Nearly €1.1 billion (US$1.2 billion/£0.9gbn) of fines have been imposed for a wide range of infringements of Europe’s General Data Protection Regulation. This represents a 585% year-on-year increase in fines imposed since January 28, 2021, compared to €158.5 million during the same period last year, according to international law firm, DLA Piper. The figure is taken from the law firm’s latest annual General Data Protection Regulation (GDPR) fines and data breach survey of the 27 European Union Member States, plus the UK, Norway, Iceland and Liechtenstein.
Luxembourg, Ireland and France top the rankings for the highest individual fines (€746 million; €225 million and €50 million respectively). Luxembourg and Ireland have each imposed record-breaking fines moving them from the bottom to the top of the league tables.
Croatia, the Czech Republic and Greece reported the fewest number of breach notifications per capita since January 28, 2021.
While the increase in fines may be significant, the judgment of Europe’s highest court in Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems in July 2020 known as Schrems II continues to be the top data protection compliance challenge for many organisations caught by GDPR. The judgment and Chapter V of GDPR impose strict limitations on the transfer of personal data from Europe and the UK to ‘third countries’, with data exporters risking suspension orders, fines and claims for compensation for failing to meet these new requirements. The judgment requires organisations exporting personal data from Europe and the UK to third countries to carry out comprehensive mapping of those transfers and detailed assessments of the legal and practical risks of interception by public authorities in the countries where importers are located, greatly increasing the compliance burden on data exporters and importers.
Commenting on the survey findings, Ross McKean, Chair of the UK Data Protection and Security Group, said: “The nearly sevenfold increase in fines may grab the headlines, but the Schrems II judgment and its profound implications for data transfers has established itself as the top data protection compliance challenge for many organisations caught by GDPR.”
According to the survey findings, the Schrems II judgment doesn’t just create a risk of fines and claims for compensation, it also threatens service interruption in the event data transfers are suspended, with serious implications for Business Continuity.
“The threat of suspension of data transfers is potentially much more damaging and costly than the threat of fines and compensation claims. The focus on transfers and the significant work required to achieve compliance inevitably means that organisations have less time, money and resource to focus on other privacy risks,” said McKean.
Ewa Kurowska-Tober, Global Co-Chair of DLA Piper’s Data Protection & Security Group, said: “The Schrems II judgment has effectively shifted the problem and burden of a fundamental conflict of laws from the politicians and lawmakers to individual data exporters and importers. Meeting the requirements of Schrems II is a challenge even for the most sophisticated and well-resourced organisations and is beyond the means of many small and medium sized enterprises. What is really needed is a resolution of the underlying conflict of laws rather than imposing an unrealistic compliance burden onto business and another headwind to international trade as we emerge from the global pandemic.”
