Dutch AP fines Uber €825m: what meaningful human review looks like
The Dutch Data Protection Authority (AP) has fined Uber €825 million over automated driver-account deactivations. The decision, reported on 21…
EU Data Protection Enforcement
Follow significant enforcement decisions from European data protection authorities, including Ireland’s DPC, France’s CNIL, Italy’s Garante and the Dutch AP. Each case analysis explains the regulator’s findings and the operational lessons for organisations processing personal data across Europe. Explore recent decisions on AI, health data, security, international transfers and individual rights below, or view the wider data protection enforcement and fines collection.
Garante fines Emirates €180,000 over assisted-travel health data
Italy's Garante fined Emirates €180,000 over MEDIF health-data transparency and retention. Practical lessons for accessibility and assisted-travel data.
Irish DPC fines HSE €300,000 after Tullamore ransomware breach
The Irish Data Protection Commission has fined the Health Service Executive €300,000 after a ransomware attack on the laboratory information…
CNIL fines IQVIA €5m over health data warehouse breaches
On 26 May 2026, the French data protection authority CNIL fined IQVIA Operations France €5 million over failures in two…
Irish DPC fines Permanent TSB €277,500 over phone-based account takeover and late breach reporting
Irish DPC fined Permanent TSB €277,500 after phone-based impersonation attacks exposed weak contact-centre controls and late GDPR breach reporting.
Dutch AP fines Yango €100 million over Russia transfers — why boards should revisit GDPR transfer governance
The Dutch AP fined Yango operator MLU B.V. €100 million over personal data transfers to Russia. Here is the board-level…