GDPRfines

GDPR fines are administrative penalties issued under the General Data Protection Regulation (GDPR) to organizations that violate EU data protection rules. They can apply to both data controllers and processors that process the personal data of individuals located in the European Union, including organizations with cross-border activities.

Article 83 of the GDPR establishes two tiers of fines. Category 1 violations may be fined up to 10 million euros or 2% of the worldwide annual turnover, whichever is higher. Category 2 violations are subject to up to 20 million euros or 4% of worldwide turnover, whichever is higher. The precise amount is determined by factors such as the nature and gravity of the violation, the level of intentionality or negligence, duration, any mitigating or aggravating circumstances, the degree of cooperation with authorities, and previous infringements.

Enforcement is conducted by national supervisory authorities within the EU, with coordination through the European Data Protection Board for cross-border cases. The process generally includes a complaint or ex officio investigation, a findings assessment, and a decision to impose a fine, which may be issued alongside orders to remedy, suspend processing, or implement additional safeguards. Fines are intended to be proportionate and to deter non-compliance, rather than to collect revenue.

Notable GDPR fines have included Google's 50 million euro penalty by the French data protection authority in 2019 for transparency and consent issues; Amazon EU Sàrl's 746 million euro fine by Luxembourg's data protection authority in 2021 for insufficient GDPR compliance; and WhatsApp Ireland Ltd's 225 million euro fine by the Irish DPC in 2021 for transparency obligations. These cases illustrate the range of violations that can attract substantial penalties.