---
title: "Art. 5 GDPR: Principles relating to processing of personal data"
canonical: "https://dposchool.com/gdpr/article/5"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_5"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Art. 5 GDPR · Chapter II: Principles

# Article 5 GDPR: Principles relating to processing of personal data

Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

## Summary (not the official text)

Personal data must be processed lawfully, fairly and transparently, for specified purposes, limited to what is necessary, kept accurate, stored no longer than necessary and kept secure. The controller is responsible for, and must be able to demonstrate, compliance with these principles.

## Official text

### Article 5(1)

**1.** Personal data shall be:

#### Article 5(1)(a)

**(a)** processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

#### Article 5(1)(b)

**(b)** collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);

#### Article 5(1)(c)

**(c)** adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

#### Article 5(1)(d)

**(d)** accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);

#### Article 5(1)(e)

**(e)** kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);

#### Article 5(1)(f)

**(f)** processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

### Article 5(2)

**2.** The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

## Source

Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 5 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_5)

Text as of 28 October 2026.

This is reference material, not legal advice.

## Related recitals

This list is under review.

- [Recital 39](https://dposchool.com/gdpr/recital/39)
- [Recital 40](https://dposchool.com/gdpr/recital/40)

## Court of Justice judgments

### [C-474/24, AR and Others v Österreichische Datenschutzbehörde and Others](https://dposchool.com/gdpr/case/c-474-24)

Judgment of 14 July 2026 · ECLI:EU:C:2026:579

Publishing the names and sanctions of athletes who broke anti-doping rules falls within the GDPR; it is not in principle health data unless the substance or method reveals health information; national law may require publication if it allows an individual balancing and excludes recreational athletes, vulnerable persons and whistleblowers.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-474/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0474)

### [C-492/23, X v Russmedia Digital SRL and Inform Media Press SRL](https://dposchool.com/gdpr/case/c-492-23)

Judgment of 2 December 2025 · ECLI:EU:C:2025:935

An online marketplace operator is a controller of personal data in ads published on its site; before publication it must identify ads with sensitive data, check the advertiser is the person concerned or has explicit consent, take security measures against copying, and cannot rely on the hosting exemptions of the e-Commerce Directive for these GDPR duties.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-492/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0492)

### [C-247/23, VP v Országos Idegenrendészeti Főigazgatóság](https://dposchool.com/gdpr/case/c-247-23)

Judgment of 13 March 2025 · ECLI:EU:C:2025:172

A public register must rectify inaccurate data on a person's gender identity; reasonable evidence may be required, but not proof of gender reassignment surgery.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-247/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0247)

### [C-394/23, Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect](https://dposchool.com/gdpr/case/c-394-23)

Judgment of 9 January 2025 · ECLI:EU:C:2025:2

Making customers state a title (Mr or Ms) to buy a train ticket is not necessary for the contract and cannot rest on legitimate interest where customers were not told of that interest, the data are not strictly necessary, or the risk of discrimination outweighs it; the right to object does not change the necessity test.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-394/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0394)

### [C-65/23, MK v K GmbH](https://dposchool.com/gdpr/case/c-65-23)

Judgment of 19 December 2024 · ECLI:EU:C:2024:1051

Works agreements on employee data must meet Arts. 5, 6(1) and 9 as well as Art. 88(2), and courts can fully review whether processing under them is necessary.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-65/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0065)

### [C-446/21, Maximilian Schrems v Meta Platforms Ireland Limited](https://dposchool.com/gdpr/case/c-446-21)

Judgment of 4 October 2024 · ECLI:EU:C:2024:834

Data minimisation prevents a social network from using all personal data it collects, on or off the platform, for targeted advertising without limits of time or type; a person who speaks publicly about their sexual orientation does not thereby allow the network to process other data about it for advertising.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-446/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0446)

### [C-687/21, BL v MediaMarktSaturn Hagen-Iserlohn GmbH](https://dposchool.com/gdpr/case/c-687-21)

Judgment of 25 January 2024 · ECLI:EU:C:2024:72

Staff mistakenly handing a document to the wrong person does not by itself show inadequate security measures; compensation is compensatory only; where the wrong recipient demonstrably did not read the data, a purely hypothetical risk of misuse is not damage.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-687/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0687)

### [C-231/22, État belge v Autorité de protection des données](https://dposchool.com/gdpr/case/c-231-22)

Judgment of 11 January 2024 · ECLI:EU:C:2024:7

A body that runs a national official journal can be a controller of the personal data in what it publishes, even without legal personality, where national law sets the purposes and means; it may be responsible jointly with the bodies that send it the documents.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-231/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0231)

### [C-340/21, VB v Natsionalna agentsia za prihodite](https://dposchool.com/gdpr/case/c-340-21)

Judgment of 14 December 2023 · ECLI:EU:C:2023:986

A data breach by third parties does not in itself prove that security measures were inadequate; the controller bears the burden of proving appropriateness; fear of misuse after a breach can be non-material damage.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-340/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0340)

### [C-26/22, UF and AB v Land Hessen](https://dposchool.com/gdpr/case/c-26-22)

Judgment of 7 December 2023 · ECLI:EU:C:2023:958

Credit agencies may not keep insolvency-discharge data longer than the public register; a person who objects can obtain erasure absent overriding grounds; and supervisory authority decisions on complaints are subject to full judicial review.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-26/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0026)

### [C-60/22, UZ v Bundesrepublik Deutschland](https://dposchool.com/gdpr/case/c-60-22)

Judgment of 4 May 2023 · ECLI:EU:C:2023:373

A failure to conclude a joint-controller arrangement or keep a record of processing does not by itself make processing unlawful or give a right to erasure or restriction.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-60/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0060)

### [C-268/21, Norra Stockholm Bygg AB v Per Nycander AB](https://dposchool.com/gdpr/case/c-268-21)

Judgment of 2 March 2023 · ECLI:EU:C:2023:145

When a civil court is asked to order disclosure of a document containing third parties' personal data, the GDPR applies and the court must weigh those persons' interests, applying proportionality and data minimisation.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-268/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0268)

### [C-77/21, Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság](https://dposchool.com/gdpr/case/c-77-21)

Judgment of 20 October 2022 · ECLI:EU:C:2022:805

Copying customer data into a test database can be compatible further processing under Art. 6(4), but keeping the data there longer than needed for testing breaches storage limitation.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-77/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0077)

### [C-175/20, SIA 'SS' v Valsts ieņēmumu dienests](https://dposchool.com/gdpr/case/c-175-20)

Judgment of 24 February 2022 · ECLI:EU:C:2022:124

A tax authority that collects large amounts of personal data from a business must respect the principles in Art. 5(1); it may only derogate from them on the basis of a legislative measure under Art. 23(1).

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-175/20&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0175)

### [C-439/19, Proceedings brought by B](https://dposchool.com/gdpr/case/c-439-19)

Judgment of 22 June 2021 · ECLI:EU:C:2021:504

Penalty points for traffic offences are data on criminal offences under Art. 10; the GDPR precludes a law making them publicly available without the requester showing a specific interest, or passing them on to businesses for reuse.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-439/19&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0439)

### Related (earlier law or other instruments)

#### [C-129/21, Proximus NV v Gegevensbeschermingsautoriteit](https://dposchool.com/gdpr/case/c-129-21)

Judgment of 27 October 2022 · ECLI:EU:C:2022:833

Instrument: GDPR together with the ePrivacy Directive

Consent to appear in phone directories, given once, covers all directory publishers; a request to be removed is an erasure request, and the controller must inform other controllers it supplied.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-129/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0129)

## EDPB guidance

### [Guidelines 03/2026 on web scraping in the context of generative AI](https://dposchool.com/gdpr/guidance/edpb-03-2026)

EDPB 03/2026 · Draft for consultation · First published 8 July 2026

Consultation open until 30 October 2026. Articles indicative.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-032026-on-web-scraping-in-the-context-of-generative-ai_en)

### [Guidelines 02/2025 on processing of personal data through blockchain technologies](https://dposchool.com/gdpr/guidance/edpb-02-2025)

EDPB 02/2025 · Final · First published 14 April 2025 · Final version 7 July 2026

Version 2 is final.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-022025-on-processing-of-personal-data-through-blockchain_en)

### [Guidelines 1/2026 on processing of personal data for scientific research purposes](https://dposchool.com/gdpr/guidance/edpb-01-2026)

EDPB 01/2026 · Draft for consultation · First published 16 April 2026

Consultation closed 25 June 2026; final version not yet published.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-12026-on-processing-of-personal-data-for-scientific-research_en)

### [Recommendations 2/2025 on the legal basis for requiring the creation of user accounts on e-commerce websites](https://dposchool.com/gdpr/guidance/edpb-rec-02-2025)

EDPB Rec 02/2025 · Draft for consultation · First published 4 December 2025

Consultation closed; final not yet published.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/recommendation/recommendations-22025-on-the-legal-basis-for-requiring-the-creation-of_en)

### [Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models](https://dposchool.com/gdpr/guidance/edpb-opinion-28-2024)

EDPB Opinion 28/2024 · Final · First published 18 December 2024 · Final version 18 December 2024

Art. 64(2) opinion; date is EDPB publication date.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-282024-on-certain-data-protection-aspects-related-to_en)

### [Guidelines 03/2022 on deceptive design patterns in social media platform interfaces](https://dposchool.com/gdpr/guidance/edpb-03-2022)

EDPB 03/2022 · Final · First published 21 March 2022 · Final version 24 February 2023

Version 1 was titled 'dark patterns'.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-032022-on-deceptive-design-patterns-in-social-media-platform_en)

## Fines

Amounts are shown in the currency in which the fine was imposed.

### [IQVIA Solutions Italy S.r.l: EUR 7,000,000](https://dposchool.com/gdpr/fine/garante-iqvia-2026-09)

Garante per la protezione dei dati personali, Italy · Decision of 23 September 2026 · Appeal status: unknown

Health-analytics firm treated a database of about one million GP patients as anonymous when a persistent identifier made them re-identifiable; no legal basis, no information, no DPIA, weak retention and security.

[Source: the authority](https://www.edpb.europa.eu/news/italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en)

### [FREE MOBILE: EUR 27,000,000](https://dposchool.com/gdpr/fine/cnil-free-mobile-2026-01)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 8 January 2026 · Appeal status: unknown

After an October 2024 intrusion exposed 24 million subscriber contracts (including IBANs): weak VPN authentication and poor detection, an incomplete breach notice to subscribers, and excessive retention of former subscribers' data.

[Source: the authority](https://www.cnil.fr/en/sanction-free-2026)

### [Experian Nederland B.V.: EUR 2,700,000](https://dposchool.com/gdpr/fine/ap-experian-2025-10)

Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 16 October 2025 · Appeal status: not appealed

Credit-scoring business used personal data from many sources without a valid legal basis and did not inform the people concerned.

[Source: the authority](https://www.autoriteitpersoonsgegevens.nl/actueel/experian-krijgt-boete-van-27-miljoen-euro-voor-privacyovertredingen)

### [McDonald’s Polska Sp. z o.o.: PLN 16,932,657](https://dposchool.com/gdpr/fine/uodo-mcdonalds-2025-07)

Prezes Urzędu Ochrony Danych Osobowych (Polish Data Protection Authority), Poland · Announced on 21 July 2025 · Appeal status: unknown

Outsourced staff scheduling without risk analysis or supervision of the processor, so employee data (names, PESEL or passport numbers, shifts) ended up in a public directory.

Not fully confirmed: Decision date not shown on the page (announcement date used). Three fines: PLN 1,632,063 + 13,600,528 + 1,700,066. The processor was fined PLN 183,858 in total. Articles taken from the narrative; the page does not give a single list of infringed articles.

[Source: the authority](https://uodo.gov.pl/pl/138/3827)

### [Luka Inc.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-luka-replika-2025-04)

Garante per la protezione dei dati personali, Italy · Decision of 10 April 2025 · Appeal status: unknown

AI companion chatbot ran with no identified legal basis, an inadequate privacy policy and no effective age verification despite excluding minors.

[Source: the authority](https://www.edpb.europa.eu/news/ai-the-italian-supervisory-authority-fines-company-behind-chatbot-replika_en)

### [Netflix International B.V.: EUR 4,750,000](https://dposchool.com/gdpr/fine/ap-netflix-2024-11)

Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 26 November 2024 · Appeal status: unknown

Did not tell customers clearly enough, in its privacy statement and access replies, about purposes, legal bases, recipients, retention and transfers (2018 to 2020).

[Source: the authority](https://www.autoriteitpersoonsgegevens.nl/en/documents/fine-netflix)

### [Posti: EUR 2,400,000](https://dposchool.com/gdpr/fine/fi-posti-2024-11)

Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman, Finland), Finland · Decision of 13 November 2024 · Appeal status: unknown

Automatically opened an OmaPosti electronic mailbox for customers, tied to other services, with a pre-ticked box and without clear information.

Not fully confirmed: Confirmed on the EDPB news page. Fine for Art. 5 and 6(1); reprimand and order for Art. 13; instruction on Art. 25. Company name given only as 'Posti'.

[Source: the authority](https://www.edpb.europa.eu/news/finnish-sa-administrative-fine-imposed-on-posti-for-unlawful-processing-of-personal-data_en)

### [Foodinho s.r.l.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-foodinho-2024-11)

Garante per la protezione dei dati personali, Italy · Decision of 13 November 2024 · Appeal status: unknown

Glovo-group delivery platform geolocated over 35,000 riders even off shift, used facial recognition for identity checks, made automated decisions (including deactivations) without safeguards, and let other group companies see rider data.

[Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10074601)

### [LinkedIn Ireland Unlimited Company: EUR 310,000,000](https://dposchool.com/gdpr/fine/dpc-linkedin-2024-10)

Data Protection Commission (Ireland), Ireland · Decision of 22 October 2024 · Appeal status: under appeal

Processed members' data for behavioural analysis and targeted advertising without a valid legal basis, and without fair and clear information.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-linkedin-ireland-unlimited-company-october-2024)

### [Meta Platforms Ireland Limited: EUR 91,000,000](https://dposchool.com/gdpr/fine/dpc-meta-2024-09)

Data Protection Commission (Ireland), Ireland · Decision of 26 September 2024 · Appeal status: under appeal

Stored some Facebook users' passwords in plain text, notified the breach late and did not document it.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-meta-platforms-ireland-limited-september-2024)

### [Clearview AI Inc.: EUR 30,500,000](https://dposchool.com/gdpr/fine/ap-clearview-2024-05)

Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 16 May 2024 · Appeal status: not appealed

Built a facial recognition database of billions of photos, including of people in the Netherlands, without a legal basis, and did not inform people or answer access requests.

[Source: the authority](https://www.autoriteitpersoonsgegevens.nl/en/documents/decision-fine-clearview-ai)

### [Enel Energia S.p.A.: EUR 79,107,101](https://dposchool.com/gdpr/fine/garante-enel-energia-2024-02)

Garante per la protezione dei dati personali, Italy · Decision of 8 February 2024 · Appeal status: upheld

Telemarketing: weak control of sales-agent access let unauthorised agencies place contracts obtained through unlawful calls into the company's systems; failures of security, accountability, privacy by design and processor contracts.

[Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9988710)

### [Amazon France Logistique: EUR 32,000,000](https://dposchool.com/gdpr/fine/cnil-amazon-france-logistique-2023-12)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 27 December 2023 · Appeal status: reduced

Warehouse employee monitoring: scanner-based productivity indicators kept in detail for 31 days, some judged to lack a legal basis, plus poor information to temporary staff and on CCTV, and weak security.

[Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048989272)

### [EOS Matrix d.o.o.: EUR 5,470,000](https://dposchool.com/gdpr/fine/azop-eos-matrix-2023-10)

Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Croatia · Announced on 5 October 2023 · Appeal status: unknown

Debt collector could not protect or explain a leak from its main database, processed non-debtors' data and debtors' health data with no legal basis, and recorded calls without a legal basis or clear notice.

[Source: the authority](https://azop.hr/agenciji-za-naplatu-potrazivanja-eos-matrix-d-o-o-izrecena-upravna-novcana-kazna-u-iznosu-od-547-milijuna-eura/)

### [TikTok Technology Limited: EUR 345,000,000](https://dposchool.com/gdpr/fine/dpc-tiktok-2023-09)

Data Protection Commission (Ireland), Ireland · Decision of 1 September 2023 · Appeal status: under appeal

Child users' accounts were public by default, 'Family Pairing' was weak, and children were not told clearly about the settings; the EDPB added a fairness ('dark patterns') finding.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-tiktok-technology-limited-september-2023)

### [Meta Platforms Ireland Limited: EUR 210,000,000](https://dposchool.com/gdpr/fine/dpc-meta-facebook-2022-12)

Data Protection Commission (Ireland), Ireland · Decision of 31 December 2022 · Appeal status: under appeal

Facebook relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-meta-platforms-ireland-limited-december-2022)

### [Meta Platforms Ireland Limited: EUR 180,000,000](https://dposchool.com/gdpr/fine/dpc-meta-instagram-2022-12)

Data Protection Commission (Ireland), Ireland · Decision of 31 December 2022 · Appeal status: under appeal

Instagram relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-meta-platforms-ireland-limited-december-2022)

### [Meta Platforms Ireland Limited: EUR 405,000,000](https://dposchool.com/gdpr/fine/dpc-instagram-2022-09)

Data Protection Commission (Ireland), Ireland · Decision of 2 September 2022 · Appeal status: under appeal

Instagram let 13 to 17 year olds run business accounts that published their phone numbers or emails, and set child accounts to public by default.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-processing-personal-data-relating-child-users-instagram-social-networking-service)

### [Clearview AI, Inc: EUR 20,000,000](https://dposchool.com/gdpr/fine/hdpa-clearview-2022-07)

Hellenic Data Protection Authority, Greece · Decision of 13 July 2022 · Appeal status: unknown

Facial recognition company processed people's images in Greece unlawfully, without transparency, ignored an access request and had no EU representative.

[Source: the authority](https://www.dpa.gr/en/en/enimerwtiko/prakseisArxis/imposition-fine-clearview-ai-inc)

### [Minister van Financiën (controller for the Belastingdienst, Dutch Tax Administration): EUR 3,700,000](https://dposchool.com/gdpr/fine/ap-belastingdienst-2022-04)

Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 7 April 2022 · Appeal status: unknown

Kept an unlawful fraud blacklist (FSV) on about 270,000 people for over six years: no legal basis, inaccurate data, weak security, DPO not involved in the DPIA.

[Source: the authority](https://autoriteitpersoonsgegevens.nl/actueel/boete-belastingdienst-voor-zwarte-lijst-fsv)

### [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/garante-clearview-2022-02)

Garante per la protezione dei dati personali, Italy · Decision of 10 February 2022 · Appeal status: unknown

Facial-recognition firm scraped billions of facial images, including of people in Italy, with no legal basis, without transparency, and without an EU representative; ordered to delete Italian data and stop collecting it.

[Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9751362)

### [IAB Europe: EUR 250,000](https://dposchool.com/gdpr/fine/apd-iab-europe-2022-02)

Autorité de protection des données / Gegevensbeschermingsautoriteit (Belgium), Belgium · Decision of 2 February 2022 · Appeal status: upheld

The ad-industry Transparency and Consent Framework processed users' preference strings without a legal basis, with vague information, weak safeguards, no records, no DPIA and no DPO.

[Source: the authority](https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr)

### [WhatsApp Ireland Ltd: EUR 225,000,000](https://dposchool.com/gdpr/fine/dpc-whatsapp-2021-08)

Data Protection Commission (Ireland), Ireland · Decision of 20 August 2021 · Appeal status: under appeal

Did not tell users and non-users clearly enough how their data was processed, including sharing with other group companies.

Not fully confirmed: The DPC summary page tags only Articles 5 and 13 (no sub-paragraphs); the full decision also covers other transparency articles. Fine raised after EDPB binding decision 1/2021. DPC fines table: Pending Appeal.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/decision-concerning-whatsapp-ireland-ltd)

### [Deliveroo Italy s.r.l.: EUR 2,500,000](https://dposchool.com/gdpr/fine/garante-deliveroo-2021-07)

Garante per la protezione dei dati personali, Italy · Decision of 22 July 2021 · Appeal status: unknown

Food-delivery platform managed about 8,000 riders through opaque algorithms (booking and work allocation), collected excessive data including location, and lacked a DPIA and proper records.

[Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9685994)

### [Carrefour France: EUR 2,250,000](https://dposchool.com/gdpr/fine/cnil-carrefour-france-2020-11)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 18 November 2020 · Appeal status: unknown

Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings.

Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb\_aar\_2020\_final\_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both.

[Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042563756)

### [Marriott International Inc: GBP 18,400,000](https://dposchool.com/gdpr/fine/ico-marriott-2020-10)

Information Commissioner's Office (United Kingdom), United Kingdom · Decision of 30 October 2020 · Appeal status: unknown

Starwood's systems, compromised in 2014 and later acquired by Marriott, were not detected as breached until September 2018; security of guest data was inadequate.

[Source: the authority](https://ico.org.uk/media2/migrated/2618524/marriott-international-inc-mpn-20201030.pdf)

### [British Airways plc: GBP 20,000,000](https://dposchool.com/gdpr/fine/ico-ba-2020-10)

Information Commissioner's Office (United Kingdom), United Kingdom · Decision of 16 October 2020 · Appeal status: unknown

An attacker used compromised remote-access credentials and altered a script on the airline's website to send customers' card data to an outside domain (22 June to 5 September 2018).

[Source: the authority](https://ico.org.uk/media2/migrated/2618421/ba-penalty-20201016.pdf)

### [Google LLC: SEK 75,000,000](https://dposchool.com/gdpr/fine/imy-google-2020-03)

Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), Sweden · Decision of 10 March 2020 · Appeal status: reduced

Failed to remove search results in time under the right to be forgotten, and told website owners about removals, which discouraged people from asking.

[Source: the authority](https://www.imy.se/tillsyner/google/)

### [TIM S.p.A.: EUR 27,802,946](https://dposchool.com/gdpr/fine/garante-tim-2020-01)

Garante per la protezione dei dati personali, Italy · Decision of 15 January 2020 · Appeal status: unknown

Aggressive telemarketing: calls to people who had refused or were on internal block lists, marketing without valid consent, and weak control of call-centre partners.

Not fully confirmed: Amount, date and name read in the decision (register no. 7 of 15 January 2020). Articles listed are those the decision states for its main finding (section 3.1, which also cites Article 130 of the Italian Code); later sections discuss further provisions (e.g. Articles 12 and 21), so the list may be incomplete.

[Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9256486)

### [Deutsche Wohnen SE: EUR 14,500,000](https://dposchool.com/gdpr/fine/blnbdi-deutsche-wohnen-2019-10)

Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI), Germany · Decision of 30 October 2019 · Appeal status: reduced

Property company kept years-old tenant documents (pay slips, bank statements, tax and health-insurance data) in an archive system with no means of deleting data no longer needed.

[Source: the authority](https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/pressemitteilungen/2019/20191105-PR-Translation-Fine_DW.pdf)

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Chapter II](https://dposchool.com/gdpr/chapter/2) / Article 5

Previous: [Art. 4 GDPR: Definitions](https://dposchool.com/gdpr/article/4)

Next: [Art. 6 GDPR: Lawfulness of processing](https://dposchool.com/gdpr/article/6)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents