BULLETIN №082Last updated · 29 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -21%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 11 Feb 2021 | Stichting OLVGStichting OLVG was fined by the AP 440,000 EUR for failing to implement two-factor authentication and for not regularly reviewing log files. The authority found that the organization did not maintain appropriate security measures required under Article 32 GDPR. | NL | AP | GDPR | €440,000 | ↗ |
| 17 Dec 2025 | Stichting Hogeschool van Arnhem en NijmegenThe Autoriteit Persoonsgegevens imposed a fine of €175,000 on Stichting Hogeschool van Arnhem en Nijmegen for failing to implement adequate technical and organizational measures appropriate to the risk. These deficiencies resulted in a data breach. | NL | AP | GDPR | €175,000 | ↗ |
| 16 Jul 2019 | Stichting HagaZiekenhuisStichting HagaZiekenhuis was fined by the AP for failing to implement two-factor authentication and for not regularly reviewing log files. The authority found these shortcomings breached Article 32 GDPR on appropriate security measures. | NL | AP | GDPR | €460,000 | ↗ |
| 09 Mar 2023 | Stefano MolenaThe Garante imposed a EUR 3,000 fine on Stefano Molena for operating a surveillance camera without the required informational signage. The breach concerned privacy rules and the duty to properly inform individuals subject to monitoring. | IT | Garante | GDPR | €3,000 | ↗ |
| 21 Feb 2013 | Stefano Giovanni MaulluStefano Giovanni Maullu was fined by the Garante in the amount of 16,000 EUR for sending unsolicited political SMS messages. The authority also found that the required data protection information was not provided. | IT | Garante | GDPR | €16,000 | ↗ |
| 05 Sept 2013 | Stefano EvangelistaStefano Evangelista was fined by the Garante 2,400 EUR for failing to provide the required privacy notice for a video surveillance system at his business, Pizzeria del Borgo. The case concerned a breach of Article 13 of the Italian Privacy Code. | IT | Garante | GDPR | €2,400 | ↗ |
| 10 Apr 2025 | Stefanelli FedericaThe Garante imposed a 45,000 EUR fine on Stefanelli Federica for processing personal data without proper consent in unauthorized call-center operations. The case also involved sensitive data, including payment method information, which could have led to unauthorized contract activations. | IT | Garante | GDPR | €45,000 | ↗ |
| 16 Nov 2017 | S.T.E.A.T. S.p.a.S.T.E.A.T. S.p.a. was fined by the Garante for failing to properly notify the installation of electronic monitoring and localization devices on public transport buses. The authority found a breach of data protection notification obligations. | IT | Garante | GDPR | €20,000 | ↗ |
| 21 Jul 2022 | Stay Over s.r.l.Stay Over s.r.l. was fined by the Garante EUR 10,000 for a delayed and inadequate response to a data access request. The authority also found unlawful processing of a former employee's email account after employment ended. | IT | Garante | GDPR | €10,000 | ↗ |
| 12 Oct 2023 | S.T.A. Società Trattamento Acque s.r.l.S.T.A. Società Trattamento Acque s.r.l. was fined €75,000 by the Garante. The authority found a breach of Article 15 GDPR after the company failed to respond to an employee's request for access to professional training records. | IT | Garante | GDPR | €75,000 | ↗ |
| 04 May 2017 | Starweb s.r.l.Starweb s.r.l. was fined €16,000 by the Garante for making unsolicited promotional calls. The authority found that the company failed to provide the required information notice and did not obtain consent from the contacted individuals. | IT | Garante | GDPR | €16,000 | ↗ |
| 12 Dec 2024 | Start To Fly S.r.l.Start To Fly S.r.l. was fined by the Garante 10,000 EUR for sending unsolicited emails and SMS messages to a complainant. The complainant was unable to unsubscribe from the mailing list despite multiple attempts. | IT | Garante | GDPR | €10,000 | ↗ |
| 05 Oct 2017 | Start S.p.A.Start S.p.A. was fined by the Garante 40,000 EUR for operating a geolocation system on its buses without full compliance with data protection rules. The case concerned location data processing without the required legal basis and safeguards. | IT | Garante | GDPR | €40,000 | ↗ |
| 18 Jun 2021 | STAROFSERVICE SASSTAROFSERVICE SAS was fined by the AEPD 3,000 EUR for sending advertising emails without the recipient's consent. This conduct breached Article 21 of the LSSI. | ES | AEPD | ePrivacy | €3,000 | ↗ |
| 25 Mar 2025 | Star Delta Electrical ServicesThe Jersey Data Protection Authority fined Jon Peacock t/a Star-Delta Electrical Services £4,000. The case arose from a client complaint concerning the handling of personal data by the sole trader. The penalty was issued under the Data Protection (Jersey) Law 2018. | JE | JOIC | GDPR | €4,787 | ↗ |
| 21 Jan 2013 | STAPLES PRODUCTOS DE OFICINA, S.L.U.STAPLES PRODUCTOS DE OFICINA, S.L.U. was fined by the AEPD EUR 30,001 for sending unsolicited commercial emails without recipient consent. This conduct breached Article 21 of the LSSI. | ES | AEPD | ePrivacy | €30,001 | ↗ |
| 04 Aug 2017 | STAPLES PRODUCTOS DE OFICINA S.L.U.STAPLES PRODUCTOS DE OFICINA S.L.U. was fined EUR 2,000 by the AEPD for sending unsolicited commercial emails. The breach involved continuing to contact recipients despite requests to cancel consent. | ES | AEPD | ePrivacy | €2,000 | ↗ |
| 01 Jan 2014 | STAGE ENTERTAINMENT ESPAÑA, S.L.STAGE ENTERTAINMENT ESPAÑA, S.L. was fined by the AEPD 2,000 EUR for continuing to send commercial emails to a user despite repeated requests to delete their data and stop communications. The authority found a breach of Article 21.1 of the LSSI. | ES | AEPD | ePrivacy | €2,000 | ↗ |
| 24 Oct 2013 | Stadek sncStadek snc was fined EUR 4,000 by the Garante for non-compliant video surveillance signage. The case concerns a breach of data protection requirements related to informing individuals about surveillance. | IT | Garante | GDPR | €4,000 | ↗ |
| 17 Apr 2014 | SSTC srlSSTC srl was fined EUR 66,000 by the Italian authority Garante. The case concerned telemarketing activities carried out without the prior consent of the contacted individuals, in breach of data protection rules. | IT | Garante | GDPR | €66,000 | ↗ |