BULLETIN №082Last updated · 30 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -21.2%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 28 Nov 2023 | Barn- och utbildningsnämnden, Östersunds kommunBarn- och utbildningsnämnden in Östersunds kommun was fined by IMY for failing to conduct a data protection impact assessment before deploying Google Workspace for Education in 24 schools. The authority found this to be a breach of Article 35 GDPR. | SE | IMY | GDPR | €26,241 | ↗ |
| 28 Nov 2023 | Arbeids- og velferdsetaten (NAV)The Norwegian DPA has notified NAV of a planned 20 million NOK fine for serious information security deficiencies in its IT systems. The issues included inadequate access control and a lack of systematic log monitoring, which may have compromised the confidentiality of sensitive personal data. | NO | Datatilsynet | GDPR | €1,707,000 | ↗ |
| 24 Nov 2023 | Pitagorasz Oktatási Stúdió Kft.Pitagorasz Oktatási Stúdió Kft. was fined by NAIH for processing minors' personal data without a valid legal basis. The authority found breaches of GDPR principles, including accountability, purpose limitation, and transparency. | HU | NAIH | GDPR | €1,315 | ↗ |
| 23 Nov 2023 | Alpha BankAlpha Bank was fined for failing to satisfy the complainant’s request for access to personal data. The authority found breaches of GDPR Articles 15 and 5. | GR | HDPA | GDPR | €10,000 | ↗ |
| 23 Nov 2023 | SC Sweat Concept One SASC Sweat Concept One SA was fined 10,000 RON for failing to respond to a data subject’s request to exercise the right to erasure. The authority found a breach of the ePrivacy provisions. | RO | ANSPDCP | ePrivacy | €2,012 | ↗ |
| 22 Nov 2023 | ORTHOPHONISTE (procédure simplifiée)CNIL imposed a EUR 5,000 fine on ORTHOPHONISTE under a simplified procedure and issued an injunction. The case concerns a breach of the data protection authority’s requirements. | FR | CNIL | GDPR | €5,000 | ↗ |
| 22 Nov 2023 | ASOCIACIÓN COMUNIDAD DE VECINOS R.R.R.The association unlawfully processed personal data by sending all members a letter containing personal details of a person who was not part of the association. The authority found a breach of Article 6(1) GDPR and imposed a fine. | ES | AEPD | GDPR | €1,000 | ↗ |
| 22 Nov 2023 | LOS NIÑOS DE MONTESSORI, S.L.The company was fined by the AEPD for failing to publish a privacy policy on its website and for installing non-exempt cookies without informing users or obtaining consent. The case reflects deficiencies in basic transparency and consent requirements under data protection rules. | ES | AEPD | GDPR | €4,000 | ↗ |
| 20 Nov 2023 | Libra Internet Bank SALibra Internet Bank SA was fined EUR 1,500 by ANSPDCP for GDPR violations. The case concerned non-compliance with personal data protection requirements. | RO | ANSPDCP | GDPR | €1,500 | ↗ |
| 17 Nov 2023 | Gemeente VoorschotenThe municipality of Voorschoten unlawfully processed personal data about residents’ waste disposal history without a sufficient legal basis. It also failed to properly inform the affected residents, breaching GDPR Articles 5, 6 and 14. | NL | AP | GDPR | €30,000 | ↗ |
| 16 Nov 2023 | SOCIETE AYANT UNE ACTIVITE DE SOUTIEN AUX ENTREPRISES, NOTAMMENT POUR LES EVENEMENTS TELEVISES (procédure simplifiée)The CNIL imposed a fine of EUR 8,000 on SOCIETE AYANT UNE ACTIVITE DE SOUTIEN AUX ENTREPRISES, NOTAMMENT POUR LES EVENEMENTS TELEVISES. The case was handled under a simplified procedure. | FR | CNIL | GDPR | €8,000 | ↗ |
| 16 Nov 2023 | Autostrade per l’Italia S.p.A.Autostrade per l’Italia S.p.A. was fined by the Garante 100,000 EUR for failing to respond to employees' requests for access and rectification of personal data linked to annual severance pay calculations. The case concerns a failure to meet obligations for handling data subject rights requests. | IT | Garante | GDPR | €100,000 | ↗ |
| 16 Nov 2023 | Amazon Italia Transport s.r.l.Amazon Italia Transport s.r.l. was fined €40,000 by the Garante for failing to respond to a former employee’s request for access to personal data. The authority found a breach of Article 15 GDPR. | IT | Garante | GDPR | €40,000 | ↗ |
| 16 Nov 2023 | Dane anonimowe (W. sp. j. z siedzibą we W. przy ul.)The President of the Personal Data Protection Office imposed an administrative fine of PLN 14,148 on the company. The sanction was issued because the company failed to provide access to personal data and information necessary for the authority’s tasks. | PL | UODO | GDPR | €3,235 | ↗ |
| 16 Nov 2023 | Intelling LtdBetween 1 January 2021 and 11 November 2021, Intelling sent 1,164,877 direct marketing messages in breach of Regulation 22 of PECR. The Commissioner opened the case after receiving 1,103 complaints via the 7726 Spam Reporting Service. | GB | ICO | ePrivacy | €79,982 | ↗ |
| 16 Nov 2023 | NEW BUY GOLD DI EMANUELE VITA & C. S.A.S.The company was fined EUR 1,000 by the Italian supervisory authority, Garante. The penalty was imposed because it operated a video surveillance system without the required information notice for data subjects, in breach of Article 13 GDPR. | IT | Garante | GDPR | €1,000 | ↗ |
| 16 Nov 2023 | Provvedimento del 16 novembre 2023 [9973749]An attorney was fined for unlawfully processing personal data by sending sensitive judicial documents via certified email. The authority found that the method of transmission breached data protection rules. | IT | Garante | GDPR | €500 | ↗ |
| 16 Nov 2023 | Provvedimento del 16 novembre 2023 [9960948]The Garante imposed an EUR 18,000 fine on a training company for the unauthorized online publication of personal data relating to health. The case concerned breaches of GDPR Articles 5 and 32 on data processing principles and security. | IT | Garante | GDPR | €18,000 | ↗ |
| 16 Nov 2023 | BEGIN RESTAURANTES, S.L.BEGIN RESTAURANTES, S.L. was fined by the AEPD EUR 2,000 for deficiencies in its cookie policy. The authority found the use of non-essential third-party cookies without proper consent and insufficient information in the main page banner. | ES | AEPD | ePrivacy | €2,000 | ↗ |
| 15 Nov 2023 | COMMUNE (procédure simplifiée)CNIL imposed a EUR 6,000 fine on COMMUNE under a simplified procedure. The case concerns an administrative sanction decision. | FR | CNIL | GDPR | €6,000 | ↗ |