EU Data Protection Enforcement | Measured Collective

Xandr fined NOK 92 million over Grindr advertising data

Scott Dooley — Wed, 28 Oct 2026 09:23:50 +0000

Norway’s DPA fined Xandr NOK 92 million over Grindr user data in advertising auctions. The decision explains consent checks and joint-controller duties.

The post Xandr fined NOK 92 million over Grindr advertising data appeared first on Measured Collective.

CNIL closes Google injunction after account and Gmail changes

Scott Dooley — Tue, 27 Oct 2026 07:32:22 +0000

CNIL announced the closure on 14 October 2026, following its 23 September decision. The outcome concerns a limited injunction, not blanket compliance.

The post CNIL closes Google injunction after account and Gmail changes appeared first on Measured Collective.

Paper-record security and retention: an audit guide for managers

Scott Dooley — Tue, 27 Oct 2026 07:19:31 +0000

Start a paper-record audit with one storage location and follow a sample file through its life: arrival, access, retrieval, retention review and disposal. HR, compliance, facilities and records managers should be able to show who owns each decision and what evidence proves it happened. Use the audit below to turn a storage policy into checks ...

The post Paper-record security and retention: an audit guide for managers appeared first on Measured Collective.

Irish DPC fines Google €403m: what location-data governance teams should learn

Scott Dooley — Tue, 27 Oct 2026 07:11:35 +0000

The Irish Data Protection Commission (DPC) has fined Google Ireland Limited €403 million after finding failures in the way Google processed location data through Web & App Activity, Location History and Location Accuracy. The decision is a reminder for every organisation using location analytics: a privacy notice and a settings screen are not controls unless ...

The post Irish DPC fines Google €403m: what location-data governance teams should learn appeared first on Measured Collective.

Securitas Direct fined €100,000: why data-subject rights must be genuinely free

Scott Dooley — Wed, 23 Sep 2026 07:10:30 +0000

The Spanish DPA fined Securitas Direct €100,000 after a chargeable phone number made data-subject rights harder to exercise. Here is how managers can audit rights-exercise routes.

The post Securitas Direct fined €100,000: why data-subject rights must be genuinely free appeared first on Measured Collective.

CNIL fines EXTIA €300,000: what HR teams should learn about erasure requests

Scott Dooley — Thu, 10 Sep 2026 15:46:23 +0000

On 9 September 2026, the CNIL published a decision fining EXTIA €300,000 after the IT and engineering company failed to handle candidates’ and former employees’ erasure requests reliably. The underlying decision was made on 21 July 2026. The case is a useful warning for HR and recruitment teams: deleting a record is only one part ...

The post CNIL fines EXTIA €300,000: what HR teams should learn about erasure requests appeared first on Measured Collective.

CNIL fines Hôpital Privé de la Loire €500,000 after health-data breach

Scott Dooley — Thu, 10 Sep 2026 15:37:00 +0000

A €500,000 CNIL fine against Hôpital Privé de la Loire is a reminder that healthcare security has to be designed around the sensitivity and scale of the data being processed. The decision concerns both the controls protecting a computerised patient record and the organisation’s communication with people affected by the breach. For healthcare managers, the ...

The post CNIL fines Hôpital Privé de la Loire €500,000 after health-data breach appeared first on Measured Collective.

Dutch AP fines Uber €825m: what meaningful human review looks like

Scott Dooley — Sat, 22 Aug 2026 07:05:49 +0000

The Dutch Data Protection Authority (AP) has fined Uber €825 million over automated driver-account deactivations. The decision, reported on 21 August and confirmed to Reuters by the regulator, concerns European incidents from 2018 to 2022. Uber says it will appeal, so the penalty is not final. The amount is eye-catching. The operational lesson is more ...

The post Dutch AP fines Uber €825m: what meaningful human review looks like appeared first on Measured Collective.

Garante fines Emirates €180,000 over assisted-travel health data

Scott Dooley — Fri, 19 Jun 2026 08:11:26 +0000

Italy's Garante fined Emirates €180,000 over MEDIF health-data transparency and retention. Practical lessons for accessibility and assisted-travel data.

The post Garante fines Emirates €180,000 over assisted-travel health data appeared first on Measured Collective.

Irish DPC fines HSE €300,000 after Tullamore ransomware breach

Scott Dooley — Thu, 18 Jun 2026 07:16:30 +0000

The Irish Data Protection Commission has fined the Health Service Executive €300,000 after a ransomware attack on the laboratory information system at Midlands Regional Hospital Tullamore. The DPC notice, published on 15 June 2026, says the breach was detected on 14 November 2018 and affected systems used to store and process patients’ diagnostic-test results. The ...

The post Irish DPC fines HSE €300,000 after Tullamore ransomware breach appeared first on Measured Collective.

CNIL fines IQVIA €5m over health data warehouse breaches

Scott Dooley — Fri, 29 May 2026 07:10:47 +0000

On 26 May 2026, the French data protection authority CNIL fined IQVIA Operations France €5 million over failures in two authorised health data warehouses. The regulator published the decision on 28 May 2026, made the sanction public, and gave the company six months to fix some of the remaining breaches or face a further penalty ...

The post CNIL fines IQVIA €5m over health data warehouse breaches appeared first on Measured Collective.

Irish DPC fines Permanent TSB €277,500 over phone-based account takeover and late breach reporting

Scott Dooley — Sat, 16 May 2026 11:14:10 +0000

Irish DPC fined Permanent TSB €277,500 after phone-based impersonation attacks exposed weak contact-centre controls and late GDPR breach reporting.

The post Irish DPC fines Permanent TSB €277,500 over phone-based account takeover and late breach reporting appeared first on Measured Collective.

Dutch AP fines Yango €100 million over Russia transfers — why boards should revisit GDPR transfer governance

Scott Dooley — Thu, 14 May 2026 07:22:23 +0000

The Dutch AP fined Yango operator MLU B.V. €100 million over personal data transfers to Russia. Here is the board-level GDPR lesson on cross-border access, transfer governance and high-risk jurisdictions.

The post Dutch AP fines Yango €100 million over Russia transfers — why boards should revisit GDPR transfer governance appeared first on Measured Collective.