Order report
BULLETIN №082Last updated · 31 Jul 2026

Fine Tracker.

A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.

5,273 entries

Total fines
€8.6bn
Decisions
5,273
Jurisdictions
33
Regulators
74
Avg monthly
€162.7m
YoY volume
-21.4%
Country
Type
Date range
ImposedCompanyCountryAuthorityTypeAmount↗
01 Jan 2023CIUDAD RESIDENCIAL H.H.H.CIUDAD RESIDENCIAL H.H.H. was fined by the AEPD EUR 2,000 for breaching the data minimization principle. The case concerned capturing and storing photographs of residents collecting packages without informing them about this processing.ESAEPDGDPR€2,000↗
01 Jan 2023B.B.B.The entity was fined EUR 600 by the AEPD for improperly directing surveillance cameras toward a neighbor's property. This conduct breached data protection rules and affected the privacy of third parties.ESAEPDGDPR€600↗
01 Jan 2023OPEN BANK, S.A.Openbank was fined by the AEPD for opening a bank account without the individual's authorization. The account was later used for fraudulent activities, indicating failures in verification and data protection controls.ESAEPDGDPR€70,000↗
01 Jan 2023DEH NOTIFICACION ELECTRONICA HABILITADA S.L.DEH NOTIFICACION ELECTRONICA HABILITADA S.L. was fined by the AEPD €30,000 for sending unencrypted passwords for digital certificates. The authority considered this a potential data security risk. The procedure concerning Article 6(1) GDPR was archived due to no infringement.ESAEPDGDPR€30,000↗
01 Jan 2023VODAFONE ESPAÑA, S.A.U.Vodafone España was fined by the AEPD 200,000 EUR for making commercial calls to a complainant despite the numbers being on the Robinson list. The case indicates a breach of data protection rules governing direct marketing.ESAEPDGDPR€200,000↗
01 Jan 2023B.B.B.The entity was fined by the AEPD 300 EUR for operating a surveillance camera that captured public areas without proper signage. This conduct breached data protection requirements.ESAEPDGDPR€300↗
01 Jan 2023TELEFÓNICA MÓVILES ESPAÑA, S.A.TELEFÓNICA MÓVILES ESPAÑA, S.A. was fined by the AEPD 70,000 EUR for changing the ownership of a mobile line without proper verification. The failure enabled unauthorized access to the complainant’s bank data and fraudulent transactions.ESAEPDGDPR€70,000↗
01 Jan 2023B.B.B.The entity used a video from a training session containing the complainant’s personal statements without consent. The material was used for marketing purposes to attract new clients, which constituted a breach of data protection rules.ESAEPDGDPR€10,000↗
01 Jan 2023VACACIONES EDREAMS, S.L.VACACIONES EDREAMS, S.L. was fined by the AEPD in the amount of 10,000 EUR for failing to provide access to personal data upon a customer request. The authority found a breach of Article 15 of the GDPR.ESAEPDGDPR€10,000↗
01 Jan 2023Suministrador Ibérico de Energía, S.L.Suministrador Ibérico de Energía, S.L. was fined by the AEPD €70,000 for switching a customer's electricity provider without consent. The authority found that the processing lacked a valid legal basis under Article 6(1) GDPR.ESAEPDGDPR€70,000↗
01 Jan 2023UNIQUE HOTEL APARTMENT. S.LThe hotel improperly managed guest registration records, breaching data protection principles. It failed to maintain numerical order and did not communicate the records to the competent security forces.ESAEPDGDPR€2,000↗
01 Jan 2023INMARAN ASESORES S.L.INMARAN ASESORES S.L. was fined by the AEPD in the amount of 2,000 EUR for failing to comply with a data protection authority resolution. The company did not implement the required measures to inform data subjects under Article 13 GDPR.ESAEPDGDPR€2,000↗
01 Jan 2023KUGELCHEN PROPIERTIES, S.L.KUGELCHEN PROPIERTIES, S.L. was fined by the AEPD EUR 2,000 for processing personal data without consent. The company continued charging a customer despite requests to delete personal data and stop transactions.ESAEPDGDPR€2,000↗
01 Jan 2023D. ***NIF.1The entity operating https://www.dmerka.com was fined EUR 600 by the AEPD. The authority found that the controller was not identified and that required information on personal data processing was not provided, in breach of Article 13 GDPR.ESAEPDGDPR€600↗
01 Jan 2023ENERGÍA COLECTIVA, S.L.ENERGÍA COLECTIVA, S.L. was fined by the AEPD for inaccurately processing personal data. The issue led to incorrect billing and an intrusion into individuals’ privacy.ESAEPDGDPR€70,000↗
01 Jan 2023ORANGE ESPAGNE, S.A.U.ORANGE ESPAGNE, S.A.U. was fined EUR 200,000 by the AEPD for issuing a duplicate SIM card to a third party without the complainant's consent. The incident enabled unauthorized access to personal and banking data, indicating a serious data protection failure.ESAEPDGDPR€200,000↗
01 Jan 2023QUALITY-PROVIDER S.A.QUALITY-PROVIDER S.A. was fined 20,000 EUR by the AEPD for unlawfully obtaining personal data from a website. The data was then used for promotional purposes without the consent of the data subjects.ESAEPDGDPR€20,000↗
01 Jan 2023CLUB VOLEIBOL ***CLUB.1The club was fined by the AEPD in the amount of EUR 500 for publishing minors' images without proper consent. The authority also found that the club failed to provide access to personal data requested by a parent.ESAEPDGDPR€500↗
01 Jan 2023LOCAL VERTICALS, S.L.The company was fined by the AEPD in the amount of 10,000 EUR for failing to provide adequate information about personal data processing on its website. The authority found a breach of Article 13 of the GDPR.ESAEPDGDPR€10,000↗
01 Jan 2023VODAFONE ESPAÑA, S.A.U.The AEPD fined VODAFONE ESPAÑA, S.A.U. 100,000 EUR for allowing a third party to impersonate a customer. This led to a mobile line portability request and the purchase of a mobile device without the customer’s consent.ESAEPDGDPR€100,000↗