Fines Archives - Measured Collective

AEPD fines Amadeus €14.4M over traveller profiling: what the booking-data case means for reuse projects

Scott Dooley — Mon, 06 Jul 2026 06:14:47 +0000

A B2B platform holds years of customer booking data collected for one operational purpose. A product team wants to mine it for a new analytics pilot. No breach, no hacker. Just reuse. In May 2026, Spain’s data protection authority closed a cross-border GDPR case against Amadeus with a €14.4 million fine, reduced from €18 million ...

The post AEPD fines Amadeus €14.4M over traveller profiling: what the booking-data case means for reuse projects appeared first on Measured Collective.

California sues 23andMe: why genetic-data security failures become a board issue

Scott Dooley — Mon, 08 Jun 2026 06:44:31 +0000

California says 23andMe failed to protect genetic data and misled consumers after the 2023 breach. Here is why the lawsuit matters for boards, privacy teams, and managers.

The post California sues 23andMe: why genetic-data security failures become a board issue appeared first on Measured Collective.

Disney CCPA settlement: why cross-device opt-outs must work account-wide

Scott Dooley — Mon, 25 May 2026 06:15:14 +0000

California’s 11 February 2026 settlement with Disney is one of the clearest CCPA warnings yet for teams that run the same customer account across multiple apps, devices, and ad-tech integrations. The point is bigger than streaming. It is about whether one opt-out request actually stops sale or sharing everywhere your systems say it should. If ...

The post Disney CCPA settlement: why cross-device opt-outs must work account-wide appeared first on Measured Collective.

ICO secures £355,880.10 confiscation order against Rizwan Manjra — why insider misuse controls still matter

Scott Dooley — Sat, 23 May 2026 07:22:19 +0000

On 21 May 2026, the ICO said it had secured a £355,880.10 confiscation order against former motor-insurance worker Rizwan Manjra. This was not a corporate fine. It was a proceeds-of-crime order after an employee had already admitted unlawfully accessing personal information for financial gain. The compliance lesson is still squarely for organisations: insider misuse stays ...

The post ICO secures £355,880.10 confiscation order against Rizwan Manjra — why insider misuse controls still matter appeared first on Measured Collective.

General Motors CCPA settlement: why data minimization is now an enforcement risk

Scott Dooley — Mon, 18 May 2026 06:14:00 +0000

California’s settlement with General Motors shows how CCPA data minimisation is now an enforcement risk. Here’s what the case says about retention, purpose limits, sensitive data, and the checks managers should run now.

The post General Motors CCPA settlement: why data minimization is now an enforcement risk appeared first on Measured Collective.

ICO fines South Staffordshire PLC & South Staffordshire Water £963,900 after phishing-led breach exposed 633,887 people’s data

Scott Dooley — Wed, 13 May 2026 08:39:20 +0000

The ICO fined South Staffordshire £963,900 after a phishing-led cyber attack exposed 633,887 people’s data. What failed, and what managers should review now.

The post ICO fines South Staffordshire PLC & South Staffordshire Water £963,900 after phishing-led breach exposed 633,887 people’s data appeared first on Measured Collective.

Reddit Fined £14.47m by ICO for Children’s Privacy Failures — 2026

Scott Dooley — Sun, 26 Apr 2026 08:49:23 +0000

Reddit fined £14.47m by ICO for children's privacy failures under GDPR and DPA 2018. What this means for your organisation.

The post Reddit Fined £14.47m by ICO for Children’s Privacy Failures — 2026 appeared first on Measured Collective.

Advanced Computer Software Group Fined £3m by ICO for NHS Ransomware Data Breach — 2025

Scott Dooley — Sun, 26 Apr 2026 06:41:22 +0000

The ICO fined Advanced Computer Software Group £3m for the 2022 NHS ransomware data breach. Learn what this means for your data security compliance.

The post Advanced Computer Software Group Fined £3m by ICO for NHS Ransomware Data Breach — 2025 appeared first on Measured Collective.

Reddit Fined £14.47m by ICO for Children’s Privacy Failures — 2026

Scott Dooley — Sat, 04 Apr 2026 04:39:40 +0000

Reddit fined £14.47m by ICO for children's privacy failures under GDPR and DPA 2018. What this means for your organisation.

The post Reddit Fined £14.47m by ICO for Children’s Privacy Failures — 2026 appeared first on Measured Collective.

Age Verification Is No Longer Optional: How Regulators Are Raising the Bar

Scott Dooley — Wed, 11 Mar 2026 06:44:45 +0000

In early 2026, regulators on both sides of the Atlantic fined platforms, blocked laws, and rewrote policy — all focused on one question: are you doing enough to verify whether your users are children? Three enforcement actions in February and March 2026 make the direction of travel unmistakable. Self-declaration tick boxes are no longer a ...

The post Age Verification Is No Longer Optional: How Regulators Are Raising the Bar appeared first on Measured Collective.

ICO’s Public Sector Approach: Why the Post Office Received a Reprimand Instead of a £1m Fine

Scott Dooley — Wed, 31 Dec 2025 12:34:02 +0000

In December 2025, the ICO concluded its investigation into a data breach that exposed personal information belonging to 502 victims of the Post Office Horizon scandal. After considering a fine of up to £1.094 million, the regulator instead issued a reprimand under its “public sector approach” policy. The decision has drawn sharp criticism from privacy ...

The post ICO’s Public Sector Approach: Why the Post Office Received a Reprimand Instead of a £1m Fine appeared first on Measured Collective.

The EU’s First DSA Fine: What X’s €120m Penalty Means for Digital Platform Compliance

Scott Dooley — Wed, 31 Dec 2025 12:33:59 +0000

On 5 December 2025, the European Commission issued its first-ever fine under the Digital Services Act (DSA). X, formerly Twitter, was fined €120 million for three specific violations of the EU’s platform regulation rulebook. This decision matters beyond X. It shows how the Commission interprets its enforcement powers and what it expects from large platforms ...

The post The EU’s First DSA Fine: What X’s €120m Penalty Means for Digital Platform Compliance appeared first on Measured Collective.

ICO fines Care Home Director for Deleting Data: The Warning Every Manager Should Read

Scott Dooley — Mon, 08 Sep 2025 12:53:28 +0000

On 3 September 2025, Jason Blake, 56, director of Bridlington Lodge Care Home in Yorkshire, was ordered to pay £1,100 in fines and £5,440 in costs after being found guilty of failing to respond to a data subject access request (DSAR). The case is a rare criminal prosecution for DSAR non-compliance. The Facts In April ...

The post ICO fines Care Home Director for Deleting Data: The Warning Every Manager Should Read appeared first on Measured Collective.

Canal+ fined €600k for GDPR breaches including failure to report data breach

Harry Mulhern — Mon, 06 Nov 2023 03:59:19 +0000

French broadcasting company Groupe Canal+ was recently fined €600,000 by the French data protection authority (CNIL) for multiple violations of the EU’s General Data Protection Regulation (GDPR).

The post Canal+ fined €600k for GDPR breaches including failure to report data breach appeared first on Measured Collective.