Search Privacy Fines

Articles: Art. 5 (1) a), b), e) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 27 GDPR

Unlawful processing of biometric data through facial recognition without consent.

Articles: Art. 5, Art. 6, Art. 9

Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 27 GDPR

Facial recognition company unlawfully processed biometric data of people in Italy.

Articles: Art. 5, Art. 6, Art. 9, Art. 14, Art. 27

Articles: Art. 6 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 31 GDPR

Collected personal information from children creating Xbox accounts without notifying parents or obtaining consent.

Genshin Impact developer settled FTC charges of collecting data from children without consent.

The Austrian Post had sold detailed personal profiles of approximately three million Austrians to various companies and political parties. The profiles contained names, addresses, political predilections, and even intimate details.

Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR

Articles: Art. 5 (2) GDPR, Art. 24 (1) GDPR

Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR. Art. 24 GDPR, Art. 25 GDPR

Antivirus company sold browsing data through subsidiary Jumpshot despite privacy promises.

The company collected data from multiple tenants without providing the option to remove that data once it was no longer required. This led to the company retaining personal data of tenants for years (salary statements, social security insurances, health insurances, tax insurances, bank statements). The Berlin Data Commissioner issued a fine of €14,500,000.

Articles: Art. 5 GDPR, Art. 25 GDPR

Articles: Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 13 GDPR

Articles: Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 7 GDPR, Art. 15 (1) GDPR, Art. 16 GDPR, Art. 21 GDPR, Art. 24 GDPR, Art. 25 (1) GDPR, Art. 32 GDPR, Art. 33 GDPR

Articles: Art. 5 GDPR, Art. 6 GDPR

Cookie consent mechanism did not allow users to refuse cookies as easily as accepting them.

Articles: Art. 82

Articles: Art. 6 GDPR, Art. 17 GDPR

Articles: <a href="https://www.privacy-regulation.eu/en/32.htm">Art. 32 GDPR</a>

The telecom company 1&#038;1 Telecom GmbH was fined with €9,550,000 after it came to light that sensitive customer information could be obtained by phone by anyone by just telling a client&#8217;s name and date of birth. This could have permitted anyone to obtain the personal information of any customer in case they knew their name and date of birth. The BfDI considered that the company failed to implement the necessary technical measures to ensure the protection of personal data. The BfDI further revealed that the fine was intended to be much larger but was eventually decreased due to the cooperation of the company during the investigation.

Articles: Art. 32 GDPR

Articles: Art. 32 GDPR

Articles: Art. 5 (1) a), e) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 22 GDPR, Art. 35 GDPR

Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPR

The Italian Data Protection Authority (Garante) imposed two fines of €11,5 million total on Eni Gas and Luce because of the unlawful processing of personal data during an advertising campaign as well as for the activation of unsolicited contracts. This first fine of €8,5 million was issued for the unlawful processing of personal data in the context of a marketing campaign. The company made promotional calls without the consent of the contacted people and refused to acknowledge people&#8217;s wishes to be added onto a &#8220;do not contact&#8221; list. The company also did not provide an opt-out procedure for these unsolicited calls. The DPA also determined that the company lacked sufficient technical and organizational measures to protect users&#8217; personal data. Data was also processed longer than the allowed retention period. According to the DPA, some data was also collected from third party entities that did not have consent from the data subjects to disclose that data.

Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPR

Articles: Art. 5 (1) c) GDPR, others