No more pandemic-era reprieve. Three years after the General Data Protection Regulation took effect, European regulators are serious about enforcing it.
According to an eye-popping report from Finbold, GDPR fines topped 984 million euros (more than $1.1 billion US dollars) in the third quarter.
That’s nearly 20 times higher than the total fines in the first two quarters of this year, and three times more than the 306 million euros imposed by EU regulators during all of last year.
The report cites factors behind the high Q3 numbers, including the fact that GDPR investigations can take a long time — they could have started months or even years ago and only finished in the third quarter. And after apparently taking a lenient approach during the pandemic, regulators are back in action now as economies recover and businesses regain their footing.
Understanding the nuance of customer consent and legitimate interest is key to GDPR compliance. Customer consent is considered the gold standard of data collection - with good reason. A consent management platform supports compliance.
Over the past three years, fines have been steadily increasing. To date, here are the top largest GDPR fines:
Luxembourg has imposed the highest total GDPR fines (746 million euro from 11 cases), followed by Ireland and Italy, according to Finbold analysis. Tech and telecommunications companies have incurred the highest fines.
Companies can do more to protect consumers’ data privacy, and it’s in their best interest to do so. Learn the requirements of GDPR, CCPA, and LGPD.
When GDPR was enacted, businesses weren’t sure what to expect in terms of enforcement. By now, it’s clear regulators mean business.
While big tech and telecommunications companies have incurred the highest fines, a broad range of businesses have been investigated and fined for GDPR violations. The GDPR Enforcement Tracker run CMS, a global legal services firm, illustrates regulators’ wide scope.
Banks, bars, hospital, hair salons, and municipalities have incurred GDPR fines for violations like illegal data processing, insufficient data security, and general non-compliance.
Last month, data protection authorities in Spain fined a hairdressing salon 1,000 euros for failing to disclose how it handles personal data. Denmark officials fined the Danish Cancer Society 107,000 euros for poor technical and organizational information security measures. And the National Bank of Greece was fined 20,000 euros for “insufficient fulfillment of data subjects rights.”
While the Finbold report notes that some companies appeal the GDPR rulings, which sometimes leads to fines being reduced or withdrawn, it also predicts that fines will continue to soar as regulators grow more confident about implementing GDPR guidelines.
Altogether, the regulatory activity puts businesses on notice that GDPR penalties are a growing risk. Along with a growing number of state privacy laws in the US, including the California Consumer Privacy Act, it highlights the need for organizations to make data privacy a priority. Consumers today demand it.
