BULLETIN №082Last updated · 03 Aug 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -21.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 25 Jul 2013 | Anonymised (HDPA 90/2013)The HDPA imposed a EUR 500 fine on the anonymised entity for sending unsolicited marketing emails. The conduct breached the requirement to obtain subscriber consent before sending such communications. | GR | HDPA | ePrivacy | €500 | ↗ |
| 16 Jun 2010 | Anonymised (HDPA 29/2010)The company was fined EUR 3,000 by the HDPA for sending unsolicited marketing emails and faxes without subscriber consent. This conduct breached ePrivacy rules on electronic marketing communications. | GR | HDPA | ePrivacy | €3,000 | ↗ |
| 31 Oct 2022 | B OEThe company was fined for violations related to the operation of a video surveillance system. The authority found non-compliance with data processing principles and insufficient data minimization. | GR | HDPA | GDPR | €10,000 | ↗ |
| 30 Mar 2023 | Vodafone-PanafonVodafone-Panafon was fined by the HDPA for processing personal data for direct marketing without proper consent and transparency. The authority found breaches of lawfulness, fairness, and purpose limitation. | GR | HDPA | GDPR | €10,000 | ↗ |
| 27 Dec 2012 | Euro-Catering O.E.The company installed a CCTV system without notifying the supervisory authority, failed to display required informational signs, and collected excessive data. These actions breached privacy protection rules. | GR | HDPA | GDPR | €20,000 | ↗ |
| 25 Jun 2025 | Vodafone-PanafonVodafone-Panafon was fined by the HDPA for failing to notify a data breach in a timely manner. The authority cited a violation of Article 12 of Law L.3471/2006. | GR | HDPA | ePrivacy | €100,000 | ↗ |
| 04 Apr 2022 | Piraeus Bank S.A.Piraeus Bank S.A. was fined by the HDPA 10,000 EUR for breaching the principle of data confidentiality. The bank sent debit card transaction notifications to incorrect email addresses, failed to notify the authority of the breach, and did not take timely corrective action. | GR | HDPA | GDPR | €10,000 | ↗ |
| 16 Jun 2015 | Eurobank Ergasias AEA fine was imposed for failing to maintain appropriate organizational and technical security measures. This led to unauthorized employee access to the complainant's personal data. | GR | HDPA | GDPR | €5,000 | ↗ |
| 08 Aug 2014 | RANNER ETAIREIA SYLLOGIS KAI DIACHEIRISIS PLIROFORION E.P.E.RANNER ETAIREIA SYLLOGIS KAI DIACHEIRISIS PLIROFORION E.P.E. was fined by the HDPA in the amount of EUR 3,000. The authority found processing of personal data without consent and the sending of unsolicited electronic messages for marketing purposes. | GR | HDPA | GDPR | €3,000 | ↗ |
| 01 Jan 2025 | Εθνική Τράπεζα της Ελλάδος Α.Ε.The data protection authority imposed a EUR 220,000 fine on Εθνική Τράπεζα της Ελλάδος Α.Ε. for a GDPR violation. The case concerned deficiencies in personal data protection and compliance with GDPR requirements. | GR | Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα | GDPR | €220,000 | ↗ |
| 23 Nov 2023 | Alpha BankAlpha Bank was fined for failing to satisfy the complainant’s request for access to personal data. The authority found breaches of GDPR Articles 15 and 5. | GR | HDPA | GDPR | €10,000 | ↗ |
| 04 Apr 2022 | Anonymised (HDPA 15/2022)The former mayor disclosed a municipal employee’s personal data without consent or a lawful basis. The authority found this to be a breach of GDPR principles of lawfulness and purpose limitation. | GR | HDPA | GDPR | €5,000 | ↗ |
| 05 Jan 2022 | Egnatia Odos S.A.Egnatia Odos S.A. was fined by the HDPA EUR 1,000 for failing to provide the complainant with access to personal data related to a toll violation. The authority found a breach of the right of access under the GDPR. | GR | HDPA | GDPR | €1,000 | ↗ |
| 13 May 2015 | HellastatHellastat was fined by the HDPA EUR 5,000 for the illegal collection and use of data. The case concerned a breach of data protection laws. | GR | HDPA | GDPR | €5,000 | ↗ |
| 10 Jun 2021 | MARIA & DESPOINA KOUSATHANA O.E.The company was fined by the HDPA 5,000 EUR for operating a video surveillance system without proper notification and for unlawful camera use in kitchen areas. The authority also found that data subjects were not informed about the processing of their personal data. | GR | HDPA | GDPR | €5,000 | ↗ |
| 12 Jun 2023 | Piraeus Bank S.A.Piraeus Bank S.A. was fined by the HDPA in the amount of 100,000 EUR for failing to implement appropriate technical and organizational measures. The authority found that the bank did not ensure data protection by design and by default. | GR | HDPA | GDPR | €100,000 | ↗ |
| 08 Aug 2014 | INFOASSIST A.E.INFOASSIST A.E. was fined by the HDPA 7,500 EUR for processing personal data without consent. The authority found breaches of legality and data minimization principles. | GR | HDPA | GDPR | €7,500 | ↗ |
| 22 May 2012 | Municipal Water and Sewerage Company of RhodesThe Municipal Water and Sewerage Company of Rhodes was fined 5,000 EUR by the HDPA. The authority found that the company failed to satisfy the complainant’s data access rights and did not respond within the mandatory 15-day period. | GR | HDPA | GDPR | €5,000 | ↗ |
| 08 Aug 2014 | Hummingbird EPEHummingbird EPE was fined by the HDPA for processing publicly available personal data without the consent of the data subjects. The authority found a breach of the principles of data relevance and proportionality. | GR | HDPA | GDPR | €7,500 | ↗ |
| 27 Sept 2022 | Anonymised (HDPA 18/2022)A fine was imposed for sending unsolicited political communication via SMS without prior consent. The case concerns a breach of consent requirements for political and marketing communications. | GR | HDPA | ePrivacy | €2,000 | ↗ |