Issue #14 | October 2026, Week 3

Irish watchdog finds GDPR breaches at Children’s Health Ireland facility

Geltungsbereich

Irland

Rechtsname des Verletzers

Children’s Health Ireland (CHI)

Sitz des Rechtsverletzers

Irland

Behaupteter Verstoß

Failure to protect childrens’ data

Vollstreckungsmaßnahme

A reprimand and an order to complete data assessment

Verfahrensstatus

Verwaltungsmaßnahme

Die irische Datenschutzkommission (DPC) hat festgestellt, dass Children’s Health Ireland (CHI) in ihrer Einrichtung im Tallaght University Hospital gegen die DSGVO-Vorschriften zur Sicherheit und Vertraulichkeit von Gesundheitsakten von Kindern verstoßen hat.

The decision, notified to CHI on 10 September 2026, follows an inquiry launched in August 2025 after protected disclosures raised concerns about the handling and security of paper medical records.

The DPC also learned that documents containing sensitive personal data about children had overflowed from a confidential waste bin and were later removed. The bin was located beside the door of the non-consultant hospital doctor’s office.

The DPC found that CHI breached Article 5(1)(f) and Article 32(1) of the General Data Protection Regulation (GDPR). Article 5(1)(f) requires personal data to be kept secure and confidential, while Article 32 requires organizations to put appropriate security measures in place to protect personal data.

The DPC reprimanded CHI and ordered it to complete data protection impact assessments covering the storage of healthcare records and the management of confidential waste. CHI must also fully implement the security measures and procedures identified in the assessments. CHI has been ordered to submit the completed assessments to the DPC within four weeks of the decision.

Italian data protection agency fines two entities for privacy violations

Geltungsbereich

Italien

Rechtsname des Verletzers

Multiple entities

Sitz des Rechtsverletzers

Italien

Behaupteter Verstoß

Violation of the GDPR rules

Vollstreckungsmaßnahme

A €8,000 fine; a €4,000 fine

Verfahrensstatus

Verwaltungsmaßnahme

Italy’s data protection authority Garante has fined two entities for violation of the GDPR rules. In the first case, the authority has fined the Rome Technopole Foundation €8,000 for unlawfully publishing the personal data of 480 scholarship applicants online.

The investigation began after a student filed a complaint about an Excel file containing the rankings of successful applicants for scholarships aimed at first-level graduates. The file, published on the Foundation’s website, included sensitive personal information such as home addresses, tax codes, dates of birth, email addresses, identity document details, university records and bank account information, including IBANs.

In response to the Authority’s request for information, the Foundation said it had removed the file about 12 hours after publication. It explained that the incident resulted from a misunderstanding of the rules on administrative transparency.

Garante found that the Foundation had violated the principles of lawfulness and data minimization under data protection law and had no adequate legal basis for making the information public.

The second case involves the Municipality of Arvier, which has to pay €4,000 for several violations related to its video surveillance system. The investigation followed a citizen’s complaint that a camera was filming her home, including its windows and balconies. The watchdog found that the system lacked a clear legal basis, captured unnecessary images of private property, and provided inadequate information to the public. It also found weaknesses in the municipality’s data protection impact assessment.

The municipality has been ordered to review its cameras, correct their angles, protect private homes through image masking where necessary, clarify the purposes of surveillance, and improve its privacy notices and data protection assessment.

The FCC proposes more than $10M in fines over Lifeline fraud claims

Geltungsbereich

Vereinigte Staaten

Rechtsname des Verletzers

AirVoice Wireless and TAG Mobile

Sitz des Rechtsverletzers

Vereinigte Staaten

Behaupteter Verstoß

Fernkommunikationsbetrug

Vollstreckungsmaßnahme

Proposed fines of $2.67 million and $7.45 million, respectively

Verfahrensstatus

Verwaltungsmaßnahme

The US Federal Communications Commission (FCC) is proposing more than $10 million in fines against two wireless providers accused of fraud involving a federal program that helps low-income households pay for phone service.

AirVoice Wireless and TAG Mobile, both operated by Houston-based HTH Communications, are accused of submitting duplicate reimbursement claims, making false certifications and violating federal rules.

The companies allegedly submitted claims for the same subscribers, sometimes changing their addresses to receive payments for the same person in different states. The agency also accused the companies of possible wire fraud and violations of program rules.

The FCC is proposing a $2.67 million fine against AirVoice Wireless for 74 duplicate claims and three improper reimbursement requests. TAG Mobile faces a proposed $7.45 million fine for 318 duplicate claims and three improper requests, along with other alleged violations.

Norway fines Microsoft’s Xandr €8M over Grindr user data

Geltungsbereich

Norway

Rechtsname des Verletzers

Xandr

Sitz des Rechtsverletzers

Vereinigte Staaten

Behaupteter Verstoß

Illegal sharing of personal data

Vollstreckungsmaßnahme

€8 million fine

Verfahrensstatus

Verwaltungsmaßnahme

Norway’s data protection authority (Datatilsynet) has fined Microsoft’s advertising technology unit Xandr 92 million Norwegian crowns (about €8 million) for sharing Grindr users’ sensitive personal data with thousands of advertisers without a valid legal basis.

The data, shared between July 2018 and April 2020, could reveal users’ sexual orientation. It was passed through automated advertising auctions, allowing companies to target users with personalized adverts without their knowledge.

Xandr argued that it assumed Grindr had obtained users’ consent. However, the Norwegian Data Protection Authority rejected the explanation, saying companies cannot avoid responsibility by blaming others. It ruled that Xandr shared legal responsibility with Grindr and failed to check whether valid consent had been obtained.

The case began in 2020 after the Norwegian Consumer Council filed a complaint against Xandr, which was known as AppNexus at the time.

Grindr was fined 65 million Norwegian crowns (about €5.7 million) over the same breaches in 2021. The fine against Xandr is the largest ever issued by Norway’s data protection authority. Xandr has three weeks to appeal the decision.

Finland fines a healthcare company €33,000 over cookie tracking

Geltungsbereich

Finnland

Rechtsname des Verletzers

Mindemo Oy

Sitz des Rechtsverletzers

Finnland

Behaupteter Verstoß

Data protection rules violation

Vollstreckungsmaßnahme

A €33,000 fine

Verfahrensstatus

Verwaltungsmaßnahme

Finland’s Data Protection Ombudsman has fined Finnish healthcare provider Mindemo Oy (formerly known as Heltti Oy) €33,000 for failing to properly protect users’ personal data through website cookies and tracking tools.

The company’s online therapy appointment booking service shared users’ information with Google, Meta and Microsoft when they accepted cookies; if visitors rejected cookies, the data was not shared.

Die Untersuchung ergab, dass Informationen mindestens ein Jahr lang an Tracking-Dienstleister übermittelt worden waren. Zu den Daten gehörten gesundheitsbezogene Angaben wie Terminbuchungen und -bestätigungen, die Art der gewählten Therapie sowie der Name des Therapeuten. Die Informationen wurden nicht ordnungsgemäß anonymisiert oder geschützt, um zu verhindern, dass sie mit einzelnen Nutzern in Verbindung gebracht werden konnten.

In addition to the fine, Mindemo received a warning over shortcomings in the secure processing of personal data.

The company said it had removed the tracking tools from its website and appointment booking service during the investigation. It had also asked the service providers to delete the data they had collected.