.svg)
Since its inception in 2018, the General Data Protection Regulation (GDPR) has transformed the privacy landscape across the European Union beyond all recognition.
After a slow start, with regulators initially struggling to get up to speed, steadily evolving jurisprudence and growing enforcement has since strengthened the GDPR’s position as a global pioneer in data protection, handing consumers back an unprecedented level of control over their personal information.
2022 has been a significant year for data protection in Europe. With collective GDPR fines reaching a record high, it is clear that regulators are taking enforcement more seriously than ever. Despite this, companies are still getting it wrong - and often in a big way. With repeat offenders popping up again and again, questions remain over the efficacy of fines as a deterrent to those with the deepest pockets.
With a slight decrease in the total number of fines issued from 2021, this year saw a focus on the most severe breaches, with several landmark penalties levied against some of the biggest household names in big tech. However, approaches between member states varied considerably, with some authorities recording far higher numbers of smaller “open and shut” regulatory matters.
Whilst these differences are a sign that many regulators are still finding their feet when it comes to focusing their resources, the general direction of travel is clear - as the GDPR enters its fifth year, any grace period is well and truly over, and the net is tightening on companies who are still falling on the wrong side of the line.
In this article, we explore the importance of the GDPR within the wider context of global privacy laws, before taking a deep dive into the six biggest fines handed out in Europe over the past year - and how to avoid becoming one of them as you move forwards into 2023.
Summary
- Why is the GDPR so important?
- What are the maximum privacy fines under the GDPR?
- How are penalties under the GDPR calculated?
- Where and why did most of the biggest GDPR fines happen in 2022?
- What were the five biggest fines issued under the GDPR in 2022?
- Key takeaways and how to avoid GDPR enforcement action in 2023
Why is the GDPR so important?
What is so special about the General Data Protection Regulation (GDPR) that it has become the gold standard of data privacy regulations?
First, it sets a global example.
With many countries across the world still playing catch up with the advancement of technology, the GDPR is widely viewed as an exemplary regime when it comes to data protection.
With many places (including the US and Australia) still a long way from adopting federal privacy laws, the GDPR’s comprehensive jurisdiction across the EU has given unique authority to its regulators - setting a powerful example for others. Put simply - where the GDPR goes, other regimes tend to follow.
Secondly, it affects almost everyone
Not only does the unified nature of the GDPR mean that European citizens can enforce their rights against any company within Europe, but its scope also extends far beyond EU borders, also protecting them when their information is processed by organizations anywhere else in the world.
This means that, effectively, the GDPR is a global concern for any and all individuals and businesses - anywhere in the world - whose goods or services might be accessed by European citizens.
What are the maximum privacy fines under the GDPR?
The GDPR carries some of the most stringent penalties for data offenses anywhere in the world. Fines are not the only remedy on the menu (with companies also on the receiving end of data processing bans and orders to remedy infringements) but monetary penalties arguably pose the greatest risk for companies handling consumer data.
Fines issued under the GDPR vary considerably, and are determined on the facts of each case. Their primary purpose is to serve as an effective and proportionate deterrent to future breaches.
As well as a two tier administrative fine system, the GDPR also provides the additional right for data subjects to seek private compensation through the civil courts where they suffer damage as a result of an infringement.
Lower tier fines
GDPR infringements are treated according to their severity and scale. Even the most “minor” breaches can be penalized by lower tier fines of up to either 10 million Euros, or 2% of the organization’s annual global revenue (whichever is greater). These fines are handed down in respect of the following:
- Controllers and processors (Articles 8, 11, 25-39, 42 and 43): This includes any organizations who collect, control or process personal data. They must comply with a wide host of regulations including those governing consent, lawful basis for processing, and security.
- Monitoring bodies (Article 41): The GDPR encourages the appointment of independent monitoring bodies to handle complaints and infringements. These bodies must ensure compliance with approved codes of conduct.
- Certification bodies (Articles 42 and 43): The GDPR also encourages member states to appoint an accredited body to certify compliant organizations. These must comply with regulations around transparency and bias-free assessments.
Higher tier fines
Where infringements of data subject rights are more severe, fines can be imposed at up to double the amount of lower-tier penalties. Maximum higher tier fines can extend to up to whichever is greater - 4% of an organization's total global annual turnover, or 20 million Euros.
For large multinationals like Google and Meta, this can add up fast. Higher tier fines are handed down in respect of the most fundamental breaches which go to the core of the protection of privacy, including, amongst others:
- The basic principles for processing (Articles 5, 6, and 9): These include transparency, accuracy, security, and prohibitions on sensitive data processing. If an organization cannot demonstrate a fundamental lawful basis for its processing, it will fall at the first hurdle.
- Data subject rights (Articles 12-22): Central to the GDPR is the right of data subjects to access the information that an organization holds about them, and to have this data erased where applicable. Organizations who fail to facilitate this are likely to be penalized harshly.
- The conditions for consent (Article 7): Consent is at the heart of the protection of consumer privacy. An organization must be able to clearly document that they have obtained consent from data subjects where they rely on its existence for data processing.
- Transfer of data to third countries (Articles 44-49): Because the scope of the GDPR extends beyond EU borders, organizations who wish to transfer information elsewhere across the globe must demonstrate that the data will be safeguarded when it arrives - or face heavy penalties.
Scope of total global turnover fines
Higher tier fines can be bad news for multinationals. When assessing a total global turnover fine, regulators can take into account the entire corporate group to which the offending company belongs.
In the case of Meta, for example, which operates multiple subsidiaries in various jurisdictions, a fine for a breach within one subsidiary will not be limited to their turnover, but to that of the entire Meta group.
How are penalties under the GDPR calculated?
Some of the key factors which must be considered by regulatory authorities when dishing out fines under the GDPR include:
- The gravity and nature of the offense, including who was affected, and how badly;
- Whether or not the infringement was intentional;
- Whether any actions were taken to mitigate the damage caused to those affected;
- Whether the company took adequate precautionary measures to comply with the GDPR;
- Whether the company has a previous history of compliance issues;
- The extent to which the company cooperated to remedy the infringement;
- The data category of personal information affected;
- Whether the company provided proactive notification of the breach to their regulator;
- Whether the company was certified as compliant and following codes of conduct; and
- Any aggravating factors (including financial benefits gained from the breach, or losses avoided as a result of it).
Where and why did most of the biggest GDPR fines happen in 2022?
Countries
Notably, the countries with the highest total fines issued to date under the GDPR are entirely different from those that have issued the largest number of fines. Ireland, France, and Luxembourg lead the pack when it comes to the highest amounts levied, with Ireland issuing fines of almost 1 billion against Meta alone.
The picture is slightly different in respect of the total number of fines issued to date, with Spain, Italy, and Germany topping the list. Spain in particular has set a high regulatory bar, issuing hundreds of fines over the past year. The vast majority of these relate to relatively straightforward security matters in which non-compliance is both easy to spot and penalize.
Types of violation
By far the biggest fines handed out this year were in respect of non-compliance with fundamental data processing principles, with a large number also issued to organizations for failure to demonstrate a legal basis for their processing activities.
Because these types of infringements go to the heart of data subject rights, they also reflect the increase in six-figure penalties handed out throughout 2022.
Industries
It should come as no surprise that with technological innovation evolving at an ever faster pace, big tech is once again the biggest villain of the year.
The heftiest fines of 2022 went to organizations in the media, telecoms, and broadcasting industry for the third year running - a trend that looks set to continue.
What were the six biggest fines issued under the GDPR in 2022?
1: Instagram [Meta Platforms Ireland Limited] - Children’s data rights (28 July 2022)
- Total fine: 405 million Euros
- Country: Ireland (Irish Data Protection Commission)
- Breaches: Art. 5 (1) a), c) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 24 GDPR, Art. 25 (1), (2) GDPR, Art. 35 GDPR
A global household name, Meta is a multi-billion dollar heavyweight at the center of the social media landscape, with over 2.934 billion total users across its platforms as of July 2022.
In the second highest ever fine to be issued under the GDPR - and the first EU-wide ruling on children’s privacy rights, this landmark decision followed the unlawful public disclosure of personal data in respect of child users (between the ages of 13 and 17) of the Instagram platform.
The oversight allowed children to set up accounts through the business account feature, which set email addresses and phone numbers to public by default. The same information was disclosed in respect of new registrations for personal accounts. The regulator rejected Meta’s arguments that the disclosures met a legitimate interest and were necessary for the performance of their contracts.
Meta have voiced their opposition to the decision, which marks a key moment in the protection of the personal data of minors across Europe.
2. Facebook [Meta Platforms, Inc] - Data scraping (28 November 2022)
- Total fine: 265 million Euros
- Country: Ireland (Irish Data Protection Commission)
- Breaches: Art. 25 (1), (2) GDPR
It’s been a tough year for relations between Meta and the Irish regulator. Hot on the heels of the Instagram decision, the company found itself on the receiving end of yet another six figure fine, this time in respect of its Facebook platform. The case took the total fines levied against Meta in Ireland to almost 1 billion Euros over the past 12 months.
Following media reports of personal data from over 500 million Facebook users being leaked online, an inquiry was launched in April 2021 which concluded in November of this year.
Meta was found in breach of the principle of data protection by default, having failed to secure the processing involved in the Facebook search, messenger importer and Instagram contact importer tools between 2018 and 2019. This led to illegal “data scraping” of personal information by third parties.
3. Google LLC - Cookies (6 January 2022)
- Total fine: 90 million Euros
- Country: France (Commission Nationale de l'Informatique et des Libertés (CNIL))
- Breaches: Art 7 GDPR, Art. 82 Loi Informatique et Libertés
At the heart of the internet, Google handles over 70 percent of global online search requests, with an average of 90 billion visits per month. Although this decision was handed down on the last day of 2021, it was not published until January this year - and is a significant case to take note of.
The CNIL handed down a hefty fine against the online giant for its failure to provide a mechanism for Youtube users in France to refuse cookies on the platform as easily as they could accept them.
In their decision, the CNIL imposed particularly heavy judgment on the company given the substantial financial benefit gained from increased acceptance rates, as its main revenue streams come from targeted advertising based on cookie monitoring.
As a specialist area of data law, cookie regulation technically falls within the scope of the ePrivacy Directive, and not the GDPR. However, because the issue of consent was central to the infringement at hand, the matter was brought within the remit of the consent mechanisms of the GDPR. Google also received a further 60 million Euro fine on the same day in respect of the same breaches in Ireland.
4. Clearview AI - Biometric monitoring (20 October 2022)
- Total fine: 60 million Euros per country
- Country: Italy (Garante per la protezione dei dati personali), Greece (Hellenic Data Protection Authority (HDPA), France (Commission Nationale de l'Informatique et des Libertés (CNIL))
- Breaches: Art. 5 (1) a), b), e), Art. 6, Art. 9, Art. 12, Art. 13, Art. 14, Art. 15, Art. 27 GDPR
Clearview AI is a facial recognition firm which collects images of individuals from across the internet to be sold to law enforcement authorities. With over 20 billion images in its database, the company creates a “biometric template” of data subjects - who are usually unaware that their images have been used.
The company was found guilty of unlawfully processing sensitive biometric and geolocation information without consent. They could not demonstrate any legitimate interest to justify the intrusion.
To add insult to injury, Clearview were also found guilty of unlawfully restricting people’s right of data access, limiting the scope of requests to a 12 month period and twice a year per data subject. They were frequently providing partial responses or none at all, particularly to those who made multiple requests.
In the final nail in the coffin of this case, Clearview were heavily penalized for failing to respond to the formal notice issued by the CNIL. This led to a substantially higher fine, and should serve as a warning to others that regulators are taking an increasingly dim view of poor cooperation with authorities.
5. Microsoft Ireland Operations Ltd - Cookies [Bing.com] (19 January 2022)
- Total fine: 60 million Euros
- Country: France (CNIL)
- Breaches: Art. 82 loi Informatique et Libertés
One of the biggest tech heavyweights on the planet, Microsoft has fallen foul of data protection laws on more than one occasion over the past few years. Just days before the close of 2022, the company landed itself the largest domestic fine of the year from the French regulator - for a remarkably similar offense to the Google matter just a few months earlier.
Microsoft were penalized for failing to provide users of the popular search engine Bing in France with a simple option for rejecting cookies - instead offering only a “de facto” button for users to accept cookies upon entering the site. The result was that user devices were effectively being tracked without consent - a breach worsened by the fact that the information gathered was in part used for lucrative advertising purposes.
Microsoft has been given three months to rectify the situation and provide users with a genuine opt out button at the point of use, under threat of further penalties of 60,000 Euros per day for failure to comply.
As in the Google case, cookie regulation in France technically falls under the scope of the ePrivacy Directive - but the core of the issue is user consent, which remains at the heart of the GDPR.
With this penalty consolidating a clear line of jurisprudence in this area, the writing is on the wall when it comes to the use of online cookies - it is likely that regulators will grant increasingly less leeway to companies who fail to protect customer rights in respect of online tracking and consent in the future.
6. Enel Energia - Telemarketing (19 January 2022)
- Total fine: 26.5 million Euros
- Country: France (CNIL)
- GDPR breaches: Art 31, Art 5 (1) and (2), Art 25(1), Art 6, Art 12(2)
Last but not least, the energy supply company kicked off the year with a hefty fine for violation of accountability, accuracy, transparency and fairness principles as part of extensive unlawful telemarketing activities. The decision in the Enel Energia case came after several years of lengthy investigations and requests for information by Italy’s regulating body.
The company was found guilty of making unsolicited marketing and promotional calls and emails to individuals, including to some who had explicitly opted out of receiving them. A litany of further breaches were also uncovered in the company’s processing of personal information through its website and apps, as well as those of its partners.
A recurring theme in many of the higher penalties issued this year, Enel Energia were also found guilty of failing to protect the right of data subjects to both access details of the data held about them, and to object to its use. The waters were muddied further with conflicting information provided to users about the identity of the company’s data controller.
Lack of cooperation with the regulatory investigation was once again a key aggravating feature in this case, increasing the penalty imposed.
Key takeaways and how to avoid GDPR enforcement action in 2023
</
