European data regulators issued EUR1.1 billion in GDPR fines – a sevenfold year on year increase
Data protection supervisory authorities across Europe have issued a total of nearly EUR1.1 billion (USD1.2 / GBP0.9 billion) in fines since 28 January 2021, according to international law firm DLA Piper.
This figure is taken from the law firm’s latest annual General Data Protection Regulation (GDPR) Fines and Data Breach Survey of the 27 European Union Member states plus the UK, Norway, Iceland and Liechtenstein. This is nearly a sevenfold increase on last year’s total.
This year has seen a change to the aggregate fines league table, with Luxembourg and Ireland, both having record-breaking fines imposed, replacing Italy and Germany in the top two spots and Italy moving down to third place with EUR746 million (USD843 / GBP619 million), EUR226 million (USD255 / GBP188 million) and EUR79 million (USD89 / GBP66 million) respectively.
The highest GDPR fine to date is the one imposed by the Luxembourg National Commission for Data Protection (CNDP) for EUR746 million on a US online based retailer, the biggest fine so far for non-compliance with the GDPR. This is more than 14 times higher than the previous largest GDPR fine (EUR50 million) imposed by France’s CNIL on Google.
The trend of increasing numbers of daily data breach notifications in Europe has also continued over the last year, for the third year running.
Since 28 January 2021, there have been over 130,000 personal data breaches notified to regulators - on average 356 breach notifications per day, an 8% increase on last year’s daily average of 331 notifications per day.1
Weighting the results against country populations, the Netherlands take the top position with 150.7 data breaches per 100,00 people. Greece, Czech Republic and Croatia reported the fewest number of breaches per capita since 2018.
Commenting on the survey findings, Ross McKean, Chair of the UK Data Protection and Security Group said: “The nearly sevenfold increase in fines may be grabbing the headlines but the Schrems II judgment and its profound implications for data transfers has established itself as the top data protection compliance challenge for many organisations caught by GDPR.”
According to the survey findings the Schrems II judgment doesn’t just create a risk of fines and claims for compensation; it also threatens service interruption in the event data transfers are suspended with serious implications for business continuity.
“The threat of suspension of data transfers is potentially much more damaging and costly than the threat of fines and compensation claims. The focus on transfers and the significant work required to achieve compliance inevitably means that organisations have less time, money and resource to focus on other privacy risks”.
Ewa Kurowska-Tober, Global Co-Chair of DLA Piper's Data Protection & Security Group, said “The Schrems II judgment has effectively shifted the problem and burden of a fundamental conflict of laws from the politicians and lawmakers to individual data exporters and importers. Meeting the requirements of Schrems II is a challenge even for the most sophisticated and well-resourced organisations and is beyond the means of many small and medium sized enterprises. What is really needed is a resolution of the underlying conflict of laws rather than imposing an unrealistic compliance burden onto business and another headwind to international trade as we emerge from the global pandemic.”
Key findings:
- Luxembourg, Ireland and France top the table of the highest individual fines issued (EUR746m, EUR225m and EUR50m respectively). Luxembourg, Ireland and Italy top the table of the highest aggregate fines issued
- There was an 8% growth for breach notifications compared to last year with more than 130,000 breaches notified since 28 January 2021
- Per capita the Netherlands tops the rankings for data breach notifications
- The increase in fines is significant but the Schrems II judgment of Europe’s highest court and its profound implications restricting international data transfers continues to be the top data protection compliance challenge for many organisations caught by GDPR
Request the report by clicking here.
Contact
Petter Bjerke, Location Head of IPT at DLA Piper Norway, T: +47 90 60 77 08, E: petter.bjerke@dlapiper.com.
N.B. Not all Member States of the European Economic Area make details of breach notification statistics publicly available. Several have only provided incomplete statistics or statistics for part of the period covered by this report so the figures have been rounded up and in some cases extrapolated to provide best approximations. Similarly not all GDPR fines are publicly reported and some data only covered part of the period covered by this report.
