BULLETIN №083Last updated · 07 Aug 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.5m
- YoY volume
- -23.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 01 Jan 2019 | COMUNIDAD DE PROPIETARIOS R.R.R.The community of property owners was fined by the AEPD for publicly displaying personal data taken from meeting minutes in the building elevators. The authority found that this constituted a breach of data protection rules. | ES | AEPD | GDPR | €15,000 | ↗ |
| 01 Jan 2019 | VODAFONE ESPAÑA, S.A.U.The AEPD fined Vodafone España, S.A.U. 30,000 EUR for changing a customer's phone plan and purchasing a mobile device without consent. The case concerns a breach of data protection rules and the absence of a valid legal basis for processing the customer's data. | ES | AEPD | GDPR | €30,000 | ↗ |
| 01 Jan 2019 | Morele.netMorele.net received an administrative fine from the President of the Personal Data Protection Office (UODO) for a GDPR violation. The 2,830,410 PLN penalty followed a phishing attack that led to unauthorized access to customer data affecting about 2.2 million people. | PL | President of the Personal Data Protection Office (UODO) | GDPR | €658,000 | ↗ |
| 01 Jan 2019 | TODO POR EL 431, S.L.TODO POR EL 431, S.L. was fined by the AEPD €4,000 for using surveillance cameras oriented toward public spaces without justified cause. The authority found this to be a breach of data protection rules. | ES | AEPD | GDPR | €4,000 | ↗ |
| 01 Jan 2019 | XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined EUR 60,000 by the AEPD for processing personal data without a legal basis. The authority found a breach of Article 6 GDPR, meaning the processing lacked a lawful basis. | ES | AEPD | GDPR | €60,000 | ↗ |
| 01 Jan 2019 | D. B.B.B.The respondent was fined for publishing intimate photos and conversations of the complainant on WhatsApp without consent. The authority found a breach of data protection rules. | ES | AEPD | GDPR | €10,000 | ↗ |
| 01 Jan 2019 | Xfera Móviles, S.A.Xfera Móviles, S.A. was fined by the AEPD 70,000 EUR for the unauthorized disclosure of personal data caused by an error. The authority found a breach of the GDPR principle of integrity and confidentiality. | ES | AEPD | GDPR | €70,000 | ↗ |
| 01 Jan 2019 | LA ROCA NETWORKS, S.L.LA ROCA NETWORKS, S.L. was fined by the AEPD 2,500 EUR for sending unsolicited commercial emails without proper consent. The conduct breached Article 21 of the LSSI, which governs electronic marketing communications. | ES | AEPD | ePrivacy | €2,500 | ↗ |
| 01 Jan 2019 | XFERA MÓVILES S.A.XFERA MÓVILES S.A. was fined 60,000 EUR by the AEPD for processing personal data without consent. As a result, unauthorized contracts were sent to a customer, indicating improper use of personal data. | ES | AEPD | GDPR | €60,000 | ↗ |
| 01 Jan 2019 | TWITTER INTERNATIONAL COMPANY (TWITTER SPAIN, S.L.)Twitter International Company (Twitter Spain, S.L.) was fined EUR 30,000 by the AEPD. The authority found inadequate cookie information and the use of cookies without obtaining user consent, in breach of the LSSI. | ES | AEPD | ePrivacy | €30,000 | ↗ |
| 01 Jan 2019 | QUESERIA ARTESANAL AMECO S.L.QUESERIA ARTESANAL AMECO S.L. was fined by the AEPD 5,000 EUR for processing personal data without consent. Customers were unaware of how their data had been obtained, indicating a breach of transparency and lawful processing requirements. | ES | AEPD | GDPR | €5,000 | ↗ |
| 01 Jan 2019 | AMADOR RECREATIVOS, S.L.AMADOR RECREATIVOS, S.L. was fined by the AEPD 6,000 EUR for installing a video surveillance system aimed at public space without justified cause. The case concerned an unjustified scope of monitoring and a breach of data protection rules. | ES | AEPD | GDPR | €6,000 | ↗ |
| 01 Jan 2019 | CAFE BAR NINA (Nina Cb)CAFE BAR NINA was fined €2,000 by the AEPD for installing an unauthorized surveillance camera. The conduct breached data protection requirements. | ES | AEPD | GDPR | €2,000 | ↗ |
| 01 Jan 2019 | KNLTBThe Dutch tennis association KNLTB was fined by the Autoriteit Persoonsgegevens for violating the GDPR/AVG. The original fine was 525,000 EUR and was later reduced to 250,000 EUR because KNLTB shared members’ personal data with two sponsors without a valid legal basis. | NL | Autoriteit Persoonsgegevens | GDPR | €525,000 | ↗ |
| 01 Jan 2019 | EDP ENERGÍA, S.A.U.EDP ENERGÍA, S.A.U. was fined by the AEPD EUR 75,000 for processing personal data without consent. The case concerned an energy contract to which the complainant was not a party, constituting a breach of Article 6(1) GDPR. | ES | AEPD | GDPR | €75,000 | ↗ |
| 01 Jan 2019 | TELEFONICA MOVILES ESPAÑA, S.A.U.TELEFONICA MOVILES ESPAÑA, S.A.U. was fined 50,000 EUR by the AEPD. The authority found that the company used personal data to fraudulently contract phone lines without the data subjects’ consent. | ES | AEPD | GDPR | €50,000 | ↗ |
| 01 Jan 2019 | GESTIÓN DE COBROS, YO COBRO SLThe company was fined EUR 60,000 by the AEPD for unlawfully processing personal data. The breach involved sending debt collection emails to an institutional email address without consent, in violation of data protection rules. | ES | AEPD | GDPR | €60,000 | ↗ |
| 01 Jan 2019 | Don B.B.B.Don B.B.B. was fined by the AEPD in the amount of 1,000 EUR for sending an unsolicited commercial email. The conduct breached Article 21 of the LSSI, which governs marketing communications without prior consent. | ES | AEPD | ePrivacy | €1,000 | ↗ |
| 01 Jan 2019 | Vodafone España, S.A.U.Vodafone España, S.A.U. was fined EUR 75,000 by the AEPD for a data protection breach. The case involved unauthorized contract portability using a customer's personal data without consent. | ES | AEPD | GDPR | €75,000 | ↗ |
| 01 Jan 2019 | VODAFONE ESPAÑA, S.A.U.The AEPD imposed a fine of EUR 55,000 on Vodafone España, S.A.U. for breaching data protection principles. The case involved sending a customer's personal data to a third party without adequate security measures. | ES | AEPD | GDPR | €55,000 | ↗ |