Issue #14 | October 2026, Week 3

Irish watchdog finds GDPR breaches at Children’s Health Ireland facility

Jurisdiction

Ireland

Infringer Legal Name

Children’s Health Ireland (CHI)

Infringer Domicile

Ireland

Alleged Violation

Failure to protect childrens’ data

Enforcement Action

A reprimand and an order to complete data assessment

Case Status

Administrative action

Ireland’s Data Protection Commission (DPC) has found that Children’s Health Ireland (CHI) breached the GDPR rules on the security and confidentiality of children’s health records at its facility in Tallaght University Hospital.

The decision, notified to CHI on 10 September 2026, follows an inquiry launched in August 2025 after protected disclosures raised concerns about the handling and security of paper medical records.

The DPC also learned that documents containing sensitive personal data about children had overflowed from a confidential waste bin and were later removed. The bin was located beside the door of the non-consultant hospital doctor’s office.

The DPC found that CHI breached Article 5(1)(f) and Article 32(1) of the General Data Protection Regulation (GDPR). Article 5(1)(f) requires personal data to be kept secure and confidential, while Article 32 requires organizations to put appropriate security measures in place to protect personal data.

The DPC reprimanded CHI and ordered it to complete data protection impact assessments covering the storage of healthcare records and the management of confidential waste. CHI must also fully implement the security measures and procedures identified in the assessments. CHI has been ordered to submit the completed assessments to the DPC within four weeks of the decision.

Italian data protection agency fines two entities for privacy violations

Jurisdiction

Italy

Infringer Legal Name

Multiple entities

Infringer Domicile

Italy

Alleged Violation

Violation of the GDPR rules

Enforcement Action

A €8,000 fine; a €4,000 fine

Case Status

Administrative action

Italy’s data protection authority Garante has fined two entities for violation of the GDPR rules. In the first case, the authority has fined the Rome Technopole Foundation €8,000 for unlawfully publishing the personal data of 480 scholarship applicants online.

The investigation began after a student filed a complaint about an Excel file containing the rankings of successful applicants for scholarships aimed at first-level graduates. The file, published on the Foundation’s website, included sensitive personal information such as home addresses, tax codes, dates of birth, email addresses, identity document details, university records and bank account information, including IBANs.

In response to the Authority’s request for information, the Foundation said it had removed the file about 12 hours after publication. It explained that the incident resulted from a misunderstanding of the rules on administrative transparency.

Garante found that the Foundation had violated the principles of lawfulness and data minimization under data protection law and had no adequate legal basis for making the information public.

The second case involves the Municipality of Arvier, which has to pay €4,000 for several violations related to its video surveillance system. The investigation followed a citizen’s complaint that a camera was filming her home, including its windows and balconies. The watchdog found that the system lacked a clear legal basis, captured unnecessary images of private property, and provided inadequate information to the public. It also found weaknesses in the municipality’s data protection impact assessment.

The municipality has been ordered to review its cameras, correct their angles, protect private homes through image masking where necessary, clarify the purposes of surveillance, and improve its privacy notices and data protection assessment.

The FCC proposes more than $10M in fines over Lifeline fraud claims

Jurisdiction

United States

Infringer Legal Name

AirVoice Wireless and TAG Mobile

Infringer Domicile

United States

Alleged Violation

Wire fraud

Enforcement Action

Proposed fines of $2.67 million and $7.45 million, respectively

Case Status

Administrative action

The US Federal Communications Commission (FCC) is proposing more than $10 million in fines against two wireless providers accused of fraud involving a federal program that helps low-income households pay for phone service.

AirVoice Wireless and TAG Mobile, both operated by Houston-based HTH Communications, are accused of submitting duplicate reimbursement claims, making false certifications and violating federal rules.

The companies allegedly submitted claims for the same subscribers, sometimes changing their addresses to receive payments for the same person in different states. The agency also accused the companies of possible wire fraud and violations of program rules.

The FCC is proposing a $2.67 million fine against AirVoice Wireless for 74 duplicate claims and three improper reimbursement requests. TAG Mobile faces a proposed $7.45 million fine for 318 duplicate claims and three improper requests, along with other alleged violations.

Norway fines Microsoft’s Xandr €8M over Grindr user data

Jurisdiction

Norway

Infringer Legal Name

Xandr

Infringer Domicile

United States

Alleged Violation

Illegal sharing of personal data

Enforcement Action

€8 million fine

Case Status

Administrative action

Norway’s data protection authority (Datatilsynet) has fined Microsoft’s advertising technology unit Xandr 92 million Norwegian crowns (about €8 million) for sharing Grindr users’ sensitive personal data with thousands of advertisers without a valid legal basis.

The data, shared between July 2018 and April 2020, could reveal users’ sexual orientation. It was passed through automated advertising auctions, allowing companies to target users with personalized adverts without their knowledge.

Xandr argued that it assumed Grindr had obtained users’ consent. However, the Norwegian Data Protection Authority rejected the explanation, saying companies cannot avoid responsibility by blaming others. It ruled that Xandr shared legal responsibility with Grindr and failed to check whether valid consent had been obtained.

The case began in 2020 after the Norwegian Consumer Council filed a complaint against Xandr, which was known as AppNexus at the time.

Grindr was fined 65 million Norwegian crowns (about €5.7 million) over the same breaches in 2021. The fine against Xandr is the largest ever issued by Norway’s data protection authority. Xandr has three weeks to appeal the decision.

Finland fines a healthcare company €33,000 over cookie tracking

Jurisdiction

Finland

Infringer Legal Name

Mindemo Oy

Infringer Domicile

Finland

Alleged Violation

Data protection rules violation

Enforcement Action

A €33,000 fine

Case Status

Administrative action

Finland’s Data Protection Ombudsman has fined Finnish healthcare provider Mindemo Oy (formerly known as Heltti Oy) €33,000 for failing to properly protect users’ personal data through website cookies and tracking tools.

The company’s online therapy appointment booking service shared users’ information with Google, Meta and Microsoft when they accepted cookies; if visitors rejected cookies, the data was not shared.

The investigation found that information had been transferred to tracking service providers for at least a year. The data included health-related details, such as appointment bookings and confirmations, the type of therapy selected, and the name of the therapist. The information was not properly anonymized or protected to prevent it from being linked to individual users.

In addition to the fine, Mindemo received a warning over shortcomings in the secure processing of personal data.

The company said it had removed the tracking tools from its website and appointment booking service during the investigation. It had also asked the service providers to delete the data they had collected.