Malta

Insurance company

1,000 €

GDPR enforcement action by Information and Data Protection Commissioner (IDPC) on 2026-05-04.

Rank · Sector

#331

of 343 in Finance, Insurance and Consulting

Rank · Malta

#16

of 16

Rank · All fines

#2,922

of 3,267

Case details

Authority: Information and Data Protection Commissioner (IDPC)
Date: 2026-05-04
Controller / Processor: Insurance company
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 5 (2) GDPR, Art. 21 (2) GDPR
Type of violation: Insufficient fulfilment of data subjects rights

Summary

The DPA of Malta has imposed a fine of EUR 1,000 on an insurance company. In January 2023, a data subject objected to telemarketing calls. The controller responded by telling the data subject that they would delete their personal data. However, the data subject was contacted again on 11 June and 4 April 2024. Due to inadequate technical and organisational measures, it was found that the controller's sub-agents proceeded to call the complainant even after they had been added to the do-not-call list. This was because the list was not being synchronised adequately across all sub-agents.

Open original source Links to the regulator's original publication or another source.