European data regulators issued over EUR1 billion in GDPR fines: Ireland now ranked second highest, DLA Piper survey reports
- European data regulators issued EUR1.1 billion in GDPR fines – a sevenfold year on year increase - survey by DLA Piper
- Luxembourg, Ireland and France top the table of the highest individual fines issued (EUR746m, EUR225m and EUR50m respectively). Luxembourg, Ireland and Italy top the table of the highest aggregate fines issued
- There was an 8% growth for breach notifications compared to last year with more than 130,000 breaches notified since 28 January 2021
- Per capita the Netherlands tops the rankings for data breach notifications, while Ireland is fourth
- The increase in fines is significant but the Schrems II judgment of Europe’s highest court and its profound implications restricting international data transfers continues to be the top data protection compliance challenge for many organisations caught by GDPR
According to DLA Piper's latest annual General Data Protection Regulation (GDPR) Fines and Data Breach Survey, 6,802 data breaches were reported to the Irish Data Protection Commission in the past twelve months. Ireland recorded the sixth highest level of breach notifications across Europe and fourth highest on a per capita basis.
Nearly EUR1.1bn of fines have been imposed for a wide range of infringements of Europe’s General Data Protection Regulation. This represents a 594% year on year increase in fines imposed since 28 January 2021 compared to EUR158.5m during the same period last year, according to international law firm DLA Piper. The figure is taken from the law firm’s latest annual General Data Protection Regulation (GDPR) fines and data breach survey of the 27 European Union Member States plus the UK, Norway, Iceland and Liechtenstein.
Luxembourg, Ireland and France top the rankings for the highest individual fines (EUR746m; EUR225m and EUR50m respectively). Luxembourg and Ireland have each imposed record breaking fines moving them from the bottom to the top of the league tables.
The growth of breach notifications has continued with an 8% increase from last year’s average of 331 notifications per day to 356 this year and more than 130,000 personal data breaches notified in aggregate since 28 January 2021.
Weighting the results against country populations, the Netherlands takes pole position this year ahead of Liechtenstein, Denmark and Ireland, with 151, 136, 131 and 130 breach notifications per 100,000 people respectively. Croatia, the Czech Republic and Greece reported the fewest number of breach notifications per capita since 28 January 2021.
John Magee, Partner and Head of Data Protection & Information Security at DLA Piper Ireland, commented on the report: “It is four years since the implementation of GDPR and we are now seeing significant fines imposed for a wide range of infringements of Europe’s rigorous data protection laws. This year, regulators have issued record fines surpassing one billion euro and Ireland now ranks second overall for total fines to date, demonstrating the significant position and influence of the Data Protection Commission (DPC) in the EU. Given that Ireland is home to some of the world’s largest-data businesses there is no doubt that the DPC will continue to play a central role in the enforcement of GDPR in Europe.”
While the increase in fines may be significant, the judgment of Europe’s highest court in Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems in July 2020 known as “Schrems II” continues to be the top data protection compliance challenge for many organisations caught by GDPR. The judgment and Chapter V of GDPR impose strict limitations on the transfer of personal data from Europe to “third countries” with data exporters risking suspension orders, fines and claims for compensation for failing to meet these new requirements. The judgment requires organisations exporting personal data from Europe to third countries to carry out comprehensive mapping of those transfers and detailed assessments of the legal and practical risks of interception by public authorities in the countries where importers are located, greatly increasing the compliance burden on data exporters and importers.
John added: “The Schrems II judgment has effectively shifted the problem and burden of a fundamental conflict of laws from the politicians and lawmakers to individual data exporters and importers. Meeting the requirements of Schrems II is a challenge even for the most sophisticated and well-resourced organisations.”
