Search Privacy Fines

Articles: Art. 6 (1) GDPR, Art. 14 GDPR

Articles: Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 12 (2), (3), Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 18 GDPR, Art. 19 GDPR, Art. 20 GDPR, Art. 21 GDPR, Art. 22 GDPR

Articles: Art. 5 (1) GDPR

The data was processed inadequately, in inobservance with the data minimization and storage limitation principles of the GDPR. This means the data that was processed went beyond the relevant needs for the purpose of the processing, while also being kept in a form that permits the identification of data subjects longer than it is necessary for the purpose of the processing.

Articles: Art. 5 (1) GDPR

The data processing had breached the storage limitation and data minimization principles of the GDPR.

Articles: Art. 5 (1) c) GDPR, Art. 5 (1) e) GDPR

Articles: Art. 5 (1) c) GDPR, Art. 5 (1) e) GDPR

Articles: Art. 12 (1) GDPR

Articles: Unknown

UniCredit Bank opened a bank account for a person who has not requested any account to be opened. The bank allegedly had his personal data at their disposal because the affected person was responsible for closing a bank account operated by his employer. The bank was requested to prove that it had consent from the data subject to process his personal data but was unable to provide this proof.

Articles: Art. 6 GDPR

Articles: Art. 6 GDPR

Not available.

Articles: Art. 5 (1) a) GDPR, Art. 5 (1) b) GDPR, Art. 32 (1) GDPR

Articles: Art. 5 (1) a) GDPR, Art. 5 (1) b) GDPR, Art. 32 (1) GDPR

Articles: Art. 5 GDPR, Art. 6 GDPR

Articles: Art. 12 (2) GDPR, Art. 5 (1) GDPR

The company sold a card that was constantly tracked through GPS. The owner found this out and reported it since the company had no information related to this GPS tracking. The Czech Data Protection Authority decreed that this was a violation of Art. 5 (1) of the GDPR, and issued a fine.

Articles: Art. 5 (1) a) GDPR

The company did not process the data using the appropriate security measures required to prevent unlawful alteration or destruction of the data.

Articles: Art. 32 GDPR

Articles: Art. 32 GDPR

Articles: Art. 5 (1) a) GDPR

An online game operator was exposed to a DDoS attack that led to the malfunctioning of the game serves. The attackers blackmailed the operator into paying money for the attacks to stop. As part of the “deal”, the attackers offered the operator to create and implement a better firewall protection system that would prevent any future attacks from other parties. The operator agreed to this “deal”. The game operator then implemented the new code which indeed proved to be better than the old one used but – let’s be honest, unsurprisingly – also included a backdoor that allowed the attacker to steal all the data that was on the server which included player details and personal information. The attacker uploaded this information on their website after that.

Articles: Art. 32 GDPR

Articles: Art. 32 GDPR

Not available.

Articles: Art. 15 GDPR

Articles: Art. 15 GDPR

The company acquired a photocopy of a person’s ID card with the person’s consent but continued to use and process the personal data even after the affected person had withdrawn their consent.

Articles: Art. 6 GDPR, Art. 7 GDPR

Articles: Art. 6 GDPR, Art. 7 GDPR

Articles: Art. 32 GDPR