.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.webp?width=1220&height=1090&name=Osano-guarantee-seal%20(1).webp)
Data Privacy Enforcement Tracker
What's new in the world of regulatory enforcement? Our Enforcement Tracker keeps you up to speed with relevant and noteworthy enforcement actions in the world of privacy. Stay informed, spot patterns early, and guide your program with confidence.
Note: While updated regularly this is not exhaustive and not intended as legal advice.
Filters applied (0)
Clear filters
Filter by Category
-
Privacy LawSelect all
-
Region of EnforcementSelect all
-
Industry TypeSelect all
-
Employee CountSelect all
-
Estimated Annual RevenueSelect all
-
Keyword(s)Select all
-
Level of GovernmentSelect all
-
Who EnforcedSelect all
Sort By
Showing 7 of 46 results
August 17, 2026
Lab Pharma AS
Healthcare
Norway
The data protection authority penalized a pharmaceutical company following an investigation into an individual's complaint regarding the unauthorized use of her name and images in marketing materials. When asked to produce documentation and demonstrate a lawful basis for processing, company representatives issued threats of criminal complaints and lawsuits against supervisory staff in an attempt to halt lawful inquiries, failed to observe response deadlines, and delayed transmitting required records. Following review of the records, the authority determined the company lacked a valid legal basis to retain and use the individual's personal data for marketing purposes.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
SRR
Fine / Penalty
€ 18,791
Keywords
Unlawful processing
Mishandling Data
August 14, 2026
SATS ASA
Professional Services
Norway
The data protection authority issued an order and reprimand to a fitness club chain regarding its requirement for members to provide a photo for check-in identification. Following numerous complaints, the regulator determined that mandatory photo collection was not necessary to fulfill the membership agreement, as access was already provided via membership card scanning without consistent photo verification at every visit.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
UC
SRR
Fine / Penalty
N/A
Keywords
N/A
August 13, 2026
MyDr
Healthcare
Poland
The national data protection authority is launching an official investigation into a software provider for medical facilities following multiple reports of a data breach involving patient health information. The regulatory audit will specifically scrutinize the company's technical and organizational security measures, as well as whether these security protocols and risk analyses were regularly tested against evolving threat landscapes.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Vendor
Fine / Penalty
N/A
Keywords
Data Breach
August 11, 2026
[Name Not Public]
Financial Services
Denmark
A regulator expressed criticism regarding a financial institution's handling of a data subject access request. The complainant suspected a former spouse, an employee at the institution, had inappropriately accessed their accounts and requested access to the institution's log files. The institution denied the request, stating the logs had been deleted per their standard procedures. While the regulator did not dispute the deletion practice itself, they found the overall handling of the access request to be inadequate and not in compliance with data protection rules.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
DSAR
Fine / Penalty
N/A
Keywords
N/A
August 11, 2026
LocateSmarter LLC
Technology
USA
A state privacy regulator issued a decision against a data broker for failing to register in a timely manner and for unlawfully requiring consumers to provide partial Social Security numbers before allowing them to exercise their opt-out rights. The agency determined that requiring such sensitive data violated data minimization principles and could intimidate consumers from exercising their privacy rights.
Privacy Law
CCPA and Delete Act
Level of Government
State
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
CMP
Assessments
SRR
Fine / Penalty
$116,490
Keywords
N/A
August 7, 2026
Australian Government Agencies (30 Agencies)
Public Sector
Australia
A regulatory review assessed multiple government agencies on their compliance with maintaining and updating public disclosure logs following information access requests. The review determined that while general compliance was satisfactory, a significant majority of the evaluated agencies failed to publish the requested information within the required legal timeframe. As a result, the agencies were advised to improve accessibility, reporting, and governance arrangements to ensure timely transparency.
Privacy Law
Freedom of Information Act 1982 (FOI Act)
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
DSAR
Fine / Penalty
N/A
Keywords
N/A
August 7, 2026
AMATO BESTSELLER S.R.L
Retail
Romania
A regulatory investigation found that a company failed to implement appropriate security measures and employee training to prevent unauthorized access to sensitive personal data by staff and former staff. Additionally, the company did not provide correct information to data subjects, processed excessive amounts of personal and sensitive data beyond what was necessary for the stated purposes, and made automated commercial communications without obtaining prior express consent.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Vendor
Fine / Penalty
€ 55,000
Keywords
Data Breach
Other Actions
Ordered to include clear instructions in all procedures regarding data flow, document handling, and employee access; conduct periodic employee training; ensure clear, complete, and correct information is provided to data subjects; process data respecting the minimization principle; and ensure prior express consent is obtained for unsolicited communications.
August 7, 2026
R.T.I. Spa (Reti Televisive Italiane)
Media
Italy
A media company was investigated and reprimanded for broadcasting satirical deepfake videos of a prominent journalist using artificial intelligence. Because the highly realistic nature of the altered videos and the lack of clear, understandable warnings could easily mislead the public into believing the manipulated statements and images were authentic, it was determined that the company violated core principles of lawfulness, fairness, transparency, and data protection by design and default. The company was subsequently ordered to halt this specific processing of the individual's data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
N/A
Fine / Penalty
N/A
Keywords
N/A
July 27, 2026
Lusha Systems Inc.
Technology
Italy
A US-based data broker harvested, enriched, and monetized the personal and professional contact details of individuals across Italy—including high-ranking public officials and members of the judiciary—without a valid legal basis or transparent disclosures. The organization scraped personal data from social media platforms and purchased databases from external brokers to offer paid profile enrichment services. Maintaining and continuously updating individuals' online profiles was found to constitute behavior tracking under applicable privacy standards, invalidating the company's reliance on legitimate interest and rendering all historical processing unlawful.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
CMP
UC
Assessments
Data Mapping
SRR
Fine / Penalty
€ 2,000,000
Keywords
Unlawful processing
July 23, 2026
Technology
EU
The organization was penalized for giving preferential treatment to its own commercial offerings within its search engine rankings over competitor services, as well as restricting application developers from freely communicating, promoting alternative offers, and steering consumers toward outside purchase channels.
Privacy Law
DMA
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
European Commission
Related Products
N/A
Fine / Penalty
€ 890,000,000
Keywords
N/A
July 21, 2026
[Name Not Public]
Technology
USA
A formal sectoral audit has been launched to evaluate whether gig economy platforms—including transportation, delivery, and task services—are honoring privacy rights for consumers and independent contractors. The audit focuses on verifying whether these platforms adequately fulfill data access requests within required timeframes and accurately disclose the collection, use, and sharing of personal data, including geolocation, biometrics, behavioral metrics, and algorithmic decision-making inputs.
Privacy Law
CCPA
Level of Government
State
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
CMP
Assessments
UC
Data Mapping
SRR
Fine / Penalty
N/A
Keywords
N/A
July 17, 2026
Orange România SA
Telecommunications
Romania
An investigation revealed that a major telecommunications operator suffered security incidents due to synchronization errors between interconnected digital applications that mistakenly exposed customer equipment invoices to other users, as well as vulnerabilities in a ticketing platform that lacked essential access controls like multi-factor authentication and secure VPN connectivity. These technical and organizational shortcomings resulted in unauthorized access to sensitive customer and employee personal data, including identification documents, contact details, and financial information.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
CMP
Assessments
UC
Data Mapping
SRR
Fine / Penalty
€ 100,000
Keywords
Data Breach
Other Actions
Mandated the implementation of technical and organizational measures to establish a continuous monitoring and testing process for all software applications, controlling all updates, configuration changes, and interconnections, alongside vulnerability testing to prevent unauthorized data access.
July 16, 2026
23andMe, Inc.
Technology
USA
A direct-to-consumer genetic testing company experienced a major credential-stuffing attack in 2023 that compromised the genetic ancestry and personal data of 6.9 million users globally. An investigation revealed unreasonable data security practices, including failure to mandate multi-factor authentication, failure to implement rate limiting or login monitoring, failure to address suspicious login spikes, and failure to conduct adequate security design testing. Following the company's bankruptcy filing, a settlement was reached with a coalition of 42 state attorneys general.
Privacy Law
Consumer Protection Laws
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
AG
Related Products
CMP
Assessments
UC
Data Mapping
SRR
Fine / Penalty
$ 18,000,000
Keywords
Data Breach
July 16, 2026
Qantas Airways Limited
Transportation
Australia
A preliminary inquiry was conducted following a social engineering attack on a contracted third-party contact center provider that exposed customer information. The regulator examined pre-incident security measures, including supplier audits, staff cybersecurity training, and data minimization processes, as well as the immediate post-incident response. The regulator concluded that reasonable steps were taken to safeguard personal information and ensure third-party compliance, finding no evidence to support a breach of privacy law.
Privacy Law
Privacy Act 1988
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Vendor
Fine / Penalty
N/A
Keywords
Data Breach
July 15, 2026
[Name Not Public]
N/A
Poland
An individual ignored a previous administrative order to stop unlawfully recording the video and audio of neighbors and a public road using private security cameras. The individual failed to adjust the cameras to restrict the field of view solely to their own property. Because the individual ignored both the primary order and subsequent reminders, creating an ongoing infringement of neighbors' privacy and an unjustified sense of constant surveillance, the regulator issued a fine for non-compliance with its mandate.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
N/A
Fine / Penalty
€ 6,200
Keywords
Unlawful processing
July 13, 2026
[Name Not Public]
Healthcare
Poland
A specialist hospital failed to properly verify its email service processor to ensure adequate technical and organizational data security measures under data protection rules. Furthermore, the organization failed to perform a dedicated risk assessment for processing personal data via its external email service provider and failed to implement risk mitigation actions ahead of a credential compromise incident that exposed the data of 224 individuals.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Vendor
Fine / Penalty
N/A
Keywords
N/A
July 9, 2026
Character Technologies Inc.
Technology
Italy
An investigation revealed critical shortcomings in data protection compliance within a generative artificial intelligence entertainment platform accessible to minors. Issues identified included inadequate privacy disclosures, delayed completion of required Data Protection Impact Assessments (DPIAs), and late appointment of an official EU representative. Further risks were highlighted regarding age verification mechanisms and the protection of underage users.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
CMP
Assessments
UC
Data Mapping
SRR
Fine / Penalty
€ 158,000
Keywords
N/A
July 2, 2026
Banca Transilvania SA
Financial Services
Romania
An internal employee of a banking institution abused their access privileges to review a customer's confidential bank account statements, transactional history, and balances at the request of an external third party. The financial institution was penalized for failing to maintain adequate technical and organizational guardrails necessary to monitor employee behavior, restrict data processing exclusively to active business duties, and enforce data confidentiality rules against internal insider threats.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Fine / Penalty
€ 5,000
Keywords
Data Breach
July 1, 2026
Ascendex Technology SRL
Technology
Romania
An individual submitted a complaint regarding a cross-border privacy issue after an organization failed to properly manage their data deletion request. The subsequent investigation revealed that the company routinely took an excessive amount of time—in some cases up to 37 months—to resolve data erasure requests from multiple individuals across several jurisdictions without providing a final response or justifying the extensive delay.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Data Mapping
DSAR
Fine / Penalty
€ 11,000
Keywords
N/A
June 24, 2026
Medmate Australia Pty Ltd & Monash IVF Pty Ltd.
Healthcare
Australia
A year-long regulatory investigation revealed that two digital health service providers improperly tracked online visitors on their websites by deploying third-party tracking pixels. These technical trackers collected and transmitted users' online browsing and interaction data—which effectively revealed sensitive health choices and interests—to major social media and advertising platforms for retargeting and direct marketing campaigns. Because the entities exercised total operational control over the deployment and customisation of the pixels, they were deemed responsible for collecting this health data without obtaining the mandatory, explicit consent of users or providing adequate, clear privacy notices at or before the point of tracking.
Privacy Law
Privacy Act 1988
Level of Government
Federal
Employee Count
N/A
Estimated Annual Revenue
N/A
Who Enforced
DPA
Related Products
CMP
Assessments
UC
Data Mapping
SRR
Vendor
Fine / Penalty
N/A
Keywords
Tracking Tech
June 18, 2026
Altex România S.R.L.
Retail
Romania
An investigation was launched following consumer complaints regarding potential unauthorized access. It was discovered that a technical vulnerability within the company's mobile application allowed unauthorized access to a third party's personal data during an account validation process. Exposed information included names, invoices, and delivery addresses. The company was penalized for failing to implement adequate technical and organizational security measures, failing to notify the supervisory authority of the data security breach, and failing to inform the affected individual about the incident.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Fine / Penalty
€ 10,000
Keywords
Data Breach
June 16, 2026
Dormeo Home SRL.
Retail
Romania
A consumer submitted a complaint against a home goods retailer after repeatedly receiving marketing calls despite explicitly invoking their right to opt out. An investigation revealed that the operator failed to respect the individual's opt-out request and unlawfully continued processing their telephone number for promotional purposes.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
DSAR
UC
Fine / Penalty
€ 1,000
Keywords
Unlawful Marketing
June 15, 2026
Midlands Regional Hospital Tullamore
Healthcare
Ireland
A breach was detected on 14 November 2018. The attackers gained access to computers that stored and processed laboratory results of patients’ diagnostic tests, and used that access to encrypt patients’ personal data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Fine / Penalty
€ 300,000
Keywords
Data Breach
Sensitive Data
June 15, 2026
SSG Select Solutions S.R.L.
Professional Services
Romania
An employee of the security service provider permitted an unauthorized third party to access a client's in-store video monitoring room. This breach of physical security protocols allowed the unauthorized individual to access, record, and distribute video footage of individuals on a social media platform. The security vendor was found to lack sufficient technical and organizational measures to ensure data confidentiality and failed to properly enforce instructions regarding the authorized handling of personal data by its personnel.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Vendor
Data Mapping
Fine / Penalty
€ 2,000
Keywords
Data Breach
June 15, 2026
American Express
Financial Services
Australia
A financial institution failed to implement adequate safeguards to protect customer personal information from unauthorized internal access. An investigation revealed that the company lacked proper access controls and monitoring mechanisms to prevent employees from accessing sensitive customer records for improper purposes. The organization failed to adequately mitigate the risk of insider threats, leading to a breach of a customer's privacy.
Privacy Law
Privacy Act 1988
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Fine / Penalty
TBD
Keywords
Data Breach
June 12, 2026
Physician Reda Naujokaitienė (Šakiai Primary Health Care Centre)
Healthcare
Lithuania
The physician Reda Naujokaitienė unlawfully processed patients' personal data. Despite knowing that her employment with the healthcare institution was coming to an end, doctor Naujokaitienė repeatedly accessed the information system of the Šakiai Primary Health Care Centre, most often during evening hours. During these sessions, she viewed the personal data of 1,231 patients and subsequently used that information to send emails and SMS messages informing patients that she would no longer be working at the institution and inviting them to "continue the relationship" at another healthcare provider.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
N/A
Estimated Annual Revenue
N/A
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 1,153
Keywords
Unlawful processing
Mishandling Data
June 12, 2026
Compania Națională Poșta Română S.A.
Logistics
Romania
A national postal enterprise acting as a data processor on behalf of a public social services agency failed to maintain adequate organizational and physical safety measures to protect sensitive mail shipments. Due to a lack of operational supervision and control over personnel managing physical deliveries, a large volume of official correspondence was entirely lost or destroyed. The compromised shipments contained highly sensitive data elements, including names, home addresses, outstanding tax obligations, personal financial statements, individual criminal backgrounds, and confidential social inquiry records, impacting a significant number of citizens.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Vendor
Data Mapping
Fine / Penalty
€ 5,000
Keywords
Data Breach
Sensitive Data
June 11, 2026
Singtel Optus Pty Ltd
Telecommunications
Australia
A telecommunications provider failed to reasonably protect customer personal information from unauthorized disclosure over a four-year period. Despite explicitly asking transferring customers if they wanted an unlisted phone number, the company did not accurately process these preferences. As a result, over 41,000 customers who had requested unlisted numbers had their details mistakenly published in a public directory. The company retained control over the directory data across its own and a third party's systems and was aware of the ongoing risk. However, it failed to implement sufficient mitigation measures—such as periodic system reconciliations or the prompt execution of unlist requests—exposing affected individuals to potential harm.
Privacy Law
Privacy Act 1988
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Fine / Penalty
TBD
Keywords
Data Breach
June 8, 2026
Gauteng Province – Department of Health
Healthcare
South Africa
A journalist submitted information access requests to a public health agency for internal audit reports and procurement data connected to a high-profile corruption investigation. Although both parties formally signed a settlement agreement to release the documents, the agency failed to hand over the records within the agreed timeframe. Despite the agency later claiming full compliance and providing a single, separate report, evidence confirmed that multiple other requested audits and comprehensive purchase records were being improperly withheld without lawful justification, violating basic transparency and openness duties.
Privacy Law
Promotion of Access to Information Act (PAIA), 2 of 2000
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
N/A
Keywords
N/A
June 5, 2026
Nordic AS / Elkjøp Norge AS
Retail
Norway
A prominent consumer electronics retailer deployed an invalid "all-or-nothing" consent mechanism for its customer loyalty club by bundling multiple distinct data activities—such as newsletter distribution, SMS marketing, profiling, and analytics—into a single signup choice. Because consumers were forced to accept all extensive tracking workflows to unlock standard customer benefits, the consent failed to be specific or freely given. The retailer further failed to properly inform consumers about the backend profiling operations, lacked verification mechanisms to prevent minors from being targeted by tracking scripts, matched customer databases against social media platforms without completing mandatory compatibility assessments, and consistently missed statutory deadlines for fulfilling consumer data access and erasure requests.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
CMP
UC
SRR
Assessments
Fine / Penalty
€ 1,816,377
Keywords
Unlawful processing
Other Actions
Mandated to unbundle and restructure its loyalty club signup workflow to support separate consents, suspend unauthorized data-matching operations on third-party ad networks, establish operational age-verification controls, and adjust compliance timelines to fulfill backlogged and incoming user rights requests.
June 3, 2026
Schibsted
Technology
Norway
A national consumer advocacy group and an international digital rights organization filed a formal complaint against a major media and digital marketplace conglomerate over its rollout of a "pay-or-tracking" subscription choice. This framework mandates that users must either agree to have their behavioral data tracked and commercialized for personalized targeted advertising or pay a recurring monthly fee to prevent data harvesting. The complaint alleges that placing a financial cost on basic data privacy violates the requirements for user consent to be entirely voluntary and freely given.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
CMP
Fine / Penalty
TBD
Keywords
N/A
May 29, 2026
Unicredit Bank SA
Financial Services
Romania
It emerged that the company, in order to renew insurance policies by customers who had this obligation, in the context of their expiration, sent erroneous notifications to a large number of customers, both through mobile or online banking messaging, and by e-mail. The disclosure was caused by an error related to the processing of a file necessary for the preparation of notifications. It was found that the operator did not implement appropriate technical and organizational measures to ensure that any natural person acting under the authority of the operator or the person empowered by the operator and who has access to personal data only processes them at the request of the operator, taking into account ensuring a level of security appropriate to the risk of the processing. Consequently, this breach led to the unauthorized disclosure of personal data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
Vendor
Data Mapping
Fine / Penalty
€ 12,000
Keywords
Data Breach
May 29, 2026
Debbie Okparavero and Maliha Islam (Individuals)
Financial Services
United Kingdom
Two former employees of an automotive assistance company unlawfully copied and sold nearly 30,000 lines of personal information. Following a prior conviction and suspended prison sentences for the data theft, authorities utilized asset recovery laws to calculate and seize the financial profits generated by the individuals through their illegal data harvesting and sales scheme.
Privacy Law
Computer Misuse Act 1990
Level of Government
Federal
Employee Count
N/A
Estimated Annual Revenue
N/A
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Fine / Penalty
£118,852.32
Keywords
Data Breach
Other Actions
The defendants were given three months to pay their respective confiscation orders or face default prison sentences (18 months and 10 months, respectively) while remaining liable for the full amount. In a prior hearing, both were sentenced to six-month suspended prison sentences and ordered to complete 150 hours of unpaid work.
May 28, 2026
Chrome Holding Co. (formerly known as 23andMe)
Healthcare
USA
A consumer genetics company failed to implement basic data security measures to protect sensitive user profiles, biological relationships, and ancestry data from a credential stuffing cyberattack. The business left known system vulnerabilities unaddressed and allowed malicious actors to operate undetected for five months. Following the compromise, the organization issued misleading public notifications that downplayed the severity of the incident and improperly deflected accountability onto its consumers while simultaneously negotiating with the threat actor.
Privacy Law
CCPA
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
AG
Related Products
Assessments
UC
Data Mapping
SRR
Vendor
Fine / Penalty
TBD
Keywords
Data Breach
Mishandling Data
May 28, 2026
IQVIA
Healthcare
France
A healthcare data analytics firm improperly managed massive health data repositories harvested from pharmacies and medical practices. The enterprise mistakenly operated under the assumption that the datasets were fully anonymized, whereas they remained pseudonymous and vulnerable to re-identification due to data depth and unique identifiers. This misclassification led to a cascade of deficiencies, including delivering inaccurate or incomplete disclosure statements to patients, failing to implement practical workflows for individuals to object to data collection, and letting backend pharmacy software transmit records even when individuals had explicitly refused. Furthermore, the environment lacked adequate tracking controls, such as a routinely reviewed connection log and multi-factor authentication defenses.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Fine / Penalty
€ 5,000,000
Keywords
Unlawful processing
Mishandling Data
Data Breach
May 22, 2026
Sibanye Stillwater Limited
Logistics
South Africa
A civil society organization requested annual compliance reports regarding social and labor plans from a mining corporation. The corporation denied the request, arguing that releasing the reports would harm its commercial and financial interests and breach personal privacy. These objections were rejected because they relied on speculation rather than providing factual proof of potential financial damage. Because the information directly impacts local communities and helps evaluate how well operational conditions are being monitored, granting access to the records was deemed essential to public interest and transparency.
Privacy Law
Promotion of Access to Information Act (PAIA), 2 of 2000
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
N/A
Keywords
N/A
May 22, 2026
Permanent TSB (PTSB)
Financial Services
Ireland
A banking institution suffered operational and systemic errors within its customer data management workflows, leading to unauthorized disclosures of personal data. The institution misdirected documentation to incorrect addresses and systematically mixed up account records between unrelated individuals with identical or similar names. These errors occurred repeatedly over a multi-year period due to a lack of appropriate technical and organizational safeguards to ensure data accuracy and integrity. Furthermore, the organization failed to properly document and promptly notify the supervisory authority regarding some of these security breaches.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
UC
SRR
Fine / Penalty
€ 277,500
Keywords
Data Breach
Sensitive Data
May 15, 2026
Media Outlets Involved in Garlasco Case Coverage
Telecommunications
Italy
The data protection authority issued a formal warning and strict reminder to media operators following the unlawful publication of an online television report. The broadcast made public the audio and transcripts of private conversations between a defendant and his defense counsel, an action strictly prohibited under criminal procedure laws. The authority emphasized that such continuous and morbid sensationalism of criminal news violates the fundamental data protection principle of essentiality of information, overstepping the boundary of public interest and compromising individual dignity.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
N/A
Keywords
Unlawful processing
Mishandling Data
May 15, 2026
Rizwan Manjra (Individual)
Financial Services
United Kingdom
A former motor insurance worker unlawfully accessed personal information on their employer's computer systems for personal financial gain. Following a prior conviction for this unauthorized access, authorities secured an order to seize the financial benefits the individual generated through the illegal acquisition and onward sale of the personal information, ensuring they do not retain the profits of their criminal activity.
Privacy Law
Computer Misuse Act 1990
Level of Government
Federal
Employee Count
N/A
Estimated Annual Revenue
N/A
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Fine / Penalty
£355,880.10
Keywords
Data Breach
May 14, 2026
Property Lovers Pty Ltd (and fastproperty.ai)
Technology
Australia
A compliance investigation into an AI-powered real estate research application concluded that the software did not collect, use, or disclose personal details during the examined timeframe. The inquiry was initiated to ensure compliance with a prior regulatory ruling involving data scraping, but the review verified no current data protection violations existed. Matters outside the data authority's purview were referred to a consumer watchdog.
Privacy Law
Privacy Act 1988
Level of Government
Federal
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Vendor
Data Mapping
Fine / Penalty
N/A
Keywords
N/A
May 12, 2026
Isabel SA (TruliUs)
Technology
Belgium
A B2B platform provider that developed an online corporate identity verification service wrongly classified itself as a data processor instead of a data controller within its terms and conditions. Because the provider completely designed the system's architecture and independently defined the processing parameters, it held the status of a data controller under the law. Due to this fundamental misclassification, the organization committed multiple downstream violations, including gathering excessive identity attributes without proving necessity, hosting an inaccurate privacy policy that mismatched real data processing practices, and neglecting to answer user data access requests within mandated timelines due to an internal technical failure.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
CMP
Data Mapping
SRR
Vendor
Fine / Penalty
€ 120,000
Keywords
N/A
May 12, 2026
Société Wallonne des Eaux
Public Sector
Belgium
A large regional water utility company was investigated following an internal employee grievance regarding its customer service call center. The organization routinely recorded incoming customer communications for quality evaluation and staff coaching but failed to provide clear, upfront notifications or a simple mechanism for callers to object to the tracking. Furthermore, the organization conditioned basic transparency details on having active internet access, stored test audio files indefinitely without clear limitations, and neglected to establish a formal data processing agreement with a third-party subcontractor tasked with handling and evaluating the recordings over a five-year period.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
CMP
Data Mapping
Vendor
Fine / Penalty
€ 86,000
Keywords
Unlawful processing
Mishandling Data
May 12, 2026
[Name Not Public]
Technology
Belgium
A technology corporation was penalized for keeping a departed freelance consultant's corporate email account active for more than a year rather than permanently deleting it. Instead of completely erasing the account after a brief, temporary transition window, the business maintained the inbox in a backup status and processed incoming third-party communications unlawfully. Furthermore, an automatic out-of-office message mistakenly indicated to outside clients that the individual's absence was merely short-term, and the business subsequently blocked the individual's formal request to view or access her personal information under the pretense of protecting commercial trade secrets.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
CMP
Data Mapping
SRR
Fine / Penalty
€ 177,000
Keywords
Unlawful processing
Mishandling Data
May 8, 2026
General Motors Company
Transportation
USA
An automotive manufacturing corporation illegally retained and sold the sensitive personal data of hundreds of thousands of drivers to third-party data brokers. Collected via an on-board connected vehicle service, this information included precise geolocation details, consumer contact information, and specific driving behavior patterns. The organization conducted these data sales without the knowledge or affirmative consent of its customers, directly violating its internal privacy protocols and contradicting public assurances that promised it would not sell such sensitive consumer information. Furthermore, the company failed to abide by data minimization and purpose limitation requirements by holding onto the data long after its original operational utility had expired.
Privacy Law
CCPA
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
Assessments
UC
Data Mapping
SRR
Vendor
Fine / Penalty
$12,750,000
Keywords
Unlawful processing
Mishandling Data
Tracking Tech
Other Actions
Five-year prohibition on selling driving data to consumer reporting agencies and data brokers; mandatory deletion of all retained driving data within 180 days absent explicit consumer consent; formal requests issued to downstream data brokers to purge previously acquired driver datasets; implementation of a robust, audited privacy risk assessment program with reporting mandates to the California Department of Justice and the CPPA.
May 8, 2026
Permanent TSB (PTSB)
Financial Services
Ireland
Malicious actors in possession of certain customer information called into the bank's contact center, impersonated valid account holders, bypassed identity verification protocols, and successfully modified account details. This unauthorized access exposed account holders to an elevated risk of fraud, compelled individuals to close their banking accounts, and in some instances resulted in financial losses. The subsequent investigation determined that the financial institution failed to apply robust technical and organizational guardrails to secure processing systems within the support center and failed to report the resulting data breaches to the supervisory authority within the mandated 72-hour window.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
UC
SRR
Fine / Penalty
€ 277,500
Keywords
Data Breach
Mishandling Data
May 8, 2026
MLU B.V. (Yango)
Technology
Netherlands
A mobile ride-hailing company was penalized for unlawfully transferring the personal records of customers and drivers to servers located in Russia without adequate data protection safeguards. The investigation revealed that extensive collections of highly sensitive data, including driver's license scans, bank accounts, and exact location history, were continuously transmitted to a country lacking an independent data protection authority, exposing users to potential state surveillance.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
Vendor
Data Mapping
Fine / Penalty
€ 100,000,000
Keywords
Unlawful processing
Mishandling Data
May 7, 2026
Management Corporation - Strata Title Plan No. 4869
Real Estate
Singapore
Failed to put in place any reasonable security arrangements to protect the personal data processed by its managing agent, appoint a data protection officer; and (iii) develop and implement policies and practices that are necessary to meet its obligations.
Privacy Law
Singapore Personal Data Protection Act (PDPA)
Level of Government
Federal
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Vendor
Data Mapping
Fine / Penalty
N/A
Keywords
Mishandling Data
May 7, 2026
South Staffordshire Plc & South Staffordshire Water Plc
Logistics
United Kingdom
A prominent water utility organization experienced a significant cyber incident resulting in the unauthorized exfiltration of consumer data. An investigation identified a failure to implement appropriate technical and organizational measures to safeguard personal information, rendering the system vulnerable to exploitation and subsequent data exposure affecting over 600,000 individuals.
Privacy Law
UK GDPR
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Fine / Penalty
£963,900
Keywords
Data Breach
Mishandling Data
May 7, 2026
Canada Revenue Agency
Public Sector
Canada
An investigation into a government tax agency revealed significant administrative security gaps that allowed malicious actors to gain unauthorized access to and modify personal taxpayer records. Cybercriminals bypassed authentication processes, leading to fraudulent benefit requests and severe financial hardship for citizens. The findings indicated critical delays in implementing mandatory multi-factor authentication, inconsistent utilization of industry best-practice controls, and inadequate tracking or reporting of security incidents.
Privacy Law
PIPEDA
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Fine / Penalty
N/A
Keywords
Data Breach
Mishandling Data
May 6, 2026
OpenAI
Technology
Canada
A joint regulatory investigation revealed that the initial training and deployment of a popular artificial intelligence chatbot violated national and provincial privacy frameworks. The technology developer was found to have overcollected personal data, lacked valid consent and transparency mechanisms, and generated factual inaccuracies concerning individuals. Additionally, the system failed to provide sufficient options for individuals to access, correct, or delete their personal information, while lacking proper accountability structures for the controlled data.
Privacy Law
PIPEDA
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
CMP
SRR
Assessments
Vendor
Fine / Penalty
N/A
Keywords
Unlawful processing
Mishandling Data
May 5, 2026
Infinite Styles Services Co. Ltd.
Retail
Ireland
The data protection authority initiated a statutory inquiry regarding the organization’s cross-border transfers of European Union and European Economic Area users' personal data to China. The probe will examine and evaluate whether the business fulfills core protection obligations when moving information abroad, ensuring that data is afforded a level of security substantially equivalent to that maintained within Europe. Specifically, the inquiry will assess compliance with basic processing principles, user transparency mandates, and the specialized lawful transfer mechanisms established for non-adequate third countries.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Vendor
Data Mapping
Fine / Penalty
N/A
Keywords
Unlawful processing
May 5, 2026
Aalborg Municipality
Public Sector
Denmark
The data protection authority initiated an investigation following media reports regarding the public entity's data protection officer annual reports. The probe revealed a systematic failure across all municipal departments to establish proper data erasure routines, define deletion deadlines, or maintain an accurate overview of systems retaining personal data. Furthermore, the organization continuously stored personal data within multiple IT systems that lacked automated deletion functionality and failed to perform manual deletion runs, resulting in the unlawful preservation of personal data that was no longer necessary to retain.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Fine / Penalty
N/A
Keywords
Mishandling Data
April 30, 2026
Blue Projects S.R.L.
Professional Services
Romania
A cyberattack on the organization's IT infrastructure compromised the confidentiality and availability of personal data. This resulted in unauthorized access to a significant volume of data belonging to employees, collaborators, and correspondents, including names, national identification numbers, home addresses, contact details, emails, job titles, and resumes. The investigation revealed that the company failed to implement appropriate technical and organizational measures to ensure a level of security appropriate to the processing risk, specifically neglecting to secure system confidentiality and failing to establish a process for regularly testing and evaluating security effectiveness.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 2,500
Keywords
Data Breach
April 28, 2026
Crowd Entertainment Limited
Entertainment
Romania
An online gambling platform collected an individual's phone number when a third party registered an account, without verifying the accuracy of the data supplied. The organization subsequently sent marketing communications via text message to the individual without obtaining prior consent. Furthermore, when the affected individual submitted an inquiry to trace the source of their contact details and verify consent, the company unlawfully and excessively collected and retained sensitive personal documentation—including a copy of their national identification card and a selfie photograph—to process the request.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
CMP
UC
Assessments
SRR
Fine / Penalty
€ 35,000
Keywords
Unlawful Marketing
Unlawful processing
Other Actions
Implementing technical and organizational measures (including employee training) to guarantee the accuracy of data submitted during account registration, ensuring strict data minimization principles are met, and preventing the excessive collection and retention of user identity documents.
April 23, 2026
Accountancy Firm
Financial Services
Belgium
An accountancy firm failed to deactivate a former employee's professional mailbox for over 21 months following their departure. The company’s policy of keeping mailboxes active for up to three years to comply with tax audit cycles was deemed a violation of lawful processing principles. The regulator found that the firm lacked a valid legal basis for this extended retention and had inappropriately accessed private communications within the mailbox without consent. Additionally, the firm failed to respond to the former employee's formal request for data deletion.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Vendor
Fine / Penalty
€ 8,500
Keywords
Unlawful processing
Mishandling Data
April 21, 2026
[Name Not Public]
Financial Services
Hungary
A financial entity processed an individual's corporate mobile phone number for debt collection purposes despite the individual explicitly stating they did not wish to be contacted by phone. The organization failed to correctly identify the individual's oral refusal as a formal objection to data processing. Furthermore, the company maintained inconsistent records regarding how they obtained the contact information and failed to provide clear information on the legal basis for the processing or the individual's right to object during the communication.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
CMP
UC
SRR
Assessments
Vendor
Fine / Penalty
€ 2,750
Keywords
N/A
April 20, 2026
Poste Italiane SpA
Financial Services
Italy
A national postal and financial services provider was penalized following an investigation into its data processing activities. The regulator found that the company failed to comply with strict data retention periods and continued to process personal data without a valid legal basis in certain operational areas. Specifically, the organization did not implement adequate technical measures to ensure that personal data was deleted or anonymized once the original purpose for collection had been fulfilled, leading to the prolonged storage of customer information.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
SRR
Fine / Penalty
€ 6,624,000
Keywords
N/A
April 20, 2026
Postepay SpA
Financial Services
Italy
A national postal and financial services provider was penalized following an investigation into its data processing activities. The regulator found that the company failed to comply with strict data retention periods and continued to process personal data without a valid legal basis in certain operational areas. Specifically, the organization did not implement adequate technical measures to ensure that personal data was deleted or anonymized once the original purpose for collection had been fulfilled, leading to the prolonged storage of customer information.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
SRR
Fine / Penalty
€ 5,877,000
Keywords
N/A
April 17, 2026
[Name Not Public]
Professional Services
Denmark
A labor union filed a complaint on behalf of an individual after their former employer shared personal details—including sensitive information regarding union membership status—with an external advisor during an active employment law dispute. The advisor in question was a relative of the business owner and a colleague of the complainant at their current workplace. The supervisory authority evaluated the case and concluded that the transfer was lawful, noting that sharing information with a qualified legal or professional advisor to establish, exercise, or defend against legal claims falls within permissible processing boundaries when handled with appropriate relevance and necessity.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
N/A
Keywords
Unlawful processing
Sensitive Data
April 15, 2026
Utility Company
Logistics
Slovenia
A public utility company continuously and indiscriminately collected location data from employees using GPS tracking devices installed inside company vehicles without clearly defining the processing purpose. The employer failed to conduct separate legitimate interest assessments for its tracking activities, did not evaluate if less intrusive means could achieve the same operational objectives, and did not properly inform workers regarding the scope or intent of the monitoring.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 6,600
Keywords
Unlawful processing
April 13, 2026
5 ON LINE SRL
Unknown
Argentina
The investigation began because a company was reportedly mishandling the information of people listed as debtors during their debt collection efforts. This company failed to properly protect personal data and engaged in collection practices that overstepped legal boundaries, prompting the oversight agency to intervene. The core of the issue is that any business that hands over customer information to a third-party collector remains just as responsible for how that data is treated as the collector itself. Because the company and its partners did not ensure this sensitive information was processed legitimately and securely, they now face potential sanctions including heavy fines or the total shutdown of their databases.
Privacy Law
Personal Data Protection Law (Law 25,326)
Level of Government
Federal
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Data Mapping
SRR
Fine / Penalty
TBD
Keywords
Mishandling Data
April 7, 2026
Housing Associaction
Logistics
Poland
A housing community mistakenly sent an email containing the detailed fee settlement statement of one property owner to an unauthorized third party (another member of the housing community). The organization argued that no breach had occurred because the data was of an ordinary nature, impacted only a single individual, and members maintain broad document inspection rights. The supervisory authority rejected these claims, ruling that mistakenly routing financial and administrative records to the wrong recipient compromises confidentiality and poses a non-negligible risk. The entity failed to formally document the incident as a data breach or report it to the regulatory authority within the statutory 72-hour timeframe.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 2,350
Keywords
Data Breach
Mishandling Data
April 3, 2026
Blue Projects S.R.L.
Professional Services
Romania
A professional services firm was penalized following a self-reported data breach caused by a cyberattack on its IT infrastructure. The incident compromised the confidentiality and availability of sensitive personal data belonging to employees, collaborators, and other contacts, including names, national identification numbers (CNP), home addresses, contact details, and CVs. The regulator's investigation concluded that the company had failed to implement adequate technical and organizational measures to ensure data security and lacked a regular process for testing and evaluating the effectiveness of its security controls.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 2,500
Keywords
Data Breach
March 31, 2026
Change Healthcare (Subsidiary of UnitedHealth Group)
Healthcare
USA
A lawsuit was filed following a massive data breach that compromised the sensitive information of nearly 2.2 million residents in a single state. The investigation revealed that a threat actor maintained undetected access to internal systems for ten days, deploying malware and exfiltrating data including Social Security numbers and medical records. The action alleges the company maintained outdated IT systems and failed to provide timely notification to affected individuals, waiting five months to disclose the event while the breach simultaneously caused significant operational disruptions across the regional healthcare infrastructure.
Privacy Law
Iowa Consumer Fraud Act; Iowa Personal Information Security Breach Protection Act
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
AG
Related Products
Assessments
Data Mapping
Vendor
Fine / Penalty
TBD
Keywords
Data Breach
March 30, 2026
Intesa Sanpaolo S.p.A.
Financial Services
Italy
A major financial institution was penalized following a significant data breach involving insider misuse. An investigation revealed that an employee performed over 6,600 unauthorized consultations of the banking records of more than 3,500 clients over a two-year period, including individuals with high-public profiles. The regulator found that the bank’s internal monitoring systems were inadequate to detect such prolonged suspicious activity and that the organization failed to provide timely and complete notification of the breach to both the authority and the affected individuals.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Vendor
Fine / Penalty
€ 31,800,000
Keywords
Data Breach
Sensitive Data
March 27, 2026
Legal Person
Professional Services
Slovenia
The organisation operated a web portal that delivered patients' medical test results (izvidi) through "unique" URL links generated after login. The URLs ended in 6-digit sequential numbers with insufficient entropy, so an average user — without specialised IT security knowledge — could simply guess adjacent six-digit values in the URL, paste them into a browser, and pull up other patients' results. The exposed personal data included name, surname, date and year of birth, address, employer details, and health data. The IPRS found the organisation failed to implement appropriate technical and organisational measures to ensure an adequate level of security for processing.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Vendor
Fine / Penalty
€ 13,491
Keywords
Data Breach
Sensitive Data
March 27, 2026
[Name Not Public]
Transportation
Hong Kong
A passenger seeking baggage claim compensation received an email from a third-party ground service agent containing sample forms that inadvertently included the real personal data of four other individuals, including names, flight details, and bank account information. The investigation revealed that while the airline had internal manuals in place, it failed to ensure its ground service agents followed these protocols, provided insufficient training, and lacked oversight of outgoing communications from these agents.
Privacy Law
Personal Data Ordinance (PDPO)
Level of Government
National
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
N/A
Fine / Penalty
N/A
Keywords
Data Breach
March 25, 2026
Region Syddanmark (Region of Southern Denmark)
Public Sector
Denmark
A regional authority was found to have insufficient security measures regarding a database used for research and clinical purposes. A technical vulnerability allowed authenticated users to access PDF documents containing personal and sensitive health information of other registered individuals by simply modifying the URL. The breach exposed data related to approximately 23,000 people, including children in psychiatric care. While the court acquitted the region on a secondary charge related to hidden data in a presentation, it upheld the penalty for the database vulnerability due to a lack of appropriate technical safeguards.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 66,900
Keywords
Data Breach
March 25, 2026
Renault Commercial Roumanie SRL
Logistics
Romania
The company was investigated following a cyberattack on a third-party application that resulted in the unauthorized public disclosure of extensive personal data, including IDs, contact details, and employer information. The investigation found that Renault failed to implement adequate security measures or a regular testing process and neglected its duty to use service providers that offer sufficient data protection guarantees under GDPR.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 125,000
Keywords
Data Breach
March 23, 2026
The Queen Elizabeth Hospital King's Lynn NHS Foundation Trust
Healthcare
United Kingdom
A public healthcare trust was issued an enforcement notice following a significant failure to meet statutory timelines for information requests. An investigation revealed a compliance rate as low as 24%–26%, resulting in a substantial backlog of nearly 100 requests, some over six months old. The failures were attributed to a lack of dedicated staff, inadequate software not designed for request management, and a general lack of understanding of transparency processes across the organization.
Privacy Law
Freedom of Information Act 2000 (FOIA)
Level of Government
National
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
SRR
Fine / Penalty
N/A
Keywords
Mishandling Data
March 23, 2026
University Hospitals Birmingham NHS Foundation Trust
Healthcare
United Kingdom
A major healthcare trust was issued an enforcement notice due to a sustained failure to provide public access to information within statutory timeframes. An investigation revealed a compliance rate of only 54.5% over a 17-month period, resulting in a backlog of 432 requests. Over 150 of these requests remained unanswered for more than a year. The failures were linked to an increase in the volume and complexity of requests, historical lack of senior oversight, and a shortage of dedicated resources.
Privacy Law
Freedom of Information Act 2000 (FOIA)
Level of Government
National
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
SRR
Fine / Penalty
N/A
Keywords
Mishandling Data
March 23, 2026
ING Bank NV Amsterdam – Bucharest Branch SA,
Financial Services
Romania
The company was investigated following a data breach. An employee handed over a customer's account statements to a third party without consent. The investigation found that the bank lacked adequate security measures, leading to the unauthorized disclosure of the customer's name, address, IBAN, and transaction history.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 4,000
Keywords
Data Breach
March 20, 2026
Domeniul Public și Privat SA
Telecommunications
Romania
A telecommunications infrastructure provider was penalized following an investigation into its data processing security practices. The authority found that the company failed to implement adequate technical and organizational measures to ensure a level of security appropriate to the risk. Specifically, vulnerabilities in the company's internal systems allowed for unauthorized access to personal data belonging to data subjects. The investigation highlighted a failure to regularly test and evaluate the effectiveness of security measures, leading to a breach of confidentiality for subscriber information.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Vendor
Fine / Penalty
€ 5,000
Keywords
Data Breach
March 12, 2026
Intesa Sanpaolo
Financial Services
Italy
A major banking group was penalized for the unlawful processing and profiling of approximately 2.4 million customers during a corporate transition to its digital-only subsidiary. The bank utilized automated profiling to identify customers to be transferred based on criteria such as age, digital habits, and financial holdings without a valid legal basis. Furthermore, the bank failed to provide transparent and prominent notification of the transfer; notices were hidden within the "archive" section of the mobile app during the summer period, preventing customers from reasonably anticipating the change or exercising their right to object to the unilateral contract modification.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
Assessments
UC
Vendor
Trusthub
SRR
Fine / Penalty
€ 17,628,000
Keywords
Mishandling Data
March 10, 2026
Acea Energia
Logistics
Italy
The energy provider was penalized following hundreds of complaints regarding aggressive telemarketing practices. The investigation revealed that the company processed personal data for promotional purposes without valid consent, failed to properly manage "opt-out" requests, and did not adequately oversee its network of sales agencies (data processors). Furthermore, the company was found to have collected data from third parties without ensuring the original data collection was compliant with transparency and consent requirements.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
CMP
UC
SRR
Assessments
Vendor
Fine / Penalty
€ 2,000,000
Keywords
Mishandling Data
Unlawful Marketing
March 5, 2026
Altex România SRL
Retail
Romania
The retail company was penalized following an investigation into its handling of data subject rights. The regulator found that the organization failed to respond to multiple requests from customers seeking to exercise their rights to access and rectification. Additionally, the company did not comply with requests to close user accounts or erase data and failed to cooperate with the supervisory authority during the investigation by not providing the requested information within the established deadlines.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
SRR
Assessments
Fine / Penalty
€ 8,200
Keywords
Mishandling Data
March 5, 2026
Ford
Logistics
USA
The automotive manufacturer was penalized following an investigation into its connected vehicle and digital property privacy practices. The regulator found that the company added unnecessary friction to the consumer "opt-out" process by requiring individuals to complete a mandatory email verification step before their requests were processed. Because the organization failed to act on requests where this secondary verification was not completed, it continued to sell or share the personal information of those consumers in violation of the law.
Privacy Law
CCPA
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
CMP
UC
Assessments
SRR
Fine / Penalty
$375,703
Keywords
Mishandling Data
March 2, 2026
University of Limerick
Public Sector
Ireland
The organization was penalized following an inquiry into a series of 12 personal data breaches involving unauthorized access to staff email accounts via phishing. The investigation revealed that the institution failed to implement adequate technical and organizational security measures, leading to the exposure of sensitive identity, financial, and medical data. Additionally, the entity was found to have maintained an incomplete record of processing activities and failed to notify both the regulator and the affected individuals of high-risk breaches within the required legal timeframes.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Fine / Penalty
€ 98,000
Keywords
Data Breach
Mishandling Data
February 20, 2026
Netopia Financial Services S.R.L.
Financial Services
Romania
The company was penalized following an investigation into its data processing practices which revealed a failure to implement appropriate technical and organizational measures. Specifically, the organization did not have a regular procedure for testing and evaluating the effectiveness of security controls, and it failed to ensure that personal data was not accessible to an unlimited number of persons without human intervention. This led to the unauthorized disclosure of customer information.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
“Assessments”
“Vendor”
“Data Mapping”
Fine / Penalty
€ 10,000
Keywords
“Data Breach”
“Mishandling Data”
February 19, 2026
Your Consulting SRL
Professional Services
Romania
The company was penalized following an investigation into its application, which resulted in the unauthorized disclosure of sensitive personal data. The breach, which occurred between March and April 2024, exposed information including full names, national identification numbers (CNP), and vacation voucher details. The regulator determined that the organization failed to implement adequate technical and organizational measures at the time of processing and lacked a routine procedure for testing and evaluating the effectiveness of its security controls.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
Assessments
Vendor
Data Mapping
Fine / Penalty
€ 3,000
Keywords
Data Breach
Mishandling Data
February 17, 2026
TP-Link Systems Inc.
Technology
USA
The company is accused of deceptively marketing its networking devices as secure and unaffiliated with China while allegedly allowing the Chinese government to access American consumers' devices. The investigation revealed that despite "Made in Vietnam" labels, the supply chain remains deeply entrenched in China, subjecting the company to foreign national data laws that require sharing consumer data with state intelligence services. Additionally, the company allegedly failed to address long-standing firmware vulnerabilities that have been exploited by state-sponsored hacking groups.
Privacy Law
Texas Deceptive Trade Practices Act
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
AG
Related Products
Assessments
Vendor
Data Mapping
Fine / Penalty
TBD
Keywords
N/A
February 11, 2026
Disney
Entertainment
USA
The company failed to provide a unified and effective method for consumers to opt out of the sale or sharing of their personal information across its various streaming services and devices. The investigation revealed that opt-out requests were "disjointed," requiring users to exercise their rights multiple times (up to 10 times) across different platforms to achieve a full opt-out. Even when logged into their accounts, consumers' requests to stop the sale/sharing of data for targeted advertising were not fully honored across the company's ecosystem.
Privacy Law
CCPA
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
AG
Related Products
UC
CMP
SRR
Data Mapping
Assessments
Vendor
Fine / Penalty
$27,000,000
Keywords
Mishandling Data
Other Actions
Implement a unified opt-out mechanism that honors consumer choices across all services/devices; provide clear and conspicuous notice regarding cross-context behavioral advertising; submit to a compliance program with 60-day check-ins; and ensure third-party vendors use data only in ways consistent with Disney's CCPA obligations.
February 11, 2026
Two Individuals
Financial Services
United Kingdom
Two individuals were convicted for their roles in a large-scale data theft ring involving the unlawful access and sale of personal information from over 400 garages, insurance firms, and claims management companies. The investigation revealed that the individuals intentionally sought employment at these firms specifically to steal data for profit. One individual accessed thousands of records and received £16,000 in payments, while the other sold data for over £70,000. This case marks a significant result in the regulator's largest-ever investigation into nuisance call data sourcing.
Privacy Law
Data Protection Act 1998; Computer Misuse Act 1990
Level of Government
Federal
Employee Count
N/A
Estimated Annual Revenue
N/A
Who Enforced
DPA
Related Products
Vendor
Assessments
Data Mapping
Fine / Penalty
£86,550
Keywords
Data Breach
February 9, 2026
[Unknown]
Unknown
Malta
The company failed to provide a complete copy of an individual's personal data following a right of access request. The investigation found that the controller relied on incorrect national legal grounds and failed to justify why certain information was withheld. The regulator determined that the company violated the accountability principle by failing to demonstrate that its refusal to provide the data was lawful, proportionate, and strictly necessary.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
SRR
Assessments
Fine / Penalty
N/A
Keywords
Mishandling Data
February 5, 2026
Ten municipalities
Public Sector
Netherlands
Ten municipalities were fined for the illegal processing of dossiers containing sensitive information about Muslim residents. The municipalities conducted investigations into these individuals without their knowledge and without a valid legal basis. The Dutch DPA found that the collection and processing of data regarding religious beliefs and background constituted a serious violation of transparency and data minimization principles, as well as the special protections afforded to sensitive personal data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Vendor
Fine / Penalty
€ 250,000
Keywords
Sensitive Data
Unlawful Processing
February 5, 2026
Tensa Art Design S.A.
Retail
Romania
The operator was fined following a complaint regarding the unauthorized placement of tracking and behavioral advertising cookies on its website. During the resulting investigation, the company failed to provide the information requested by the supervisory authority. The fine was ultimately issued for non-cooperation and the failure to facilitate the regulator's investigative powers, rather than the underlying cookie violation itself.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
CMP
Assessments
Vendor
Fine / Penalty
€ 20,000
Keywords
Mishandling Data
Unlawful Marketing
February 5, 2026
MediaLab.AI, Inc.
Technology
United Kingdom
The platform owner was fined for failing to protect children's privacy. Between 2021 and 2025, the company allowed children under 13 to use its services without implementing age-verification measures or obtaining parental consent. By failing to identify the age of its users, the company unlawfully processed children's data and exposed minors to potentially harmful and age-inappropriate content. Additionally, the regulator found the company failed to conduct a required Data Protection Impact Assessment (DPIA) to mitigate risks specific to younger users.
Privacy Law
UK GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
CMP
UC
SRR
Assessments
TrustHub
Fine / Penalty
£247,590
Keywords
Tracking Tech
Sensitive Data
February 4, 2026
Genpact Romania SRL
Technology
Romania
The company suffered a data breach resulting from a cyberattack that exploited password vulnerabilities and account reset mechanisms. This unauthorized access exposed the personal data of a significant number of employees across the European Union, including names, employee IDs, office emails, and department details. The investigation concluded that the operator failed to implement adequate technical and organizational security measures to ensure a level of security appropriate to the risks of accidental or unlawful data disclosure.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
Vendor Management
Fine / Penalty
€ 10,000
Keywords
Data Breach
February 3, 2026
Partidul Alianța pentru Unirea Românilor (AUR)
Public Sector
Romania
A political party was fined following a complaint from an individual who received personalized electoral mail during the 2025 presidential campaign. The investigation revealed that the party failed to respond to the individual's formal request to exercise their rights of access, erasure, and objection. This lack of response violated the procedural requirements for handling data subject requests within mandated timelines.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
CMP
UC
SRR
Assessments
Fine / Penalty
€ 1,000
Keywords
Mishandling Data
Unlawful Marketing
January 30, 2026
Evita-teparii.ro
Technology
Romania
An individual operator was fined for operating a website that published identity cards and personal details of individuals labeled as "scammers" or "debtors" without a legal basis. The site also processed special categories of data—including information about sexual orientation and alleged criminal convictions—while failing to provide mandatory identity information about the data controller. Furthermore, the operator ignored a formal deletion request from a data subject and failed to cooperate with the regulator's investigation.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
SRR
Data Mapping
Assessments
Fine / Penalty
€ 10,000
Keywords
Sensitive Data
Unlawful Processing
January 29, 2026
France Travail (formerly Pôle Emploi)
Public Sector
France
A significant data breach occurred after hackers used social engineering to compromise accounts of partner organization advisors. This unauthorized access exposed personal information—including national insurance numbers and contact details—of millions of individuals registered over the last 20 years. The investigation revealed that the organization failed to implement robust authentication, lacked effective system monitoring, and granted excessively broad data access rights to external partners.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Vendor
Fine / Penalty
€ 5,000,000
Keywords
Data Breach
Sensitive Data
January 28, 2026
Sportadmin
Technology
Sweden
The company was fined following a major cyberattack that resulted in the leakage of personal data belonging to over 2.1 million individuals, a significant portion of whom were children. The investigation revealed that despite being aware of system vulnerabilities and high-risk areas, the company failed to implement adequate technical and organizational security measures. Deficiencies included a lack of routines for detecting security flaws and the absence of a real-time intrusion detection system, which allowed the attacker to publish sensitive information, including health data and protected identities, on the dark web.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Vendor
Fine / Penalty
€ 530,000
Keywords
Data Breach
Sensitive Data
January 22, 2026
[Name Not Public]
Retail
France
The company transmitted email addresses and phone numbers of 10.5 million loyalty program members to a social network for targeted advertising without valid consent. The company claimed consent was obtained via loyalty program signup, but the CNIL found that information was missing or unclear. Additionally, the company failed to perform a Data Protection Impact Assessment (DPIA), used weak password security, and deposited advertising cookies without user choice.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
CMP
UC
Assessments
Fine / Penalty
€ 3,500,000
Keywords
Mishandling Data
Unlawful Marketing
January 19, 2026
Continental Automotive Products SRL
Logistics
Romania
Continental Automotive Products SRL self-reported a data breach. The incident involved the repeated internal distribution of an Excel file containing sensitive personal data (including medical data from medical certificates) of current and former employees. The investigation found that the company failed to implement adequate technical and organizational measures to ensure data security and system resilience, allowing unauthorized access to sensitive information for a significant number of individuals.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 15,000
Keywords
Data Breach
Sensitive Data
January 16, 2026
Timegrip AS
Technology
Norway
Failed to fulfill data subject access requests (DSARs). Following the bankruptcy of a retail chain that used Timegrip’s software, employees requested copies of their time-tracking data to claim unpaid wages. Timegrip refused, arguing it was only a data processor and had no instruction from the (now bankrupt) controller. The DPA ruled that because Timegrip exerted real control over the data, it acted as a controller. The fine was aggravated because 80 vulnerable employees were affected.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
SRR
TrustHub
Fine / Penalty
€ 21,650
Keywords
Mishandling Data
January 15, 2026
Allay Claims Ltd
Financial Services
United Kingdom
The company sent a large volume of unsolicited SMS messages. The messages promoted services related to PPI tax refunds. The investigation found that the company failed to obtain valid consent from recipients, violating direct marketing regulations.
Privacy Law
UK GDPR
Level of Government
Federal
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
CMP
UC
Assessments
Fine / Penalty
£120,000.
Keywords
Mishandling Data
Unlawful Marketing
January 14, 2026
Rejsekort
Logistics
Denmark
The Danish DPA is investigating the new Rejsekort app regarding its continuous tracking of user locations to calculate fares. The investigation focuses on whether the app collects more data than necessary (data minimization), specifically when users forget to "check out," potentially allowing the app to track movement to sensitive locations (doctors, unions, etc.) outside of transport. The case has been elevated to the European Data Protection Board (EDPB) for a formal opinion to ensure consistent interpretation across the EU.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
CMP
UC
Assessments
Data Mapping
Fine / Penalty
TBD
Keywords
Mishandling Data
January 14, 2026
Free Mobile
Telecommunications
France
Following a massive October 2024 data breach affecting 24 million subscriber contracts, including the exposure of IBANs. The investigation revealed that the companies used weak VPN authentication for remote work and had ineffective anomaly detection systems. Furthermore, the company failed to provide sufficiently detailed notification to victims and Free Mobile was found to have retained millions of former subscribers' data for excessive periods without justification.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
TrustHub
Fine / Penalty
€ 27,000,000
Keywords
Data Breach
January 14, 2026
Free
Telecommunications
France
Following a massive October 2024 data breach affecting 24 million subscriber contracts, including the exposure of IBANs. The investigation revealed that the companies used weak VPN authentication for remote work and had ineffective anomaly detection systems. Furthermore, the company failed to provide sufficiently detailed notification to victims.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
TrustHub
Fine / Penalty
€ 27,000,000
Keywords
Data Breach
January 13, 2026
Premier Restaurants Romania SRL
Retail
Romania
A cyberattack on an IT application owned by the operator led to unauthorized access to the personal data of a significant number of employees. The investigation revealed that the company failed to implement adequate technical security measures and, crucially, failed to ensure that its data processors (vendors) provided sufficient guarantees for implementing appropriate security measures.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 8,000
Keywords
Data Breach
January 8, 2026
Money Seeds S.R.L.
Financial Services
Romania
Following a complaint from a data subject who continued to receive unsolicited commercial emails despite having objected, an investigation found multiple compliance failures. The operator kept processing the individual’s email address for direct marketing after the objection was lodged, did not provide an opt-out mechanism that was simple and free of charge, and failed to respond appropriately to the data subject’s requests to delete their data and to stop processing. The company also could not demonstrate that it had provided data subjects with complete transparency information, as required.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
CMP
UC
SRR
Assessments
TrustHub
Fine / Penalty
€ 3,000
Keywords
Mishandling Data
Unlawful Marketing
January 8, 2026
Singapore Data Hub Pte. Ltd.
Technology
Singapore
Failed to implement reasonable security arrangements to protect personal data in its possession, the organization was found to have breached the Protection Obligation by maintaining inadequate access controls and security measures, leaving the data vulnerable to unauthorized access.
Privacy Law
Singapore Personal Data Protection Act (PDPA)
Level of Government
Federal
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
S$17,500
Keywords
Data Breach
January 8, 2026
People Central Pte. Ltd.
Technology
Singapore
Failed to to implement reasonable security arrangements to protect personal data. The investigation found a breach of the Protection Obligation due to inadequate access controls and security measures on its HR management platform, which exposed sensitive personal data of users to potential unauthorized access.
Privacy Law
Singapore Personal Data Protection Act (PDPA)
Level of Government
Federal
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
S$17,501
Keywords
Data Breach
January 8, 2026
Air Sino-Euro Associates Travel Pte. Ltd.
Logistics
Singapore
An investigation revealed that the company failed to appoint a Data Protection Officer (DPO) and did not have written data protection policies (Accountability Obligation). Additionally, the company failed to implement reasonable security arrangements to protect customer data, which led to a security incident (Protection Obligation).
Privacy Law
Singapore Personal Data Protection Act (PDPA)
Level of Government
Federal
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
S$47,000
Keywords
Data Breach
January 8, 2026
Goldheart Jewelry Pte. Ltd.
Retail
Singapore
After a ransomware attack compromised personal data, the investigation found the company breached the Protection Obligation by failing to implement adequate patch management. Specifically, the organization did not remediate known vulnerabilities in its IT systems, allowing attackers to gain unauthorized access and deploy ransomware.
Privacy Law
Singapore Personal Data Protection Act (PDPA)
Level of Government
Federal
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
S$58,000
Keywords
Data Breach
January 8, 2026
Rickenbacher Data LLC
Technology
USA
The company failed to register as a data broker as required by the California Delete Act. The company was found to be buying and reselling sensitive personal information of millions of individuals, including lists based on health conditions (e.g., Alzheimer’s, drug addiction), age ("Senior Lists"), race ("Hispanic Lists"), and political views. As part of the settlement, the company must stop selling all Californians’ personal information entirely.
Privacy Law
Delete Act
Level of Government
State
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Unknown
Who Enforced
CalPrivacy (Formerly CPPA)
Related Products
N/A
Fine / Penalty
$45,000
Keywords
N/A
January 8, 2026
S&P Global Inc.
Financial Services
USA
The company failed to register as a data broker as required by the California Delete Act. The action was part of the CPPA's "Data Broker Enforcement Strike Force" initiative.
Privacy Law
Delete Act
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
CalPrivacy (Formerly CPPA)
Related Products
N/A
Fine / Penalty
$62,600
Keywords
N/A
December 31, 2025
Disney
Entertainment
USA
A federal judge approved an order requiring Disney to pay $10 million to settle FTC allegations that the company failed to properly label kid-directed videos on YouTube as "Made for Kids" (MFK). This failure allowed for the unlawful collection of personal data (persistent identifiers) from children under 13 for targeted advertising without parental notice or consent.
Privacy Law
Children’s Online Privacy Protection Act (“COPPA”)
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
Federal Court
Related Products
CMP
UC
Trusthub
Assessments
Fine / Penalty
$10,000,000
Keywords
Tracking Tech
Sensitive Data
December 30, 2025
Roumasport S.R.L.
Retail
Romania
An investigation revealed that repeated cyberattacks on the company's IT platform led to unauthorized access to a significant number of customer accounts. The regulator found that the company failed to implement adequate technical and organizational measures to ensure the confidentiality and integrity of customer data, particularly in preventing unauthorized access to loyalty and account information.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 10,000
Keywords
Data Breach
December 29, 2025
Order of General Nurses
Healthcare
Romania
A complaint about a surveillance camera pointed directly at an employee's desk. The investigation found that the operator recorded employees and students in offices and classrooms without consulting staff/unions, without proving that less intrusive methods were ineffective, and without providing mandatory GDPR information to those being filmed.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 2,000
Keywords
Tracking Tech
December 22, 2025
PayPal, Inc. and PayPal Holdings, Inc.
Technology
USA
The company reached a settlement following an investigation into unfair and deceptive practices regarding its e-payment platforms. The Attorney General raised concerns over inadequate disclosures regarding the privacy of users' sensitive financial information and deceptive advertising of "Purchase Protection." Specifically, the Venmo platform was criticized for confusing privacy settings, leading to the public exposure of sensitive transaction data.
Privacy Law
NH Consumer Protection Act
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
AG
Related Products
CMP
UC
SRR
Assessments
TrustHub
Fine / Penalty
€ 1,750,000
Keywords
Sensitive Data
December 22, 2025
NEXPUBLICA
Technology
France
Failed to implement adequate security for its "PCRM" software. This tool is used by local government agencies (MDPH) to manage services for disabled persons. Users reported seeing third-party documents on the portal, leading to the discovery of severe structural security flaws. Despite being aware of these vulnerabilities through previous audits, the company failed to fix them until after several data breaches occurred.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 1,700,000
Keywords
Data Breach
December 19, 2025
Mobius Solutions Ltd
Technology
France
Following a data breach involving the data of 46 million Deezer users. The investigation found that Mobius failed to delete user data after the end of its contract, used the data without the controller's instructions to improve its own services, and failed to maintain a mandatory record of processing activities (ROPA). Despite being based outside the EU, the CNIL asserted jurisdiction because the company monitored the behavior of individuals in France.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Fine / Penalty
€ 1,000,000
Keywords
Data Breach
December 18, 2025
French Political Candidates
Public Sector
France
The CNIL issued simplified sanctions against five candidates from the 2024 elections for illegal political prospection. Key violations included: using a medical professional's patient list for campaign SMS (purpose limitation breach), failing to provide mandatory GDPR information in messages, lacking "STOP SMS" or opt-out mechanisms, failing to respond to data access/erasure requests, and exposing email addresses of hundreds of party members by failing to use the "BCC" function.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
CMP
UC
SRR
Trusthub
Assessments
Fine / Penalty
€23,500 total (cumulative across five candidates)
Keywords
Unlawful Marketing
December 16, 2025
Roblox
Technology
USA
The Iowa Attorney General sued Roblox for allegedly failing to protect children from sexual exploitation and the distribution of child sexual abuse material (CSAM). The lawsuit claims Roblox marketed the platform as safe for kids while intentionally concealing known dangers, including grooming, pornography, and extortion, and failing to implement basic safety controls.
Privacy Law
Iowa Consumer Fraud Act and Children’s Online Privacy Protection Act (“COPPA”)
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
AG
Related Products
Assessments
Fine / Penalty
TBD
Keywords
N/A
December 15, 2025
HAN University of Applied Sciences
Public Sector
Netherlands
Fined due to a 2021 data breach where a hacker used SQL injection to steal hundreds of thousands of records. The investigation revealed that HAN failed to implement adequate technical security, including insufficient protection against SQL injection, broad database access rights (breaching the "least privilege" principle), and the storage of passwords in plain text or using outdated hashing algorithms (MD5/SHA1).
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 175,000
Keywords
Data Breach
December 10, 2025
Geturhotels Srl
Logistics
Italy
A data subject filed a complaint about repeated promotional SMS messages sent by Geturhotels even after the recipient said they had objected and asked for deletion. The company said it relied on “legitimate interest” for marketing and attributed the continued messages to an internal tooling/CRM logging failure during SMS platform changes. The Garante issued an order that included a €6,000 administrative fine.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
CMP
UC
SRR
Assessments
TrustHub
Fine / Penalty
€ 6,000
Keywords
Mishandling Data
Unlawful Marketing
December 10, 2025
Crowd Entertainment Limited
Entertainment
Romania
An investigation was initiated following a complaint filed by a data subject dissatisfied with the way in which his request for access to his personal data was handled. During the investigation, the National Supervisory Authority for Personal Data Processing found that the operator did not present evidence showing that it had communicated, in writing and within the legal deadline, a complete and appropriate response to the petitioner's request requesting access to his personal data related to the player accounts registered on the platforms owned by the operator, including information regarding his self-exclusion requests.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
SRR
Assessments
TrustHub
Fine / Penalty
€ 15,000
Keywords
N/A
December 8, 2025
Compania de Apa Oltenia S.A.
Logistics
Romania
The case stemmed from a complaint that an employee disclosed a customer’s personal data on a social network, and ANSPDCP concluded the operator had not implemented sufficient security measures to protect customers’ personal data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 1,000
Keywords
Data Breach
December 3, 2025
American Express
Financial Services
France
CNIL found that on the French American Express website, advertising and tracking cookies were being placed on visitors’ devices without proper consent. In practice, the site dropped marketing cookies before people had made any choice about them, and in some cases continued to place or use cookies even when users had indicated they did not want them, while still using the information for advertising purposes.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
CMP
UC
Trusthub
Assessments
Fine / Penalty
€ 1,500,000
Keywords
Tracking Tech
December 3, 2025
ROR Partners, LLC
Professional Services
USA
ROR Partners ran a large-scale profiling and targeting operation using huge amounts of personal data, selling custom audience lists to clients, but it failed to follow California’s rules for data brokers by not registering with the state even though it was clearly acting like a data broker.
Privacy Law
Delete Act
Level of Government
State
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
CalPrivacy (Formerly CPPA)
Related Products
Regulatory Guidance
Privacy Expert
Fine / Penalty
$56,000
Keywords
N/A
December 2, 2025
Post Office Limited
Logistics
United Kingdom
The ICO issued a reprimand after the Post Office’s Corporate Communications Team mistakenly uploaded an unredacted version of a legal settlement deed to its public website. This document contained the personal data (names, home addresses, and settlement status) of 502 postmasters involved in the Horizon IT scandal. The ICO found the Post Office failed to implement appropriate technical and organizational measures to secure this sensitive data.
Privacy Law
UK GDPR
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
N/A
Fine / Penalty
N/A
Keywords
Data Breach
December 2, 2025
Temu
Retail
USA
The complaint alleges that Temu does much more than provide Arizonans access to cheap goods. Modeled after an earlier Chinese app, Pinduoduo, the Temu app is allegedly designed to harvest sensitive user data without users’ knowledge or consent and to evade detection. Temu allegedly collects an alarming amount of sensitive user data and personally identifiable information (PII) that goes far beyond what is necessary for a typical online shopping app. According to the lawsuit, the app secretly infiltrates users’ devices to access and harvest sensitive information, including the user’s precise physical location, the phone’s microphone and camera, and the user’s private activity on other apps installed on the phone, all without their knowledge or consent.
Privacy Law
Consumer Fraud Act
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
AG
Related Products
CMP
UC
SRR
Assessments
TrustHub
Fine / Penalty
TBD
Keywords
Tracking Tech
Sensitive Data
December 1, 2025
DELAFRUIT, S.L.
Logistics
Spain
A worker complained that CCTV cameras were installed in a rest/break area (specifically the canteen/dining area) and that required CCTV signage was missing.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 3,600
Keywords
N/A
December 1, 2025
RISING SUN CAR RENTAL S..L.
Logistics
Spain
A complainant alleged that the company had video surveillance cameras that captured not only images but also sound in work areas. The complaint states that cameras inside the office captured images and conversations between employees and customers, and that in outdoor employee areas (rest/leisure) sound was also captured. The complaint also alleges that the mandatory informational sign indicating the presence of CCTV had not been posted.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 3,600
Keywords
N/A
November 28, 2025
SPRINTER MEGACENTROS DEL DEPORTE, S.L.
Retail
Spain
SPRINTER reported a cybersecurity incident involving unauthorized access and ransomware activity in its datacenter, with indications of data exfiltration. The incident involved millions of affected individuals (later refined to 6,381,913), including customers and employees/ex-employees, and impacted multiple EU countries. Types of data impacted (summarized): identification/contact data for customers (including national ID numbers), and for employees/ex-employees also images plus certain health/financial data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 1,560,000
Keywords
Data Breach
Sensitive Data
November 27, 2025
Verisure Italy s.r.l.
Technology
Italy
Both an ex-customer and a prospective customer continued receiving promotional outreach after objecting/asking for marketing to cease, even after the company acknowledged the requests. They failed to operationalize rights handling (suppression) across their marketing channels. They used/retained marketing data without a valid permission basis in at least some cases.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
CMP
UC
SRR
Assessments
TrustHub
Fine / Penalty
€ 400,000
Keywords
Mishandling Data
Unlawful Marketing
November 27, 2025
Nițu A. Cleopatra – Expert Accountant
Professional Services
Romania
They did not implement security measures appropriate to the risk of the data and processing activities. A cyberattack compromised their systems and also disrupted their access to their own infrastructure, indicating weak resilience and recovery readiness. The breach resulted in unauthorized access/disclosure of a broad set of personal data, including high-impact identifiers (CNP) and sensitive financial/accounting records (e.g., bank statements, invoices, tax documents), increasing the potential harm to individuals.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 2,000
Keywords
Data Breach
Sensitive Data
November 27, 2025
Infobel
Technology
Belgium
They sold personal data for direct marketing without being able to demonstrate a valid legal basis. The case centers on Infobel’s resale of an individual’s contact/address data for a marketing campaign while failing to substantiate that the data could lawfully be used that way. They relied on “consent passed along from another party” but couldn’t prove it was valid for Infobel’s marketing resale use. Infobel said consent was obtained at the telecom subscription stage, but the complainant disputed this and the authority treated the underlying permission as not legally sufficient/credible for Infobel’s processing.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
CMP
UC
SRR
Assessments
TrustHub
Fine / Penalty
€ 40,000
Keywords
Mishandling Data
Unlawful Marketing
November 24, 2025
Telecommunications operator (operator of electronic communications networks and services)
Telecommunications
Croatia
The company kept sending customer data to a non-EU partner without proper legal protections or clear notice to customers, collected more sensitive employee documents than it reasonably needed, and handed data to a marketing partner without first checking that partner’s security. In short, it shared and stored people’s information in risky and unfair ways that didn’t match privacy rules.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Trusthub
Vendor
Fine / Penalty
€ 4,500,000
Keywords
Mishandling Data
Unlawful Marketing
November 21, 2025
Jam City
Technology
USA
According to the California Attorney General, Jam City failed to give people using its games a simple, working way to say “don’t sell or share my data” as required by the CCPA. Many of its mobile games did not include an in-app opt-out mechanism at all, or the opt-out link didn’t actually stop the company from sending users’ data to advertising and analytics partners for targeted ads. The investigation also found that Jam City continued to sell or share personal information about teens aged 13–16 for advertising without first getting their clear permission, even though California law gives extra protection to young people.
Privacy Law
CCPA
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
AG
Related Products
CMP
UC
SRR
Assessments
Fine / Penalty
$1,400,000
Keywords
Tracking Tech
Sensitive Data
November 19, 2025
Greencorp S.R.L.
Retail
Romania
A Romanian furniture manufacturer was sanctioned because a cyberattack was able to encrypt and potentially expose a very detailed employee database, and the regulator found that the company’s security controls and regular testing were not strong enough for the sensitive information it was holding.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 3,000
Keywords
Data Breach
November 17, 2025
PGS SOFA & CO SRL
Retail
Romania
A Romanian furniture manufacturer was sanctioned because a cyberattack exposed the salaries and bank details of many employees, customers and partners, and the regulator decided the company hadn’t put strong enough security in place or regularly tested it, then ordered them to upgrade protections (including multi-factor logins and better password rules).
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 8,000
Keywords
Data Breach
Sensitive Data
November 13, 2025
Hong Kong College of Technology (HKCT)
Public Sector
Hong Kong
One of its servers containing personal data was attacked by ransomware and the data was maliciously encrypted (the Data Breach Incident). The incident affected approximately 8,146 individuals, including students, course applicants, and former employees. The affected personal data included names, identity card numbers, mobile phone numbers, home phone numbers, dates of birth, email addresses, genders, photographs, certificate examination results and proof of academic results, staff positions, corresponding departments, names of supervisors and their comments, addresses, bank account numbers, and partial bank transaction records.
Privacy Law
Hong Kong Personal Data (Privacy) Ordinance (PDPO)
Level of Government
Federal
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
N/A
Keywords
Data Breach
Sensitive Data
November 13, 2025
HKICC Lee Shau Kee School of Creativity
Public Sector
Hong Kong
A2024 cyberattack in which hackers broke into the school’s servers, encrypted them and affected personal data for about 1,300 people, including students, parents, staff, freelancers, alumni and tenants, with information like names, addresses, Hong Kong ID numbers, bank details and tax data.
Privacy Law
Hong Kong Personal Data (Privacy) Ordinance (PDPO)
Level of Government
Federal
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
N/A
Keywords
Data Breach
Sensitive Data
November 12, 2025
Rocket Mortgage, LLC
Financial Services
USA
This lawsuit says Rocket Mortgage kept calling a Florida consumer for sales purposes even after she texted “STOP” and received a confirmation that she had been unsubscribed, then continued calling her many times over the following weeks. It seeks to represent nationwide and Florida classes of people who, like her, weren’t Rocket customers, sent a text opt-out, and still kept getting calls, arguing that Rocket ignored people’s “don’t call me” requests in violation of federal and Florida telemarketing rules.
Privacy Law
TCPA
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
AG
Related Products
CMP
UC
SRR
Assessments
Fine / Penalty
TBD
Keywords
Tracking Tech
Unlawful Marketing
November 12, 2025
Fan Courier Express S.R.L.
Logistics
Romania
A large courier service a customer’s request to see and erase their personal data and kept an unnecessary, negative note about that customer in its systems, which the authority said was unfair and not properly justified under GDPR.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
€ 4,000
Keywords
Mishandling Data
Other Actions
Fan Courier was ordered to send a full response to the complainant, including a secure copy of all their personal data, re-evaluate whether it really needs to keep certain information about the person (like the negative remark), improve privacy compliance overall, including better staff training so employees handle data requests and records correctly.
November 10, 2025
Whitedecor SRL
Retail
Romania
Following a complaint, the authority found that Whitedecor repeatedly sent unsolicited marketing SMS messages without valid consent and then failed to respond within one month to the data subject’s requests for access, erasure, and objection.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
CMP
UC
SRR
Fine / Penalty
€ 2,000
Keywords
Mishandling Data
November 7, 2025
Klass Wagen S.R.L.
Logistics
Romania
The investigation found that a former employee disclosed credentials of colleagues, enabling unauthorized access to a contract-management system and exposure of personal data (including names, addresses, phone numbers, emails, place/date of birth, driving licence number, ID/passport series and number, CNP) for a large number of data subjects—including individuals in other EU/EEA states.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 9,450
Keywords
Data Breach
November 6, 2025
Illuminate Education, Inc. (Illuminate)
Technology
USA
Illuminate did not adequately lock down its student-data systems, left powerful old accounts active, didn’t watch closely enough for suspicious access, and overstated how safe its platform was—so when attackers came, they were able to steal highly sensitive information about school children across multiple states.
Privacy Law
K-12 Pupil Online Personal Information Protection Act (KOPIPA)
Level of Government
State
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
AG
Related Products
Assessments
Fine / Penalty
$5,100,000
Keywords
Data Breach
Sensitive Data
Other Actions
Subject to court approval, Illuminate has agreed to: Implement appropriate access control and account management, including terminating the credentials of former employees and conducting audits to check that all valid credentials belong only to current employees. Implement appropriate real-time monitoring and alerts for suspicious access and activity. Implement appropriate safeguards to protect backup databases, such as not storing backup databases within the same network segment as original databases. Inform California DOJ of breaches involving student data. Provide reminders to school districts that they should perform a review of the student data stored by Illuminate on the school’s behalf, including reminders related to retention and deletion of student data.
November 6, 2025
Lead Pronto Ltd
Technology
United Kingdom
Lead Pronto sent unsolicited marketing text messages to people’s mobile phones promoting “government funded boiler grants,” without having the proper permission from those people to contact them in this way.
Privacy Law
Data Protection Act 1998
Level of Government
Federal
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
Assessments
CMP
UC
SRR
Fine / Penalty
£30,000
Keywords
Unlawful Marketing
November 4, 2025
THERE'S AN AI FOR THAT S.R.L
Technology
Romania
An investigation found that cookies that were not technically necessary were stored on the user's equipment on the website owned by the operator, without clear and complete information and without the express consent of the data subjects.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
CMP
UC
Fine / Penalty
€ 5,895
Keywords
Tracking Tech
October 30, 2025
Technology
USA
Texas accused Google of secretly tracking people in ways that didn’t match what users were told. According to the lawsuits, Google continued gathering location data even when people thought they had turned tracking off, collected browsing activity in Chrome’s “Incognito” mode that users reasonably believed was private, and harvested highly sensitive biometric information—like face geometry from photos and voiceprints from voice-assistant products—without getting Texans’ clear permission or being upfront about how that data would be used.
Privacy Law
Capture Or Use Of Biometric Identifier Act
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
AG
Related Products
CMP
UC
SRR
Assessments
TrustHub
Fine / Penalty
$1,375,000,000
Keywords
Tracking Tech
Sensitive Data
October 30, 2025
Sling
Technology
USA
As part of an ongoing investigation—launched in July 2024—into the compliance of streaming platforms and connected-TV providers with CCPA opt-out requirements, the DOJ found that Sling: 1) Failed to provide an easy-to-use, frictionless method for consumers to stop the sale of their personal information 2) Did not implement adequate privacy protections for children, particularly around data collection and usage practices, and 3) Did not design its opt-out process with consumer behavior and interaction patterns in mind, resulting in an overly burdensome experience.
Privacy Law
CCPA
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
AG
Related Products
CMP
UC
SRR
Trusthub
Fine / Penalty
$ 530,000.00
Keywords
N/A
October 29, 2025
Vinomofo
Logistics
Australia
Failed to take reasonable steps to protect the personal information it held, leading to unauthorised access during a large-scale data migration. It also neglected to foster a culture of privacy or adequate security governance and training in respect of its customers’ data.
Privacy Law
Privacy Act 1988
Level of Government
Federal
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
OAIC
Related Products
Assessments
Fine / Penalty
€ 0
Keywords
Data Breach
October 28, 2025
Marina Bay Sands Pte Ltd (MBS)
Entertainment
Singapore
Marina Bay Sands was punished because it left a part of its website unprotected after a big software migration, which let criminals get into a system linked to its “ArtScience Friends” programme and steal the names and contact details of about 665,000 patrons, later found for sale on the dark web. During the migration, the company relied on a single employee to manually list technical settings for many connected systems, didn’t have a proper second check, and then failed to notice for six months that security rules were missing, which the regulator said was not good enough protection for such a large business holding so much customer data.
Privacy Law
Singapore Personal Data Protection Act (PDPA)
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
S$315,000
Keywords
Data Breach
October 28, 2025
SIA 'ZZ Dats'
Technology
Latvia
A Latvian IT company that runs the shared system for local municipalities was punished because weak security let outsiders access and copy personal data about residents and municipal staff, and the regulator decided the company hadn’t protected this information well enough under GDPR.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 300,000
Keywords
Data Breach
October 28, 2025
APARELLS ORTOPEDICS CURTO, S.L
Healthcare
Spain
A small Spanish orthopaedics company was sanctioned because it failed to give a patient a complete copy of their medical records, lost part of that information, and handled the request so badly that it even talked about deleting the data instead of providing access, which the regulator said showed poor protection and management of sensitive health data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
€ 6,000
Keywords
Mishandling Data
Sensitive Data
October 27, 2025
Gynecological Center
Healthcare
Poland
The medical centre sent a document containing another patient’s personal and banking details along with the name of a genetic test, thereby exposing sensitive health- and identity-related information. They then failed to report the incident or notify the affected person in a timely manner despite the risk posed by the disclosure.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 9,450
Keywords
Data Breach
October 23, 2025
Comune di Avola
Public Sector
Italy
The town of Avola got in trouble because it hadn’t properly told the public or the Italian privacy regulator who its data protection officer was, and it only fixed the problem after the regulator started an investigation.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
TrustHub
Fine / Penalty
€ 2,000
Keywords
Privacy Notice
October 23, 2025
Statista Aldo Moro' Higher Education Institute in Fara Sabina
Public Sector
Italy
The school accidentally put a student’s name in a public file name tied to discipline, didn’t give a proper formal response when the family raised a privacy complaint, and had not set up the required privacy officer role on time.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
SRR
Fine / Penalty
€ 4,000
Keywords
Mishandling Data
October 23, 2025
Aktia Pankki Oyj
Financial Services
Finland
Failed to properly plan, implement and test a technical change in its strong electronic identification service, which resulted in some users being able to access other customers’ highly sensitive data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 865,000
Keywords
Data Breach
Sensitive Data
October 22, 2025
Agency for Control of Outstanding Debts S.R.L.
Financial Services
Romania
Failed to respond adequately and within the legal timeframe to a data subject access request (DSAR).
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
€ 2,000
Keywords
Mishandling Data
October 20, 2025
S.P.E.E.H. HIDROELECTRICA SA
Logistics
Romania
a customer received another person’s electricity invoice, exposing detailed personal and billing information. The breach, caused by a technical error in the company’s invoicing system, led to the unauthorized disclosure of multiple customers’ personal data. The regulator found that Hidroelectrica failed to maintain adequate control over personal data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Fine / Penalty
€ 5,000
Keywords
Data Breach
Sensitive Data
October 16, 2025
Experian Nederland B.V.
Technology
Netherlands
The company processed personal data for consumer credit-scoring without sufficient legal basis and failing to properly inform individuals.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
Data Mapping
Fine / Penalty
€ 2,700,000
Keywords
Mishandling Data
October 16, 2025
PRIME TRANSACTION SA
Financial Services
Romania
A cyberattack in June 2025 exposed sensitive personal data, including identification numbers, financial details, and identity documents. The regulator found that the company failed to implement adequate technical and organizational security measures and did not regularly test or evaluate the effectiveness of its protections.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 2,000
Keywords
Data Breach
Sensitive Data
October 15, 2025
CAPITA PENSION SOLUTIONS LIMITED
Financial Services
United Kingdom
A cyber attack in April 2023 which saw hackers gain access to over 6m people’s data. The breach occurred from a lack of “appropriate technical and organizational measures” and failed to promptly isolate a compromised device (leaving it active for 58 hours), enabling the attacker to escalate and exfiltrate data.
Privacy Law
UK GDPR
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 6,880,000
Keywords
Data Breach
Sensitive Data
October 15, 2025
CAPITA PLC
Financial Services
United Kingdom
A cyber attack in April 2023 which saw hackers gain access to over 6m people’s data. The breach occurred from a lack of “appropriate technical and organizational measures” and failed to promptly isolate a compromised device (leaving it active for 58 hours), enabling the attacker to escalate and exfiltrate data.
Privacy Law
UK GDPR
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 9,180,000
Keywords
Data Breach
Sensitive Data
October 13, 2025
Vellea Home SRL
Retail
Romania
The authority determined that, following a cybersecurity incident (a data breach), Vellea Home lacked “appropriate technical and organizational measures” to maintain confidentiality, integrity, availability, and resilience of processing systems.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 5,000
Keywords
Data Breach
October 9, 2025
EON ENERGIE ROMANIA S.A.
Logistics
Romania
A cyber attack led to unauthorised access to the personal data (email addresses and passwords) of a significant number of data subjects and has generated a high risk of potential financial damage.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 25,000
Keywords
Data Breach
September 30, 2025
[Name Not Public]
Financial Services
Germany
The company had commissioned service providers to send postal advertising. In several cases and over a longer period of time, the company did not fulfil the rights of data subjects asserted by the recipients after receiving the advertising letter.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
CMP
UC
SRR
Trusthub
Assessments
Fine / Penalty
€ 195,000
Keywords
Unlawful Marketing
September 30, 2025
[Name Not Public]
Logistics
Germany
Despite a good credit rating, the credit card applications of several customers had been rejected using automated decisions – these are decisions made on the basis of algorithms and without human intervention. When the affected customers then demanded a justification for the rejected applications, the company did not sufficiently fulfil its statutory information and disclosure obligations.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
CMP
UC
SRR
Trusthub
Assessments
Fine / Penalty
€ 492,000
Keywords
N/A
September 30, 2025
Tractor Supply Company
Retail
USA
The company failed to notify consumers and job applicants of their privacy rights, provide effective opt-out mechanisms, and establish proper contracts with third parties receiving personal data.
Privacy Law
CCPA
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
CPPA
Related Products
CMP
UC
SRR
Trusthub
Fine / Penalty
$ 1,350,000.00
Keywords
N/A
September 25, 2025
SERVACE S.L.
Public Sector
Spain
The company lacked a lawful basis for processing and failed to uphold data confidentiality principles, when it used an employee’s personal email address for work communications without consent and exposing that address to other recipients.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
CMP
UC
SRR
Fine / Penalty
€ 20,000
Keywords
N/A
September 25, 2025
S.C. PRIMONET RO S.R.L.
Retail
Romania
An investigation followed a self-reported cyberattack that exposed customers’ payment card details—including card numbers, CVCs, and names—leading to unauthorized transactions and financial loss.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 20,000
Keywords
Data Breach
Sensitive Data
September 23, 2025
[Name Not Public]
Logistics
Spain
A complaint let to an investigation by the DPA that found the homeowner association was operating an insecure website that exposed residents’ personal data. The website lacked HTTPS encryption and used a shared username and password for all residents, leaving sensitive documents—such as meeting minutes and debt information—accessible without adequate safeguards.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 600
Keywords
Data Breach
Sensitive Data
September 22, 2025
DHL PARCEL IBERIA, S.L.
Logistics
Spain
A customer filed a complaint, because the company included more personal information than needed on shipping labels.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 3,000
Keywords
Data Breach
September 18, 2025
Dr. Max SRL
Healthcare
Romania
The case stemmed from the company’s refusal to honor a data subject’s deletion request and for unlawfully retaining a copy of the individual’s ID without consent. Investigators also found Dr. Max failed to respond to the deletion request.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
€ 1,000
Keywords
N/A
September 18, 2025
[Name Not Public]
Technology
Ireland
An undercover investigation by RTÉ Prime Time has found data showing the specific movement of tens of thousands of smartphones in Ireland is available to purchase. The Irish DPA is working to identify the data broker.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
CMP
UC
SRR
Trusthub
Fine / Penalty
TBD
Keywords
Tracking Tech
September 18, 2025
SAMARITAINE SAS
Retail
France
Due to an increase in cargo thefts in its storage areas, the company SAMARITAINE SAS installed new cameras in two of its facilities. These cameras were disguised as smoke detectors and were capable of recording audio. The CNIL determined that this situation did not constitute an exceptional circumstance that would justify an exception to the rule requiring that CCTV cameras monitoring employees be visible and not hidden.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 100,000
Keywords
Tracking Tech
September 16, 2025
Canada Goose
Retail
USA
A class action lawsuit was filed in the U.S. District Court for the Central District of California against outdoor apparel retailer Canada Goose. The suit alleges that the company tracks website visitors’ IP addresses, session data, clickstream activity, and form inputs in real time without consent. The tracking reportedly occurs through third-party tools from Google, TikTok, Snapchat, and others.
Privacy Law
CIPA
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
Class Actions Lawsuit
Related Products
CMP
UC
Fine / Penalty
TBD
Keywords
Tracking Tech
September 11, 2025
Casa di Cura Città di Roma
Healthcare
Italy
The medical clinic violated GDPR principles by automatically applying patients’ consent for electronic health records to past medical data without explicit authorization.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
CMP
UC
SRR
Fine / Penalty
€ 12,000
Keywords
N/A
September 10, 2025
Moncler
Retail
South Korea
Attackers obtained administrator credentials, installed malware on a domain controller, and exfiltrated and encrypted data. Regulators found Moncler failed to implement strong authentication measures and did not notify users within the 24-hour requirement under South Korea’s Personal Information Protection Act (PIPA).
Privacy Law
PIPA
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
$ 63,529.00
Keywords
Data Breach
September 9, 2025
Joint Investigative Privacy Sweep: CA, CO, and CT
All
USA
The California Privacy Protection Agency (CPPA), together with the Attorneys General of Colorado and Connecticut, launched a coordinated investigative sweep targeting businesses that may be ignoring consumers’ Global Privacy Control (GPC) signals—browser-based requests to stop selling or sharing personal information.
Privacy Law
CCPA, CPA, CTDA
Level of Government
State
Employee Count
All
Estimated Annual Revenue
All
Who Enforced
AG
Related Products
CMP
UC
Fine / Penalty
TBD
Keywords
Tracking Tech
September 9, 2025
Unita Turism Holding S.A.
Logistics
Romania
The company found following a computer attack, personal data belonging to current and former employees were unauthorised disclosed and extracted, namely: name and surname, position, place of residence, personal identification number, medical and financial-banking documents. It was found they did not have in place at the time of the cyber attack, adequate technical and organisational measure.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 5,000
Keywords
Data Breach
Sensitive Data
September 8, 2025
S-Pankki Oyj
Financial Services
Finland
A new login feature on the S-Mobiili app in April 2022 introduced a software bug that allowed unauthorized access to accounts, potentially compromising transaction details, balances, and personal information. S-Pankki self-reported the issue, after it had persisted for several months.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 3,000,000
Keywords
Data Breach
September 5, 2025
Temu
Retail
USA
The complaint highlights failures to provide consumers with accessible tools for reporting suspicious or unsafe listings, especially within Temu’s “gamified” shopping interface, and to clearly disclose identifying information for high-volume third-party sellers, as required by law. This case is the first enforcement action brought under the INFORM Act.
Privacy Law
INFORM Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
FTC
Related Products
Trusthub
Fine / Penalty
$ 2,000,000.00
Keywords
N/A
September 5, 2025
Allium UPI
Healthcare
Estonia
The company failed to safeguard sensitive client data and lacking basic cybersecurity measures. The breach—discovered in early 2024—exposed the personal information of over 750,000 individuals, including children and vulnerable groups, through unauthorized repeated access to the loyalty database and backup systems
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 3,000,000
Keywords
Data Breach
Sensitive Data
September 4, 2025
[Name Not Public]
Logistics
Belgium
A student filed a complaint with the APD against the use of surveillance cameras in the residence he occupied. While the protection of a property is a legitimate aim, the surveillance of students, on the other hand, contravened the principle of the "peaceful enjoyment" of a tenant, and could create a "chilling effect" (when the person who feels constantly monitored tends to adapt his or her behavior). The negative impact of the processing of the camera images on the students' private lives therefore did not allow the owner's interests to prevail over their own. In addition, the cameras filmed part of the public road and the property of the neighbors, thus violating the principle of data minimization (which states that no more data may be processed than is necessary to achieve the purpose pursued).
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
Assessments
SRR
Fine / Penalty
€ 9,700
Keywords
Tracking Tech
September 3, 2025
PowerSchool
Technology
USA
Texas Attorney General Ken Paxton filed a lawsuit against PowerSchool—a California-based provider of cloud-based services for K-12 schools—after a December 2024 data breach exposed sensitive personal and health information of over 880,000 Texas students and teachers. The breach occurred via a subcontractor’s compromised credentials, enabling unauthorized access to unencrypted data, including names, addresses, Social Security numbers, medical and special education details, and even bus stop locations.
Privacy Law
Texas Deceptive Trade Practices Act and the Identity Theft Enforcement and Protection Act
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
AG
Related Products
Assessments
Vendor
Fine / Penalty
TBD
Keywords
Data Breach
Sensitive Data
September 1, 2025
[Name Not Public]
Unknown
Spain
The company used third-party personal data—names and DNI numbers of at least six individuals—without their consent or knowledge to falsely present them as copper sellers in delivery operations, a misuse extending beyond the original contractual or employment purposes of data collection.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Vendor
Fine / Penalty
€ 1,200
Keywords
Mishandling Data
September 1, 2025
Infinite Styles Services Co. Limited (Shien subsidiary)
Retail
France
The company placed advertising and tracking cookies on users’ devices without obtaining valid consent, despite opt-out or refusal options being provided. The CNIL criticized Shein for poorly designed cookie banners that lacked necessary details—even when users clicked “Refuse all,” tracking cookies continued to be placed. The fine reflects the company’s significant user base in France—approximately 12 million unique visitors per month—and its disregard for established legal obligations
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
CMP
UC
SRR
Trusthub
Fine / Penalty
€ 150,000,000
Keywords
Unlawful Marketing
September 1, 2025
Google Ireland Limited
Technology
France
The company displayed advertisements between Gmail users’ emails without prior consent, and placing advertising cookies during Google account creation without valid, informed consent from French users.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
CMP
UC
SRR
Trusthub
Fine / Penalty
€ 125,000,000
Keywords
Unlawful Marketing
September 1, 2025
Google LLC
Technology
France
The company displayed advertisements between Gmail users’ emails without prior consent, and placing advertising cookies during Google account creation without valid, informed consent from French users.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
CMP
UC
SRR
Trusthub
Fine / Penalty
€ 200,000,000
Keywords
Unlawful Marketing
September 1, 2025
La Fantana S.R.L.
Logistics
Romania
An investigation was triggered by the company’s breach notification, which revealed that a cyberattack exposed sensitive personal data including names, surnames, bank card numbers, expiration dates, and security codes. The company lacked adequate technical and organizational security measures to protect against unauthorized access and ensure the confidentiality, integrity, and resilience of its systems.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 10,000
Keywords
Data Breach
Sensitive Data
August 26, 2025
AUTOESCUELA A.A.A.
Professional Services
Spain
The company ignored requests to access and erase their personal data and operated a video surveillance system without proper informational signage. The AEPD determined that the auto school failed to comply with its duty to inform individuals about the video monitoring, breaching the GDPR’s transparency requirements.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
CMP
UC
SRR
Trusthub
Fine / Penalty
€ 300
Keywords
N/A
August 26, 2025
ING Bank Slaski
Financial Services
Poland
The bank failed to conduct individual purpose-driven risk assessments, instead broadly implementing scanning as a procedural requirement, even when not necessary for AML obligations.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 4,323,250
Keywords
Mishandling Data
August 25, 2025
YUNEXPRESS SPAIN, S.L.
Logistics
Spain
The case originated from a complaint where a package was falsely marked as delivered. The delivery record contained the complainant’s name and address, but the DNI number and signature belonged to a third party, leading to inaccurate and misleading personal data processing. Ultimately, YUNEXPRESS was sanctioned for negligent data handling in its logistics chain, exposing customers to risks from inaccurate identity data and uncontrolled subcontractor processing.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Data mapping
Fine / Penalty
€ 5,400
Keywords
Mishandling Data
August 25, 2025
LEIVA BUS, S.L.
Logistics
Spain
The case began after a passenger filed a complaint concerning damage to their luggage. During the claims process, LEIVA BUS mistakenly sent the passenger a damage assessment document that not only contained their personal data (name, DNI, bank account, compensation amount) but also the full personal details of another unrelated individual affected by the same incident. The AEPD determined they failed to implement adequate technical and organizational safeguards to prevent unauthorized disclosure of third-party data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
SRR
Assessments
Vendor
Fine / Penalty
€ 1,800
Keywords
Data Breach
Sensitive Data
August 22, 2025
GRUPO BONATEL SL
Telecommunications
Spain
The incident, detected in September 2023, led to the encryption and exfiltration of company data, with attackers demanding ransom and publishing portions of the stolen information. The breach compromised personal data of nearly 1,000 individuals, primarily employees and ex-employees across Bonatel and affiliated companies.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 18,000
Keywords
Data Breach
Sensitive Data
August 22, 2025
BANCO INVERSIS, S.A.
Financial Services
Spain
The case stemmed from a cyberattack in late October 2023, which exploited compromised customer credentials and weaknesses in Inversis’s online investment consultation platform. Attackers used brute-force techniques and flaws in authentication controls (including a 90-day exemption from OTP revalidation allowed under PSD2) to perform unauthorized queries. This led to unauthorized access to the personal data of about 45,000 Inversis clients and up to 2 million individuals from institutional client databases
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 6,000
Keywords
Data Breach
Sensitive Data
August 18, 2025
Meta
Technology
USA
Texas Attorney General has launched an investigation into Meta, issuing civil investigative demands over concerns these platforms deceptively marketed AI chatbots as mental health tools—particularly targeting children—without medical credentials, while potentially harvesting and exploiting user data for targeted advertising.
Privacy Law
SCOPE Act
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
AG
Related Products
Assessments
Trusthub
Fine / Penalty
TBD
Keywords
Mishandling Data
Sensitive Data
August 18, 2025
SC Elite Conta SRL
Financial Services
Romania
A cyber-attack compromised a series of categories of personal data of a significant number of data subjects were affected, such as: name, surname, personal identification number, series and number of the identity card, signature, address, position and employment salary.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 3,000
Keywords
Data Breach
August 15, 2025
Otter AI
Technology
USA
The suit alleges that its AI-powered tool, Otter Notetaker, recorded and transcribed private conversations during virtual meetings without securing prior consent from all participants. Plaintiffs claim Otter used these recordings to train its AI models, violating both federal and California privacy laws.
Privacy Law
ECPA and CIPA
Level of Government
Federal
State
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
Class Actions Lawsuits
Related Products
Trusthub
CMP
UC
Assessments
Data mapping
Fine / Penalty
TBD
Keywords
Unlawful processing
Mishandling Data
Sensitive Data
August 15, 2025
T-Mobile
Telecommunications
USA
In April 2024, the US Federal Communications Commission (FCC) fined AT&T, Sprint, T-Mobile and Verizon almost US$200 million for allegedly disclosing customers’ location information without consent. T-Mobile and Sprint challenged the FCC’s forfeiture orders in November 2024. The DC Circuit denied this petition.
Privacy Law
Telecommunications Act 1996
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
FCC
Related Products
Trusthub
CMP
UC
Assessments
Data mapping
Fine / Penalty
$ 92,000,000.00
Keywords
Mishandling Data
Sensitive Data
August 14, 2025
WORLD 2 MEET, S.L.
Logistics
Spain
The case began with a June 2024 complaint from a customer who booked a villa and was required to submit full copies of ID documents for all guests as part of the online check-in process. The complainant argued that only the information required by Spanish security regulations (Real Decreto 933/2021) should be provided, not entire scanned documents. The AEPD determined that requesting complete copies of ID cards or passports was excessive and unnecessary.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Regulatory Guidance
Assessments
Fine / Penalty
€ 42,000
Keywords
Unlawful processing
Mishandling Data
Sensitive Data`
August 14, 2025
Children’s Health Ireland (CHI)
Healthcare
Ireland
This formal inquiry will examine CHI’s compliance with their GDPR obligations, in particular relating to the security of personal data and the processes that CHI have in place for managing physical records at CHI (Tallaght).
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
TBD
Keywords
Data Breach
Sensitive Data
August 14, 2025
Roblox
Technology
USA
The state of Louisiana has filed a complaint against Roblox, alleging that the company falsely advertised its gaming platform as safe for children. The complaint asserts Roblox failed to implement basic safeguards, such as blocking multiple accounts from the same device or IP address, and neglected to provide adequate warnings about predator risks. Regulators argue these omissions contradict Roblox’s public claims of child safety.
Privacy Law
Louisiana Unfair Trade Practices Act 1972
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
AG
Related Products
Assessments
Trusthub
Fine / Penalty
TBD
Keywords
Privacy Notice
August 12, 2025
REAL SOCIEDAD DE FUTBOL S.A.D.
Entertainment
Spain
A ransomware attack (variant: Akira) in October 2023 encrypted all of the club’s virtualized servers, disrupting access to personal data of approximately 60,000 individuals. The compromised data included a wide range of information: names, ID/passport numbers, contact details, account numbers, biometric data, images, health data (for employees), and sensitive data linked to players and staff such as medical, psychological, and performance records.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Data mapping
Fine / Penalty
€ 66,000
Keywords
Data Breach
Sensitive Data
August 12, 2025
REAL FEDERACION ESPANOLA DE TENIS DE MESA
Entertainment
Spain
The case arose from a complaint during the federation’s 2024 electoral process, where the RFETM published—without restriction on its official website—full texts of electoral appeals submitted by a candidate. These documents contained the complainant’s personal data (name, surname, ID number, home address, phone number, email, job position, references, and handwritten signature) as well as third-party data. The AEPD determined that no law justified the disclosure of full unredacted documents online.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 1,600
Keywords
Data Breach
Sensitive Data
August 12, 2025
GACM SEGUROS GENERALES, COMPANIA DE SEGUROS Y REASEGUROS S.A.U.
Financial Services
Spain
The AEPD found that GACM Seguros had failed to implement sufficient controls to ensure the accuracy and proper allocation of customer data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 4,800
Keywords
Data Breach
Sensitive Data
August 12, 2025
Flexicredit
Financial Services
Romania
The violation stemmed from granting 17 loans in 2023–2024 based on falsified documents sent electronically by a third party without the consent of the individuals concerned. FLEXICREDIT failed to adequately verify applicants’ identities for remote credit applications and did not implement sufficient technical and organizational security measures.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
CMP
UC
SRR
Assessments
Vendor
Fine / Penalty
€ 3,000
Keywords
Data Breach
Sensitive Data
August 6, 2025
Tractor Supply Company
Retail
USA
The CPPA's petition alleges that Tractor Supply failed to comply with a subpoena seeking information about the company's compliance with the California Consumer Privacy Act of 2018. The petition marks the CPPA's first public disclosure of an ongoing investigation into a company, and the CPPA's first judicial action to enforce an investigative request.
Privacy Law
CCPA
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
CPPA
Related Products
CMP
UC
SRR
Assessments
Fine / Penalty
TBD
Keywords
Privacy Notice
Tracking Tech
August 5, 2025
Order of Biochemists
Healthcare
Romania
An investigation began after a data subject complained that the organization ignored their requests to access personal data. The organization failed to provide a complete or timely written response, breaking the rules on how and when to communicate with individuals. They also did not follow the Supervisory Authority’s instruction to respond properly to the person, violating their duty to cooperate with the authority.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
€ 1,000
Keywords
Mishandling Data
August 4, 2025
[Name Not Public]
Healthcare
Poland
The incident occurred at a non-public healthcare facility (niepubliczny ZOZ) in Pyskowice, where a car containing patient records was stolen. The theft exposed a critical oversight: the facility had not recognized the risk of transporting medical records in a vehicle.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 7,700
Keywords
Data Breach
Sensitive Data
August 1, 2025
[Name Not Public]
Retail
Thailand
A collectible toy company’s reservation system, managed by a third-party data processor, was compromised for about 10 minutes, during which 200,000 personal data records were unlawfully amended. While the toy company, as data controller, took prompt remedial action for affected individuals, the data processor failed to contain the breach, notify the controller, or provide remediation. Regulators highlighted inadequate security safeguards and a failure to comply with breach notification requirements.
Privacy Law
Personal Data Protection Act
Level of Government
Federal
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
PDPC
Related Products
SRR
Trusthub
Assessments
Fine / Penalty
$92,435
Keywords
N/A
August 1, 2025
[Name Not Public]
Retail
Thailand
A cosmetics company experienced a data breach that exposed customer information to a call-center scam operation. While the company took steps to provide remedial action to affected individuals, regulators found it had failed to implement adequate security measures and did not notify the PDPC of the breach as required under the PDPA.
Privacy Law
Personal Data Protection Act
Level of Government
Federal
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
PDPC
Related Products
SRR
Trusthub
Assessments
Fine / Penalty
$76,210
Keywords
Data Breach
August 1, 2025
[Name Not Public]
Retail
Thailand
A company suffered a data breach that enabled scammers to target individuals through fraudulent call center schemes, leading to over 100 complaints filed with the PDPC. Regulators found that the company lacked sufficient security measures, failed to report the breach in a timely manner, and had not appointed a Data Protection Officer (DPO). The company also failed to provide required remedial action to affected individuals within the prescribed timeframe.
Privacy Law
Personal Data Protection Act
Level of Government
Federal
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
PDPC
Related Products
SRR
Trusthub
Assessments
Fine / Penalty
$213,380
Keywords
Data Breach
August 1, 2025
[Name Not Public]
Healthcare
Thailand
A hospital hired a contractor to destroy patient medical records, but the contractor mishandled the documents by storing them improperly, failing to follow destruction protocols, and even using them to wrap sweets. More than 1,000 patient records were leaked.
Privacy Law
Personal Data Protection Act
Level of Government
Federal
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
PDPC
Related Products
Assessments
Vendor
Fine / Penalty
$36,880
Keywords
Data Breach
Sensitive Data
August 1, 2025
[Name Not Public]
Public Sector
Thailand
A cyberattack on a state agency’s web application exposed the personal data of 200,000 individuals, which was later sold on the dark web. Regulators found that the agency and its software developer failed to implement basic security and privacy safeguards, including access controls, risk assessments, and breach prevention measures. The agency also lacked a proper data processing agreement with its software vendor.
Privacy Law
Personal Data Protection Act
Level of Government
Federal
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
PDPC
Related Products
Assessments
Vendor
Fine / Penalty
$4,670
Keywords
Data Breach
July 29, 2025
Accurate Append, Inc
Technology
USA
Accurate Append failed to register and pay the annual data broker fee required under the Delete Act for the 2023 calendar year by the January 31, 2024 deadline, as required by California law. The company only completed its registration after being contacted by the CPPA Enforcement Division and agreed to pay an administrative fine.
Privacy Law
Delete Act
Level of Government
State
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
CPPA
Related Products
Regulatory Guidance
Assessments
Fine / Penalty
$55,400
Keywords
N/A
July 28, 2025
[Name Not Public]
Professional Services
Poland
The company collected an employee’s biometric data without a valid legal basis and failed to cooperate with the data protection authority during the investigation.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
CMP
UC
SRR
Assessments
Fine / Penalty
€ 4,400
Keywords
Mishandling Data
Sensitive Data
July 23, 2025
Agricola International SA
Logistics
Romania
An investigation was launched after Agricola International SA reported a personal data breach, as required by law. The breach occurred following a cyberattack that exposed a wide range of sensitive personal data belonging to employees, their family members, and customers. The exposed data included identity documents, contact details, employment information, banking details, and medical and salary records.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 5,000
Keywords
Data Breach
Sensitive Data
July 21, 2025
24/7 Communication Sp. z o.o.
Professional Services
Poland
The infractions stemmed from mismanagement of employee scheduling data, including exposure of personal identifiers (PESEL and passport numbers) in a publicly accessible directory, poor contractual oversight, and inadequate risk assessments and security measures. UODO additionally issued a reprimand to McDonald’s for failing to directly notify affected (former) employees of the personal data breach through proper channels.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Vendor
Assessments
Fine / Penalty
€ 43,000
Keywords
Data Breach
Sensitive Data
July 21, 2025
McDonald’s Polska Sp. z o.o.
Retail
Poland
McDonald's Polska Sp. z o.o. has entrusted the processing of personal data of employees of the restaurant chain to an external company for the purpose of managing work schedules. Failure to analyse the risk of this process, implement appropriate safeguards, and implement the provisions of the personal data processing agreement led to the disclosure of personal data in a publicly available catalogue.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Vendor
Assessments
Fine / Penalty
€ 3,955,000
Keywords
N/A
July 16, 2025
Georgescu Călin
Public Sector
Romania
An investigation found that between December 2024 and April 2025, the operator’s website placed cookies on users’ devices without first getting their clear, informed consent. The site also failed to tell users how their personal information (such as name, email, and phone number) submitted through a contact form would be used.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
TrustHub
CMP
UC
SRR
Fine / Penalty
€ 9,912
Keywords
Privacy Notice
Tracking Tech
July 9, 2025
SC Tremend Software Consulting SRL
Professional Services
Romania
In June 2025, Romania’s National Supervisory Authority for Personal Data Processing fined SC Tremend Software Consulting SRL after finding that it failed to properly secure employee data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 3,000
Keywords
Data Breach
July 8, 2025
Selgros Cash & Carry SRL
Retail
Romania
During the DPA's investigation, it was found that, due to an error in the programming or implementation of an application, personal data belonging to several targeted individuals were revealed.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 3,000
Keywords
Data Breach
July 8, 2025
Old Lemmer Foundation
Non-Profit
Netherlands
Unlawfully live-streaming public-space video without a GDPR legal basis.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 500
Keywords
Unlawful processing
July 8, 2025
General Motors
Transportation
USA
AG Hilgers filed a lawsuit against General Motors for deceptive collection and sale of Nebraskans’ driving data. It is alleged that General Motors LLC and OnStar LLC unlawfully collected, processed, and sold sensitive driving data from Nebraskans without their knowledge or consent.
Privacy Law
Nebraska Consumer Protection Act and Uniform Deceptive Trade Practices Act
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
AG
Related Products
TrustHub
CMP
UC
SRR
Fine / Penalty
TBD
Keywords
Selling Data
Sensitive Data
Tracking Tech
July 8, 2025
TicketNetwork
Technology
USA
TicketNetwork's privacy notice was found to be unreadable, missing essential data rights, and containing malfunctioning rights mechanisms.
Privacy Law
Connecticut Data Privacy Act
Level of Government
State
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
AG
Related Products
Trusthub
SRR
Fine / Penalty
$85,000
Keywords
Privacy Notice
July 7, 2025
Alliance for the Union of Romanians Party (AUR)
Public Sector
Romania
A configuration mistake in the aur.mobi app accidentally exposed a wide range of users’ personal information—everything from names, contact details, IDs and addresses to demographics (like age, gender, nationality, religion), education and work history—so anyone using the app at that time could view it.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 15,000
Keywords
Data Breach
Sensitive Data
July 7, 2025
Deer Oaks
Healthcare
USA
Deer Oaks exposed ePHI in two incidents: a coding error in a pilot portal made 35 patients’ data publicly accessible online, and a ransomware attack in August 2023 compromised data for 171,871 individuals. OCR found Deer Oaks failed to conduct a proper risk analysis.
Privacy Law
HIPAA
Level of Government
Federal
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
OCR
Related Products
Assessments
Vendor
Data Mapping
Fine / Penalty
$225,000
Keywords
Data Breach
Sensitive Data
July 3, 2025
Apoteket AB
Healthcare
Sweden
Apoteket AB improperly transferred customers’ sensitive health-related data to Meta via the Meta Pixel on their websites
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Vendor
Data Mapping
Fine / Penalty
SEK 37 million
Keywords
Data Breach
Sensitive Data
Tracking Tech
July 3, 2025
Apohem AB
Healthcare
Sweden
Apohem AB improperly transferred customers’ sensitive health-related data to Meta via the Meta Pixel on their websites
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Vendor
Data Mapping
Fine / Penalty
SEK 8 million
Keywords
Data Breach
Sensitive Data
Tracking Tech
July 1, 2025
U.S. Department of Health and Human Services’ (HHS)
Public Sector
USA
Attorney General Dan Rayfield and several states have sued HHS for sharing private Medicaid health records with DHS (including ICE).N10
Privacy Law
Medicaid Act
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
AG
Related Products
Assessments
Fine / Penalty
TBD
Keywords
Sensitive Data
Sharing Data
July 1, 2025
Healthline
Healthcare
USA
Healthline failed to allow consumers to opt out of targeted advertising and shared data with third parties without CCPA-mandated privacy protections.
Privacy Law
CCPA
Level of Government
State
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
AG
Related Products
UC
CMP
Vendor
Assessments
Trust Hub
Fine / Penalty
$1,550,000.00
Keywords
Sensitive Data
Tracking Tech
Dark Patterns
Other Actions
Healthline must ensure opt-out tools are functional, stop sharing sensitive data, audit privacy terms in contracts, and keep its privacy disclosures accurate.
June 23, 2025
Vodafone Romania S.A.
Telecommunications
Romania
The controller did not implement adequate technical and organisational measures
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 4,000.00
Keywords
Data Breach
Other Actions
Ordered to take the corrective measure of technical and procedural implementation of a mechanism applied at regular intervals, regarding the testing, evaluation and periodic assessment of the effectiveness of the measures adopted.
June 23, 2025
Dublin Education and Training Board (CDETB)
Public Sector
Ireland
13,000 data subjects had their data compromised in a security breach in November 2018. This included special categories of PII.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Data mapping
Fine / Penalty
€125,00
Keywords
Data Breach
Other Actions
Implement adequate security.
June 20, 2025
Walmart
Retail
USA
Walmart (including in its capacity as an agent of MoneyGram, Western Union, and Ria) allowed its money transfer services to be used by scammers who defrauded consumers out of hundreds of millions of dollars.
Privacy Law
FTC Act
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
FTC
Related Products
Vendor
Assessments
Fine / Penalty
$10,000,000.00
Keywords
Data Breach
June 19, 2025
SC Diamir SRL
Retail
Romania
The investigation was started following a complaint that the operator displayed a person's identity card at the workplace, thus revealing the name, surname, address, series and number of the identity document and the photo of the person.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
SRR
Assessments
Fine / Penalty
€ 1,000.00
Keywords
Data Breach
Sensitive Data
June 18, 2025
Dincă Viorel George
Transportation
Romania
The investigation was started following a notification that a natural person had a video surveillance system inadequately mounted on a building. The controller then did not respond to the DPA investigation.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
Regulatory Guidance
Privacy Expert
Fine / Penalty
€ 200.00
Keywords
N/A
Other Actions
Required to send a complete response to the National Supervisory Authority.
June 18, 2025
AB Storstockholms Lokaltrafik
Transportation
Sweden
Following a complaint from a consumer related to daily sobriety tests, the investigation found that the company processed PII and Sensitive PII without proper legal basis.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
SRR
Assessments
Fine / Penalty
€ 6,800.00
Keywords
Unlawful processing
Sensitive Data
June 18, 2025
Waxholms Ångfartygs AB
Logistics
Sweden
Following a complaint from a consumer related to daily sobriety tests, the investigation found that the company processed PII and Sensitive PII without proper legal basis.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
SRR
Assessments
Fine / Penalty
€ 6,800.00
Keywords
Unlawful processing
Sensitive Data
June 17, 2025
23andMe
Healthcare
United Kingdom
Between April and September 2023, a hacker carried out a credential stuffing attack on 23andMe’s platform, exploiting reused login credentials that were stolen from previous unrelated data breaches. This resulted in the unauthorized access to personal information belonging to 155,592 UK residents.
Privacy Law
UK GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
£2,310,000.00
Keywords
Sensitive Data
Data Breach
June 16, 2025
Paddle.com Market Limited
Technology
USA
Paddle provided foreign-based tech-support schemes with access to the U.S. payment system, allowing these companies to harm consumers.
Privacy Law
FTC Act
Level of Government
Federal
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
FTC
Related Products
Assessments
Trust Hub
Vendor
Fine / Penalty
$5,000,000.00
Keywords
Data Breach
Other Actions
Permanently banned from processing payments for tech-support telemarketers.
June 16, 2025
SC Kashto Concept
Retail
Romania
An investigation was launched following a notification received from a data subject, which found the website owned by the operator, cookies were stored that were not technically necessary for the operation of the website.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
CMP
SRR
Fine / Penalty
€ 990.00
Keywords
Tracking Tech
June 12, 2025
Department of Social Protection (DSP)
Public Sector
Ireland
DSP failed to identify a valid lawful basis for the collection of biometric data, improperly retained this information, improperly completed a DPIA, and failed to provide information to data subjects.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
SRR
Assessments
Trust Hub
Fine / Penalty
€ 550,000.00
Keywords
Unlawful processing
Mishandling Data
Sensitive Data
Other Actions
DPA issued an order to the DSP requiring it to cease processing of biometric data in connection with SAFE 2 registration within 9 months of this decision if the DSP cannot identify a valid lawful basis.
June 12, 2025
Temu
Retail
USA
AG Hilgers, Nebraska, alleges Temu unlawfully harvests data, including from kids, utilizes multiple deceptive practices to encourage purchases, allows infringement and counterfeits to thrive, and engages in deceptive marketing to greenwash its image.
Privacy Law
Nebraska Consumer Protection Laws
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
AG
Related Products
CMP
UC
SRR
Trust Hub
Fine / Penalty
TBD
Keywords
Unlawful processing
Dark Patterns
June 12, 2025
23andMe
Healthcare
USA
AGJason Miyares, Virginia, has filed a lawsuit and separate objection to 23andMe’s plan to sell the personal genetic data of roughly 15 million consumers without their knowledge or consent in violation of Virginia law and the company’s own privacy commitments to consumers.
Privacy Law
VCDPA
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
AG
Related Products
UC
CMP
SRR
Trust Hub
Fine / Penalty
TBD
Keywords
Sensitive Data
Selling Data
June 12, 2025
Six Norwegian websites
All
Norway
The Norwegian DPA investigated six websites, and found that all of them shared visitors' personal data with third parties illegally, and in several of the cases they shared sensitive data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
UC
CMP
Vendor
Data mapping
Assessments
Fine / Penalty
NOK 250,000.00
Keywords
Sensitive Data
Mishandling Data
Tracking Tech
Unlawful processing
June 10, 2025
Accounting Audit SRL
Professional Services
Romania
Accounting Audit SRL, as a processor, has not implemented adequate technical and organizational measures in order to ensure a level of security appropriate to the risk of processing, including the ability to ensure the confidentiality and integrity of the processing systems and services.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 10,000.00
Keywords
Data Breach
June 3, 2025
Vodafone
Telecommunications
Germany
Vodafone GmbH had not adequately reviewed and monitored partner agencies working on its behalf. Further the BfDi found security deficiencies in the authentication process for the combined use of the online portal ‘MeinVodafone'.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
Vendor
Assessments
Fine / Penalty
€ 45,000,000.00
Keywords
Data Breach
May 30, 2025
AG-BROKER ASIGURARE S.R.L.
Professional Services
Romania
The controller did not implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk posed by the processing.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 5,000.00
Keywords
Data Breach
May 27, 2025
Yliopiston Apteekin
Healthcare
Finland
Deficiencies in its cookie practices and the use of other tracking technologies on its online pharmacy website.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
CMP
UC
Fine / Penalty
€ 1,100,000.00
Keywords
Mishandling Data
Unlawful processing
Tracking Tech
May 22, 2025
A.A.A
Professional Services
Spain
Insufficient legal basis for data processing. A legal representative processed a client’s sensitive information without consent.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
CMP
UC
Trust Hub
Fine / Penalty
€ 2,000.00
Keywords
Unlawful processing
May 22, 2025
Dumitru Viorel Focșa
Public Sector
Romania
It was found that the operator processed on its Facebook page (Meta), by disclosing in a public post, the personal data (name, surname, phone number) of the Authority's petitioner, without his consent.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
Regulatory Guidance
Assessments
Fine / Penalty
€ 1,000.00
Keywords
Data Breach
Mishandling Data
Unlawful processing
May 21, 2025
Data Diggers Market Research SRL
Professional Services
Romania
It was found that the controller did not provide the complainants with complete information as a result of exercising the right of access to personal data. Did not communicate with the petitioners, and did not prove a legal basis for processing.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
SRR
Assessments
Fine / Penalty
€ 12,000.00
Keywords
Mishandling Data
Unlawful processing
May 19, 2025
Replika
Technology
Italy
Lack of Legal Basis, Inadequate Privacy Policy, No Effective Age Verification, and Transparency and Accountability Failures.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Trust Hub
Assessments
Fine / Penalty
€ 5,000,000.00
Keywords
Unlawful processing
Other Actions
The Italian authority also ordered Luka Inc. to bring its data processing practices into compliance with GDPR.
May 16, 2025
ACCOUNTING & AUDIT CONSULTING SRL
Financial Services
Romania
It was found that unauthorized persons illegally accessed the personal data of the operator's customers' employees, namely: name, surname, personal identification number, domicile, position, salary, bonuses and other salary rights.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 5,000.00
Keywords
Data Breach
May 15, 2025
CALOGA
Advertising
France
Commercial prospecting without prospects’ consent and transferring their data to partners without a valid legal basis.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
CMP
UC
Vendor
Fine / Penalty
€ 80,000.00
Keywords
Unlawful Marketing
Unlawful processing
May 15, 2025
SOLOCAL MARKETING SERVICES
Advertising
France
Insufficient legal basis for data processing. Failed to obtain proper consent from individuals before using their data for marketing purposes and for sharing the data with third parties without a valid legal basis.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
CMP
UC
Vendor
Fine / Penalty
€ 900,000.00
Keywords
Unlawful processing
Unlawful Marketing
May 14, 2025
CVA TAX & FINANCE S.R.L.
Financial Services
Romania
A data breach led to the unauthorized disclosure and access to the personal data of a significant number of employees of the customers in the operator's portfolio, namely: name, surname, personal identification number, address, position, salary, bonuses and other salary r
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 2,000.00
Keywords
Data Breach
May 13, 2025
Romoffice Construct Holding Ag SRL
Logistics
Romania
The investigation was started following a complaint from a natural person, who complained that the operator Romoffice Construct Holding Ag SRL processed his personal data without his consent, it was found that the operator Romoffice Construct Holding Ag SRL processed without legal basis personal data belonging to the petitioner.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
CMP
UC
SRR
Assessments
Fine / Penalty
€ 2,000.00
Keywords
Unlawful processing
May 12, 2025
CV PRO CONSULT S.R.L.
Financial Services
Romania
It was found that, following a cyber attack, the operator's access to its own IT infrastructure was accessed and also restricted. This situation led to the unauthorized disclosure and access to the personal data of a significant number of employees of the customers in the operator's portfolio, namely: name, surname, personal identification number, address, position, salary, bonuses and other salary rights.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
Assessments
Data mapping
Fine / Penalty
€ 2,000.00
Keywords
Data Breach
May 9, 2025
ROUMASPORT SR
Retail
Romania
The investigation found that the operator unlawfully accessed the video surveillance system at a workplace, processing employees' images—including for disciplinary purposes—violating processing principles and legal conditions.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 5,000.00
Keywords
Sensitive Data
Other Actions
Improve cybersecurity operations.
May 8, 2025
Jerico Pictures, Inc., d/b/a National Public Data
Technology
USA
Failed to register and pay an annual fee as required by the Delete Act.
Privacy Law
Delete Act
Level of Government
State
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
CPPA
Related Products
Privacy Expert
Regulatory Guidance
Fine / Penalty
$46,000.00
Keywords
N/A
May 7, 2025
Acea Energia
Advertising
Italy
They engaged in aggressive telemarketing—using detailed personal data lists acquired without specific consent and misleading consumers with false technical‐issue warnings to pressure them into switching energy suppliers.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
CMP
UC
SRR
Fine / Penalty
€ 850,000.00
Keywords
Mishandling Data
Unlawful processing
Unlawful Marketing
Other Actions
Stringent corrective measures.
May 2, 2025
TikTok
Technology
Ireland
"TikTok’s personal data transfers to China infringed the GDPR because TikTok failed to verify, guarantee and demonstrate that the personal data of EEA users, remotely accessed by staff in China, was afforded a level of protection essentially equivalent to that guaranteed within the EU.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
CMP
UC
SRR
Trust Hub
Fine / Penalty
€ 530,000,000.00
Keywords
Cross-Border Transfer
Unlawful processing
Other Actions
Required TikTok to improve its EEA Privacy Policy. Also, TikTok must put an end to the transfers to China.
April 23, 2025
Real Estate Agency
Professional Services
Belgium
A complaint was filed because the agency kept publishing property listings, including precise address information and cadastral references, even after the property was sold.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
CMP
UC
Assessments
Trust Hub
Privacy Expert
Fine / Penalty
€ 6,000.00
Keywords
Sensitive Data
Mishandling Data
Unlawful processing
Other Actions
The agency was ordered to delete the data and cease its processing across all platforms.
April 23, 2025
Diskrimineringsombudsmannen
Public Sector
Sweden
The company operated a form that collected sensitive personal data that had a security misconfiguration in the analytics tool which failed to mask personal data on the form’s summary page before submission, and unintentionally transferred to an external data processor.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Data mapping
Vendor
Fine / Penalty
€ 9,200.00
Keywords
Sensitive Data
Data Breach
Mishandling Data
Other Actions
Removed form and required the processor to delete all information.
April 22, 2025
[Name Not Public]
Advertising
Belgium
Non-compliance with several general data processing principles.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
CMP
UC
SRR
Assessments
Privacy Expert
Trust Hub
Fine / Penalty
€ 20,000.00
Keywords
Mishandling Data
Unlawful processing
April 18, 2025
Court Overrules FCC’s Fine Against AT&T
Telecommunications
USA
This could have broader implications on the legality of regulatory agencies levying fines through administrative proceedings, the 5th U.S. Circuit Court of Appeals has overturned a $57 million fine imposed by the Federal Communications Commission against AT&T for violating the privacy of its customers’ location data.
Privacy Law
Communications Act of 1934
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
FCC
Related Products
CMP
UC
SRR
Assessments
Data mapping
Fine / Penalty
$57,000,000.00
Keywords
Fine Overturned
April 14, 2025
DPP Law Ltd.
Professional Services
United Kingdom
DPP failed to adopt the principle of least privilege and failed to regularly audit administrative accounts on its network.
Privacy Law
UK GDPR
Level of Government
Federal
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
£70,300.00
Keywords
Data Breach
April 11, 2025
Lusha
Advertising
Italy
The investigation follows complaints from individuals who received unsolicited calls, suggesting that their data may have been sourced from Lusha’s platform without proper consent.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
CMP
UC
Trust Hub
Fine / Penalty
TBD
Keywords
Unlawful Marketing
April 11, 2025
NOVATES ALIMENTACIÓN MADRID, S.L.
Retail
Spain
Improper handling of video surveillance data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
CMP
UC
SRR
Fine / Penalty
€ 20,000.00
Keywords
Sensitive Data
Other Actions
They were ordered to implement and notify the AEPD of technical and organizational security measures within one month to secure surveillance data appropriately.
April 10, 2025
Marina Salud
Healthcare
Spain
The Processor appointed sub-processors without authorisation from the controller.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Vendor
Fine / Penalty
€ 500,000.00
Keywords
Unlawful processing
April 9, 2025
Servicios de Integración de Andalucía
Telecommunications
Spain
(SIA) was sanctioned for including an employee’s personal phone number in a WhatsApp group used for internal communications, without valid consent or an alternative contact method.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
CMP
UC
Assessments
Fine / Penalty
€ 2,000.00
Keywords
Unlawful processing
April 3, 2025
Poczta Polska
Logistics
Poland
The postal service provider for unlawfully sharing personal data (including PESEL numbers, names, addresses, and travel details) of all registered Polish adults during the 2020 election preparations.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
Vendor
Assessments
Data mapping
Fine / Penalty
€ 6,479,424.00
Keywords
Mishandling Data
April 3, 2025
Caixabank
Financial Services
Spain
A complaint from a customer who discovered that a co-owner could access not only their joint account but also a third account due to a system error in "CaixaBankNow."
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
Assessments
Data mapping
Fine / Penalty
€ 3,500,000.00
Keywords
Sensitive Data
Data Breach
Mishandling Data
April 3, 2025
Liga Nacional de Fútbol Profesional
Entertainment
Spain
They were conducting biometric checks in stadiums without prior data protection impact assessments.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 1,000,000.00
Keywords
Sensitive Data
Notice
April 3, 2025
Ibermutua Mutua Colaboradora Con La Seguridad Social Nº 274
Healthcare
Spain
Software error that led to the accidental disclosure of personal data to third parties.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Data mapping
Fine / Penalty
€ 600,000.00
Keywords
Sensitive Data
Data Breach
Mishandling Data
April 3, 2025
[Name Not Public]
Telecommunications
Germany
They delayed responses to information requests.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
€ 120,000.00
Keywords
Mishandling Data
March 28, 2025
FUNDACIÓ PRIVADA DE SERVEIS PER ALS USUARIS DEL HABITATGE SOCIAL DE CATALUNYA
Professional Services
Spain
Failed to obtain the data subject’s consent or legal basis to process their personal bank account data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
CMP
UC
SRR
Fine / Penalty
€ 2,000.00
Keywords
Sensitive Data
Unlawful processing
March 24, 2025
Meta
Technology
United States
A state jury found the company liable for failing to protect children from sexual exploitation and predatory behavior on its platforms. The case centered on the platform's design and algorithmic recommendations, which allegedly facilitated the connection between predators and minors, leading to significant physical and emotional harm.
Privacy Law
New Mexico Consumer Protection Laws
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
AG
Related Products
N/A
Fine / Penalty
$375,000,000
Keywords
N/A
March 21, 2025
Amazon
Technology
Luxembourg
Amazon’s €746M GDPR fine upheld. Fine was from inaquadue transparency and consent management.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
Luxembourg Court
Related Products
CMP
UC
SRR
Trust Hub
Fine / Penalty
€ 756,000,000.00
Keywords
Mishandling Data
March 13, 2025
Investigative Sweep on Location Data Industry
Technology
USA
The agency is sending letters to advertising networks, mobile app providers and data brokers that appear to be violating the CCPA.
Privacy Law
CCPA
Level of Government
State
Employee Count
Unknown
Estimated Annual Revenue
N/A
Who Enforced
AG
Related Products
Data mapping
Assessments
Regulatory Guidance
Privacy Expert
Vendor
SRR
UC
CMP
Fine / Penalty
N/A
Keywords
Unlawful processing
Data Minimization
Mishandling Data
Sensitive Data
March 12, 2025
Honda
Transportation
USA
Honda required more information than needed to process opt-out and data limitation requests.
Privacy Law
CCPA
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
CPPA
Related Products
SRR
UC
Fine / Penalty
$632,500.00
Keywords
Data Minimization
March 12, 2025
Saturn Technologies
Technology
USA
They didn’t verify users’ school email addresses and age to ensure they were high school students, and didn't inform users that it would copy and use their “contact books”.
Privacy Law
New York Law
Level of Government
State
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
AG
Related Products
Data mapping
Trust Hub
Assessments
Privacy Expert
Fine / Penalty
$650,000.00
Keywords
Mishandling Data
Data Minimization
Unlawful processing
March 6, 2025
Publicaciones y Ediciones Baraca 208, S.L.
Retail
Spain
Unlawfully publishing personal data, including health information, without a legal basis.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
DPA
Related Products
Trust Hub
Privacy Expert
Assessments
Fine / Penalty
€ 6,000.00
Keywords
Data Breach
Unlawful processing
March 6, 2025
Breogan Autolux, S.L.
Retail
Spain
Sending SMS advertisements without consent.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
CMP
UC
Fine / Penalty
€ 6,000.00
Keywords
Unlawful Marketing
March 6, 2025
Polskie Radio Szczecin (Polish Radio Szczecin)
Logistics
Poland
The radio station released a press article in which a conviction for sexual harassment was described. The journalist revealed that a parliament member’s son was the victim and did it in such a way that the child could be identified.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 13,500.00
Keywords
Mishandling Data
Data Breach
March 5, 2025
EDPB enforcement sweep on SRRs
All
Europe
EDPB has launched its 2025 enforcement sweep targeting organizations’ compliance with data subjects’ right of erasure (right to delete or be forgotten), focusing particularly on how exceptions are applied. Thirty-two EU member state data protection authorities (DPAs) will participate in this year-long sweep that began March 5, 2025.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
N/A
Who Enforced
EDPB
Related Products
SRR
Fine / Penalty
TBD
Keywords
N/A
February 26, 2025
Cookie-Banner Class Actions (U.S)
All
USA
Since the beginning of 2025, several (at least three) class actions have been filed arising out of allegedly malfunctioning cookie banners. The plaintiffs claim to have opted out of non-essential cookies, but their opt-out was not effective.
Privacy Law
N/A
Level of Government
State
Employee Count
Unknown
Estimated Annual Revenue
N/A
Who Enforced
State Courts
Related Products
CMP
UC
Fine / Penalty
N/A
Keywords
N/A
February 20, 2025
Medstar S.R.L.
Healthcare
Romania
The investigation was started following a complaint from a data subject, who claimed that the operator where he performed his medical tests, the Medstar clinic, disclosed his personal data and that of another data subject.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
€ 2,000.00
Keywords
Data Breach
Mishandling Data
February 11, 2025
Amazon
Technology
USA
Maxwell v. Amazon: The plaintiffs claim that Amazon collected health data from consumers through its SDK without giving the required notice or getting consent. The complaint doesn't discuss whether this data collection could be considered necessary under MHMDA's rules. However, it suggests that since the services consumers used were provided by apps using the SDK (and not directly by Amazon), this exception doesn't apply.
Privacy Law
MHMDA
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
State Courts
Related Products
CMP
UC
Trust Hub
Fine / Penalty
TBD
Keywords
Sensitive Data
Unlawful processing
February 5, 2025
ORANGE ESPAGNE, S.A.U.
Telecommunications
Spain
Unauthorized duplication of the complainant's SIM card, leading to financial losses.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 1,200,000.00
Keywords
Data Breach
Other Actions
ORANGE was ordered to implement measures to ensure that SIM card duplications are only carried out with proper verification of the requester's identity.
February 4, 2025
[Name Not Public]
Retail
France
Disproportionate surveillance of its employees' activity, through software.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Privacy Expert
Assessments
Fine / Penalty
€ 40,000.00
Keywords
Data Minimization
Tracking Tech
Unlawful processing
January 23, 2025
Softehnica S.R.L.
Logistics
Romania
Insufficient technical and organisational measures to ensure information security.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
DPA
Related Products
Assessments
Data mapping
Fine / Penalty
€ 2,000.00
Keywords
Mishandling Data
January 20, 2025
Vodafone Romania S.A.
Telecommunications
Romania
Insufficient technical and organisational measures to ensure information security.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Data mapping
Fine / Penalty
€ 15,000.00
Keywords
Data Breach
January 17, 2025
DELIVERY SOLUTIONS S.A.
Logistics
Romania
Insufficient technical and organisational measures to ensure information security.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Data mapping
Fine / Penalty
€ 2,000.00
Keywords
Data Breach
Other Actions
Corrective measures were ordered
January 9, 2025
Komendanta Miejskiego Policji w Krakowie
Public Sector
Poland
An unauthorized press release disclosed a woman’s sensitive personal data following a 2023 police intervention related to an abortion. To justify their actions after media reports, the police published detailed health information, including mental health status and reproductive health data. The UODO found the police failed to conduct a risk assessment, repurposed data collected for internal use for public communications, and lacked effective technical and organizational controls.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 18,000
Keywords
Data Breach
Sensitive Data
January 9, 2025
Court Administration Office
Public Sector
South Korea
Data breach involving litigation-related documents containing the personal data of 17,998 individuals. The PIPC claims the breach occurred as a result of the CAO’s unencrypted storage systems and weak data security protocols. The CAO also delayed reporting the breach, according to the PIPC.
Privacy Law
PIPA
Level of Government
Federal
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
Unknown
Who Enforced
PIPC
Related Products
Assessments
Data mapping
Fine / Penalty
$183,982.00
Keywords
Data Breach
Mishandling Data
January 8, 2025
Bindl v EU commission
Public Sector
EU-wide
European General Court Decision: The court ordered the European Commission to pay damages (400 EUR) for unlawfully transferring data to the U.S. without adequate protections. This transfer to the US occurred when data was shared with Meta via a "Sign in with Facebook" button on an official EU website.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
Unknown
Who Enforced
European General Court
Related Products
Assessments
Data mapping
Trust Hub
Fine / Penalty
400 EUR
Keywords
Cross-Border Transfer
January 8, 2025
Allstate + Arity (Allstate's tech subsidiary)
Transportation
USA
Arity (Allstate's tech subsidiary) allegedly slipped their SDK into third-party apps to collect “trillions of miles” of driving behavior from mobile devices, other in car devices, and vehicles themselves.
Privacy Law
Texas Data Privacy and Security Act
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
AG
Related Products
Trust Hub
UC
Fine / Penalty
TBD
Keywords
Selling Data
Mishandling Data
Tracking Tech
Unlawful processing
January 8, 2025
Bayview Asset Management (Lakeview Loan Servicing, Community Loan Servicing, and Pingora Holdings)
Financial Services
USA
Failing to maintain sufficient cybersecurity practices and for not fully cooperating with state regulators following a data breach that impacted 5.8 million customers.
Privacy Law
State Agency Rules
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
52 state financial regulatory agencies
Related Products
Assessments
Data mapping
Fine / Penalty
$20,000,000.00
Keywords
Data Breach
Mishandling Data
Other Actions
Corrective actions, improve cybersecurity programs, undergo independent assessments, and provide three years of additional reporting to the states.
January 8, 2025
ECJ v Austria
All
Austria
The ECJ ruled that data subject complaints cannot be deemed excessive solely based on their frequency.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
ECJ
Related Products
SRR
Fine / Penalty
None
Keywords
N/A
Other Actions
None
January 7, 2025
Elgon Information Systems
Healthcare
USA
Ransomware attack prompted HHS finding they had failed to conduct a thorough risk analysis to address vulnerabilities in its systems, exposing 31,248 individuals’ ePHI.
Privacy Law
HIPAA
Level of Government
Federal
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
Under $1 million
Who Enforced
HHS
Related Products
Assessments
Data mapping
Fine / Penalty
$80,000.00
Keywords
Sensitive Data
Data Breach
Mishandling Data
December 20, 2024
OpenAI
Technology
Italy
OpenAI had wrongly relied on legitimate interest as a legal basis for processing personal data, processed inaccurate personal data, and had no age verification measures in place.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
UC
Privacy Expert
Assessments
Fine / Penalty
15,000,000
Keywords
Unlawful processing
Other Actions
They must carry out a six month campaign informing Italians of how it uses their personal data for their services.
December 20, 2024
Grubhub
Logistics
USA
Grubhub engaged in deceptive practices, such as misleading diners about delivery fees, blocking access to gift card funds, and falsely advertising driver earning.
Privacy Law
FTC Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
FTC
Related Products
Trust Hub
Privacy Expert
Regulatory Guidance
Fine / Penalty
$25,000,000.00
Keywords
Notice
Other Actions
Grubhub to make changes to its business practices, including not adding surprise fees to delivery totals, providing a simple way to cancel Grubhub+ subscriptions, stopping listing unaffiliated restaurants and not making misleading driver-earning claims. Illinois Attorney General aided in case.
December 18, 2024
Netflix
Entertainment
Netherlands
Netflix did not give customers sufficient information about what the company does with their personal data between 2018 and 2020.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
CMP
Templates
Trust Hub
Fine / Penalty
4.75M euro
Keywords
Notice
December 18, 2024
Toyota Bank Polska S.A.
Financial Services
Poland
The Data Personal Officer (DPO) was not fully independent in his work. Furthermore, Toyota Bank Polska S.A. failed to include profiling in the record of processing activities and data protection impact assessment.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
Assessments
Trust Hub
Privacy Expert
Regulatory Guidance
Fine / Penalty
€ 132,000.00
Keywords
Unlawful processing
December 17, 2024
Meta Platforms Ireland Limited
Technology
Ireland
Insufficient technical and organisational measures to ensure information security.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
Assessments
Data mapping
Fine / Penalty
251,000,000
Keywords
Mishandling Data
Data Breach
December 12, 2024
Various Organizations
All
France
The French Data Protection Authority (CNIL) issued notices to several organizations regarding non-compliant cookie banners. The notices were a result of complaints about dark patterns that encouraged users to accept non-essential cookies. The CNIL found that the methods for rejecting cookies were not as easy to use as those for accepting them, and that the designs were misleading. https://www.huntonak.com/privacy-and-information-security-law/cnil-issues-notices-regarding-non-compliant-cookie-banners
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
CMP
Fine / Penalty
N/A
Keywords
Dark Patterns
December 3, 2024
Gravy Analytics (and subsidiary Venntel)
Technology
USA
Unlawfully tracking and selling sensitive location data from users, including selling data about consumers’ visits to health-related locations and places of worship.
Privacy Law
FTC Act
Level of Government
Federal
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
FTC
Related Products
CMP
UC
SRR
Assessments
Data mapping
Trust Hub
Fine / Penalty
TBD
Keywords
Sensitive Data
Selling Data
Unlawful processing
Other Actions
Prohibited from selling, disclosing, or using sensitive location data in any product or service, and must establish a sensitive data location program.
November 28, 2024
Freedelity
Technology
Belgium
The DPA found issues with Freedelity’s:
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
CMP
UC
Assessments
Data mapping
Fine / Penalty
TBD
Keywords
Tracking Tech
Unlawful processing
Other Actions
The company has a period of 4 months to comply with these injunctions, and will have to pay penalties of up to 5,000 euros per day of delay in the event of non-compliance or partial compliance.
November 27, 2024
Coupang
Retail
South Korea
he fine was in relation to two data breaches, the first caused by the mishandling of data transmitted and the second breach was caused by an authentication issue.
Privacy Law
PIPA
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
PIPC
Related Products
Assessments
Data mapping
Fine / Penalty
$1,100,000.00
Keywords
Data Breach
November 27, 2024
Mediahuis
Entertainment
Belgium
Mediahuis had fully complied with the DPA’s order regarding illegal cookie banners, thereby avoiding a €25,000 (US$26,402) daily penalty.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
Market Court
Related Products
CMP
Fine / Penalty
Avoided $26,402 daily penalty
Keywords
Unlawful processing
Tracking Tech
November 21, 2024
Eken
Technology
Hong Kong
Apparent violations of FCC rules that require the company to designate an agent located in the United States.
Privacy Law
FCC Rules
Level of Government
Federal
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
FCC
Related Products
Privacy Expert
Regulatory Guidance
Fine / Penalty
TBD
Keywords
Unlawful processing
November 19, 2024
Technology
Germany
The German Federal Court of Justice made a judgment under the case number VI ZR 10/24 regarding claims for non-material damages pursuant to Art. 82 GDPR from a 2021 data breach of Facebook. This judgment is important insofar as the BGH has taken a position on a legal issue – non-material damages for loss of control over personal data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
German Federal Court of Justice
Related Products
Data mapping
Fine / Penalty
€ 250.00
Keywords
Data Breach
November 19, 2024
Bunnings
Retail
Australia
Individuals’ facial images were compared against those of individuals Bunnings had enrolled in a database who had been identified as posing a risk, for example, due to past crime or violent behavior, according to the OAIC.
Privacy Law
Privacy Act 1988
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
OAIC
Related Products
UC
Assessments
Data mapping
Fine / Penalty
TBD
Keywords
Unlawful processing
Tracking Tech
Sensitive Data
November 15, 2024
Posti
Logistics
Finland
Posti had automatically created an electronic OmaPosti mailbox for customers without a separate request.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
UC
CMP
SRR
Fine / Penalty
€ 2,400,000.00
Keywords
Mishandling Data
November 14, 2024
Growbots
Technology
USA
The company failed to register between February 1 and July 26, 2024, per the Delete Act.
Privacy Law
Delete Act
Level of Government
State
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
CPPA
Related Products
Regulatory Guidance
Fine / Penalty
$35,000.00
Keywords
N/A
November 14, 2024
UpLead
Technology
USA
The company failed to register between February 1 and July 21, 2024, per the Delete Act.
Privacy Law
Delete Act
Level of Government
State
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
CPPA
Related Products
Regulatory Guidance
Fine / Penalty
$34,400.00
Keywords
N/A
November 7, 2024
T-Mobile
Telecommunications
USA
The telecom company promised to address “foundational security flaws,” work to improve “cyber hygiene,” and adopt “robust modern architectures,” such as zero trust and multi-factor authentication that is resistant to phishing.
Privacy Law
FCC Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
FCC
Related Products
Assessments
Data mapping
Fine / Penalty
$31,500,000.00
Keywords
Data Breach
November 5, 2024
Meta
Technology
South Korea
From July 2018 to March 2022, the company gathered data from nearly 980,000 users without asking for their explicit permission. This information included highly personal details such as users’ political beliefs, religious preferences, and whether they were in same-sex relationships. Once the company collected this sensitive data, it shared it with around 4,000 advertisers.
Privacy Law
PIPA
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
PIPC
Related Products
CMP
UC
Assessments
Fine / Penalty
₩15,000,000
Keywords
Tracking Tech
Unlawful processing
Sensitive Data
November 3, 2024
Blackcab Systems SRL
Professional Services
Romania
DSAR not fulfilled, and during the investigation, it was found that the operator Blackcab Systems SRL did not prove that it responded to the petitioner's request.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
€ 1,000.00
Keywords
Mishandling Data
Other Actions
Corrective measures were ordered against the operator:
November 1, 2024
Master Wealth Control and Property Lovers
Financial Services
Australia
The companies failed to collect data fairly; to notify individuals whose data was collected; and
Privacy Law
Privacy Act 1988
Level of Government
Federal
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$1 million – $10 million
Who Enforced
OAIC
Related Products
CMP
UC
Assessments
Data mapping
Trust Hub
Fine / Penalty
n/a
Keywords
Unlawful processing
Mishandling Data
Other Actions
Ordered to cease collecting personal information unfairly, destroy their leads lists within 30 days, update their privacy policies, and provide evidence of compliance.
October 31, 2024
Meta
Technology
USA
CFPB staff informed Meta on Sept. 18 that it is weighing potential legal action related to advertising for financial products on the company’s platforms, which include photo-sharing platform Instagram and messaging service WhatsApp, the company revealed in a Thursday securities filing.
Privacy Law
Dodd-Frank Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
CFPB
Related Products
UC
CMP
Fine / Penalty
TBD
Keywords
Unlawful Marketing
October 29, 2024
Temu
Retail
EU-wide
The Commission has opened formal proceedings to assess whether Temu may have breached the Digital Services Act (DSA) in areas linked to the sale of illegal products, the potentially addictive design of the service, the systems used to recommend purchases to users, as well as data access for researchers.
Privacy Law
Digital Services Act (DSA)
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
EU Commission
Related Products
Assessments
Fine / Penalty
TBD
Keywords
Tracking Tech
Unlawful Marketing
October 29, 2024
Untold SRL
Professional Services
Romania
The controller did not resolve the request for access to the personal data of the data subject, although he communicated for correspondence his e-mail address, telephone number, full name and surname and postal address.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
€ 15,000.00
Keywords
Mishandling Data
Other Actions
Corrective measures were ordered against the operator.
October 27, 2024
Vodafone Romania S.A.
Telecommunications
Romania
It was found that the operator Vodafone Romania S.A. did not adopt sufficient technical and organizational measures to ensure the confidentiality of the processed personal data. no measures were taken to hide the recipients' email addresses.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 5,000.00
Keywords
Data Breach
October 23, 2024
Technology
Ireland
Ireland’s data protection watchdog has fined the professional social media site for GDPR breaches related to targeted advertising.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPC
Related Products
UC
CMP
Assessments
Fine / Penalty
€ 310,100,000.00
Keywords
Tracking Tech
Unlawful Marketing
Other Actions
In addition, the regulator handed LinkedIn a reprimand and ordered it to bring its processing into compliance.
October 22, 2024
NHL
Entertainment
USA
VPPA: Lawsuit claims that the NHL collected and shared personal viewing data with third parties, such as Facebook, without user consent.
Privacy Law
VPPA
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
Class Actions Lawsuits
Related Products
CMP
UC
Fine / Penalty
TBD
Keywords
VPPA
Unlawful processing
October 22, 2024
MLB
Entertainment
USA
VPPA: MLB is facing a lawsuit for allegedly violating the Video Privacy Protection Act (VPPA) by sharing users’ personal video viewing information with Facebook without consent.
Privacy Law
VPPA
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
Class Actions Lawsuits
Related Products
CMP
UC
Fine / Penalty
TBD
Keywords
VPPA
Unlawful processing
October 21, 2024
Unisys
Professional Services
USA
Negligently minimized its cybersecurity incident in its public disclosures. Downplayed the extent of the breach, and did not properly disclose the cyberthreat.
Privacy Law
SEC Rules
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
SEC
Related Products
Assessments
Trust Hub
Fine / Penalty
$4,000,000.00
Keywords
Data Breach
October 21, 2024
Avaya
Professional Services
USA
Negligently minimized its cybersecurity incident in its public disclosures. Downplayed the extent of the breach, and did not properly disclose the cyberthreat.
Privacy Law
SEC Rules
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
SEC
Related Products
Assessments
Trust Hub
Fine / Penalty
$1,000,000.00
Keywords
Data Breach
October 21, 2024
Check Point
Technology
USA
Negligently minimized its cybersecurity incident in its public disclosures. Downplayed the extent of the breach, and did not properly disclose the cyberthreat.
Privacy Law
SEC Rules
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
SEC
Related Products
Assessments
Trust Hub
Fine / Penalty
$995,000.00
Keywords
Data Breach
October 21, 2024
Mimecast
Technology
USA
Negligently minimized its cybersecurity incident in its public disclosures. Downplayed the extent of the breach, and did not properly disclose the cyberthreat.
Privacy Law
SEC Rules
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
SEC
Related Products
Assessments
Trust Hub
Fine / Penalty
$990,000.00
Keywords
Data Breach
October 21, 2024
IBERCAJA BANCO, S.A.
Financial Services
Spain
Insufficient legal basis for data processing.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
€ 180,000.00
Keywords
Unlawful processing
October 20, 2024
Grue municipality
Public Sector
Norway
Sensitive Data breach in a public postal journal. 14 individuals were affected.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Data mapping
Fine / Penalty
€ 20,800.00
Keywords
Sensitive Data
Data Breach
Other Actions
The municipality also initiated extensive control work and measures to prevent similar incidents in the future
October 15, 2024
Your Consulting SRL
Professional Services
Romania
The operator did not implement adequate technical and organizational measures at the time of establishing the means of processing or at the time of the processing itself and did not carry out periodic testing, evaluation and assessment of the effectiveness of the technical and organizational measures to guarantee the security of the processing.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
Trust Hub
Assessments
Fine / Penalty
€ 3,000.00
Keywords
Data Breach
Other Actions
Must implement robust security program starting with assessments
October 14, 2024
Quick Tax Claims
Professional Services
UK
Quick Tax Claims Limited had sent 7,863,547 unlawful text messages over the course of a month, resulting in 66,793 complaints – 93% of these stating there was no ‘opt out’ option.
Privacy Law
UK GDPR
Level of Government
Federal
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
ICO
Related Products
CMP
UC
SRR
Fine / Penalty
£120,000.00
Keywords
Unlawful Marketing
October 14, 2024
National Basketball Association
Entertainment
USA
Defendant’s allegedly disclosured the plaintiff’s video viewing information to Meta via the Facebook Pixel without consent, in violation of the VPPA.
Privacy Law
VPPA
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
Federal Courts
Related Products
CMP
UC
Fine / Penalty
TBD
Keywords
VPPA
Unlawful processing
October 10, 2024
WerepairUK Ltd
Professional Services
UK
WerepairUK Ltd, based in Tonbridge, has been fined for making 42,688 unsolicited calls. It has appealed the decision. These calls were made to people who had explicitly opted out of receiving marketing communications, violating their privacy and causing some distress.
Privacy Law
UK GDPR
Level of Government
Federal
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
ICO
Related Products
SRR
UC
Fine / Penalty
£80,000.00
Keywords
Unlawful Marketing
October 10, 2024
Service Box Group Limited
Professional Services
UK
Service Box Group Limited, based in Hove, East Sussex, has been fined for 5,361 calls.
Privacy Law
UK GDPR
Level of Government
Federal
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
ICO
Related Products
UC
SRR
Fine / Penalty
£40,000.00
Keywords
Unlawful Marketing
October 10, 2024
RTL Belgium
Telecommunications
Belgium
Failed to display both an 'accept all' and a 'reject all' button on the first layer of its cookie banner.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
CMP
UC
Fine / Penalty
€ 40,000 per day
Keywords
Dark Patterns
Other Actions
See H171
October 8, 2024
Marriott International, Inc. (subsidiary Starwood Hotels & Resorts Worldwide LLC)
Transportation
USA
Marriott and Starwood deceived consumers by claiming to have reasonable and appropriate data security. Despite these claims, the companies unfairly failed to deploy reasonable or appropriate security to protect personal information.
Privacy Law
FTC Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
FTC
Related Products
SRR
Data mapping
Fine / Penalty
TBD
Keywords
Data Deletion
Data Breach
Mishandling Data
Data Minimization
Other Actions
Must implement robust security program, and fulfil all delete SRR.
October 8, 2024
Marriott International, Inc. (subsidiary Starwood Hotels & Resorts Worldwide LLC)
Transportation
USA
Attorney General Tong announced today that a coalition of 50 attorneys general, co-led by Connecticut, has reached a settlement with Marriott International, Inc. as the result of an investigation into a large multi-year data breach of one of its guest reservation databases.
Privacy Law
State consumer protection laws
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
50 US State AGs
Related Products
Data mapping
SRR
Fine / Penalty
$52,000,000.00
Keywords
Data Breach
Data Deletion
Mishandling Data
Data Minimization
October 2, 2024
TikTok
Technology
USA
The complaint alleges that TikTok did not provide verified parents with the ability to control or limit the privacy and account settings on a minor’s account, such as tools to limit TikTok’s sharing, disclosure and sale of a minor’s personal identifying information and control TikTok’s ability to display targeted advertising to a minor.
Privacy Law
Securing Children Online Through Parental Empowerment (“SCOPE”) Act
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
AG
Related Products
CMP
UC
Fine / Penalty
10,000 per violation
Keywords
Unlawful processing
October 1, 2024
California Privacy Protection Agency Announces Investigative Sweep of Data Brokers
Technology
USA
The California Privacy Protection Agency (“CPPA”) announced that it is conducting an investigative sweep focused on enforcing requirements for data brokers to register with the CPPA by January 31, 2024, under California’s Delete Act (the “Act”). Under the Act, the CPPA has the authority to impose an administrative fine of $200 per day for each day the data broker failed to register.
Privacy Law
Delete Act
Level of Government
State
Employee Count
Unknown
Estimated Annual Revenue
N/A
Who Enforced
CPPA
Related Products
UC
SRR
Fine / Penalty
$200 per day
Keywords
N/A
September 26, 2024
Meta
Technology
Ireland
Meta informed the commission in 2019 it inadvertently stored certain passwords of its platforms’ users in “plaintext,” or without protection or encryption
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
Assessments
Data mapping
Fine / Penalty
$100,000,000.00
Keywords
Data Breach
September 24, 2024
Mozilla
Technology
EU-wide
Mozilla, the nonprofit that develops the Firefox web browser, has been hit with a complaint by European Union privacy rights group noyb, which accuses it of violating the bloc's General Data Protection Regulation (GDPR) by tracking Firefox users by default without their permission.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
Noyb
Related Products
CMP
UC
Fine / Penalty
TBD
Keywords
Tracking Tech
September 16, 2024
AT&T
Telecommunications
USA
AT&T had a data breach of a cloud vendor in January 2023 that impacted 8.9 million customers.
Privacy Law
FCC Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
FCC
Related Products
Vendor
Data mapping
Fine / Penalty
$13,000,000.00
Keywords
Data Breach
Other Actions
AT&T has also agreed to boost its data governance practices to increase supply chain integrity in the handling of sensitive data to protect consumers from similar vendor data breaches in the future.
September 1, 2024
Verkada
Technology
USA
FTC: Did not apply appropriate controls to sensitive data.
Privacy Law
FTC Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
FTC
Related Products
UC
Assessments
Data mapping
Fine / Penalty
$2,950,000.00
Keywords
Sensitive Data
Data Breach
Other Actions
FTC is requiring Verkada to create a comprehensive information security program
August 28, 2024
Apohem AB
Retail
Sweden
Apohem AB had implemented Meta's tracking pixel on their websites to enhance marketing efforts on Facebook and Instagram. However, the activation of an advanced matching feature within the pixel led to the unintended transfer of sensitive customer data to Meta over an extended period.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
CMP
Assessments
Data mapping
Fine / Penalty
$730,000.00
Keywords
Tracking Tech
Unlawful processing
Unlawful Marketing
Sensitive Data
August 28, 2024
Apoteket AB
Retail
Sweden
Apoteket AB had implemented Meta's tracking pixel on their websites to enhance marketing efforts on Facebook and Instagram. However, the activation of an advanced matching feature within the pixel led to the unintended transfer of sensitive customer data to Meta over an extended period.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
CMP
Assessments
Data mapping
Fine / Penalty
$3,400,000.00
Keywords
Unlawful Marketing
Unlawful processing
Tracking Tech
Sensitive Data
August 26, 2024
Uber Technologies, Inc.
Transportation
Netherlands
The European Union’s data protection laws were violated by transferring sensitive personal data of its drivers to the U.S. without adequate safeguards.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
Assessments
Fine / Penalty
$310,000,000.00
Keywords
Cross-Border Transfer
August 22, 2024
Lawline
Technology
USA
VPPA: claims that the platform unlawfully disclosed its users' video viewing habits to third parties, specifically analytics and marketing companies, without obtaining proper consent.
Privacy Law
VPPA
Level of Government
Federal
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
Federal Courts
Related Products
CMP
UC
Trust Hub
Data mapping
Assessments
Fine / Penalty
TBD
Keywords
VPPA
Tracking Tech
August 20, 2024
[Name Not Public]
Telecommunications
Thailand
Failure to Appoint a Data Protection Officer (DPO).
Privacy Law
Personal Data Protection Act ("PDPA")
Level of Government
Federal
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
PDPA
Related Products
Data mapping
Fine / Penalty
฿205,520
Keywords
Data Breach
Mishandling Data
Other Actions
The second expert committee ordered the company to enhance its security measures to prevent future data leaks. The company must also train its staff, update security measures to keep pace with technological changes, and report these improvements to the PDPC within 7 days of receiving the order.
August 19, 2024
Equiniti Trust
Financial Services
USA
SEC rules: A lot going on here, with issues re handling client assets. Breach, data governance and poor retention.
Privacy Law
SEC Rules
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
SEC
Related Products
Data mapping
Assessments
Fine / Penalty
$850,000.00
Keywords
Data Breach
August 6, 2024
Advanced Computer Software Group
Technology
UK
UK GDPR: failed to implement sufficient security measures to protect personal information.
Privacy Law
UK GDPR
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
ICO
Related Products
Data mapping
Assessments
Fine / Penalty
£6,000,000.00
Keywords
Data Breach
August 5, 2024
UNIQLO EUROPE, LTD
Retail
Spain
The complainant in the case, whose employment contract had been terminated, requested access to their payroll information for July 2022. In responding to the request, the controller sent an e-mail to the complainant that contained an attached PDF document that included his payroll and that of 446 other workers on the staff.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
€ 270,00
Keywords
Data Breach
Mishandling Data
July 29, 2024
Meta
Technology
USA
Meta knowingly violated the state’s Capture or Use of Biometric Identifier Act and Deceptive Trade Practices and Consumer Protection Act by implementing a now-defunct facial-recognition-based photo and video tagging feature.
Privacy Law
Capture or Use of Biometric Identifier Act
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
AG
Related Products
CMP
UC
Fine / Penalty
$1,400,000,000.00
Keywords
Sensitive Data
Tracking Tech
Selling Data
July 23, 2024
TikTok
Technology
UK
Failing to comply with a request for information and not cooperating with Ofcom’s investigation into the effectiveness of its child protection measures.
Privacy Law
UK GDPR
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
ICO
Related Products
Data mapping
Fine / Penalty
£1,875,000.00
Keywords
Sensitive Data
Mishandling Data
July 17, 2024
Oracle
Technology
USA
The proposed settlement was announced on 18 July in San Francisco federal court. In August 2022, plaintiffs had filed a lawsuit that alleged Oracle’s advertising tracking tools accessed, collected, stored, disclosed, sold and used internet users’ personal data without consent.
Privacy Law
US Civil Law
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
Federal Courts
Related Products
CMP
UC
Fine / Penalty
$150,000,000.00
Keywords
Tracking Tech
Unlawful processing
July 17, 2024
What’s App (Meta)
Technology
Nigeria
Meta was ordered to “immediately reinstate the rights of Nigerian users to self-determine and control” data sharing, and stop sharing WhatsApp users’ information “with other Facebook companies and third parties” without users’ active consent.
Privacy Law
Nigeria Data Protection Act 2023
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
Federal Competition and Protection Commission
Related Products
Data mapping
UC
CMP
Fine / Penalty
$2,200,000,000.00
Keywords
Unlawful processing
Mishandling Data
Other Actions
35,000 for investigation costs.
July 17, 2024
TracFone
Telecommunications
USA
Verizon-owned mobile virtual network operator TracFone
Privacy Law
FCC Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
FCC
Related Products
CMP
UC
Data mapping
Vendor
Fine / Penalty
$16,000,000.00
Keywords
Data Breach
July 8, 2024
NGL
Technology
USA
The FTC and the Los Angeles District Attorney’s Office accused NGL of violating the Children’s Online Privacy Protection Rule (COPPA Rule) by knowingly collecting the personal data of children younger than 13 without parental consent.
Privacy Law
FTC Act
Level of Government
Federal
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
FTC
Related Products
SRR
Data mapping
UC
Fine / Penalty
$5,000,000.00
Keywords
Unlawful processing
Data Minimization
Sensitive Data
July 1, 2024
Vinted
Retail
Lithuania
Did not have proper rationale for denying the right to erasure (‘right to be forgotten’) and the right of access. They reasoned that the user did not identify in their request the ‘specific grounds’ under Article 17 of the GDPR.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
SRR
Data mapping
Fine / Penalty
€ 2,385,276.00
Keywords
Mishandling Data
June 30, 2024
Grindr
Technology
Norway
The Norwegian Data Protection Authority said that sharing such data without seeking explicit consent broke GDPR rules.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
CMP
UC
SRR
Data mapping
Vendor
Fine / Penalty
€ 6,500,000.00
Keywords
Unlawful processing
June 17, 2024
Tilting Point Media LLC (Tilting Point)
Technology
USA
Tilting Point employed an age screen that did not ask for age in a “neutral manner” and therefore encouraged children to enter an older age. Further, Tilting Point inadvertently configured third-party software development kits (SDKs) to collect and sell children’s data without first obtaining consent.
Privacy Law
CCPA
Level of Government
State
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
AG
Related Products
UC
Assessments
Fine / Penalty
$500,000.00
Keywords
Unlawful processing
Tracking Tech
Mishandling Data
Other Actions
prohibition on selling and sharing the personal information of children without affirmative consent, a requirement to use neutral age screens, restrictions on the use of SDKs, children’s data minimization requirements, and a requirement to submit annual reports regarding compliance efforts to the California Department of Justice and the Los Angeles City Attorney’s office.
June 17, 2024
[Name Not Public]
Technology
USA
The Texas AG’s office began an enforcement sweep of apparent violations of Texas’ Data Broker Law (the “Law”). Specifically, over 100 companies received letters for alleged failure to register as data brokers with the Texas Secretary of State by the March 1, 2024 deadline.
Privacy Law
Data Broker Law
Level of Government
State
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
AG
Related Products
Regulatory Guidance
Data mapping
Fine / Penalty
$10,000.00
Keywords
N/A
Other Actions
The Data Broker Law, the Biometric Identifier Act, the Deceptive Trade Practices Act as well as federal laws including the Children’s Online Privacy Protection Act (COPPA) and the Health Insurance Portability and Accountability Act (HIPAA).
June 4, 2024
Medibank Private Ltd (MPL.AX)
Financial Services
Australia
Medibank failed to take reasonable steps to protect personal information it held given its size, resources, the nature and volume of the sensitive and personal information it handled, and the risk of serious harm for an individual in the case of a breach.
Privacy Law
Privacy Act 1988
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
OAIC
Related Products
Data mapping
Fine / Penalty
TBD
Keywords
Data Breach
May 22, 2024
Police Service of Northern Ireland (PSNI)
Public Sector
UK
Exposed personal data belonging to all PSNI serving officers and staff.
Privacy Law
UK GDPR
Level of Government
Federal
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
ICO
Related Products
Assessments
Fine / Penalty
£750,000.00
Keywords
Data Breach
May 21, 2024
Kakao Corp
Telecommunications
South Korea
Failure to report a data breach.
Privacy Law
PIPA
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
PIPC
Related Products
Assessments
Fine / Penalty
$11,100,000.00
Keywords
Data Breach
May 19, 2024
Blackbaud
Financial Services
USA
Order finalized after announcement in February 2024.
Privacy Law
FTC Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
FTC
Related Products
Data mapping
Fine / Penalty
$3,000,000.00
Keywords
Sensitive Data
Data Deletion
Other Actions
Delete data that is no longer needed
March 17, 2024
Benefytt Technologies
Healthcare
USA
Health company and its third parties operated series of deceptive websites that targeted consumers who were searching for comprehensive health insurance plans qualified under the Affordable Care Act.
Privacy Law
FTC Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
FTC
Related Products
SRR
UC
CMP
Fine / Penalty
$100,000,000.00
Keywords
Sensitive Data
Tracking Tech
Unlawful Marketing
March 14, 2024
Flo Health
Healthcare
Canada
App shared personal health information to Facebook and other third-parties without users' consent.
Privacy Law
Canadian Civil Law
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
Supreme Court of British Columbia
Related Products
UC
Vendor
Fine / Penalty
TBD
Keywords
Sensitive Data
Unlawful processing
Mishandling Data
March 4, 2024
Intellexa Consortium
Technology
USA
Used spyware and surveillance technology to target U.S. government officials, journalists and policy experts.
Privacy Law
OFAC sanctions
Level of Government
Federal
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
OFAC
Related Products
UC
CMP
Fine / Penalty
TBD
Keywords
Tracking Tech
Unlawful processing
February 27, 2024
BNSF Railway
Transportation
USA
Unlawfully collected fingerprint scans without consent from thousands of drivers using automated gate systems at the company’s four facilities in Illinois.
Privacy Law
FTC Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
FTC
Related Products
UC
Fine / Penalty
$75,000,000.00
Keywords
Selling Data
Unlawful processing
February 21, 2024
[Name Not Public]
Logistics
Italy
Used facial recognition technology to determine employee attendance.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
UC
Assessments
Fine / Penalty
€ 103,000.00
Keywords
Tracking Tech
Unlawful processing
February 21, 2024
Avast Limited
Technology
USA
Collected, retained and sold data without proper notice or consent to third parties.
Privacy Law
FTC Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
FTC
Related Products
CMP
UC
Fine / Penalty
$16,500,000.00
Keywords
Selling Data
Unlawful processing
February 20, 2024
Doordash
Retail
USA
Sold its customers' personal information without notice and without providing an opportunity to opt-out of the sale of their data.
Privacy Law
CCPA
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
AG
Related Products
CMP
UC
Fine / Penalty
$375,000.00
Keywords
Selling Data
Unlawful processing
February 13, 2024
College Board
Public Sector
USA
Unlawfully sold students' personal data to schools and other customers
Privacy Law
New York law
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
AG
Related Products
UC
Fine / Penalty
$750,000.00
Keywords
Selling Data
Unlawful processing
February 6, 2024
Montefiore Medical Center
Healthcare
USA
Breach of its unsecured electronic protected health information (“ePHI”) from 2015
Privacy Law
HIPAA
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
Department of Health and Human Services’ Office for Civil Rights
Related Products
CMP
UC
Data mapping
Fine / Penalty
$4,750,000.00
Keywords
Sensitive Data
Data Breach
Other Actions
MMC has entered and agrees to comply with the Corrective Action Plan (“CAP”)
February 2, 2024
Tagadamedia
Technology
France
Failure to comply with the obligation to have a legal basis for the processing of data
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
DPA
Related Products
UC
Fine / Penalty
€ 75,000.00
Keywords
Unlawful processing
January 30, 2024
Uber Technologies, Inc.
Transportation
Netherlands
Failed to disclose its data retention period for European drivers' data
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
SRR
Assessments
Data mapping
Fine / Penalty
€ 10,000,000.00
Keywords
Data Deletion
Mishandling Data
Cross-Border Transfer
January 29, 2024
OpenAI (ChatGPT)
Technology
Italy
Lack of a suitable legal basis for the collection and processing of personal data for the purpose of training the algorithms underlying ChatGPT.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
Assessments
CMP
UC
Fine / Penalty
TBD
Keywords
Unlawful processing
January 15, 2024
X-Mode Social, Inc./Outlogic)
Technology
USA
Raw data collection and sale of location information that could be used to track people’s visits to places of worship, reproductive health clinics, and domestic abuse shelters.
Privacy Law
FTC Act
Level of Government
Federal
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
FTC
Related Products
CMP
UC
Fine / Penalty
Unknown settlement amount
Keywords
Tracking Tech
Selling Data
Sensitive Data
January 13, 2024
Poxell Ltd & Skean Homes Ltd
Telecommunications
UK
Made unsolicited marketing calls to people registered with the Telephone Preference Service (TPS) while withholding their identity.
Privacy Law
UK GDPR
Level of Government
Federal
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
ICO
Related Products
UC
Fine / Penalty
€ 150,000.00
Keywords
Unlawful Marketing
January 8, 2024
Amazon
Retail
Luxembourg
Processed users’ personal data for targeted advertising without their consent.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
CMP
UC
Fine / Penalty
€ 818,000,000.00
Keywords
Unlawful Marketing
Unlawful processing
Tracking Tech
January 2, 2024
Kochava
Telecommunications
USA
Collected, without notice or consent, vast amounts of consumer location and personal data.
Privacy Law
FTC Act
Level of Government
Federal
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
FTC
Related Products
CMP
UC
Fine / Penalty
TBD
Keywords
Unlawful processing
Sensitive Data
December 28, 2023
Yahoo
Telecommunications
France
Deposited cookies on website without user’s consent
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
CMP
UC
Fine / Penalty
€ 10,000,000.00
Keywords
Tracking Tech
December 28, 2023
NS Cards France
Telecommunications
France
Failure to comply with the obligation to retain data for a period limited to the purpose for which it was collected (article 5.1.e of the GDPR).
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
UC
CMP
Fine / Penalty
€ 105,000.00
Keywords
Tracking Tech
Data Deletion
December 26, 2023
Amazon France Logistique
Retail
France
Warehouse employees used scanners to tracker activities and the scans carried out by employees resulted in recording of data, which is stored and used to calculate indicators providing information on the quality, productivity and periods of inactivity of each employee.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
€ 32,000,000.00
Keywords
Unlawful processing
Tracking Tech
December 18, 2023
Rite Aid
Retail
USA
Rite Aid deployed artificial intelligence-based facial recognition technology to identify customers who may have been engaged in shoplifting or other problematic behavior.
Privacy Law
FTC Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
FTC
Related Products
Assessments
Data mapping
Fine / Penalty
N/A
Keywords
Tracking Tech
Unlawful processing
Sensitive Data
Other Actions
Prohibited from using facial recognition technologies for five years.
December 13, 2023
Kodas Design and Speed Auction
Technology
South Korea
Both companies violated safety measure obligations and personal information leakage notification and reporting obligations under the PIPA.
Privacy Law
PIPA
Level of Government
Federal
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
PIPC
Related Products
Vendor
Data mapping
Fine / Penalty
$1,71,653
Keywords
Data Breach
December 13, 2023
Tipros
Telecommunications
Singapore
Tipros unreasonably disclosed the personal data of the complainant when responding to the complainant’s review on the Organization's Google reviews page.
Privacy Law
Personal Data Protection Act (PDPA)
Level of Government
Federal
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
PDPC
Related Products
SRR
Fine / Penalty
N/A
Keywords
Data Breach
Other Actions
Review 13 other Google reviews and remove personal data from Google review page.
November 30, 2023
Technology
USA
Secretly tracked the internet use of millions of people who were using its Chrome browser's incognito mode.
Privacy Law
FTC Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
FTC
Related Products
CMP
UC
Fine / Penalty
$5,000,000,000.00
Keywords
Tracking Tech
Unlawful processing
November 27, 2023
Shanghai Commercial and Savings Bank
Financial Services
China
Audit leak of customer data.
Privacy Law
Banking Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
Financial Supervisory Commission
Related Products
SRR
Fine / Penalty
NT 10,000,000
Keywords
Data Breach
November 1, 2023
Australian Clinical Labs Limited
Healthcare
Australia
Data breach of patient's personal information and data.
Privacy Law
Privacy Act 1988
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
OAIC
Related Products
SRR
Fine / Penalty
AUS$ 2,200,000
Keywords
Data Breach
October 31, 2023
First American Title Insurance Company
Financial Services
USA
Violations of the NYDFS Cybersecurity Regulation in connection with a 2019 data breach, which exposed consumers’ non-public information.
Privacy Law
NYDFS Cybersecurity Regulation
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
FTC
Related Products
CMP
UC
Fine / Penalty
$1,000,000.00
Keywords
Data Breach
October 25, 2023
FT v DW (C-307/22)
Healthcare
Germany
A patient asked dentist for a copy of his dental records. Dentist said that patient is responsible for costs with such provision, per German law.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
CJEU
Related Products
SRR
Fine / Penalty
N/A
Keywords
Mishandling Data
October 22, 2023
Axpo Italia Spa
Energy
Italy
Electricity and gas suppliers that activated accounts without data subject knowledge issued contracts in their name based on acquired, and unsolicited, contracts.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Vendor
Templates
Fine / Penalty
€ 10,000,000.00
Keywords
Unlawful processing
Other Actions
Corrective measures, including:
October 16, 2023
Clearview AI, Inc.
Technology
UK
Personal data of UK individuals collected through the use of its facial recognition technology and held in its database.
Privacy Law
UK GDPR
Level of Government
Federal
Employee Count
Small (1-50 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
ICO
Related Products
UC
Fine / Penalty
€ 7,500,000.00
Keywords
Unlawful processing
Sensitive Data
October 4, 2023
Debt Collection Company
Financial Services
Croatia
Unlawfully processed sensitive data (health related) of 181,641 of their debtors, as well as the data of individuals who are not in a debtor-creditor relationship, most often collecting telephone number, first and last name and residential address.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Data mapping
UC
Fine / Penalty
€ 5,470,000.00
Keywords
Sensitive Data
Unlawful processing
September 30, 2023
Backbaud
Telecommunications
USA
Ransomware attack (in 2020) exposed users’ personal data, donation history and financial information to unauthorized third parties.
Privacy Law
Securities Act of 1933 and Section 13(a) of the Securities Exchange Act of 1934
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
SEC
Related Products
UC
SRR
Fine / Penalty
$49,500,000.00
Keywords
Data Breach
August 15, 2023
Ecommerce Enablers
Technology
Singapore
Access key to the company's storage servers on a private GitHub repository shared. Ex-filtration of data of 1.46 million email addresses, 10,000 national identity numbers, 300,000 bank account numbers and 380,000 pieces of partial credit card information.
Privacy Law
PIPA
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
PDPC
Related Products
Data mapping
Fine / Penalty
€ 50,250.00
Keywords
Data Breach
August 15, 2023
DoorDash Technologies Australia Pty Ltd
Retail
Australia
Promotional emails were sent to customers who had already unsubscribed, and 515,000 text messages were sent to their potential drivers without an unsubscribe function.
Privacy Law
Spam Act 2003
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
ACMA
Related Products
SRR
Fine / Penalty
AUS$ 2,011,320
Keywords
Unlawful Marketing
August 13, 2023
Experian Consumer Services
Technology
USA
Failed to comply with CAN-SPAM Act.
Privacy Law
CAN-SPAM Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
FTC
Related Products
CMP
UC
Fine / Penalty
$650,000.00
Keywords
Unlawful Marketing
July 26, 2023
Greenley v. Kochava, Inc.
Technology
USA
Data broker coded its software development kits to track a user’s geolocation, search terms, click choices, purchase decisions, and/or payment methods
Privacy Law
CIPA
Level of Government
Federal
Employee Count
Medium (51-200 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
U.S. District Court for the Southern District of California
Related Products
SRR
UC
Fine / Penalty
$5,000 per fine
Keywords
CIPA
July 13, 2023
Meta Platforms Ireland Limited and Facebook Norway AS
Technology
Norway
Processed personal data of data subjects in Norway for the purpose of targeting ads on the basis of “observed behavior".
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
Unknown
Keywords
Tracking Tech
Unlawful Marketing
Unlawful processing
July 5, 2023
Telekall Infoservice
Telecommunications
Brazil
The company violated LGPD data processing requirements and failed to cooperate with its investigation.
Privacy Law
LGPD
Level of Government
Federal
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
SRR
UC
Trust Hub
Fine / Penalty
€ 1,483.00
Keywords
Mishandling Data
Unlawful processing
June 29, 2023
Tele2 Sverige Aktiebolag
Telecommunications
Sweden
NOYB filed a complaint relating to unlawful transferring of personal data to the US.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
CMP
Fine / Penalty
€ 1,000,000.00
Keywords
Cross-Border Transfer
Other Actions
DPA determined that the use of the standard contractual clauses was not sufficient to guarantee a level of protection equivalent to that of the EU.
June 26, 2023
Creditinfo Lánstraust hf.
Professional Services
Iceland
Processed credit information re small loans, without a legal basis.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Data mapping
CMP
Fine / Penalty
€ 257,000.00
Keywords
Unlawful processing
June 14, 2023
CRITEO
Telecommunications
France
Used cookies to track user behavior for advertising
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
€ 40,000,000.00
Keywords
Tracking Tech
Data Deletion
June 11, 2023
Piraeus Bank
Financial Services
Greece
Processed personal data without taking appropriate and effective technical and organizational measures to process only the data necessary for the specific purpose.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
$210,000.00
Keywords
Data Minimization
Mishandling Data
June 11, 2023
Spotify
Technology
Sweden
Not sufficiently complied with data subject rights.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
€ 4,900,000.00
Keywords
Mishandling Data
May 30, 2023
Ring LLC
Technology
USA
Made false/misleading representations that it took reasonable steps to ensure that Ring home security cameras are a secure means to monitor private areas of consumers’ homes.
Privacy Law
FTC Act
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
FTC
Related Products
CMP
UC
Fine / Penalty
$5,800,000.00
Keywords
Mishandling Data
May 29, 2023
Shopee and Eslite
Retail
Taiwan
Did not provide information on safety checks or evidence that corrective measures have been implemented. Failed to conduct audits on outsourced suppliers – one of their supply chains had inadequate account management.
Privacy Law
PIPA
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
MODA
Related Products
Vendor
Fine / Penalty
2,000 TWD
Keywords
Data Breach
May 28, 2023
WIND (now NOVA)
Advertising
Poland
Sending of five promotional messages despite objections.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
CMP
UC
SRR
Fine / Penalty
€ 150,000.00
Keywords
Unlawful Marketing
May 11, 2023
Meta Platforms Ireland Limited
Technology
Ireland
Meta had violated Art. 46 GDPR by continuing to transfer personal data to the U.S. after the Schrems II ruling of the CJEU.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
DPA
Related Products
SRR
Assessments
Data mapping
Fine / Penalty
€ 1,200,000,000.00
Keywords
Cross-Border Transfer
Other Actions
The DPC ordered to cease any future transfer of personal data to the U.S., as well as to cease storage, within six months of data already transferred to the U.S.
April 3, 2023
TikTok
Technology
UK
More than one million British children under the age of 13 were using TikTok without the consent of their parents.
Privacy Law
UK GDPR
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
ICO
Related Products
UC
Data mapping
Fine / Penalty
€ 14,500,000.00
Keywords
Unlawful processing
March 15, 2023
Argon Medical Devices
Healthcare
Norway
Reported data breach of compromised personal data after 67 days.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Data mapping
Vendor
Fine / Penalty
€ 220,000.00
Keywords
Data Breach
March 10, 2023
[Name Not Public]
Healthcare
Turkey
A Hospital did not have a patient’s explicit consent before sharing their photographs and videos with the contracted media organizations for advertising and promotion purposes about the patients’ treatments.
Privacy Law
Law on the Protection of Personal Data No. 6698
Level of Government
Federal
Employee Count
Unknown
Estimated Annual Revenue
Unknown
Who Enforced
DPA
Related Products
UC
Data mapping
Fine / Penalty
$8,373.75
Keywords
Unlawful processing
February 21, 2023
VODAFONE ESPAÑA, S.A.U..
Telecommunications
Spain
System error when an Amazon sales partner had concluded a contract without first obtaining the consent of the data subject.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
DPA
Related Products
CMP
Fine / Penalty
€ 56,000.00
Keywords
Mishandling Data
February 16, 2023
Suomen Asiakastieto Oy
Professional Services
Finland
The company had unlawfully stored financial data of data subjects.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
Data mapping
SRR
Fine / Penalty
€ 440,000.00
Keywords
Unlawful processing
February 13, 2023
Byars v. Hot Topic, Inc.
Retail
USA
Case dismissed because third-party chat feature was a “tool” and no more than an “extension” of the website provider
Privacy Law
CIPA
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
U.S District Court for the Central District of California
Related Products
UC
SRR
Fine / Penalty
$5,000 per fine
Keywords
CIPA
February 5, 2023
Sats ASA
Retail
Norway
Did not comply with Customers requests for information as well as deletion of their personal data.
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
€ 900,000.00
Keywords
Data Deletion
Mishandling Data
February 2, 2023
Byars v. Goodyear Tire & Rubber Co
Retail
USA
Website’s chat features and use of session replay software violated (CIPA).
Privacy Law
CIPA
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
Over $10 billion
Who Enforced
US District Court for the Central District of California
Related Products
UC
SRR
Fine / Penalty
$5,000 per fine
Keywords
CIPA
Tracking Tech
January 31, 2023
GoodRx
Healthcare
USA
Google and Meta tracking pixels were installed on its website to share users’ medication information, location and other personal data.
Privacy Law
Health Breach Notification Rule
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
FTC
Related Products
CMP
UC
Fine / Penalty
$1,500,000.00
Keywords
Tracking Tech
January 18, 2023
Hungarian Airline Company
Transportation
Poland
Customer’s data was not timely erased when requested by airlines
Privacy Law
GDPR
Level of Government
Supernational
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
DPA
Related Products
SRR
Fine / Penalty
€ 13,244.00
Keywords
Data Deletion
Mishandling Data
October 18, 2022
Medibank
Healthcare
Australia
Privacy Act: Did not apply appropriate controls to sensitive data. Medibank says the hacker claims to have stolen 200GB of data.
Privacy Law
Privacy Act 1988
Level of Government
Federal
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
OAIC
Related Products
Assessments
Data mapping
UC
Fine / Penalty
AUS$ 2,200,000
Keywords
Sensitive Data
Data Breach
August 23, 2022
Sephora
Retail
USA
Sold consumers’ personal data using third-party trackers to get targeted ads and discounts on analytics, didn't disclose to consumers that it was selling their personal information, no GPC either. Did not cure these violations within the 30-day period
Privacy Law
CCPA
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$1 billion – $10 billion
Who Enforced
AG
Related Products
CMP
UC
SRR
Fine / Penalty
$1,200,000.00
Keywords
Selling Data
Tracking Tech
May 30, 2022
Javier v. Assurance IQ, LLC
Healthcare
USA
Privacy Law
TCPA
Level of Government
State
Employee Count
Enterprise (501+)
Estimated Annual Revenue
$100 million – $1 billion
Who Enforced
U.S. States Court of Northern District of California
Related Products
UC
SRR
Fine / Penalty
5,000 per fine
Keywords
CIPA
April 30, 2022
Patreon
Technology
USA
Privacy Law
VPPA
Level of Government
Federal
Employee Count
Large (201-500 employees)
Estimated Annual Revenue
$10 million – $100 million
Who Enforced
Federal Courts
Related Products
Assessments
Vendor
Data mapping
CMP
UC
Fine / Penalty
$7,250,000.00
Keywords
VPPA
Unlawful Marketing
Tracking Tech
Back
Next