Administrative Penalties for Breaches of the GDPR

#2.1 Preliminary Remarks

Where a supervisory authority finds there has been a breach of the provisions of the GDPR, it may impose an administrative fine, regardless of other measures or actions taken by the data subjects involved.

#2.2 Who May Be Fined?

Mainly, controllers and processors need to worry. Because the GDPR does not use the term ‘subprocessor’, but ‘another processor’, subprocessors can certainly also be fined. Additional penalties may be faced by entities that certify or monitor compliance with codes of procedure.

#2.3 What Should the Fines Be?

Pursuant to Article 83(1) GDPR, fines should be ‘effective, proportionate and dissuasive’.

In result of the realistic approach of supervisory bodies, until the early 2019 fines were very moderate, certainly not effective or proportionate.

#2.4 Greater and Lesser Fines

The general regulation foresees two types of administrative fines:

1. 1)up to EUR 10 million, but in the case of a company or group of companies having a total global turnover of more than EUR 500 million, up to 2% of global annual turnover for the previous year;
2. 2)up to EUR 20 million, but in the case of a company or group of companies having a total global turnover of more than EUR 500 million, up to 4% of global annual turnover for the previous year.

A greater fine is imposed for a breach of:

1. 1)the basic processing rules, including conditions of consent (Articles 5, 6, 7, 9 GDPR);
2. 2)the rights of data subjects as referred to in Articles 12–22 GDPR (delays in responding to demands);
3. 3)the rules of data export – transmitting personal data to a recipient in a third country or to an international organisation;
4. 4)all obligations resulting from Member State law approved on the basis of Chapter IX GDPR, that is, a failure to comply with exceptions on data protection introduced by a Member State, e.g., in order to reconcile data protection with freedom of expression and information;
5. 5)a temporary order or final restriction on processing or a suspension of data transmission issued by the supervisory authority on the basis of Article 58(2) GDPR, or a failure to guarantee access resulting in a breach of Article 58(1) GDPR (hindering an inspection).

A lesser fine applies to other breaches of the GDPR, e.g. a breach of security obligations, the processing of unidentified data, a failure to appoint a DPO.

Remember! In practice, you can pay a heavy price for:

• a breach of the data processing rules,
• a breach of the rights of individuals,
• unlawful data export.

#2.5 Recording Penalties

When imposing an administrative fine, the supervisory authority should take account of the individual nature of every case.

The criteria to be considered when imposing fines are listed in Article 83(2) GDPR. They include:

1. a)the nature, weight and duration of the breach, taking account of the nature, scope and purpose of the processing, the number of data subjects harmed and the scale of the damage they have suffered;
2. b)the intentional or unintentional nature of the breach;
3. c)actions taken by the controller or processor in order to minimise the damage suffered by data subjects;
4. d)the degree of liability of the controller or processor, taking account of their technical and organisational measures;
5. e)all relevant previous breaches by the controller or processor;
6. f)the degree of cooperation with the supervisory authority in order to remedy the breach and mitigate any adverse consequences of the breach;
7. g)the categories of personal data the breach concerns;
8. h)the way in which the supervisory authority learned about the breach, in particular whether and within what scope the controller or processor gave notification of the breach;
9. i)if the same measures were applied to the controller or processor the case concerns;
10. j)whether certification mechanisms approved under the regulation on codes of procedure were applied;
11. k)any other aggravating or mitigating factors applicable to the circumstances of the case, such as whether in connection with the breach financial benefits or losses were incurred, directly or indirectly.

As you can see, Article 83(2) GDPR sets out nineteen criteria in which a fine can be imposed, and it is not a closed catalogue. There is no point in going through them all in detail. The President of the Personal Data Protection Office will surely draw up a penalty grid in Excel and, like those entities obligated to calculate ‘the risk of a risk’ under Article 83(1) GDPR, he will have to turn into a ‘data protection accountant’ when calculating fines.

#2.6 Confiscation of Benefits from ‘GDPR Crime’

At the end of Article 83(2) GDPR, under letter k) there are two criteria of which the first is open and the second looks like an obligation of the Office to increase a fine by the amount of benefits obtained or losses avoided through ‘GDPR crime’:

any other aggravating or mitigating factors applicable to the circumstances of the case, such as whether in connection with the breach financial benefits or losses were incurred, directly or indirectly.

In this light, benefits incurred by not complying with the rules of data protection may be confiscated by the supervisory authority by being ‘added to the fine’. Similarly, savings achieved by not implementing the GDPR, as ‘losses avoided’, can also be taken away. And the entity penalised would then have to implement the GDPR anyway. Neglecting the GDPR, then, would seem to be risky, to say the least.