GDPR Fines (original) (raw)

The General Data Protection Regulation (GDPR) is notorious for its huge fines, and for good reason. While these fines usually relate to huge privacy violations affecting millions of people, the GDPR is enforced against smaller companies, too.

This article will walk you through the GDPR's core requirements, explain how its system of penalties works, and help you learn from the mistakes of other businesses that have been hit by GDPR fines so you can avoid acquiring them yourself.

On this page≡

Privacy fines are not a new concept, but the GDPR has increased their potenital sums significantly.

Here are some examples of pre-GDPR penalties so you can see how they compare to current violation outcomes.

The GDPR consists of 99 articles (grouped into 11 chapters) and 173 recitals. The articles set the legally-binding rules and principles that govern the processing of personal data. The recitals provide supporting information and additional context.

Let's take a look at some of the key sections of the GDPR, to help you understand what you'll need to do to avoid a GDPR fine.

Territorial Scope (Article 3): Who the GDPR Applies to

According to Article 3, the GDPR applies to all processing of personal data that takes place in the EU (with limited exceptions), by any person or organization that is either:

This means that companies from all over the world must comply with the GDPR if they want access to the EU market.

Definitions (Article 4)

First, you'll need to understand the language of the GDPR if you want to comply with it. Some of the GDPR's most important definitions, listed out in Article 4 in full, include:

Principles (Article 5)

The GDPR's principles of data processing provide baseline data protection standards and should underpin all processing of personal data by controllers and processors (unless an exemption applies). The principles, outline in Article 5, are:

  1. Lawfulness, fairness, and transparency: Always process personal data in a way that complies with EU law. Don't use personal data in any way that individuals wouldn't reasonably expect. Always provide clear and accessible information about your data processing practices (including via a Privacy Policy).
  2. Purpose limitation: Only process personal data for a specified, explicit, and legitimate purpose. Don't process personal data for further purposes that are incompatible with the original purpose.
  3. Data minimization: Only process the minimum amount of personal data needed for a specific purpose.
  4. Accuracy: Keep personal data accurate and up-to-date.
  5. Storage limitation: Don't store personal data for longer than necessary.
  6. Security: Implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or damage.

Controllers also have a seventh principle of "accountability." You are accountable for your compliance with the GDPR.

Lawful Bases (Article 6)

The lawful bases for processing are a set of valid legal reasons for which you may process personal data. You must not process personal data without determining a lawful basis for doing so.

The lawful bases, outlined in Article 6, are:

Data Subject Rights (Articles 12-22)

The GDPR provides data subjects with rights over their personal data. Controllers are responsible for facilitating these rights, with help from processors if necessary.

The data subject rights, outline in Articles 12 to 22, are:

There are multiple tiers of fines possible under the GDPR, each triggered by different actions (or inactions) on your part.

For minor, unintentional violations, DPAs will work with the offending controller or processor to rectify matters and it may be possible to avoid a financial penalty. That said, the GDPR is well-known for its harsh penalties, and we have seen several DPAs issue fines amounting to tens of millions of euros.

Let's look at how these penalties work.

Article 83 (4) Fines

The fines described under Article 83 (4) are the less severe of the two types of fines available to DPAs. Here's the relevant section of the GDPR:

EUR-Lex GDPR: Article 83 Section 4

This tier of fines can apply if the following infringements occur:

As you can see, Article 83 (4) GDPR allows DPAs to issues fines of whichever is greater of the following two amounts:

These less severe penalties are available for violation of the following parts of the GDPR:

Article 83 (5) Fines

The fines described under Article 83 (5) are the more severe of the two types of fines available to DPAs.

Here's the relevant section of the GDPR:

EUR-Lex GDPR: Article 83 Section 5

This tier of fines can apply if the following infringements occur:

As you can see, Article 83 (5) GDPR allows DPAs to issues fines of whichever is greater of the following two amounts:

These more severe penalties are available for violation of the following parts of the GDPR:

Although it is not possible to show visual examples of every kind of infraction, below you can see a few very obvious violations.

Valid consent is one of the cornerstones of GDPR compliance. Violations are not difficult to spot.

The McDonald's registration form does not give users an opportunity to provide their express and unambiguous consent for marketing communications; In this form, consent is assumed when a user registers for an account:

McDonalds Email Sign-up form with browsewrap Agree section highlighted

Although Apple's registration form includes marketing consent checkboxes, this method of consent is not considered freely-given because the boxes are pre-ticked by default:

Apple Create ID form with checkboxes highlighted - Updated

TechTarget's Cookies Policy includes the following terminology: "By continuing to use the site, you agree to the use of cookies."

TechTarget Cookie Policy: Intro clause with browsewrap section highlighted

This is implied consent and will not be considered legal under the GDPR. Consent for most types of cookies must be obtained via a clear action on the part of the user, such as the click of a button or tick of a checkbox.

The same goes for Privacy Policies. In order for a user to validly consent to a Privacy Policy they must click an agreement button or tick a checkbox.

Readability and Accessibility

Another fine-worthy infringement involves clear, easy-to-understand Privacy Policies. The long-winded, confusing legalese that was so popular in Privacy Policies of the past will no longer be accepted.

Ironically, it may be government agencies that will have the hardest time with this requirement.

This is the old, previous intro to the Privacy Policy for USA Citizen and Immigration Services. The language is unnecessarily complex and dense:

USA Citizen and Immigration Services Privacy and Legal Disclaimers: Screenshot of intro

Here's the current version, which is much more readable and organized:

USA Citizen and Immigration Services Privacy and Legal Disclaimers: Intro screenshot updated

Although it is still unclear how serious these types of infractions will be, it is advisable to ensure your Privacy Policy is written clearly in simple language.

Accessibility to the Privacy Policy as well as to a user's choices regarding their personal information is a key point in the GDPR.

For example, the Privacy Policy should be prominent and easy-to-find within the business's website or mobile app.

In addition, a user should have easy access to their own personal information and consent choices. According to the GDPR, "it shall be as easy to withdraw consent as to give it."

Further, usually the Privacy Policy would provide instructions on how to unsubscribe from marketing communications.

Make sure your Privacy Policy is up to date and includes GDPR-required information, is written in an easy-to-understand way, and that you get the appropriate level of consent whenever you collect personal information. Do these things and incorporate sound privacy practices into your business and you should avoid being penalized.

Now we're going to take a look at some real GDPR fines.

This isn't a list of the biggest GDPR fines to-date. Instead, we've chosen a selection of GDPR fines that small to medium-sized businesses need to learn from.

France: Excessive Data Collection and Incorrect Privacy Policy

On July 28, 2020, the French DPA issued a €250,000 fine to online shoes retailer, Spartoo. The company was also given three months to comply with the GDPR, after which it would receive a fine of €250 per day until it was fully compliant.

The standout lesson from this case is that you should only collect and store personal data when you need to. You should also provide a comprehensive Privacy Policy that explains how you collect and store personal data.

The fine was issued following a "dawn raid" on the company's premises which revealed multiple GDPR violations, including:

Here's what you can do to avoid a fine like this:

On 17 December, 2019, the Belgian DPA issued a €15,000 fine to legal news website, Jubel. The fine is seen as a deterrent to other websites that violate the GDPR and the ePrivacy Directive (another EU law that sets rules on the use of cookies).

The standout lesson from this case is about analytics cookies. Jubel's website used Google Analytics cookies, which require consent under EU law. However, the site had no cookie consent mechanism. The company attempted to argue that it did not require consent, but the DPA disagreed.

Jubel's violations in this case included:

Here's what you can do to avoid a fine like this:

Austria: Excessive Use of CCTV and Failure to Provide a Privacy Policy

On September 12, 2018, the Austrian DPA issued its first GDPR fine of €5,280 (later reduced on appeal). The offending company was a betting shop, which was accused of the following GDPR violations:

In this case, a particular point of interest is that although the betting shop had signs warning data subjects about its use of CCTV, it hadn't provided "layered" privacy information in multiple formats.

Here's what you can do to avoid a fine like this:

Spain: No Cookies Information and Privacy Policy Only Available in English

On 23 July, 2020, the Spanish DPA issued a €3,000 fine to Spanish travel website, Just Landed. The company was accused of violating both the GDPR and the ePrivacy Directive.

The standout lesson from this case is about providing up-front information about cookies, and always allowing your users to make an informed decision to opt in or out of cookies.

Just Landed was accused of violating:

Here's what you can do to avoid a fine like this:

Summary

GDPR compliance is a big task for any business. But it's well worth putting in the work up-front to avoid the penalties associated with non-compliance.

Here are some of the standout compliance lessons we can learn from the cases above: