Direct answer · GDPR
Fines under the GDPR
The GDPR has two tiers of fines. Up to EUR 10 million or, for an undertaking, up to 2% of total worldwide annual turnover if that is higher, for infringements of, among others, Articles 25 to 39 (Article 83(4)(a)). These include the DPIA obligation (Article 35), security (Article 32) and the notification of personal data breaches (Articles 33 and 34). Up to EUR 20 million or 4% for infringements of the principles and legal bases, the rights of data subjects and the rules on transfers (Article 83(5)). The absence of a required DPIA can therefore lead to a fine on its own: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) fined International Card Services EUR 150,000 for not carrying out a DPIA for the digital identification of customers.
For you to establish
- Which article was infringed? That determines the tier of the fine.
Articles
- Art. 83(4)(a) GDPR Infringements of Articles 8, 11, 25 to 39, 42 and 43: up to EUR 10 million or 2% of total worldwide annual turnover.
- Art. 83(5)(a) to (c) GDPR Principles and legal bases, rights of data subjects, transfers: up to EUR 20 million or 4%.
- Art. 83(2) GDPR What the supervisory authority takes into account when setting the amount.
Guidelines and decisions
- Guidelines 04/2022 on the calculation of administrative fines under the GDPR (EDPB, v2.1, 2023-05-24)How supervisory authorities calculate the amount of a fine.
Enforcement
- 150,000 euro fine for ICS for missing DPIA on digital identity checks (Autoriteit Persoonsgegevens, Besluit boete ICS (18 december 2023, gepubliceerd 15 januari 2024), 2023-12-18)Fine of EUR 150,000 solely for the absence of a DPIA (Art. 35(1)).
