Search Privacy Fines

Articles: Art. 5 (1) a)

Lack of transparency about data sharing with Facebook.

Articles: Art. 5(1)(a), Art. 12, Art. 13, Art. 14

YouTube illegally collected personal information from children without parental consent, targeting ads to viewers of child-directed channels.

Placing cookies without consent and non-functional opt-outs.

Articles: Art. 5, Art. 6

Placing cookies without consent and non-functional opt-outs.

Articles: Art. 5, Art. 6

Cookie consent failures at account creation.

Articles: Art. 5, Art. 6

Cookie consent failures at account creation.

Articles: Art. 5, Art. 6

Articles: Art. 82 loi Informatique et Libertes

Articles: Art. 82 loi Informatique et Libertes

Articles: Art. 82 loi Informatique et Libertes

Articles: Art. 13 GDPR, Art. 14 GDPR, Art. 6 GDPR, Art. 4 GDPR, Art. 5 GDPR

The French NGO “La Quadrature du Net” and the Austrian organization “None Of Your Business” complained about the creation of a Google account related to the configuration of the Android system in a mobile phone. A fine of 50 million euros was issued because the following principles were not observed: the principle of transparency (Art. 5 GDPR), the sufficiency of information (Art.13 / 14 GDPR), and the presence of legal basis (Art. 6 GDPR).

Articles: Art. 13 GDPR, Art. 14 GDPR, Art. 6 GDPR, Art. 4 GDPR, Art. 5 GDPR

Vendor security failures and inadequate data controls.

Articles: Art. 32

Vendor security failures and inadequate data controls.

Articles: Art. 32

Failed to verify consent before processing data for personalized advertising.

Articles: Art. 7, Art. 15, Art. 17, Art. 26

Ad-tech company failed to verify consent before processing data for personalized advertising.

Articles: Art. 7, Art. 15, Art. 17, Art. 26

Articles: Art. 5 GDPR, Art. 6 GDPR

Built illegal facial recognition database with Dutch citizens photos.

Articles: Art. 5, Art. 6, Art. 9, Art. 14, Art. 27

Alexa retained children voice recordings indefinitely ($25M). Ring employees accessed customer video feeds ($5.8M).

A huge fine of €27,8 million was issued to the Italian telecom company TIM. The Italian Data Protection Authority (Garante) revealed that TIM was fined due to numerous unlawful data processing activities related to marketing and advertising, which included unsolicited promotional calls and prize competitions in which data subjects were entered without consent.One of the reasons for the large fine was the fact that the unlawful data processing activities involved several million individuals. One individual, for example, was called a total of 155 times in a month while TIM refused to add the affected individual on a no-call list even after several requests. The DPA determined that the company lacked control over the call centers and did not have adequate measures to add people to no-call lists.TIM also did not provide accurate and detailed enough privacy policies and data processing policies, and as such consumers were not efficiently informed about the data collected and processed. The company’s management of data breaches was also not efficient according to Garante.Besides the fine, Garante also imposed 20 corrective measures according to Art. 58(2) GDPR which prohibits TIM from processing marketing-related data of those individuals who have refused to receive promotional calls, individuals who asked to be blacklisted and individuals who are not clients of TIM.The company was also forbidden from using customer data collected from the “My Tim”, “Tim Personal” and “Tim Smart Kid” apps.

Articles: Art. 58(2) GDPR

Articles: Art. 58(2) GDPR

Articles: Art. 5 (1) a), d) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 21 GDPR, Art. 24 GDPR, Art. 25 (1) GDPR, Art. 30 GDPR, Art. 31 GDPR, Art. 130 (1), (2), (4) Codice della privacy

Articles: Art. 5 (1) f) GDPR, Art. 32 GDPR

Articles: Art. 32 GDPR