Topic
Regulatory penalties and decisions issued under the EU General Data Protection Regulation, including lead-authority jurisdiction and appeals.
Italy's Garante fined BBVA €5,508,000 after a failed sync kept one customer's marketing opt-out from the CRM unit that sent promotions for seven months. The EDPB published a €16.7M Wind Tre fine three days later.
Reality
Norway's data protection authority fined Microsoft's adtech unit Xandr 92 million crowns ($9.6 million) over Grindr data, the largest penalty it has issued. The fine is 1.4 times the 65 million crowns imposed on Grindr itself over the same breaches.
Perspective Coverage
7 publishersReality
Italy's privacy regulator fined IQVIA 7 million euros after finding coded records on about one million patients could be traced back to individuals. Teams that pool health records under one persistent patient key now have a regulator's written reasoning for why removing names fell short.
Reality
Ireland's DPC takes a median 6.2 years to decide a cross-border GDPR case, a LessWrong analysis finds. The AI Act gives the Commission five years from a violation to fine, and it requires the same investigation and response steps that take up most of the Irish cases.
Reality
The Dutch regulator's fine against Uber turns the rules on automated decisions into a build order: meaningful review before the action lands, and a contest route the driver can actually find.
Perspective Coverage
3 publishersReality
More than 11,000 UK claimants, two named analytics providers and no admission of liability have produced a hard figure for what one app's pre-2020 profile data was worth, payable in two £13m tranches.
Perspective Coverage
5 publishersReality
The Data Protection Commission's EUR 403m penalty, its fourth-largest under GDPR, covers 620 days of location processing that ended in February 2020. Against Alphabet's reported revenue that is about 0.15 percent.
Perspective Coverage
5 publishersReality
Ireland's Data Protection Commission found lawfulness, fairness and retention failures in Web & App Activity and Location History, and transparency failures in all three location features it examined. One of them runs for Android users who never signed in.
Perspective Coverage
12 publishersReality
Hôpital privé de la Loire lost records on 727,113 people over several days in the summer of 2025. CNIL's decision names each control that was missing. It prices the whole set at about 69 cents a record.
Reality
The Dutch regulator did not rule that Uber's deactivations were wrong, only that no person reviewed them. That reading reaches every fraud score and abuse pipeline with EU users.
Reality