BULLETIN №083Last updated · 06 Aug 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -22.8%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 26 Nov 2019 | EDP COMERCIALIZADORA, S.A.U.EDP COMERCIALIZADORA, S.A.U. was fined by the AEPD 75,000 EUR for processing personal data without consent. The case involved data linked to a gas contract unrelated to the complainant, which breached Article 6(1) of the GDPR. | ES | AEPD | GDPR | €75,000 | ↗ |
| 25 Nov 2019 | YA candidate in municipal elections was fined for using a customer list to send election propaganda. The authority found a breach of the GDPR purpose limitation principle. | BE | APD | GDPR | €2,000 | ↗ |
| 22 Nov 2019 | MEGASTAR, S.L.MEGASTAR, S.L. was fined by the AEPD EUR 2,000 for surveillance cameras that were improperly oriented and captured disproportionate images. The authority also found that the required informational signage was missing, constituting a breach of Article 5(1)(c) GDPR. | ES | AEPD | GDPR | €2,000 | ↗ |
| 22 Nov 2019 | CENTRAL SINDICAL INDEPENDIENTE Y DE FUNCIONARIOS CSI-CSIFThe union CSI-CSIF was fined EUR 3,000 by the AEPD for publishing an electoral census list containing personal data, including DNI numbers, in a public WhatsApp group. The authority found this breached data protection principles. | ES | AEPD | GDPR | €3,000 | ↗ |
| 18 Nov 2019 | EUSKALTEL, S.A.EUSKALTEL, S.A. was fined by the AEPD 50,000 EUR for a data protection incident. Due to incorrect handling of customer information, personal data was sent to the wrong individuals. | ES | AEPD | GDPR | €50,000 | ↗ |
| 15 Nov 2019 | Raiffeisen Bank Zrt.Raiffeisen Bank Zrt. was fined by the NAIH 25,000,000 HUF for processing personal data of non-advisory service clients without a legal basis. The authority also found that the bank failed to provide adequate information about the processing of personal data collected through MiFID questionnaires. | HU | NAIH | GDPR | €74,750 | ↗ |
| 15 Nov 2019 | HM HOSPITALES 1989, S.A.HM HOSPITALES 1989, S.A. was fined by the AEPD 60,000 EUR for sending a patient's medical report to an insurance company without proper consent. The case concerns a breach of data protection rules and the special protection applicable to health data. | ES | AEPD | GDPR | €60,000 | ↗ |
| 14 Nov 2019 | ASL n. 2 SavoneseASL n. 2 Savonese was fined EUR 8,000 by the Garante for breaches of data protection principles. The authority found improper processing of personal data, including failures to comply with lawfulness, fairness, transparency, and data minimization. | IT | Garante | GDPR | €8,000 | ↗ |
| 12 Nov 2019 | CONFEDERACION GENERAL DEL TRABAJOCONFEDERACION GENERAL DEL TRABAJO was fined by the AEPD €5,000 for disclosing the complainant’s personal data without consent. The disclosure included details of a verbal abuse and harassment case, family relations, pregnancy status, and home address, shared with about 400 union members. | ES | AEPD | GDPR | €5,000 | ↗ |
| 11 Nov 2019 | Törléshez való jog megsértése, jogalap nélküli adatkezelés, célhoz kötöttség, adattakarékosság és átláthatóság elvének megsértéseThe supervisory authority found that the controller did not comply with requests to erase personal data and unlawfully processed phone numbers. It also identified breaches of purpose limitation, data minimization, and transparency principles. | HU | NAIH | GDPR | €4,485 | ↗ |
| 07 Nov 2019 | Comune di TivoliThe Municipality of Tivoli was fined by the Italian data protection authority, Garante, for unlawfully publishing personal data on its institutional website. The publication also included information about a pending criminal proceeding, breaching the principles of lawfulness, fairness, and transparency. | IT | Garante | GDPR | €6,000 | ↗ |
| 06 Nov 2019 | TODOTECNICOS24H S.L.TODOTECNICOS24H S.L. was fined by the AEPD EUR 1,500 for collecting personal data without providing the required information to the data subjects. The authority treated this as a breach of data protection rules. | ES | AEPD | GDPR | €1,500 | ↗ |
| 05 Nov 2019 | CERRAJERO ONLINE S.L.CERRAJERO ONLINE S.L. was fined EUR 1,500 by the AEPD for collecting personal data without providing the required information to data subjects. The authority treated this as a breach of data protection rules. | ES | AEPD | GDPR | €1,500 | ↗ |
| 04 Nov 2019 | Coöperatie Menzis U.A.The Dutch Data Protection Authority, AP, imposed a fine of EUR 150,000 on Coöperatie Menzis U.A. The authority found that the company had inadequate technical measures to prevent unauthorized access to personal health data. | NL | AP | GDPR | €150,000 | ↗ |
| 04 Nov 2019 | Coöperatie VGZ U.A.The Autoriteit Persoonsgegevens imposed a EUR 150,000 penalty on Coöperatie VGZ U.A. for failing to implement appropriate technical measures to protect personal data from unauthorized access. The authority found a breach of data protection law. | NL | AP | GDPR | €150,000 | ↗ |
| 04 Nov 2019 | Coöperatie Menzis U.A.Menzis was fined by the AP for failing to implement appropriate technical measures to protect personal data. The authority found a breach of Article 32 GDPR. | NL | AP | GDPR | €50,000 | ↗ |
| 31 Oct 2019 | Partito Democratico, Coordinamento Metropolitano di FirenzePartito Democratico, Coordinamento Metropolitano di Firenze was fined by the Garante €4,000 for a data protection breach. The incident resulted from a cyber attack on its website that exposed personal data of party members. | IT | Garante | GDPR | €4,000 | ↗ |
| 29 Oct 2019 | JOKER PREMIUM INVEX, S.L.JOKER PREMIUM INVEX, S.L. was fined by the AEPD EUR 10,000 for sending unsolicited commercial communications. The company used personal data taken from public sources without the individuals’ consent. | ES | AEPD | GDPR | €10,000 | ↗ |
| 24 Oct 2019 | Magyar Honvédség Egészségügyi KözpontMagyar Honvédség Egészségügyi Központ was fined by NAIH for failing to report a data breach involving a patient's application form within 72 hours. The authority also found that the organization lacked an internal incident management policy. | HU | NAIH | GDPR | €7,600 | ↗ |
| 24 Oct 2019 | Magyar Honvédség Egészségügyi KözpontThe Hungarian Defence Forces Health Centre did not report a data breach within 72 hours and lacked internal incident management procedures. NAIH found this to be a breach of GDPR obligations and imposed a fine of 2,500,000 HUF. | HU | NAIH | GDPR | €7,600 | ↗ |