{ "version": "https://jsonfeed.org/version/1.1", "title": "Data Comply One · Sanctions RGPD en Europe", "home_page_url": "https://datacomplyone.com/ressources/sanctions-rgpd", "feed_url": "https://datacomplyone.com/sanctions-rgpd-feed.json", "description": "Les 50 dernières amendes RGPD infligées par les autorités européennes de protection des données — mis à jour par Data Comply One.", "language": "fr", "authors": [ { "name": "Data Comply One", "url": "https://datacomplyone.com" } ], "icon": "https://datacomplyone.com/logos/dco-logo.webp", "favicon": "https://datacomplyone.com/favicon.ico", "items": [ { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3112", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3112", "title": "Amende RGPD 8 k€ · Accountancy Firm (Belgique)", "content_text": "The Belgian DPA has imposed a fine of EUR 8,500 on a accountancy firm. Following the termination of an employment contract, the controller failed to deactivate the former employee's personal work email address for a long time. Even after the former employee requested that the controller delete this data, the controller did not react. Additionally, the controller did not set up an automatic response to inform senders that the data subject is no longer working for the company, resulting in emails continuously being sent to the former employee's email address.", "summary": "Belgian Data Protection Authority (APD) · Belgique · amende 8 k€", "date_published": "2026-04-23T00:00:00+00:00", "tags": [ "Belgique", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3111", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3111", "title": "Amende RGPD 7 k€ · Utility Company (Slovénie)", "content_text": "The Slovenian DPA has imposed a fine of EUR 6,600 on a utility company and a responsible person within the company. The company tracked its employees using GPS trackers installed in company vehicles which ran continuously and indiscriminately. The controller had no legal basis for this data processing and did not consider less intrusive methods to achieve the same purpose. Additionally, the controller failed to adequately inform the data subjects about the processing. The fine had been split up into a fine in the amount of EUR 6,000 for the company and EUR 600 for the employee responsible.", "summary": "Slovenian Supervisory Authority (Informacijski pooblaščenec) · Slovénie · amende 7 k€", "date_published": "2026-04-15T00:00:00+00:00", "tags": [ "Slovénie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3114", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3114", "title": "Amende RGPD 2 k€ · Housing Associaction (Pologne)", "content_text": "The Polish DPA has imposed a fine of EUR 2,350 on a housing association. The controller suffered a data breach and failed to inform the DPA within 72 hours", "summary": "Polish National Personal Data Protection Office (UODO) · Pologne · amende 2 k€", "date_published": "2026-04-07T00:00:00+00:00", "tags": [ "Pologne", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3110", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3110", "title": "Amende RGPD 13 k€ · Legal Person (Slovénie)", "content_text": "The Slovenian DPA has imposed a fine of EUR 13,491 on a legal person. The controller failed to implement adequate technical and organisational measures to ensure data security by not using a sufficient randomisation method, which allowed unauthorised persons to easily access data subjects' health records by guessing a six-digit number and entering it into a web browser.", "summary": "Slovenian Supervisory Authority (Informacijski pooblaščenec) · Slovénie · amende 13 k€", "date_published": "2026-03-27T00:00:00+00:00", "tags": [ "Slovénie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3071", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3071", "title": "Amende RGPD 125 k€ · RENAULT COMMERCIAL ROUMANIE S.R.L. (Roumanie)", "content_text": "The Romanian DPA has imposed a fine of EUR 125,000 on RENAULT COMMERCIAL ROUMANIE S.R.L. The controller suffered a successful cyber attack due to insufficient technical and organisational measures to ensure data security, resulting in a large quantity of personal data being published on a platform. Additionally, the controller failed to use data processors that could guarantee the technical and organisational measures ensuring data security.", "summary": "Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) · Roumanie · amende 125 k€", "date_published": "2026-03-25T00:00:00+00:00", "tags": [ "Roumanie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3070", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3070", "title": "Amende RGPD 4 k€ · ING Bank NV Amsterdam – Sucursala București S.A. (Roumanie)", "content_text": "The Romanian DPA has imposed a fine of EUR 4,000 on ING Bank NV Amsterdam – Sucursala București S.A. The controller failed to implement adequate technical and organisational measures to ensure data security. This resulted in an employee handing bank account statements to an unauthorised third party.", "summary": "Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) · Roumanie · amende 4 k€", "date_published": "2026-03-23T00:00:00+00:00", "tags": [ "Roumanie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3065", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3065", "title": "Amende RGPD 3 k€ · Public and Private Domain SA (Roumanie)", "content_text": "The Romanian DPA has imposed a fine of EUR 3,000 on Public and Private Domain SA. The controller used body cameras to monitor its employees, even though less intrusive methods were available. Additionally, the controller failed to adequately inform its employees about the processing.", "summary": "Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) · Roumanie · amende 3 k€", "date_published": "2026-03-20T00:00:00+00:00", "tags": [ "Roumanie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3069", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3069", "title": "Amende RGPD 3 k€ · Domeniul Public și Privat SA (Roumanie)", "content_text": "The Romanian DPA has imposed a fine of EUR 3,000 on Domeniul Public și Privat SA. The controller used Bodycams to verify compliance with occupational health and safety rules. The controller failed to adequately inform employees regarding the processing, which the DPA deemed excessive.", "summary": "Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) · Roumanie · amende 3 k€", "date_published": "2026-03-20T00:00:00+00:00", "tags": [ "Roumanie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3068", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3068", "title": "Amende RGPD 8 k€ · Altex Romania S.R.L. (Roumanie)", "content_text": "The Romanian DPA has imposed a fine of EUR 8,000 on Altex Romania S.R.L. The DPA has started an investigation into the data processing of the controller, which during the process failed to adequatly react to the DPAs requests.", "summary": "Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) · Roumanie · amende 8 k€", "date_published": "2026-03-05T00:00:00+00:00", "tags": [ "Roumanie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3095", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3095", "title": "Amende RGPD 2 k€ · MALAGASUITE SHOWROOM, S.L. (Espagne)", "content_text": "The Spanish DPA has imposed a fine of EUR 2,000 on MALAGASUITE SHOWROOM, S.L. The controller collected guest identification data for the purpose of tourist accommodation. While the controller had a sufficient legal basis for processing the data, the controller failed to adequately inform the data subjects about it.", "summary": "Spanish Data Protection Authority (aepd) · Espagne · amende 2 k€", "date_published": "2026-03-02T00:00:00+00:00", "tags": [ "Espagne", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3096", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3096", "title": "Amende RGPD 900 € · ORNITOLÓGICA DE ANDALUCÍA FOA (Espagne)", "content_text": "The Spanish DPA has imposed a fine of EUR 900 on ORNITOLÓGICA DE ANDALUCÍA FOA. The controller sent a mass email to more than 200 affiliated recipients. The email disclosed personal data that was not necessary for the intended purpose, due to insufficient technical and organisational measures. The original fine of EUR 1,500 was reduced to EUR 900 due to immediate payment and admission of responsibility by the controller.", "summary": "Spanish Data Protection Authority (aepd) · Espagne · amende 900 €", "date_published": "2026-03-02T00:00:00+00:00", "tags": [ "Espagne", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3104", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3104", "title": "Amende RGPD 5 k€ · Suomen Numerokeskus Oy (Finlande)", "content_text": "The Finish DPA has imposed a fine of EUR 5,000 on Suomen Numerokeskus Oy. The controller systematically failed to adequately respond to requests from data subjects to exercise their rights. Specifically, data subjects requested access to recordings of phone calls between themselves and the controller. However, the controller deleted the data each time, meaning the requests could not be fulfilled.", "summary": "Deputy Data Protection Ombudsman · Finlande · amende 5 k€", "date_published": "2026-03-02T00:00:00+00:00", "tags": [ "Finlande", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3093", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3093", "title": "Amende RGPD 1 k€ · Unknown (Espagne)", "content_text": "The Italian DPA has imposed a fine of EUR 1,000 on a unknown data controller. The controller had been appointed to issue an energy performance certificate for a data subject. In that context, the controller requested a full copy of the front of their ID card alongside other information. Requesting a full copy of the ID card infringed the principle of data minimisation, as a full copy includes data that is not necessary for the purpose of authorising a natural person.", "summary": "Spanish Data Protection Authority (aepd) · Espagne · amende 1 k€", "date_published": "2026-03-01T00:00:00+00:00", "tags": [ "Espagne", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3094", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3094", "title": "Amende RGPD 12 k€ · HOLY MARY CATHOLIC SCHOOL, S.L. (Espagne)", "content_text": "The Spanish DPA has imposed a fine of EUR 12,000 on the HOLY MARY CATHOLIC SCHOOL, S.L. The controller, an educational institute, used Google Workspace for Education within its school environment. While the use of the tool may be justifiable under the GDPR, the controller failed to implement it adequately. The controller was unable to ensure that pupils only had access to the tools necessary for study purposes. The controller also failed to adequately inform data subjects and their parents, and to carry out a sufficient DPIA. The original fine of EUR 20,000 was reduced to EUR 12,000 due to immediate payment and admission of responsibility by the controller.", "summary": "Spanish Data Protection Authority (aepd) · Espagne · amende 12 k€", "date_published": "2026-03-01T00:00:00+00:00", "tags": [ "Espagne", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3092", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3092", "title": "Amende RGPD 1 k€ · Ciemme S.r.l.s. (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 1,000 on Ciemme S.r.l.s. The DPA began investigating the controller for potential GDPR infringements relating to direct marketing activities. The DPA therefore contacted the controller, who failed to adequately respond to the DPA's request.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 1 k€", "date_published": "2026-02-26T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3115", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3115", "title": "Amende RGPD 5 k€ · Conservatory (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 5,000 on a Conservatory. The controller sent an email to over one hundred employees informing them that a former Administrative Director had been dismissed due to disciplinary measures. The email included further details of the reasons for the dismissal, including the fact that the former employee had previously been subject to criminal proceedings.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 5 k€", "date_published": "2026-02-26T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3116", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3116", "title": "Amende RGPD 15 k€ · Ministero delle Imprese e del Made in Italy (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 15,000 on the Ministero delle Imprese e del Made in Italy. The controller started a 'Open competition, based on qualifications and examinations, to fill a total of 225 full-time, permanent non-managerial posts (...)' After the competition was closed, the ranking list of the candidates had still been effectivly online on the controllers website and could be accessed by web links. The ranking list included personal data of the candidates. The controller later took the list offline after a request to delete the data, but the list reappeared later on the website of a third party.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 15 k€", "date_published": "2026-02-26T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3117", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3117", "title": "Amende RGPD 15 k€ · Depac Società Cooperativa Sociale a r.l. (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 15,000 on Depac Società Cooperativa Sociale a r.l. The controller used two fingerprint devices to track the arrival and departure times of six employees working for a public contractor. The controller had no legal basis for this processing.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 15 k€", "date_published": "2026-02-26T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3118", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3118", "title": "Amende RGPD 15 k€ · Flamel S.r.l. (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 15,000 on Flamel S.r.l. The controller had been active in direct marketing activities involving robocalls followed up with telesales. Although Flamel S.r.l. had been a controller in substance, it acted as a data processor. Consequently, the controller failed to fulfil its duties as a data controller, resulting in an unlawfully organised processing chain. Furthermore, the controller could not simply rely on a contractual assurance regarding the consent of data subjects.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 15 k€", "date_published": "2026-02-26T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3119", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3119", "title": "Amende RGPD 15 k€ · Ministero delle Imprese e del Made in Italy (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 15,000 on the Ministero delle Imprese e del Made in Italy. The controller started a 'Open competition, based on qualifications and examinations, to fill a total of two hundred and twenty-five full-time, permanent non-managerial posts (...)' The controller used a data processor to publish the the ranking list, but the processor failed to act in accordance to the GDPR. There had not been a sufficient data processing agreement and the controller failed to adequatly controll the data processor.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 15 k€", "date_published": "2026-02-26T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3120", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3120", "title": "Amende RGPD 2 k€ · Istituto Tecnico Statale “Luigi Einaudi” di Correggio (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 2,000 on the Istituto Tecnico Statale “Luigi Einaudi” di Correggio. The controller had been publishing teachers' timetables and supervision rotas, including their full names, on its website, even though this information was only available after logging in with a username and password. Additionally, the controller recorded teachers' absences and made them visible to all teachers, colleagues, pupils and their families.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 2 k€", "date_published": "2026-02-26T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3121", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3121", "title": "Amende RGPD 12 k€ · Ministero dell’Economia e delle Finanze (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 12,000 on the Ministero dell’Economia e delle Finanze. The controller had been running an 'open competition, based on qualifications and examinations, for the recruitment of a total of (...)'. The competition comprises a preliminary selection test and subsequent stages. By law, individuals with certain medical conditions may be exempt from certain tests. After the preliminary selection, the controller published a list of candidates eligible for the next round, which was visible to all applicants. This list noted which candidates had been exempted from certain tests, allowing conclusions to be drawn about their medical conditions.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 12 k€", "date_published": "2026-02-26T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3122", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3122", "title": "Amende RGPD 3 k€ · Groupharma s.r.l.s. (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 3,000 on Groupharma s.r.l.s. Following the termination of an employment contract, a former employee requested that the controller delete his personal data from their website and send him the final version of the employment contract before termination. The controller failed to respond to this request.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 3 k€", "date_published": "2026-02-26T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3123", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3123", "title": "Amende RGPD 10 k€ · Radio Immagine Uno S.r.l. (Italie)", "content_text": "The Italian DPA has imposed a fine against Radio Immagine Uno S.r.l. The controller, who operates the news outlet Lunanotizone.it, published an article about a criminal procedure involving a data subject. The article was in breach of local press law, and the data subject requested that the controller delete the data. However, the controller did not respond to the request.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 10 k€", "date_published": "2026-02-26T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3124", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3124", "title": "Amende RGPD 32 k€ · Dedalus Italia S.p.A. (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 32,000 on Dedalus Italia S.p.A. The controller, who operates an employee portal used in the healthcare sector, carried out maintenance work on the application, but failed to implement adequate technical and organisational security measures. This resulted in employees of the portal's users being able to access the personal data of their colleagues that they should not have been able to access.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 32 k€", "date_published": "2026-02-26T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3125", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3125", "title": "Amende RGPD 30 k€ · S.M. Trattamento Acqua di XX (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 30,000 on S.M. Trattamento Acqua di XY. The controller had been active in direct marketing, using automated calls for this purpose. However, the controller failed to base the data processing on an adequate legal basis and failed to implement appropriate accountability measures. As a result, data subjects who had been registered in the Public Register of Objections were called. Furthermore, the controller failed to adequately respond to requests from data subjects. Lastly, the controller was involved in an unlawful processing chain.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 30 k€", "date_published": "2026-02-26T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3074", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3074", "title": "Amende RGPD 16,6 M€ · Reddit, Inc. (Royaume-Uni)", "content_text": "The UK DPA has imposed a fine of £14,472,500 (EUR 16,610,000) on Reddit, Inc. The controller offers a social media platform that is also available in the UK. The platform enables users to interact with each other and also, but not exclusively, includes content that may be inappropriate for children. The controller failed to implement an age-verification procedure even though minors were using the platform. The controller also failed to implement an adequate cookie consent procedure to obtain adequate consent from minors. Lastly, the controller failed to carry out a risk assessment regarding the processing of minors' data.", "summary": "Information Commissioner (ICO) · Royaume-Uni · amende 16,6 M€", "date_published": "2026-02-23T00:00:00+00:00", "tags": [ "Royaume-Uni", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3058", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3058", "title": "Amende RGPD 2 k€ · SC Hayat Dent SRL (Roumanie)", "content_text": "The Romanian DPA has imposed a fine of EUR 2,000 on SC Hayat Dent SRL. The DPA has started an investigation into the controller due to a possible violation. The controller failed to cooperate adequately with the DPA, resulting in the DPA issuing a warning and ordering the controller to supply the required information. The controller failed to comply with this order, resulting in a fine being issued.", "summary": "Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) · Roumanie · amende 2 k€", "date_published": "2026-02-20T00:00:00+00:00", "tags": [ "Roumanie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3057", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3057", "title": "Amende RGPD 3 k€ · Your Consulting SRL (Roumanie)", "content_text": "The Romanian DPA has imposed a fine of EUR 3,000 on Your Consulting SRL. The controller suffered a data leak due to insufficient technical and organisational measures. In particular, the controller failed to regularly test, evaluate and reassess security measures.", "summary": "Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) · Roumanie · amende 3 k€", "date_published": "2026-02-19T00:00:00+00:00", "tags": [ "Roumanie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3113", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3113", "title": "Amende RGPD 1,4 M€ · Restaurant Partner Polska (Pologne)", "content_text": "The Polish DPA has imposed a fine of EUR 1,393,300 on Restaurant Partner Polska. The controller of the 'Glovo' application requested that customers provide a scan or photograph of an identity document when they were suspected of fraud. The controller had no sufficient legal basis for this.", "summary": "Polish National Personal Data Protection Office (UODO) · Pologne · amende 1,4 M€", "date_published": "2026-02-19T00:00:00+00:00", "tags": [ "Pologne", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3109", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3109", "title": "Amende RGPD 6 k€ · Unknown (Slovénie)", "content_text": "The Slovenian DPA has imposed a fine of EUR 5,500 on a unkonwn company and a responsible person within the company. The controller failed to implement adequate technical and organisational measures to ensure data security by giving employees access to customer data that was not necessary for them to fulfil their duties. This resulted in a data breach. Additionally, the controller had been warned regarding the information obligations under Art. 12 and Art. 13 GDPR. The fine had been split up into a fine in the amount of EUR 5,400 for the company and EUR 100 for the employee responsible.", "summary": "Slovenian Supervisory Authority (Informacijski pooblaščenec) · Slovénie · amende 6 k€", "date_published": "2026-02-16T00:00:00+00:00", "tags": [ "Slovénie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3066", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3066", "title": "Amende RGPD 8 k€ · Election Committee of Karol Nawrocki (Pologne)", "content_text": "The Polish DPA has imposed a fine of EUR 8,470 on the Election Committee of Karol Nawrocki. The controller published documents relating to a political affair concerning the purchase of real estate, which contained personal data that could have been pseudonymised or redacted. Therefore, there was no legal basis for publishing the documents containing personal data.", "summary": "Polish National Personal Data Protection Office (UODO) · Pologne · amende 8 k€", "date_published": "2026-02-13T00:00:00+00:00", "tags": [ "Pologne", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3078", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3078", "title": "Amende RGPD 2 k€ · Comune di Velletri (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 2,000 on the Commune di Velletri. The controller provided a cemetery app containing data on deceased persons for use within the app. The app combined public and institutional cemetery information, such as names and places of burial, with social and commercial features. In order to view the data of deceased persons, data subjects had to install the app, create a profile, and enter their personal details. Therefore, data processed for institutional public purposes was used for more than the municipality could have used it for. Additionally, the controller failed to adequately control the app provider, who acted as a processor, and to adequately inform data subjects.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 2 k€", "date_published": "2026-02-12T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3079", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3079", "title": "Amende RGPD 6 k€ · Comune di Coccaglio (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 6,000 on the Commune di Coccaglio. The controller uses video surveillance to protect its warehouse property. While the use of video surveillance for this purpose is lawful, the controller also used the footage in a disciplinary procedure against an employee, which exceeded the scope of the surveillance. The controller also failed to adequately inform its employees about data processing and perform a data protection impact assessment.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 6 k€", "date_published": "2026-02-12T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3080", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3080", "title": "Amende RGPD 4 k€ · Order of Physicians, Surgeons and Dentists of the Province of Macerata (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 4,000 on the Order of Physicians, Surgeons and Dentists of the Province of Macerata. During the pandemic, the controller suspended a health professional for failing to fulfil the vaccination requirements. The controller sent the suspension notification not only to the data subject, but also to other entities, which could not have been based on sufficient legal basis.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 4 k€", "date_published": "2026-02-12T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3081", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3081", "title": "Amende RGPD 2 k€ · Comune di Monterotondo (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 2,000 on the Comune di Monterotondo. The controller used video surveillance to protect property, but installed the cameras in such a way that they film public areas, which is unnecessary for the purpose of data processing.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 2 k€", "date_published": "2026-02-12T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3082", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3082", "title": "Amende RGPD 2 k€ · Sole Trader (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 1,500 on a sole trader. The controller operates a pizzeria and installed video surveillance to protect it. However, the video surveillance captured areas outside the sole trader's property, and data subjects were not informed about the processing. Additionally, the CCTV equipment captured a traffic accident, and the controller disclosed the footage to one of the parties involved.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 2 k€", "date_published": "2026-02-12T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3083", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3083", "title": "Amende RGPD 12 k€ · Based s.r.l. (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 12,000 on Based s.r.l. A former employee requested access to his personal data relating to his email account, as well as the deletion of this data. The controller failed to respond adequately to the request and also failed to provide the data subject with its privacy policy.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 12 k€", "date_published": "2026-02-12T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3084", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3084", "title": "Amende RGPD 5 k€ · Unleadmited S.r.l. (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 5,000 on Unleadmited S.r.l. The controller operated a lead-generation business for direct marketing purposes and collected personal data through a website that was presented as a comparison portal. This data was then disclosed to third parties for their marketing activities. This processing lacked a sufficient legal basis, as the consent mechanism and privacy information were not specific, transparent or reliable enough. Furthermore, the controller failed to implement adequate technical and organisational measures to verify the identity of data subjects and demonstrate valid consent. Furthermore, the controller failed to respond properly and in a timely manner to the DPA’s requests.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 5 k€", "date_published": "2026-02-12T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3085", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3085", "title": "Amende RGPD 15 k€ · Depurazione Acqua S.r.l. (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 15,000 on Depurazione Acqua S.r.l. The controller contacted a data subject in the context of direct marketing activities despite the data subject being registered in the Public Register of Objections. Therefore, the controller processed the data subject's data without a sufficient legal basis. Additionally, the controller failed to exercise sufficient control over the data providers used to obtain the data for direct marketing activities. The controller obtained data from Unleadmited S.r.l., which had already been fined for obtaining data without a sufficient legal basis (ETid: 3084).", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 15 k€", "date_published": "2026-02-12T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3086", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3086", "title": "Amende RGPD 15 k€ · Bressanelli Galli Gelpi Porta & C. S.r.l. (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 15,000 on Bressanelli Galli Gelpi Porta & C. S.r.l. The controller had been engaged in direct marketing activities without basing the processing on a sufficient legal basis. Specifically, the controller obtained consent to process the data for a third party, but then decided to repurpose the data for its own marketing activities, despite the fact that consent had not been given for these activities. The controller also failed to adequately respond to a data subject's request to exercise their rights.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 15 k€", "date_published": "2026-02-12T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3087", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3087", "title": "Amende RGPD 4 k€ · Comune di Mazara del Vallo (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 4,000 on the Comune di Mazara del Vallo. The controller used video surveillance technology to enforce traffic rules without a sufficient legal basis. Secondly, the controller used a camera system that had not been homologated or approved for this specific purpose. Beyond this, the controller failed to carry out a data protection impact assessment and to adequately inform data subjects regarding the processing.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 4 k€", "date_published": "2026-02-12T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3088", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3088", "title": "Amende RGPD 1 k€ · Sole Trader (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 1,000 on a sole trader. The controller used a video surveillance system, but did not indicate it with the necessary signage.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 1 k€", "date_published": "2026-02-12T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3089", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3089", "title": "Amende RGPD 30 k€ · Sportitalia Società Sportiva Dilettantistica a.r.l. (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 30,000 on Sportitalia Società Sportiva Dilettantistica a.r.l. The controller failed to adequately react to a data subject's request to exercise their rights after receiving direct marketing messages. The controller also failed to inform the data subject of the actions taken.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 30 k€", "date_published": "2026-02-12T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3090", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3090", "title": "Amende RGPD 15 k€ · Lex Iuris S.r.l. (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 15,000 on Lex Iuris S.r.l. The controller sent promotional emails to data subjects after mistakenly transferring those email addresses to a marketing list without their consent. Additionally, the controller failed to adequately respond to the data subjects' requests to exercise their rights.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 15 k€", "date_published": "2026-02-12T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3091", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3091", "title": "Amende RGPD 2 k€ · Sole Trader (Italie)", "content_text": "The Italian DPA has imposed a fine of EUR 2,000 on a sole trader. The controller, who operated a pizza restaurant, had installed a video surveillance system that had been authorised by the authorities. However, the controller operated the system in ways that were not included in the authorisation. The system was installed in such a way that the controller could view the footage remotely on his mobile phone, and the retention period exceeded the authorised 24 hours. Additionally, the controller failed to install appropriate information signs.", "summary": "Italian Data Protection Authority (Garante) · Italie · amende 2 k€", "date_published": "2026-02-12T00:00:00+00:00", "tags": [ "Italie", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3106", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3106", "title": "Amende RGPD 30 k€ · Vodafone – PANAFON A.E.E.T. (Grèce)", "content_text": "The Greek DPA has imposed a fine of EUR 30,000 on Vodafone – PANAFON A.E.E.T. The controller failed to handle a data subject's requests to exercise her rights. Specifically, a data subject requested access to call recordings relating to them, but the controller only partially fulfilled this request and did so neither properly nor in a timely manner. The controller also failed to preserve certain call recordings despite a request to do so, which further undermined the data subject’s ability to exercise their rights. Furthermore, the controller provided contradictory information about the procedure for accessing the recordings.", "summary": "Hellenic Data Protection Authority (HDPA) · Grèce · amende 30 k€", "date_published": "2026-02-11T00:00:00+00:00", "tags": [ "Grèce", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3064", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3064", "title": "Amende RGPD 5 k€ · Fundację Lumus (Pologne)", "content_text": "The Polish DPA has imposed a fine of EUR on Fundację Lumus. The controller suffered a personal data breach as a result of forwarding a document without prior redaction and failed to adequately notify the DPA. In addition, the controller appointed a member of its board as DPO, who later became its president, thereby giving rise to a conflict of interest. The controller also failed to notify the DPA of the designation of the DPO.", "summary": "Polish National Personal Data Protection Office (UODO) · Pologne · amende 5 k€", "date_published": "2026-02-10T00:00:00+00:00", "tags": [ "Pologne", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3056", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3056", "title": "Amende RGPD 2 k€ · Landlord (Espagne)", "content_text": "The Spanish DPA has imposed a fine of EUR 1,800 on a Landlord. The landlord used video surveillance in rental apartments without having a sufficient legal basis. The original fine of EUR 3,000 was reduced to EUR 1,800 due to immediate payment and admission of responsibility by the controller.", "summary": "Spanish Data Protection Authority (aepd) · Espagne · amende 2 k€", "date_published": "2026-02-06T00:00:00+00:00", "tags": [ "Espagne", "RGPD", "sanction" ] }, { "id": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3029", "url": "https://datacomplyone.com/ressources/sanctions-rgpd/dco-sanc-3029", "title": "Amende RGPD 20 k€ · Tensa Art Design S.A (Roumanie)", "content_text": "The Romanian DPA has imposed a fine of EUR 20,000 onTensa Art Design S.A.The DPA began investigating the controller's data processing activities, but the controller failed to respond to the DPA's requests.", "summary": "Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) · Roumanie · amende 20 k€", "date_published": "2026-02-05T00:00:00+00:00", "tags": [ "Roumanie", "RGPD", "sanction" ] } ] }