BULLETIN №082Last updated · 04 Aug 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -21.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 12 Dec 2024 | AGENCE DE COMMUNICATION ET DE PRODUCTION AUDIOVISUELLE (procédure simplifiée)The CNIL imposed an administrative fine of EUR 6,000 on AGENCE DE COMMUNICATION ET DE PRODUCTION AUDIOVISUELLE under a simplified procedure. The case concerns a confirmed breach of rules supervised by the CNIL. | FR | CNIL | GDPR | €6,000 | ↗ |
| 22 Dec 2025 | SOCIETE EXERCANT UNE ACTIVITE DE CONSEIL EN SYSTEMES ET LOGICIELS INFORMATIQUESCNIL imposed an administrative fine of 1,700,000 EUR on SOCIETE EXERCANT UNE ACTIVITE DE CONSEIL EN SYSTEMES ET LOGICIELS INFORMATIQUES. The decision concerns a breach of rules supervised by the French data protection authority. | FR | CNIL | GDPR | €1,700,000 | ↗ |
| 13 Nov 2025 | SOCIETE EXERCANT UNE ACTIVITE DE COMMERCE DE DETAIL CHAUSSURES (procédure simplifiée)The CNIL imposed an administrative fine of EUR 5,000 on SOCIETE EXERCANT UNE ACTIVITE DE COMMERCE DE DETAIL CHAUSSURES under a simplified procedure. The decision is dated 13 November 2025. | FR | CNIL | GDPR | €5,000 | ↗ |
| 27 Dec 2023 | ASSOCIATION PROMOUVANT DES ACTIONS AU SEIN D'UNE COMMUNE (procédure simplifiée)CNIL imposed a 5,000 EUR fine on ASSOCIATION PROMOUVANT DES ACTIONS AU SEIN D'UNE COMMUNE and issued an injunction. The case concerned a confirmed data protection breach handled under a simplified procedure. | FR | CNIL | GDPR | €5,000 | ↗ |
| 02 Oct 2025 | UNIVERSITE (procédure simplifiée)The CNIL imposed an administrative fine of EUR 15,000 on UNIVERSITE (procédure simplifiée). The case concerns a breach of rules supervised by the CNIL. | FR | CNIL | GDPR | €15,000 | ↗ |
| 17 Jul 2025 | AVOCAT (procédure simplifiée)The CNIL imposed an administrative fine of 3,000 EUR on AVOCAT and issued an injunction. The case was handled under a simplified procedure. | FR | CNIL | GDPR | €3,000 | ↗ |
| 22 Jul 2024 | COMMUNECNIL imposed EUR 6,900 on COMMUNE as an astreinte liquidation. The case concerns enforcement of a prior obligation subject to supervisory authority action. | FR | CNIL | GDPR | €6,900 | ↗ |
| 08 Sept 2022 | GROUPEMENT D'INTÉRÊT ÉCONOMIQUE DES GREFFES DE TRIBUNAUX DE COMMERCE DE FRANCECNIL imposed a fine of 250,000 EUR on GROUPEMENT D'INTÉRÊT ÉCONOMIQUE DES GREFFES DE TRIBUNAUX DE COMMERCE DE FRANCE. The record states that the sanction concerns a violation, but no further details are provided. | FR | CNIL | GDPR | €250,000 | ↗ |
| 16 Oct 2025 | SOCIETE EXERCANT UNE ACTIVITE DE VENTE A DISTANCE SUR CATALOGUE SPECIALISE (procédure simplifiée)The CNIL imposed an administrative fine of EUR 3,000 on SOCIETE EXERCANT UNE ACTIVITE DE VENTE A DISTANCE SUR CATALOGUE SPECIALISE. The case concerns a breach of rules supervised by the CNIL. | FR | CNIL | GDPR | €3,000 | ↗ |
| 03 Sept 2025 | SOCIETE AYANT POUR ACTIVITE LA PROMOTION IMMOBILIERE DE LOGEMENTS (procédure simplifiée)CNIL imposed an administrative fine of 20,000 EUR on SOCIETE AYANT POUR ACTIVITE LA PROMOTION IMMOBILIERE DE LOGEMENTS. The case was handled under a simplified procedure. | FR | CNIL | GDPR | €20,000 | ↗ |
| 02 Jan 2023 | Dulnevnd fyritøka (Dátueftirlitið)DATFO referred a company to the police for suspected breaches of data protection law. The company collected and stored personal data without a valid legal basis and without providing adequate information to the data subjects. Its website contact mechanism also caused data intended for a specific provider to be collected and retained by the company. | FO | DATFO | GDPR | €13,446 | ↗ |
| 05 Jul 2021 | Anonymisoitu (TSV 943)The controller unlawfully processed employees' location data, breaching the GDPR principles of data minimization and lawfulness. The case concerned processing that went beyond what was necessary for the stated purpose. | FI | TSV | GDPR | €25,000 | ↗ |
| 28 Oct 2025 | Aktia PankkiThe sanction panel of the Finnish Data Protection Ombudsman’s Office imposed an EUR 865,000 fine on Aktia Pankki for deficiencies in information security in its strong electronic identification service. The incident caused some users to see other customers’ data in services requiring strong authentication. | FI | Tietosuojavaltuutetun toimisto | GDPR | €865,000 | ↗ |
| 17 Dec 2024 | Sambla Group OySambla Group Oy was fined EUR 950,000 by TSV for failing to adequately protect loan applicants' data. The data was accessible to third parties through unique URLs, which breached GDPR requirements on data protection and security. | FI | TSV | GDPR | €950,000 | ↗ |
| 29 Apr 2022 | TelemarkkinointiyritysA telemarketing company was fined for failing to comply with a Data Protection Ombudsman's order to provide a data subject access to a call recording. The case concerned a breach of GDPR Article 15 on the right of access. | FI | TSV | GDPR | €8,300 | ↗ |
| 10 Sept 2025 | S-PankkiThe sanctions board of the Office of the Data Protection Ombudsman imposed a EUR 1.8 million fine on S-Pankki for failing to ensure information security in its online banking authentication service. The case concerned a software vulnerability in S-mobiili that allowed logins using another customer’s credentials and resulted in a personal data security breach. | FI | Office of the Data Protection Ombudsman | GDPR | €1,800,000 | ↗ |
| 01 Jan 2025 | Sambla GroupThe Finnish Data Protection Authority fined Sambla Group EUR 950,000 after unauthorized parties accessed credit application data by manipulating web addresses. The authority found that the company had not implemented adequate safeguards to prevent the breach. | FI | Tietosuojavaltuutetun toimisto | GDPR | €950,000 | ↗ |
| 23 Jul 2020 | Anonymisoitu (TSV 632)The controller failed to implement data subject rights under GDPR Articles 12, 15, 17, and 21. It also did not obtain valid consent for electronic direct marketing. A fine of EUR 7,000 was imposed. | FI | TSV | GDPR | €7,000 | ↗ |
| 04 Jun 2025 | Yliopiston ApteekkiThe Finnish Data Protection Ombudsman’s sanctions board imposed a EUR 1.1 million fine on Yliopiston Apteekki for data protection deficiencies. The decision states that cookies and other tracking technologies used in the online pharmacy disclosed prescription-related and other customer data to Google and Meta. | FI | Office of the Data Protection Ombudsman | GDPR | €1,100,000 | ↗ |
| 16 Dec 2021 | LiikennevakuutuskeskusThe entity was fined for collecting patient data excessively for insurance claim resolution. The authority found breaches of data minimization and fairness principles. | FI | TSV | GDPR | €52,000 | ↗ |