information in relation to video surveillance on business premises and for insufficient information when cookies were used on its website. link
SPAIN Spanish Data Protection Authority (aepd) 2020-06-09 2,000 Attorney Art. 32 GDPR Insufficient technical and organisational measures to ensure information security In the course of proceedings, an attorney submitted documents whose backs contained personal data of other parties. link
SPAIN Spanish Data Protection Authority (aepd) 2020-06-09 2,000 Property Owner Art. 5 (1) c) GDPR Non-compliance with general data processing principles Usage of CCTV camera which also captured the public roads outside in a violation of the so called principle of data minimisation. link
ROMANIA Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) 2020-04-23 3,000 Telekom Romania Communications SA Art. 32 GDPR Insufficient technical and organisational measures to ensure information security The company had not taken sufficient technical and organizational measures to ensure the accuracy of personal data transmitted by telephone for the conclusion of contracts. This led to contracts being concluded by telephone on behalf of other data subjects link
ESTONIA Estonian Data Protection Authority (aepd) 2020-04-30 500 Housing Association Art. 6 GDPR Insufficient legal basis for data processing Fine of EUR 500 against a housing association for publishing photos showing members of the association without their consent. link
HUNGARY Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) 2020-03-26 2,890 Bank Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing Due to an administrative error, the personal data of the data subject were registered and transferred to the Central Credit Information System (CCI) in connection with a loan agreement, without the data subject being a party to the agreement. link
HUNGARY Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) 2020-03-19 5,800 Unknown Company Art. 6 GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights The data controller has not complied with its obligation regarding the right of access to video recordings and was also unable to demonstrate that his data processing activities had been in compliance with data protection laws. link
HUNGARY Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) 2020-01-24 1,450 Accounting firm Art. 24 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security A printed customer list of an accounting firm, which also contained personal data, could be accessed by unauthorized persons. link
GERMANY Data Protection Authority of Baden-Wuerttemberg 2020-06-30 1,240,000 Allgemeine Ortskrankenkasse ("AOK") (health insurance company) Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security From 2015 to 2019, AOK Baden-Württemberg (insurance organization) organized competitions on various occasions and collected personal data of the participants, including their contact details and health insurance affiliation. The AOK also wanted to use this data for advertising purposes, provided the participants had given their consent. With the help of technical and organizational measures, including internal guidelines and data protection training, the AOK wanted to ensure that only data of those contest participants who had previously given their effective consent would be used for advertising purposes. However, the measures defined by the AOK did not meet the legal requirements. As a result, the personal data of more than 500 lottery participants were used for advertising purposes without their consent. Immediately after this became known, the AOK Baden-Württemberg stopped all marketing measures in order to thoroughly examine all processes. link
SPAIN Spanish Data Protection Authority (aepd) 2020-06-23 7,500 Miraclia (telecommunications company) Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing The recording of telephone jokes via an app constitutes processing of personal data in accordance with the applicable data protection law, as the voices of individuals may constitute personal data if they are associated with other information, such as the telephone number. The consent of the users at the end of the conversation was not sufficient in this case. link
SPAIN Spanish Data Protection Authority (aepd) 2020-06-22 2,000 Unknown Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR Non-compliance with general data processing principles Illegal use of CCTV cameras due to coverage of public space and recording of passing pedestrians. Furthermore, insufficient fulfilment of information obligations. link
SPAIN Spanish Data Protection Authority (aepd) 2020-06-16 2,000 Café Bar Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR Non-compliance with general data processing principles Illegal use of CCTV cameras (recording of third parties) and insufficient fulfilment of information obligations. link
ROMANIA Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) 2020-06-18 4,000 Enel Energie Art. 32 GDPR Insufficient technical and organisational measures to ensure information security Failure to take adequate measures to prevent unauthorised disclosure of personal data. The fine was preceded by a complaint about the disclosure of personal data of the data subject to another customer by e-mail. link
SPAIN Spanish Data Protection Authority (aepd) 2020-06-15 75,000 Xfera Moviles S.A. Art. 6 GDPR Insufficient legal basis for data processing The data subject received a notice from a debt collection company demanding payments in connection with Xfera Móviles' services, even though the claimant had not been a customer of Xfera Móviles since September 2017. Furthermore, the resolution states that Xfera Móviles carried out the processing of the personal data of the plaintiff without his consent, which constitutes a violation of Article 6 of the GDPR. link
ROMANIA Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) 2020-06-11 3,000 Telekom Romania Art. 32 GDPR Insufficient technical and organisational measures to ensure information security Inadequate security measures of the company had led to unlawful processing of personal data without verifying their accuracy. For this reason, a fine was imposed on Telekom Romania for violation of Article 32 of the GDPR, and the introduction of effective mechanisms to identify and protect data from unauthorised disclosure and unlawful processing is ordered to ensure compliance with the GDPR. link
HUNGARY Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) 2020-06-12 288,000 Digi Távközlési Szolgáltató Kft. ("Digi") (electronic communication service provider) Art. 5 (1) b), (e) GDPR, Art. 32 (1), (2) GDPR Insufficient technical and organisational measures to ensure information security The company had infringed the principles of purpose limitation and storage restriction because its database contained a large amount of customer data which were no longer relevant for the actual purpose of collection and for which no retention period had been set. Furthermore, the NAIH pointed out that the defendant had not taken proportionate measures to reduce the risks in the area of data management and data security, arguing, inter alia, that it had not used encryption mechanisms. link
SWEDEN Data Protection Authority of Sweden 2020-06-16 1,900 Housing Association Art. 5 GDPR, Art. 6 GDPR Non-compliance with general data processing principles Unlawful usage of surveillance cameras. In the decision, the data protection authority stressed that sound recordings have additional privacy implications, especially in a residential building, and that in this case there is nothing to justify sound recording. In addition, the decision orders the housing association to stop the cameras recording staircases and entrances, to stop sound recording and to improve the information on camera surveillance. link
BELGIUM Belgian Data Protection Authority (APD) 2020-06-19 10,000 Unknown Art. 5 GDPR, Art. 6 GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights The company sent an e-mail to the person concerned without his consent. Thereupon the person concerned requested timely information about the entries in the database concerning his person, which remained unanswered. link
BELGIUM Belgian Data Protection Authority (APD) 2020-06-16 1,000 Unknown Art. 17 GDPR, Art. 21 GDPR, Art. 31 GDPR Insufficient fulfilment of data subjects rights The data subject repeatedly received e-mails with advertising content from a company, although the data subject had objected to the processing of his personal data and requested the deletion of his data. In addition, the company did not respond to any inquiries from the data protection authority in this regard. link
BELGIUM Belgian Data Protection Authority (APD) 2020-06-08 5,000 Municipal employee Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing In the context of a municipal election in 2018, the data controller had sent election advertisements to a group of employees of the same municipal administration, unlawfully using a list of contact data to which he had no access. link
ISLE OF MAN Information Commissioner of Isle of Man 2020-06-25 13,500 Department of Home Affairs Art. 12 GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights Fines for failure to comply with the right of access to personal data under Articles 12 and 15 GDPR. The Isle of Man has declared the GDPR - although it is not an EU state - to be applicable. link
DENMARK Danish Data Protection Authority (Datatilsynet) 2020-06-30 6,700 Lejre Municipality Art. 5 GDPR, Art. 6 GDPR, Art. 33 GDPR, Art. 34 GDPR Non-compliance with general data processing principles The data protection authority had found that the Lejre Municipal Child and Youth Centre had regularly uploaded minutes of meetings with particularly sensitive and sensitive personal data, including on citizens under 18 years of age, to the Lejre Municipal Personnel Portal, which was accessible to employees of the Lejre Municipality, regardless of whether the employees in question were working with these cases. In addition, the data protection authority denied the failure to comply with the obligation to inform the persons concerned of the data breach. link
IRELAND Data Protection Authority of Ireland 2020-06-30 40,000 Tusla Child and Family Agency Art. 33 GDPR Insufficient fulfilment of data breach notification obligations The organization sent a letter with abuse allegations to a third party who then uploaded it to social networks. link
NORWAY Norwegian Supervisory Authority (Datatilsynet) 2020-06-22 112,000 Østfold HF Hospital Art. 32 GDPR Insufficient technical and organisational measures to ensure information security It was found that Østfold HF Hospital had stored patient data, including sensitive data such as the reason for hospitalisation, during the period 2013-2019 without controlling access to the folders where the data was stored. Datatilsynet therefore decided that the hospital had not taken sufficient technical and organisational measures to protect personal data and was therefore in breach of the GDPR and the Patient Records Act. link
NORWAY Norwegian Supervisory Authority (Datatilsynet) 2020-06-19 28,000 Aquateknikk AS Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing Request for data from a credit agency without legal basis. link
SPAIN Spanish Data Protection Authority (aepd) 2020-06-19 6,000 National Police Brigade Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing Making copies of a company's business records in the context of investigations which contained data from third parties and for which there was no legal basis for processing. link
ITALY Italian Data Protection Authority (Garante) 2020-01-30 4,000 Comune di Colledara Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing Publication of documents relating to a public tender with personal data on a website link
ITALY Italian Data Protection Authority (Garante) 2020-03-05 3,000 San Giorgio Jonico Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR Insufficient legal basis for data processing Publication of a citizen's personal data on a website and failure to comply with requests for deletion. link
SPAIN Spanish Data Protection Authority (aepd) 2020-07-02 24,000 Iberdrola Clientes Art. 5 GDPR Non-compliance with general data processing principles A third person had received an electricity bill with personal details such as name, address and bank account of another customer. The reason for this was that Iberdola Clientes was not able to guarantee adequate security measures in the processing of the personal data of the data subject, in violation of the principles of data integrity and confidentiality. The fine of €40,000 has been reduced to €24,000 due to voluntary payment. link
SPAIN Spanish Data Protection Authority (aepd) 2020-07-02 4,000 De Vere Spain S.L. Art. 21 GDPR Insufficient fulfilment of data subjects rights The company did not respond to the data subject's request to stop processing his or her data, and therefore data subject continued to receive commercial calls. link
NORWAY Norwegian Supervisory Authority (Datatilsynet) 2020-07-02 28,000 Odin Flissenter AS Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing The company assessed the credibility of another company and thereby, according to Datatilsynet, processed personal data relating to a natural person (the owner of the company assessed) without there being a sufficient legal basis for doing so. link
SPAIN Spanish Data Protection Authority (aepd) 2020-07-02 3,600 Saunier-Tec Mantenimientos de Calor y Frio, SL. Art. 33 GDPR Insufficient fulfilment of data breach notification obligations Although the company had taken steps to remedy a data breach, it had not informed the AEPD sufficiently. As a result, the AEPD imposed a fine of EUR 4,800, which was reduced to EUR 3,600 due to voluntary payment. link
SPAIN Spanish Data Protection Authority (aepd) 2020-07-02 5,000 Xfera Moviles S.A. Art. 31 GDPR, Art. 58 GDPR Insufficient cooperation with supervisory authority The company had not cooperated sufficiently with the data protection authority. link
ROMANIA Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) 2020-07-09 15,000 Proleasing Motors SRL Art. 32 GDPR Insufficient technical and organisational measures to ensure information security The company had failed to take adequate technical and organisational measures to ensure data security, which led to the publication on Facebook of a document containing a password for access to personal data of 436 customers. link
POLAND Polish National Personal Data Protection Office (UODO) 2020-07-10 3,400 East Power Sp. z o.o. Art. 31 GDPR, Art. 58 GDPR Insufficient cooperation with supervisory authority After three subpoenas to East Power, in which the latter failed to provide sufficient explanations on a direct marketing complaint, the data protection authority found that East Power had deliberately obstructed the course of the procedure or at least failed to comply with its obligations to cooperate with the supervisory authority. link
NORWAY Norwegian Supervisory Authority (Datatilsynet) 2020-07-10 46,660 Municipality of Rælingen Art. 32 GDPR, Art. 35 GDPR Insufficient technical and organisational measures to ensure information security Fine for the processing of children's health data in connection with disability through the digital learning platform "Showbie". The Municipality had failed to carry out a Data Protection Impact Assessment ("DPIA") in accordance with Article 35 of the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") prior to the start of the processing and had not taken adequate technical and organisational measures in accordance with Article 32 of the GDPR, resulting in an increased risk of unauthorised access to the personal data of the pupils. link
THE NETHERLANDS Dutch Supervisory Authority for Data Protection (AP) 2020-07-06 830,000 Bureau Krediet Registration ('BKR') Art. 12 GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights BKR had required the payment of a fee when individuals requested access to their personal data and only provided access to their data once a year free of charge by post. link