GDPR Fines Totalling €2,8 Billion Issued in 1,700 Cases, Study by Privacy Affairs Finds

LONDON, May 22, 2023 /PRNewswire/ -- Since rolling out in May 2018, there have been close to 1,700 GDPR fines issued by European data protection authorities. Every one of the 27 EU nations and all other EEA members, have issued at least one GDPR fine.

A GDPR tracking dashboard from Privacy Affairs displays official data from national data protection bodies to monitor the status of GDPR fines.

Nations with the highest total fines:

• Ireland: €1,310,165,800
• Luxembourg: €746,312,300
• Italy: €144,195,096
• France: €298,794,300
• United Kingdom: €75,452,800
• Germany: €61,465,593
• Spain: €45,635,111
• Austria: €19,595,950
• Sweden: €16,267,730
• Norway: €10,510,750

Nations with the most fines:

• Spain: 594
• Italy: 244
• Romania: 126
• Germany: 122
• Hungary: 66
• Greece: 52
• Belgium: 37
• France: 36
• Cyprus: 35
• Luxembourg: 31

Biggest GDPR fines:

• Amazon Europe Core S.a.r.l.: €746,000,000
• Meta Platforms, Inc. (Facebook): €405,000,000
• Meta Platforms, Inc. (Facebook): €390,000,000
• Meta Platforms, Inc. (Facebook): €265,000,000
• WhatsApp (Meta): €225,000,000
• Google LLC: €90,000,000

The full list of all known GDPR fines and statistics can be found here: https://www.privacyaffairs.com/gdpr-fines/

It's striking that the countries with the highest total amount of fines are not always those with the highest number of fines.

This suggests that the severity of GDPR violations varies greatly from one case to another, and that the regulatory bodies in different countries may apply differing standards in their enforcement actions.

Ireland stands out as the country with the highest total amount of fines at €1,310,165,800. This is significantly more than the second country on this list, Luxembourg, which has a total fine amount of €746,312,300.

However, Luxembourg does not appear in the top 10 countries with the highest number of fines, suggesting that although it has fewer infractions, the severity of these infractions or the size of the offending businesses is significantly larger.

Luxembourg's and Ireland's high total fine amount but low total number of fines can be explained by the fact that nearly all of the biggest technology companies operating in Europe are legally registered in these countries.

Meanwhile, Italy comes third in terms of the total amount of fines at €144,195,096. Although the total amount is significantly less than Ireland and Luxembourg, Italy ranks second in the number of fines at 244, indicating that it has a higher frequency of smaller fines.

The highest number of fines have been issued in Spain, with a total of 594. However, despite being at the top in terms of frequency, Spain's total amount of fines ranks seventh, which suggests that the majority of its fines are relatively small compared to the other nations.

Highest fines issued to Private individuals:

• €20,000 issued to an individual in Spain for unlawful video surveillance of employees.
• €11,000 issued to a soccer coach in Austria who was found to be secretly filming female players while they were taking showers.
• €9,000 issued to another individual in Spain for unlawful video surveillance of employees.
• €2,500 issued to a person in Germany who sent emails to several recipients, where each could see the other recipients' email addresses. Over 130 email addresses were visible.
• €2,200 issued to a person in Austria for having unlawfully filmed public areas using a private CCTV system. The system filmed parking lots, sidewalks, a garden area of a nearby property, and it also filmed the neighbours going in and out of their homes

For questions regarding the research or more information about the team behind the report, contact Miklos Zoltan at miklos@privacyaffairs.com or visit Privacy Affairs.

Full research here: https://www.privacyaffairs.com/gdpr-fines

Privacy Affairs is a data privacy and cybersecurity research, information, and advice website.