Search Privacy Fines

Failed to verify consent before processing data for personalized advertising.

Articles: Art. 7, Art. 15, Art. 17, Art. 26

Articles: Art. 5 GDPR, Art. 6 GDPR

Built illegal facial recognition database with Dutch citizens photos.

Articles: Art. 5, Art. 6, Art. 9, Art. 14, Art. 27

Alexa retained children voice recordings indefinitely ($25M). Ring employees accessed customer video feeds ($5.8M).

A huge fine of €27,8 million was issued to the Italian telecom company TIM. The Italian Data Protection Authority (Garante) revealed that TIM was fined due to numerous unlawful data processing activities related to marketing and advertising, which included unsolicited promotional calls and prize competitions in which data subjects were entered without consent.One of the reasons for the large fine was the fact that the unlawful data processing activities involved several million individuals. One individual, for example, was called a total of 155 times in a month while TIM refused to add the affected individual on a no-call list even after several requests. The DPA determined that the company lacked control over the call centers and did not have adequate measures to add people to no-call lists.TIM also did not provide accurate and detailed enough privacy policies and data processing policies, and as such consumers were not efficiently informed about the data collected and processed. The company’s management of data breaches was also not efficient according to Garante.Besides the fine, Garante also imposed 20 corrective measures according to Art. 58(2) GDPR which prohibits TIM from processing marketing-related data of those individuals who have refused to receive promotional calls, individuals who asked to be blacklisted and individuals who are not clients of TIM.The company was also forbidden from using customer data collected from the “My Tim”, “Tim Personal” and “Tim Smart Kid” apps.

Articles: Art. 58(2) GDPR

Articles: Art. 58(2) GDPR

Articles: Art. 5 (1) a), d) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 21 GDPR, Art. 24 GDPR, Art. 25 (1) GDPR, Art. 30 GDPR, Art. 31 GDPR, Art. 130 (1), (2), (4) Codice della privacy

Articles: Art. 5 (1) f) GDPR, Art. 32 GDPR

Articles: Art. 32 GDPR

Articles: Art. 5 (1) a), b), e) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 27 GDPR

Articles: Art. 6 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 31 GDPR

Unlawful processing of biometric data through facial recognition without consent.

Articles: Art. 5, Art. 6, Art. 9

Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 27 GDPR

Facial recognition company unlawfully processed biometric data of people in Italy.

Articles: Art. 5, Art. 6, Art. 9, Art. 14, Art. 27

Collected personal information from children creating Xbox accounts without notifying parents or obtaining consent.

Genshin Impact developer settled FTC charges of collecting data from children without consent.

The Austrian Post had sold detailed personal profiles of approximately three million Austrians to various companies and political parties. The profiles contained names, addresses, political predilections, and even intimate details.

Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR

Articles: Art. 5 (2) GDPR, Art. 24 (1) GDPR

Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR. Art. 24 GDPR, Art. 25 GDPR

Antivirus company sold browsing data through subsidiary Jumpshot despite privacy promises.

The company collected data from multiple tenants without providing the option to remove that data once it was no longer required. This led to the company retaining personal data of tenants for years (salary statements, social security insurances, health insurances, tax insurances, bank statements). The Berlin Data Commissioner issued a fine of €14,500,000.

Articles: Art. 5 GDPR, Art. 25 GDPR

Articles: Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 13 GDPR

Articles: Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 7 GDPR, Art. 15 (1) GDPR, Art. 16 GDPR, Art. 21 GDPR, Art. 24 GDPR, Art. 25 (1) GDPR, Art. 32 GDPR, Art. 33 GDPR

Articles: Art. 5 GDPR, Art. 6 GDPR

Cookie consent mechanism did not allow users to refuse cookies as easily as accepting them.

Articles: Art. 82