BULLETIN №084Last updated · 12 Aug 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.5m
- YoY volume
- -23.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 06 Feb 2025 | Omniasig Vienna Insurance Group S.A.A fine of 3,000 EUR was imposed for unauthorized access to personal data of a significant number of data subjects over a defined period. The case concerns a data security breach requiring appropriate access controls and protective measures. | RO | ANSPDCP | GDPR | €3,000 | ↗ |
| 07 Feb 2025 | ESTUDIO ALCAZAR DEL GENIL 2022, S.L.ESTUDIO ALCAZAR DEL GENIL 2022, S.L. was fined EUR 10,000 by the AEPD for collecting and storing personal data taken from mailboxes without consent or notice to the data subjects. The authority found breaches of the lawful basis and transparency requirements under GDPR Articles 6(1) and 14. | ES | AEPD | GDPR | €10,000 | ↗ |
| 10 Feb 2025 | PPC Energie Muntenia SAPPC Energie Muntenia SA was fined EUR 1,000 by ANSPDCP for violating GDPR provisions. The case concerned non-compliance with personal data protection requirements. | RO | ANSPDCP | GDPR | €1,000 | ↗ |
| 10 Feb 2025 | PPC Energie Muntenia SAThe operator was fined by ANSPDCP in the amount of EUR 2,000 for violating GDPR provisions. The case concerns non-compliance with personal data protection requirements. | RO | ANSPDCP | GDPR | €2,000 | ↗ |
| 11 Feb 2025 | Primary Health Care of the Capital AreaThe Icelandic Supervisory Authority imposed an administrative fine on Primary Health Care of the Capital Area for unlawful processing related to the integration of medical record systems. The decision was finalized on 11 February 2025, and the fine amounted to 5,000,000 ISK. | IS | Icelandic Data Protection Authority | GDPR | €34,100 | ↗ |
| 11 Feb 2025 | A követeléskezelő társaságNAIH imposed a HUF 10 million fine on a debt collection company for continuing to process personal data after a court declared the debt time-barred. The company ignored the data subject’s deletion request and kept the case active in its system. | HU | Nemzeti Adatvédelmi és Információszabadság Hatóság | GDPR | €24,800 | ↗ |
| 11 Feb 2025 | AD735 DATA MEDIA ADVERTISING, S.L.AD735 DATA MEDIA ADVERTISING, S.L. was fined by the AEPD 10,000 EUR for sending unsolicited email messages and failing to properly handle unsubscribe requests. The conduct breached Article 21 of the LSSI. | ES | AEPD | ePrivacy | €10,000 | ↗ |
| 13 Feb 2025 | Comune di TuscaniaThe Garante imposed a 4,000 EUR fine on Comune di Tuscania for violating data protection rules. The authority took into account the limited financial resources of the small municipality when setting the sanction. | IT | Garante | GDPR | €4,000 | ↗ |
| 13 Feb 2025 | Thomas FeroDr Thomas Fero was fined by the Garante EUR 10,000 for sending patients electoral campaign emails without their consent. The authority found this to be a breach of GDPR rules on personal data processing. | IT | Garante | GDPR | €10,000 | ↗ |
| 13 Feb 2025 | Claudio BattagliaDr. Claudio Battaglia, an oncologist, was fined for using patient data for electoral propaganda without consent. The case indicates a breach of GDPR principles on lawfulness and purpose limitation. | IT | Garante | GDPR | €10,000 | ↗ |
| 13 Feb 2025 | MDE – Movimento Diritti Europei s.r.l.s.MDE – Movimento Diritti Europei s.r.l.s. was fined 15,000 EUR by the Garante. The authority found that the company failed to provide shareholders with the information required under GDPR Article 14 and instead referred them to a website that did not contain sufficient details. | IT | Garante | GDPR | €15,000 | ↗ |
| 13 Feb 2025 | ADVFAST s.r.l.s.ADVFAST s.r.l.s. was fined by the Garante for failing to respond to information requests concerning repeated unsolicited telemarketing calls. The case indicates a failure to cooperate with the supervisory authority. | IT | Garante | GDPR | €2,000 | ↗ |
| 13 Feb 2025 | Azienda ULSS n. 02573090236The public health company was fined for making a disciplinary proceeding document visible to unauthorized employees. The authority found breaches of GDPR Articles 5 and 6 and Article 2-ter of the Italian Privacy Code. | IT | Garante | GDPR | €4,000 | ↗ |
| 13 Feb 2025 | D.e.c. soc. coop.The Garante imposed a EUR 20,000 fine on D.e.c. soc. coop. for failing to deactivate an ex-employee's email account after the employment ended. The authority found this conduct breached GDPR principles of fair and transparent processing of personal data. | IT | Garante | GDPR | €20,000 | ↗ |
| 17 Feb 2025 | CLUB DE GOLF VILLA DE CUÉLLARCLUB DE GOLF VILLA DE CUÉLLAR was fined by the AEPD EUR 400 for failing to inform an employee about the installation and operation of surveillance cameras. The authority found a breach of Article 13 GDPR. | ES | AEPD | GDPR | €400 | ↗ |
| 17 Feb 2025 | ARCONADA 1932, S.L.ARCONADA 1932, S.L. did not properly handle a data subject request for access to and deletion of personal data. This breached Articles 15 and 17 of the GDPR, and the company was fined for failing to comply with the AEPD's resolution. | ES | AEPD | GDPR | €1,500 | ↗ |
| 17 Feb 2025 | Heilsugæsla höfuðborgarsvæðisinsHeilsugæsla höfuðborgarsvæðisins was fined ISK 5,000,000 by Persónuvernd. The authority found that the organization unlawfully merged its medical records system with those of other entities, breaching GDPR requirements on lawful data processing. | IS | Persónuvernd | GDPR | €34,050 | ↗ |
| 17 Feb 2025 | Meedea Construct Prest SRLThe company was fined for violating the principles and lawfulness of personal data processing, specifically Articles 6 and 9 of the GDPR. A corrective measure was also imposed to ensure GDPR compliance in data collection and processing and to reduce the risk of unauthorized access and disclosure. | RO | ANSPDCP | GDPR | €2,000 | ↗ |
| 19 Feb 2025 | EDA TV CONSULTING, S.L.EDA TV CONSULTING, S.L. was fined by the AEPD EUR 2,000 for failing to comply with cookie policy requirements on its website. The breach concerned obligations under the LSSI. | ES | AEPD | ePrivacy | €2,000 | ↗ |
| 20 Feb 2025 | Medstar S.R.L.Medstar S.R.L. was fined by ANSPDCP for failing to notify the data breach to the supervisory authority. The company also did not inform the affected individuals about the unauthorized disclosure of their personal data. | RO | ANSPDCP | GDPR | €2,000 | ↗ |