Search Privacy Fines

Cookie consent mechanism did not allow users to refuse cookies as easily as accepting them.

Articles: Art. 82

Articles: <a href="https://www.privacy-regulation.eu/en/32.htm">Art. 32 GDPR</a>

The telecom company 1&#038;1 Telecom GmbH was fined with €9,550,000 after it came to light that sensitive customer information could be obtained by phone by anyone by just telling a client&#8217;s name and date of birth. This could have permitted anyone to obtain the personal information of any customer in case they knew their name and date of birth. The BfDI considered that the company failed to implement the necessary technical measures to ensure the protection of personal data. The BfDI further revealed that the fine was intended to be much larger but was eventually decreased due to the cooperation of the company during the investigation.

Articles: Art. 32 GDPR

Articles: Art. 32 GDPR

Articles: Art. 5 (1) a), e) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 22 GDPR, Art. 35 GDPR

The Italian Data Protection Authority (Garante) imposed two fines of €11,5 million total on Eni Gas and Luce because of the unlawful processing of personal data during an advertising campaign as well as for the activation of unsolicited contracts. This first fine of €8,5 million was issued for the unlawful processing of personal data in the context of a marketing campaign. The company made promotional calls without the consent of the contacted people and refused to acknowledge people&#8217;s wishes to be added onto a &#8220;do not contact&#8221; list. The company also did not provide an opt-out procedure for these unsolicited calls. The DPA also determined that the company lacked sufficient technical and organizational measures to protect users&#8217; personal data. Data was also processed longer than the allowed retention period. According to the DPA, some data was also collected from third party entities that did not have consent from the data subjects to disclose that data.

Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPR

Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPR

Articles: Art. 5 (1) c) GDPR, others

Online therapy service shared health data with advertisers including Facebook and Snapchat.

Google was fined with €7,000,000 by the Swedish Data Protection Authority due to failing to adequately comply with its obligations regarding the right of data subjects to have their search results removed from Google search. The Data Protection Authority of Sweden had already completed an investigation on Google in 2017 where it investigated how the company dealt with individuals&#8217; requests to be removed from search results. At that time, the Data Protection Authority instructed Google to be more pro-active in executing these removal requests. In 2018 the Authority initialed a further investigation after it was reported that Google did not remove search results related to individuals even after the earlier instructions in 2017 to do so. The Authority also questioned Google&#8217;s practice of informing website owners about which search results Google had removed, specifically which link (search result) has been removed and who was behind the removal request.

Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR

Articles: Art. 6 (1) GDPR, Art. 9 (1) GDPR

Articles: Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR

Articles: Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 25 (1) GDPR, Art. 26 GDPR, Art. 28 GDPR, Art. 35 (7) GDPR

Articles: Art. 6 (1) GDPR, Art. 12 GDPR, Art. 13 (1) c) GDPR

WhatsApp fined for transparency failures in processing user data.

Articles: Art. 5(1)(a), Art. 12, Art. 13

Musical.ly (now TikTok) collected personal information from children under 13 without parental consent.

Data broker settlement for unfair and deceptive practices in selling consumer data.

Unlawful collection and use of biometric data of French residents.

Articles: Art. 6, Art. 9

Articles: Unknown

Multiple GDPR violations including failure to appoint representative.

Articles: Art. 5, Art. 27

Multiple GDPR violations including failure to appoint EU representative.

Articles: Art. 5, Art. 27

Articles: Art. 5 (1) f) GDPR, Art. 32 GDPR

Articles: Art. 6 GDPR, Art. 13 GDPR