4.7 Billion Euros in Total Known Fines Since Data Protection Law Took Effect
Ireland – home to the European headquarters of a throng of multinational tech companies – is responsible for the greatest amount of aggregate data protection fines since the European Union General Data Protection Regulation went into effect.
See Also: Live Webinar | Integrating Splunk and Panther for Real-Time Alerting and Custom Dashboarding
So says a report from global law firm DLA Piper, which finds that European data protection authorities in 2023 issued 1.8 billion euros – $1.9 billion – in known fines, a 14% increase from the previous year’s 1.6 billion euros.
Since the trading bloc’s rigorous privacy regulation came into force on May 25, 2018, Ireland has issued 2.9 billion euros in fines, including seven of the 10 largest known fines to date. That includes the record-breaking 1.2 billion euro fine imposed on Meta Platforms Ireland in May 2023 over its transfer of Europeans’ personal data to non-EU countries.
“As Ireland is a popular location for technology companies to set up their main establishment in the European Union, it is not surprising that it has rocketed to the top spot of the country league table for the aggregate value of fines imposed,” the report says.
“The Irish Data Protection Commission continued to play a central role in shaping GDPR interpretations this year, notably with key decisions and fines on issues ranging from transparency and data transfer to information security and children’s privacy,” said John Magee, a DLA Piper partner based in Dublin.
Organizations in Germany last year reported the greatest number of data breaches involving Europeans’ personal data to supervisory authorities, followed by the Netherlands and Poland, DLA Piper found. Overall, it counted an average of 335 breach notifications sent to regulators per day, a figure virtually unchanged from the 328 reported in 2022.
The report draws data from the 27 EU member states, plus Norway, Iceland and Liechtenstein – part of the European Economic Area – and the United Kingdom, which exited the EU on Jan. 31, 2020. Britain’s version of GDPR, known as the UK GDPR, currently mirrors the EU privacy law, although that could change. The Conservative British government led by Prime Minister Rishi Sunak has been attempting to modify the UK GDPR in ways that critics warn might cause it to fall out of legal alignment with the EU, potentially disrupting data flows (see: British Lawmakers Push Ahead With Modifying UK GDPR).
The report reviews the nearly 12-month period beginning on Jan. 28, 2023, and is based on fines and appeals that have been publicly reported or disclosed by European data protection authorities. It does not include amounts that have been successfully appealed. Not all DPAs publish information about fines or appeals – some treat the information as confidential – meaning the actual, total aggregate amount of penalties remains unknown.
More than five years after it went into effect, the GDPR continues to be marred by accusations that it is applied unevenly. Different countries continue to pursue differing enforcement strategies. Compared to the likes of Ireland, Luxembourg or France, for example, “Spain and Italy have opted for the little and often approach – issuing a large number of fines often for quite small amounts,” the report says.
Based on what is known, the report says a total of 4.7 billion euros in GDPR fines have been imposed since the law took effect in May 2018 – although successful appeals from companies will likely drive down that figure. Challenges have already driven the originally assessed 2022 amount of 2.9 billion in fines down to 1.6 billion euros.
Companies have seen “fines reduced or in some cases completely overturned, as well as fewer fines issued by European data protection authorities following opinions and binding decisions of the European Data Protection Board under the GDPR consistency mechanism,” the report says.
Other fines remain under appeal, including a 2021 fine of 746 million euros imposed against Amazon by Luxembourg’s DPA, where the e-commerce giant’s European operations are headquartered. Last week, Amazon in a Luxembourg courtroom argued that the fine against it should be overturned.
The third-largest GDPR penalty remains Meta Ireland being fined 405 million euros by the Irish Data Protection Commission, this time in September 2022, for violating children’s privacy related to its Instagram platform. Meta continues to appeal multiple fines issued by the DPC.
Changes are afoot in Ireland, where after a decade of helming the DPC, Commissioner Helen Dixon has announced she will step down on Feb. 19.
“The full implementation of the GDPR will remain a work-in-progress across the EU and, as the larger-scale enforcement cases now conclude, we see in Ireland and beyond, that these decisions are often subject to judicial challenge,” Dixon said in a LinkedIn post. “It will take a further number of years to bottom-out definitive interpretations of applications of this principles-based law but the groundwork is now well laid.”