Putting a price on data protection infringement

There is an assumption that the use of fines as an enforcement tool will have a deterrent effect and lead to compliance with the EU General Data Protection Regulation (GDPR). This article gives a critical analysis of the fines in Article 83 of the GDPR, and whether the introduction of elevated fines have led to the desired behavioural changes. The GDPR has no provisions that ensure harmonisation of the imposing and calculation of fines. This has already led to diverging practices by the Data Protection Authorities (DPAs). Neither does the GDPR require transparency about imposed fines. Without transparency, the deterrent effect of fines can be questioned. Monetary sanctions may not always lead to better compliance and ultimately better data protection for individuals. The GDPR has other enforcement measures that may have a more immediate effect in adjusting undesired processing of personal data, such as a temporary or definitive ban on processing which may be more harmful for a data-driven controller than a fine. The fines may function as punishment and deterrence, but not as restoration. Individuals who are affected by an infringement are not benefited by the imposed fine. Although Article 82 of the GDPR gives any person suffering material or non-material damage resulting from an infringement a right to compensation, the right is more theoretical than practical. The article concludes that adjustments should be made to ensure transparency and harmonisation. Also, changes should be considered to ensure that individuals are duly compensated in the event of damages suffered by data protection infringements. The EU General Data Protection Regulation (GDPR)1 has a dual purpose: To protect individuals against infringement of their personal data and to ensure free flow of personal data in the internal market.2 The regulation therefore has both a human rights and a business purpose. The GDPR has substantial administrative fines for non-compliance with the regulation. The fines can be issued to the controller, ie the entity responsible for the processing of personal data,3 and the processor, ie the entity processing personal data on behalf of the controller.4 The fines are designed to make non-compliance a costly mistake for both large and small entities. The maximum fines are 10 or 20 million EUR depending on the seriousness of infringements. In the case of an undertaking, the maximum can be set to 2 or 4 per cent of the global annual turnover of the preceding financial year.5 The fines are imposed by the Data Protection Authority (DPA) in the respective EU Member States.6 The use of fines as an enforcement tool may therefore diverge amongst the DPAs, dependent on their prioritizations and resources, and may also be influenced by national judicial practices on the use of financial sanctions. The GDPR has no instrument for the harmonisation of the use of fines as an enforcement tool except for voluntary cooperation between the DPAs.7 The European Data Protection Board (EDPB), an independent legal body composed of one representative from each Member State DPA, shall contribute to consistent application of the regulation and cooperation between the DPAs.8 The EDPB can issue guidelines for the setting of administrative fines, but has no authority to impose fines.9 This differs from competition law, where the European Commission has the power to initiate enforcement procedures and imposing any remedy, including fines.10 Three years after the entry into force of the GDPR, the use of fines as an enforcement tool is still being cautiously tested by the DPAs. Whether the fines have led to better data protection for individuals is unclear. The general conditions for imposing administrative fines and the interpretation of Article 83 of the GDPR have been thoroughly covered by academia.11 This article will not give an account of Article 83, but will discuss the effect of fines as a measure to ensure compliance from a law and economics perspective, and in particular whether the introduction of elevated fines have led to behavioural changes amongst the controllers. The use of fines as sanctions for data protection infringement is not new to the data protection legislation. The previous Data Protection Directive12 had a similar provision, but the amount of the fine was the of national The of fines from EUR in to EUR in Member not the with the power to impose The from the was that fines are for The for the sanctions in the GDPR to that which make the fines that are and can the In to the enforcement of the and administrative fines should be imposed for any The administrative fines should be and a for sanctions which is in EU and the case law of the European of The large fines of the GDPR the in competition law, and can be as punishment similar to the fines of competition law, the of the administrative fines is to give an to with the will both the entity and as a The use of fines should be to compliance with the or to The fines competition law are punishment and The is to protect competition in a by and The of data protection on the other is to protect from of their personal data and infringement of their of the GDPR does not have a for processing of personal data may be for for that the Regulation be with fines, has been no analysis of behavioural The of the GDPR a with the in which the to use sanctions to The of the fines was from the and was an that the GDPR and the sanctions be the large in of European and to the of the GDPR, also be to the on that the fine should the by the or the to the a on the of and the fine should be a of fines should be and to have an deterrent The fine for data protection infringement was not issued the GDPR, but was a in 20 than the the the fine a In was to make changes in their and a compliance Although the fine may was set and not lead to substantial changes in This was by the from the with by more than per cent after the case was There is an assumption that the use of fines similar to in EU competition law will have the and deterrent from competition law the effect of fines on has more than in fines for of European competition but the have not in any changes in the is as as in the European In a case against by the of a fine of to the annual of has been as to force the to from the European of the European and that has been no of the deterrent effect of fines in competition law, the have been in for a The that the Commission to a of the deterrent effect of fines, and in with the fines from competition law also of the effect of fines. The of the GDPR fines has and is the GDPR is There are that the of fines has of the may be to the of data but that the EU has had similar can be that of the is in the on the fines. The of the GDPR compliance to be a million EUR per in for that be to the The assumption was that be a of compliance to the and that EUR in administrative be by the was that be compliance but that a data protection in be a for the European In the introduction of the GDPR has led to and compliance for both and entities. The of was to be million that the of the GDPR compliance is that the regulation has influenced is the of an for GDPR as as an The of non-compliance has also led to other such as a to of to with the of are of the EU and are not their to European This that are no to from European have to the of the GDPR than their their from the to in a similar of in the of the diverging from EU data protection after has the to from the EU to the of the GDPR and their has a similar of their Article of the GDPR to the Member whether administrative fines should be imposed on The of the Data Protection from administrative fines, except for as The was that fines have a deterrent also for the of to the which lead to for which in in a flow of that an for for the deterrent effect of fines be to ensure a of data protection by the and led to a for authority as an will be to the administrative fine as other to competition and in the not being the maximum fine is set million In are from administrative fines, with the of and in a The was as being and in of the but the the The to the in the that the imposing of fines on lead to a financial that the of and the of a of The that the use of fines is not the enforcement measure to ensure compliance with the GDPR, and that the use of other measures and can be the that the from administrative fines not the data right to for the other the Data Article 83 of the GDPR to in In on the the was that the data protection had a similar The was that should be no in enforcement between and entities. that a should be set on the fines or no fines a fine the and the to was that the damage be a deterrent in the GDPR into the has imposed fines on The and deterrent have been by the in the an of can be whether fines against will have a effect from is being from one to enforcement may be more to ensure compliance and in of the fines of EUR was imposed on a for an infringement that affected and their In the for the infringement their was the fine will in effect be the which in is and from the the use of can the of the the resulting of and may be than the of a There are diverging practices the Member both on the of imposed fines and the The of fines imposed by the from to is of the are by the in and a of the fines are imposed by the in and the the DPAs, the of fine is with imposed than 10 fines each There was that the fines be to and force to more fines have been issued against of the global have their European in or to their the enforcement of the GDPR is the of the and the DPAs. have been against the has imposed one fine and the has imposed fines against The imposed a fine of million EUR against in The not any about the but that a was the by in their is by the fine but is not is by who will in In the a case against The infringement was but the years and of a a was The case was to the of Article of the GDPR after other the The EDPB a in with Article of the GDPR, the to the amount of the fine from the per cent of The imposed a fine of to per cent of the annual In the a fine against of million a by the EDPB to the fine from the million The fine is not has been by to the is and with with the has led the to issue fines against that is in the infringement for the had no the processing in The with The EDPB has a on administrative fines for the use of fines as There is no for the calculation of fines similar to the guidelines in competition Although the are to are no for harmonisation of fines the Member except in The of Article of the GDPR has been in administrative The calculation and of fines are to the of each by the In the of guidelines on the calculation of fines not to any particular In that not to use a or financial for the of the The GDPR the fine as and a of annual the being in the case of The is not in the GDPR, but to and of the Neither article the and the be as a to the case law the of an the The by the in competition law is entity in an of the legal of the entity and the in which is The EDPB to be an which in of the legal person This will require the to into the of competition law whether a controller is an and the of a of in the case of an of entities. There is already diverging on as a of the undertaking, The annual turnover is to set the for the fine in the case of Although turnover can the of for a not one of the to be considered in Article of the GDPR on the amount of the fine. turnover to be by not to set the but also to the of the fine. In a the EDPB that Article Article of the GDPR to should not be as being an and that does not turnover from being In the of the turnover is to setting a fine that is and the EDPB that the between the fine of competition law and the GDPR are such that the case law of the in competition law may to on the imposing of fines in the The EDPB that of turnover in the calculation of fines is an in competition law, can also be for Article 83 of the GDPR that turnover of an is not for the of the maximum fine amount but may also be considered for the calculation of the fine The interpretation of the EDPB that be an for the turnover to be and the of of the and turnover imposing fines. The and have made for calculation of fines. The have that will no use the the EDPB on a The is to by their and turnover and a which is by a that on the of the The is that the fine will with the than the of the The can lead to large fines being issued for the is a large The fines to the of on their with adjustments on the The on the other fine for of to will therefore lead to similar fines, of the turnover of the entity in is in the fines are but the have also of as the GDPR does not the of each to make their interpretation of turnover should be The to the of turnover in the Article 2 from the of and the of after and and other to In their case against the to the by the in the annual for the preceding The DPA, in a case against on about the and to the turnover of to the annual or from the to Article of the the on to that an amount of million and the of fines on is no that turnover be to the processing of personal Neither is a that the infringement or non-compliance has led to or an for the Article 83 of the GDPR does not between that have data as their and and where processing of personal data is a of their the controller has from the should be into account whether a fine should be should be compensated measures that have a to from competition law, the European of that are not considered fines by the Commission national competition This is to the in can that from personal data processing will be for the DPAs. The on turnover to the of personal data processing may lead to fines that are in a was million EUR for to data about The annual turnover was and the maximum fine be million can be whether is to use turnover to the fine for a from and not from processing personal The case was to the which the fine on not into the issue of the fine was There are other of imposed fines that have been in The not the of fines as an enforcement an million EUR fine against the on In a a fine of that the should the of sanctions a fine. In the imposing a fine for a was not in with the of Article of the In a a million EUR fine against a to The that the fine was and that had been to the turnover the The was in and into account in the This the calculation of the into the diverging practices of the in whether fines are set and the of fines, can the and deterrent effect of the fines. The enforcement will be of by the and may competition and lead to and require transparency in the use of Without and transparency about imposed fines, the deterrent effect of fines will be will be no of the of of fines can also have an effect and lead to changes in Without transparency, the regulation is to be can on in GDPR The assumption is that the GDPR will lead to practices the Member the of harmonisation for enforcement of fines. of on fines can contribute to adjustments and of and also on diverging There is also case law data protection fines both from Member State and the The sanctions imposed by the their administrative and other enforcement are therefore a of are not made can transparency and the of the the GDPR has no on of by the This will be to Member regulation of whether and by the can be which was also about enforcement of the Data Protection The is a of and a of transparency about the enforcement the has issued fines for of of the are as are as are not Although the are more or the in the of the of infringement be to the of but also similar about enforcement The are on and in the material on is no about or the and of The of on transparency can also have other in a case against by the was of has that the a for the DPA, the the with a on and The on on administrative fines are not with to Whether will also for is not In the European for a by the in a case to which is a as the of a This the to a for of to the General which does not the and use of for a in a the is to the of In the to ensure transparency, but of whether is to or any of the for the of The has also of as a of and which was in against and In to the of the other are to amongst and to the The EDPB a of to Article of the GDPR, but to national legal or by the in the and are There are also in Member State as to whether about or legal is the is by the EDPB as a to individuals to for their no where in the of the processing of the are not to the issued by the are not in a and and about in fines is between DPAs. Neither does the EDPB a of the fines and the in their is to The EDPB of imposed fines by the for in but are not by the EDPB the not to be the amongst to similar on fines being or an which may give the that the enforcement of the are more and than the about a fine of million EUR to a is still on EDPB but with no about the fine being by the In is the of the DPAs, is a than a of the enforcement practices of the DPAs. the EDPB in annual that enforcement of data protection is to a data protection the gives a of and no of the of enforcement or on administrative fines per The from the EDPB is in a by the on and of the European with national and enforcement of with a fine per and of fines that are to a The of administrative fines is by a law data about The deterrent and effect of fines can be the are not made to the or not in from the and the is also that transparency is a data protection the enforcement of the are not to transparency national on and administrative can be made to the of GDPR The of transparency and can both the effect of enforcement and the deterrent effect of fines and enforcement The of enforcement has led to from both and The European Commission has the by that the of the GDPR should not be by the of fines, but by changes in of fines, the are by the Commission to use other measures in the GDPR, such as temporary on the processing of This is also in with the of regulation with and enforcement to more sanctions more deterrent sanctions will the to the where to The will require for both and to be in their amongst the will also be each is as to to use and enforcement measures and to to more enforcement such as and ultimately fines, of enforcement of the GDPR will The power to impose fines has the the of the in Article of the GDPR are The of transparency about the practices of measures the to which the use their and the effect measures have on the issued from to of which are on their Whether measures have led to changes in as by the DPA, is to is not The of enforcement from data protection the is that the has from the The have the authority impose temporary or on processing and to the of already and personal ban on processing can be an or a to imposing a that on personal data for their business an to processing be more than a fine. also of more is to the fines than the of to data processing and the deterrent effect the have practices for about their the of the use of processing as an enforcement tool is not the fine on of million EUR is on their that legal for the processing of personal data for legal the processing will be and the is that the processing be the does not require to the data and the to have had a more immediate effect on than a fine. the of the fines in the GDPR was to in the large has not been There are no changes in or the business of the data protection is duly and are In to diverging practices amongst the and the of consistent of their the deterrent effect of fines may be questioned. Article 82 of the GDPR the right to for any person who has suffered material or non-material damages as a of the infringement of the The right can be by the case the but can also be of between the The of is a between the affected person and the controller and does not the Neither is a between Article 82 and 83 of the GDPR, and the right to is not dependent on or by the imposing of administrative the will the national the application of the will on national an is that non-material damage should also be the of the GDPR is to protect than a of to material damages not have the of the is no case law from the to Article on the similar in the previous Data Protection Article the has to the on whether an have suffered for to be or is that provisions of the GDPR have been Also, the the for non-material damage the of a of the infringement that the by that There is no of from the national does the EDPB of to individuals. The of the application of Article 82 of the GDPR is therefore unclear. from Member State on the the of and between the of administrative fines and the to affected individuals. of the but the the to be or that the person not a that was in In other the has in the of In the of EUR in by the of that a of rights does not in The that the to that the of was In the that the had suffered and by the of personal The was set In a a of The that no of data protection rights is to was no damage or personal to the There should be a of for resulting from to GDPR lead to for general on the right to The set damages or for The for damage is also than the the administrative fines. in the of to the of is a person a with the that will the case is damages are as as a case will be for the or the the of in the of data In the the has the of a against The case in the of a 20 million fine imposed by the for the to protect the data of by a In a representative against the of considered that the damages for of of their data, or the the that damages be of financial damages and the not be to as a representative have been by a rights in the against and The EUR per person on behalf of the The is EUR per The of the GDPR that the to use the right to was and the use of as a This was not in the GDPR, but Article of the GDPR a right to where the data can a entity to the right to on behalf for by Member State on in damages are to the Member in a for in Member was The will damage the the GDPR, the Member to to representative on behalf of of Although the the right to the procedures will national the effect on for data protection will still on the national interpretation of the of the GDPR is to the data protection of the of between the use of fines as sanctions and the right to may not data protection The of the fines and the the who the GDPR is to can be their and not be The GDPR is as a that that individuals will be in and their personal data, but the of the GDPR give to right In personal data of million individuals was on a the The imposed a fine of million and the with was the imposed a fine on the that the affected individuals have to to the procedures of law for person damages was EUR by the but the was by the The case is as the has to the whether non-material damage should be as to the and suffered by the data for of their personal data, to for damages has not been or the person has not suffered any In a case from a in the of fines in the the use of a between and in the of the of to a new and the The by the the a new but no was In to the by damages by the of a There is no that the infringement both material and non-material for the to the be a to the case to In such a can be a substantial between the is the fine and the for the affected The right to data protection may be as an but for individuals to their right to the of the GDPR is to protect the and not the be considered whether fines can be to the individuals by including in the or by fines to the affected individuals of the being the may a but the for damages for data protection is already of There to be an assumption that the introduction of fines will ensure compliance on but as article has is of the effect of of fines. analysis of the behavioural and deterrent effect of fines should be of a of the can be to the enforcement about imposed fines should be made in a and both by the national and the Without such to the a deterrent effect on the can be the use of fines on should be on the fines will the and may the to the enforcement measures should be the fines be to affected individuals of being to the the EDPB should issue guidelines for the of fines, use of other enforcement and the calculation of fines to ensure harmonisation and Member is a of the of the GDPR and to to in with the should to a use their to ban processing or set for the data will have a more immediate effect than fines. remedy, which will require changes in the is to including to the data in the fine. The fines should not be as and but to on In that the will that is a for on their The effect of the enforcement of fines and other measures are still is on the effect fines have on and compliance with data protection into account the protection of rights is from fines from competition law may not have the effect to the of the on article was the of the in the by the are to and for their and to the and as as to the for the and The by the of