BULLETIN №082Last updated · 02 Aug 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -21.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 28 Nov 2021 | INCOPROSOL, S.L.INCOPROSOL, S.L. was fined EUR 5,000 by the AEPD for recording a customer's phone conversation without informing them. The authority treated this as a breach of data protection principles. | ES | AEPD | GDPR | €5,000 | ↗ |
| 26 Nov 2021 | Valoris Center S.R.L.Valoris Center S.R.L. was fined by ANSPDCP EUR 2,000 for a personal data processing security breach. The incident was caused by a call center employee. | RO | ANSPDCP | GDPR | €2,000 | ↗ |
| 25 Nov 2021 | Azienda Ospedaliera di Rilievo Nazionale “Antonio Cardarelli"The hospital was fined by the Garante 50,000 EUR for unlawfully publishing on its website the personal data of participants in a competitive procedure, including health data. The authority found a breach of data protection principles. | IT | Garante | GDPR | €50,000 | ↗ |
| 25 Nov 2021 | Ordinanza ingiunzione - 25 novembre 2021 [9733002]A healthcare professional was fined by the Garante EUR 30,000 for unlawfully disclosing a patient's personal data, including unpaid medical bills and health information, to third parties. The authority found that the processing lacked a legal basis and breached the principles of lawfulness, fairness, and transparency. | IT | Garante | GDPR | €30,000 | ↗ |
| 25 Nov 2021 | Società H San Raffaele Resnati s.r.l.The Garante imposed a fine of EUR 6,000 on Società H San Raffaele Resnati s.r.l. for violations of data protection rules in the health sector. The case involved a data breach incident, which triggered supervisory action. | IT | Garante | GDPR | €6,000 | ↗ |
| 24 Nov 2021 | FRUTAS Y VERDURAS LOS CAMPEONES, S.L.The company was fined by the AEPD EUR 1,500 for installing surveillance cameras without the required informational signage. The case concerned Article 13 GDPR, which requires data subjects to be informed about the processing. | ES | AEPD | GDPR | €1,500 | ↗ |
| 23 Nov 2021 | atvinnuvega- og nýsköpunarráðuneytiðThe Icelandic DPA, Persónuvernd, fined atvinnuvega- og nýsköpunarráðuneytið for processing personal data in breach of core GDPR principles, including transparency and security. The case concerned the Ferðagjöf app, where the authority found deficiencies in data protection compliance. | IS | Persónuvernd | GDPR | €50,850 | ↗ |
| 22 Nov 2021 | SCF ZHU, S.L.SCF ZHU, S.L. was fined by the AEPD 1,000 EUR for failing to display visible information signs for its video surveillance system and for not maintaining a record of processing activities. The case reflects deficiencies in basic transparency and documentation obligations under data protection rules. | ES | AEPD | GDPR | €1,000 | ↗ |
| 22 Nov 2021 | B.B.B.The entity installed a surveillance camera in a shared stairway without the consent of the affected persons. The camera captured an excessive area, including private spaces, which breached data protection principles. | ES | AEPD | GDPR | €2,000 | ↗ |
| 22 Nov 2021 | COMUNIDAD DE PROPIETARIOS R.R.R.The entity was fined by the AEPD for operating a video surveillance system that recorded public transit areas without a justified basis. The authority found a breach of data protection principles. | ES | AEPD | GDPR | €3,000 | ↗ |
| 19 Nov 2021 | MEETING PUERTO C.B.MEETING PUERTO C.B. was fined by the AEPD EUR 2,000 for unlawful processing of personal data. The breach involved posting images and comments on social media without the consent of the data subjects, contrary to Article 6(1) of the GDPR. | ES | AEPD | GDPR | €2,000 | ↗ |
| 19 Nov 2021 | Working Capital Management España, S.L.Working Capital Management España, S.L. was fined by the AEPD 40,000 EUR for unlawfully processing personal data. The company included an individual's data in a credit information system without a valid contract, in connection with an identity theft case. | ES | AEPD | GDPR | €40,000 | ↗ |
| 13 Nov 2021 | IMPERIUM C.B.IMPERIUM C.B. was fined by the AEPD in the amount of 1,500 EUR for failing to provide informational signage about its video surveillance system. The authority found a breach of Article 13 GDPR because individuals on the premises were not given the required notice. | ES | AEPD | GDPR | €1,500 | ↗ |
| 12 Nov 2021 | EUSKALTEL, S.A.EUSKALTEL, S.A. was fined by the AEPD in the amount of 5,000 EUR for sending unsolicited commercial emails without the required consent. The conduct breached Article 21 of the LSSI, which governs electronic marketing communications. | ES | AEPD | ePrivacy | €5,000 | ↗ |
| 12 Nov 2021 | Transavia Airlines C.V.Transavia Airlines C.V. was fined by the AP 400,000 EUR for failing to implement appropriate security measures to protect personal data. The Article 32 GDPR breach led to unauthorized access to systems containing data of approximately 25 million individuals. | NL | AP | GDPR | €400,000 | ↗ |
| 11 Nov 2021 | Comune di Varano BorghiComune di Varano Borghi was fined EUR 1,000 by the Garante for unlawfully publishing personal data online. The authority found a breach of GDPR principles of data minimization and transparency. | IT | Garante | GDPR | €1,000 | ↗ |
| 11 Nov 2021 | COMUNIDAD DE PROPIETARIOS R.R.R.The community of property owners was fined by the AEPD EUR 2,000 for sharing residents’ personal data with a security company without proper authorization or a contract. The disclosure included names, addresses, and financial information. | ES | AEPD | GDPR | €2,000 | ↗ |
| 09 Nov 2021 | Cyrana España General S.L.Cyrana España General S.L. was fined by the AEPD in the amount of 5,000 EUR for processing personal data without consent. The conduct resulted in unauthorized charges to a customer's bank account. | ES | AEPD | GDPR | €5,000 | ↗ |
| 09 Nov 2021 | Anonymisé (CNPD decision-44-fr-2021)The company failed to meet the GDPR information obligations under Article 13 and the data minimization principle under Article 5(1)(c), particularly in connection with video surveillance. CNPD imposed a fine of 1,500 EUR. | LU | CNPD | GDPR | €1,500 | ↗ |
| 03 Nov 2021 | B.B.B.The entity processed personal data without consent by using the complainant's data to make a purchase on Amazon. The authority found a breach of GDPR Article 6. | ES | AEPD | GDPR | €2,000 | ↗ |