Search Privacy Fines

The Information Commissioner’s Office (ICO) has fined DSG Retail Limited (DSG) £500,000 after a ‘point of sale’ computer system was compromised as a result of a cyber-attack, affecting at least 14 million people.

Cathay Pacific Airways Limited £500,000 for failing to protect the security of its customers’ personal data. Between October 2014 and May 2018 Cathay Pacific’s computer systems lacked appropriate security measures which led to customers’ personal details being exposed.

CRDNN Limited fined with the maximum £500,000 fine for making more than 193 million automated nuisance calls.

Consentement des personnes (prospection commerciale) Information des personnes et transparence Non respect du droit d'accès Encadrement des relations entre le responsable de traitement et le sous-traitant Obligation de documenter une violation de données

Non respect de l'art L 34-5 CPCE - prospection commerciale Défaut d'information Non respect du droit d'accès Non respect du droit d'opposition Défaut de sécurité des données

A company behind 99.5 million nuisance calls has been fined a record £400,000 by the Information Commissioner’s Office (ICO).

Carphone Warehouse fined £400,000 after serious failures placed customer and employee data at risk.

Uber fined for failing to protect customers’ personal information during a cyber attack.

The Data Protection Commission (DPC) has completed an inquiry into the Department of Social Protection’s (DSP) processing of biometric facial templates and the use of associated facial…

Articles: Art. 5, Art. 6, Art. 9, Art. 35

Durées de conservation Défaut d'information des personnes Non-respect des demandes d'effacement des données Défaut de sécurité des données Consentement pour la prospection commerciale

Non respect de l'art L 34-5 CPCE - prospection commerciale Défaut d'information Obligation de transparence Non respect du droit d'opposition Non respect du droit d'accès Défaut de sécurité des données

Consentement des personnes (prospection commerciale par voie électronique - L. 34-5 CPCE) Défaut de base légale Information des personnes (art. 14) et transparence

Non adéquation, non pertinence et caractère excessif des données, défaut d'information des personnes, non-respect du droit d'opposition, non coopération avec l'autorité de contrôle, transfert non encadré de données hors de l'UE

Miss-Sold Products UK Ltd fined £350,000 after they failed to ensure that marketing calls sent to individuals who had consented to receive marketing.

Your Money Rights Ltd. Made unsolicited automated marketing calls without consent of recipients

This Inquiry, which was commenced by the Data Protection Commission (‘the Commission) on 22 January 2019, examined whether Twitter International Company (‘TIC’) had complied with its…

Articles: Art. 33, Art. S 110, Art. S 111

This inquiry was commenced in respect of 22 personal data breach notifications that Bank of Ireland Group plc (“BOI”) made to the Data Protection Commission (“DPC”) between 9 November 2018…

Articles: Art. 32, Art. 33, Art. 34

Breach of Principle 7 of the DPA involving highly sensitive personal data where a number of data subjects were involved.

The DPC commenced the Inquiry following a ransomware attack affecting patient data held on Centric’s patient administration system which was notified to the DPC on 5 December 2019. As a…

Articles: Art. 3, Art. 32

Sending unsolicited direct marketing texts to mobile subscribers who had not consented to receive them

Défaut d'information des personnes Obligation d’encadrer les relations avec un sous-traitant