EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines
EDPB adopts guidelines on administrative fines under GDPR and on interplay between Digital Service Act and GDPR.
EDPB (European Data Protection Board) · EU-wideEDPB (European Data Protection Board)
Regulation
Category
Type
Date
EDPB statement on data protection challenges of smart glasses
EDPB adopts guidance on privacy and surveillance risks posed by smart glasses, including video recording and evidence administration.
EDPB (European Data Protection Board) · EU-wideEDPB guidelines on anonymisation, web scraping for generative AI, and blockchain data processing
EDPB adopts final guidelines on anonymisation, web scraping for generative AI, and personal data processing through blockchain technologies.
EDPB (European Data Protection Board) · EU-wideStakeholder event on guidelines on the interplay between data protection and competition law
Brussels, 30 July – The EDPB and the European Commission organise a remote stakeholder event in the context of their joint work on upcoming guidelines on the interplay between competition and data protection . The eve...
EDPB (European Data Protection Board) · EU-wideEDPB calls for legal basis for cross-regulatory information sharing
EDPB calls for a clear legal basis enabling information sharing among regulators with different competences to support consistent GDPR application.
EDPB (European Data Protection Board) · EU-wideItalian DPA fines IQVIA EUR 7,000,000 for unlawful processing of patients' health data
IQVIA Solutions Italy fined for unlawful processing of patients' health data, breaching GDPR Articles 5, 9, 13, 25, 28 and 35.
EDPB (European Data Protection Board) · EU-wideCNIL fine: Hôpital Privé de la Loire data breach, EUR 500,000
CNIL imposed EUR 500,000 administrative fine on Hôpital Privé de la Loire for inadequate security and delayed breach notification under GDPR Articles 32 and 34.
EDPB (European Data Protection Board) · EU-wideItalian DPA fines Emirates EUR 180,000 for infringements concerning passengers' health data
Italian data protection authority imposed administrative fine on Emirates for violations of GDPR Articles 5, 12 and 13 regarding passenger health data processing.
EDPB (European Data Protection Board) · EU-wideCNIL fine: Hôpital Privé de la Loire €500,000 for health data breach and inadequate security
CNIL fined a private hospital €500,000 for failure to secure patient data and notify data subjects of a 2025 breach affecting the Computerised Patient Summary system.
EDPB (European Data Protection Board) · EU-wideEDPB Final Decision: Administrative Fine and Compliance Order against Health Service Executive (HSE) for GDPR Violations
EDPB issued administrative fine and compliance order against HSE for breaches of GDPR Articles 5, 32, 33, and 34 relating to personal data security and breach notification.
EDPB (European Data Protection Board) · EU-wideSwedish DPA fines Miljödata i Karlskrona approximately EUR 160,000 for insufficient technical and organisational measures to ensure information security
Swedish DPA imposed administrative fine on IT service provider for Article 32 GDPR breach following cyberattack exposing 2.2 million individuals' personal data.
EDPB (European Data Protection Board) · EU-wideHellenic DPA decision on data breach involving E.E.T.A.A. S.A. as processor for the Ministry of Social Cohesion and Family Affairs
Administrative fine and compliance order issued for data breach by processor; violations of GDPR Articles 25, 28, 32, 33, 34.
EDPB (European Data Protection Board) · EU-wideDutch DPA fines Uber EUR 824,990,000 for unlawful automated decision-making and insufficient information on profiling
Dutch data protection authority imposes fine on Uber for violations of GDPR Articles 22 and 13 regarding automated decision-making and profiling transparency.
EDPB (European Data Protection Board) · EU-wideIrish Data Protection Commission fines Google EUR 403,000,000 for location data processing
Google fined for unlawful processing of location data under GDPR Articles 5, 6, 12 and 13; compliance order issued.
EDPB (European Data Protection Board) · EU-wideNorwegian DPA fines Xandr EUR 8,600,000 for unlawful processing of personal data
Norwegian data protection authority imposed administrative fine on Xandr Inc. for unlawful processing of personal data under GDPR Articles 6 and 9.
EDPB (European Data Protection Board) · EU-wideItalian DPA fines Wind Tre EUR 16,700,000 for unlawful telemarketing and data protection infringements
Italian Data Protection Authority imposed administrative fine on Wind Tre S.p.A. for GDPR violations including unlawful processing, lack of lawful basis, and inadequate security measures.
EDPB (European Data Protection Board) · EU-wideItalian DPA fines security company EUR 39,000 for violations concerning employees' data
Italian Data Protection Authority imposed administrative fine on La Patria S.p.A. for violations of Articles 12, 13 and 15 GDPR regarding employee data subject rights.
EDPB (European Data Protection Board) · EU-wideItalian DPA fines BBVA EUR 5,508,000 for failing to respect a customer's objection to direct marketing
Italian data protection authority imposed administrative fine on BBVA for violating GDPR Articles 5, 12, 21 and 24 regarding customer objection to direct marketing.
EDPB (European Data Protection Board) · EU-wideSpanish DPA fines Securitas Direct EUR 100,000 for obstructing data subject rights via chargeable telephone number
Spanish data protection authority imposed administrative fine on Securitas Direct for directing individuals to a paid telephone line to exercise GDPR rights.
EDPB (European Data Protection Board) · EU-wideSpanish DPA fine: Securitas Direct EUR 100,000 for obstructing data subject rights via paid telephone number
Spanish DPA fined Securitas Direct EUR 100,000 for directing individuals to a chargeable telephone number to exercise GDPR data subject rights, making exercise more difficult.
EDPB (European Data Protection Board) · EU-wideSpanish DPA fine: Securitas Direct €100,000 for obstructing data subject rights via paid telephone number
Spanish DPA fined Securitas Direct €100,000 for making exercise of data subject rights more difficult by directing individuals to a chargeable telephone number, violating GDPR Article 12.
EDPB (European Data Protection Board) · EU-wideCNIL fine: EXTIA EUR 300,000 for failure to respect data subject rights
CNIL imposed a EUR 300,000 administrative fine on EXTIA for violations of Articles 12 and 17 GDPR concerning transparent information and right to erasure.
EDPB (European Data Protection Board) · EU-wideCNIL fine: EXTIA €300,000 for failure to respect data subject rights
CNIL imposed a €300,000 administrative fine on EXTIA for violations of Articles 12 and 17 GDPR concerning transparent information and right to erasure.
EDPB (European Data Protection Board) · EU-wideEDPB binding decision: Belgian DPA to handle merits of NOYB cookie banner complaint against VRT
EDPB binding decision requiring Belgian DPA to proceed with substantive examination of GDPR cookie-consent complaint against public broadcaster VRT.
EDPB (European Data Protection Board) · EU-wide
Showing 24 of 24 tracked updates
Health-tech only