Search Privacy Fines

RentGrow, a provider of consumer reports for tenant screening, will be required to pay $2.25 million to settle Federal Trade Commission allegations that the company violated the Fair Credit Reporting Act (FCRA), including by failing to use reasonable procedures to ensure the accuracy of its reports, and the FTC Act. The FCRA requires consumer reporting agencies (CRAs) to maintain reasonable procedures to assure the maximum possible accuracy of the information they include in background screening reports, disclose the sources of information used to compile a background screening report when a consumer requests it and take certain steps when a consumer disputes the completeness or accuracy of information in their background screening report. A complaint , filed by the Department of Justice upon notification and referral from the FTC, alleged that Massachusetts-based RentGrow Inc. is a CRA since it compiles information it obtains from a variety of sources into background screening reports

Obligation d’encadrer les relations entre le responsable de traitement et le sous-traitant Obligation pour le sous-traitant de ne traiter les données que sur instruction du responsable de traitement Défaut de sécurité des données

The ICO found that the company failed to put appropriate security measures in place to prevent a cyber-attack on a chat-bot installed on its online payment page. The data breach, which included names, payment card numbers, expiry dates and CVV numbers, potentially affected 9.4million of Ticketmaster’s customers across Europe including 1.5million in the UK

This decision arises from an own-volition inquiry that the DPC commenced in July 2019. The inquiry related to a personal data breach notified by City of Dublin Education and Training Board …

Articles: Art. 5, Art. 32, Art. 33, Art. 34

Easylife Limited has contravened Article 5(1)(a) of the GDPR in that there were serious deficiencies in the way it has collected, processed, and used the personal and special category data of 145,400 individuals.

Conservation injustifiée de données par un sous-traitant; Traitement de données par un sous-traitant non autorisé par le responsable de traitement; Registre des activités de traitement

This decision arises from an own-volition inquiry that the DPC commenced in July 2019. The inquiry related a personal data breach notified by Maynooth University in November 2018. The…

Articles: Art. 5, Art. 32, Art. 33

Non respect de l'art L 34-5 CPCE - prospection commerciale Défaut d'information Modalités d'exercice des droits Non respect du droit d'accès Non respect du droit d'opposition

Consentement des personnes (prospection commerciale par voie électronique - L. 34-5 CPCE); Preuve du consentement des personnes (art 7 RGPD); Défaut de base légale art 6-1 RGDP

The Police Service of Northern Ireland has been fined £750,000 for infringing Articles 5(1)(f), 32(1) and (2) of the UK GDPR between 25 May 2018 and 14 June 2024.

Manquement relatif à l'obligation de traiter des données de manière loyale ; manquement relatif à l'information des personnes ; manquement relatif aux cookies

The Federal Trade Commission finalized orders requiring Cox Media Group (CMG) and two other firms to pay a total of $930,000 to settle allegations they deceived customers by falsely claiming to offer an AI-powered service that could target localized ads based on conversations captured from consumers’ smart devices and that consumers had opted into such targeting. In three separate complaints first announced in May , the FTC alleged that Georgia-based media and marketing company CMG Media Corporation, which does business as Cox Media Group , and two marketing firms it worked with, New Hampshire-based MindSift LLC and Wisconsin-based 1010 Digital Works LLC , deceived customers by claiming they used a special algorithm to listen in on and detect pertinent conversations from smart devices in order to target ads to consumers within a specific geographic region. Contrary to these companies’ claims, however, the marketing service wasn’t based on voice data, and consumers hadn’t opted into thi

Absence de demande d'autorisation auprès de la CNIL (entrepôts de données de santé)

Absence de demande d'autorisation auprès de la CNIL (entrepôts de données de santé) Obligation de traiter les données de façon licite

The inquiry was commenced after BOI notified the DPC of a series of 10 data breaches relating to the BOI365 banking app. The data breach notifications concerned individuals gaining…

Articles: Art. 5, Art. 32

Durée de conservation Obligation de transparence Défaut d'information Non respect du droit d'opposition Protection des données par défaut Obligation de réaliser une analyse d'impact Défaut de sécurité des données

Data Controller(s) fined for serious breaches of the first and seventh data protection principles in respect of the processing of the personal data of ‘UK Users’.

Durée de conservation; Information des personnes; Information et consentement (cookies); Consentement des personnes (prospection commerciale par voie électronique - L. 34-5 CPCE)