The General Data Protection Regulation (GDPR) has been in force since May 2018 and thus for almost a year. Do you know of cases in which fines were imposed for violating the requirements of the GDPR? How high were these fines and which companies were affected? Background of the question are the fears of the fines at that time (up to 20 million Euro or in the case of a company up to 4% of the total worldwide annual turnover of the previous business year). To what extent were these fears justified?
There were quite a few cases where violations of GDPR were fined. To my knowledge the largest fine was EUR 50 Million for Google by the French supervisory body, see https://www.cnil.fr/fr/la-formation-restreinte-de-la-cnil-prononce-une-sanction-de-50-millions-deuros-lencontre-de-la (in French) or https://www.heise.de/newsticker/meldung/DSGVO-Verstoesse-Frankreich-verhaengt-Millionen-Strafe-gegen-Google-4283765.html (in German). I did not check but I assume that is still far from the maximum fine of 4% of annual worldwide turnover. The main reason for this fine was inadequate information about data collected, and inadequate collection of consent.
Another large fine of EUR 400.000 was imposed on a Portugese hospital where far to many people had access to patient data, see https://www.heise.de/newsticker/meldung/DSGVO-Verstoss-Krankenhaus-in-Portugal-soll-400-000-Euro-zahlen-4198972.html
Apart from these two cases, there were a number of other fines imposed (41 in Germany alone according to https://www.itgovernance.co.uk/dpa-and-gdpr-penalties), but as far as I know, these were usually in the order of four to five digit numbers.
As we seen many research articles on this matter we came to know that Not all GDPR infringements guide to fines. Supervisory establishment such as the ICO (Information Commissioner’s Office) have the capacity to take a variety of other proceedings, such as:
Issuing caution and warning;
Imposing a provisional or permanent prohibit on data processing;
Ordering the refinement, restriction or removal of data; and
postpone data convey to third countries.
Recently a summary of different fines was published at https://dataagenda.de/wp-content/uploads/2019/05/DataAgenda-Arbeitspapier-06_DS-GVO-Bu%C3%9Fgelder.pdf
The report is in German but it covers other EU countries as well.
Fines imposed for violation of GDPR provisions:
No. 1> https://ico.org.uk/media/action-weve-taken/enforcement-notices/2614924/hmrc-en-201905.pdf?fbclid=IwAR28pA0rPwLPB9JrRNMiEXmsbB1gMwFNnuzjWfusrGt3LnYz8BCXSpR6PBU
No. 2> https://www.datatilsynet.no/en/about-privacy/reports-on-specific-subjects/administrative-fine-of-170.000--imposed-on-bergen-municipality/?fbclid=IwAR2QztLU2sb-1IMKE1Fp2YTuPYIVjwR33zHG6KX_NHLxCJjt9GoAS8ZN2T4
No. 3> https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9101974?fbclid=IwAR00J4Qi-gzRmisFKIzeCD3FqqMW-CAllThzgTH6WOYIhIuTixpYGl_nz2Y
No. 4> https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/05/ico-fines-ppi-claims-company-120-000-for-millions-of-nuisance-texts/?fbclid=IwAR1J9EstsXoteMha-WQ1NWSGBUIW22vAw3GbIq-zsiONJE7fXZYNilzWJaQ
No. 5> https://www.dataprotection.ro/index.jsp?page=ANSPDCP_a_amendat_Hilmi_Medical_Center&lang=en
No. 6> https://edpb.europa.eu/news/national-news/2019/first-fine-imposed-president-personal-data-protection-office_en?fbclid=IwAR0NLZlSeKwf2f8qe41A4mpqrxliZ3-w945-mZrSTNbEMYh-CLvwCvh4g50
You may also check the Special Eurobarometer on GDPR (Report no. 487a / june 2019).
I found another, English-language list of GDPR fines imposed across Europe: http://www.enforcementtracker.com/
It seems that this list is updated regularly.
Fines are starting to get really serious now. After Google's fine of 50 Mill. Euro in France, the British data protection authority ICO has just announced they plan to fine the Marriott hotel group for UKL 99 Mill. (https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/intention-to-fine-marriott-international-inc-more-than-99-million-under-gdpr-for-data-breach/) and British Airways for UKL 183 Mill. (https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/ico-announces-intention-to-fine-british-airways/), in both cases about major security breaches regarding customer data.
Maximum fine for Santa Claus - the end of Christmas gifts ?
https://privacylawblog.fieldfisher.com/2019/breaking-news-eu-dpa-to-fine-santa-4-of-annual-worldwide-turnover
A merry and relaxing Christmas to all members of my network !