2 Years GDPR: An Overview of Enforcement, Warnings and Fines

It is about two years ago that the General Data Protection Regulation (also known as the GDPR) became applicable. Just like last year, it is time to take a preliminary stock of the enforcement actions taken by the supervisory authorities in the past year and to make a forecast of what organisations will face in 2020 and the coming years in terms of data protection and GDPR. 

1. Number of files continues to increase

Last year the Belgian DPA (Data Protection Authority) announced that there was an exponential increase in the number of files in 2018. Recently published figures show that this increase is continuing. For example, in the second year of the GDPR, the Belgian DPA received 937 notifications of data breaches, compared to only 317 notifications in the first six months of the GDPR. 

However, the Belgian DPA is not the only one to note an increase, as other supervisory authorities such as the Dutch DPA, the UK DPA, the French DPA and the German Datenschutzkonferenz (DSK) also reported a strong increase in the number of files. More figures from other supervisory authorities can also be found in the evaluation document of the European Data Protection Board (EDPB).

An increase in the number of files may be due to the increasing awareness of citizens. Research shows (pdf) that the number of citizens familiar with the local supervisory authority has increased. Compared to 2015, 20% more citizens had already heard of the local supervisory authority.

2. Strategic objectives and priorities

Due to the increase in the number of files, supervisory authorities claim to be increasingly understaffed. Part of the German DPAs and the Dutch DPA have declared this openly. For example, the Dutch DPA is obliged to deal with every notification, but earlier this year it had to admit that this was no longer feasible. Due to this, approximately 3,000 complaints would, according to the competent minister, not have been dealt with yet. That is why the Dutch DPA works with priorities, just like other supervisory authorities. 

In the period 2020-2025 the Belgian DPA will focus (pdf) on:

• priority sectors: the government, telecommunications and media, direct marketing, education and SMEs,
• GDPR priority instruments such as the role of the DPO, the lawfulness of processing and citizens’ rights, and
• societal issues such as photos and cameras, online data protection such as cookies and trackers, and sensitive data such as health data.

The Dutch DPA seems to focus on three areas in the period 2020-2023:

• data trading such as the monitoring of resale, internet of things, profiling and behavioural advertising, 
• digital government including data security, smart cities, partnerships, elections and microtargeting, and 
• artificial intelligence and algorithms.

The French DPA focuses in 2020 on:

• security of health data,
• mobility services and new applications of location data, and
• cookies and other trackers.

The UK DPA and German DSK do not mention any specific priority sectors or themes, but the UK DPA does indicate its focus on the following objectives:

• leading the implementation and monitoring of the GDPR,
• exploring innovative and technologically agile ways to protect privacy,
• strengthening transparency and accountability and promoting good information management, and
• protecting citizens in a digital world.

3. Warnings and fines in the EU

3.1. Transitional period is over

Last year we wrote that most supervisory authorities had been relatively lenient in 2018 and that some supervisory authorities, including the Belgian DPA, had indicated that they would take more stringent action in 2019. The President of the Belgian DPA announced that he would step up efforts in 2019 to ensure compliance with the GDPR. This prediction seems to have been fulfilled by the three fines of EUR 50,000 imposed by the Belgian DPA in April and May 2020. 

The President of the Dutch DPA also announced in the past that in 2018 the Dutch DPA would focus primarily on ending violations. To this end, the Dutch DPA organised exploratory investigations into the record of processing activities, data processing agreements and data breach registers. The Dutch DPA also insisted that the organisation itself should take remedial action. However, the President of the Dutch DPA also stated that complaints in 2019 would lead to more investigations and possible sanctions. This prediction also seems to have come true by two heavy fines of EUR 525,000 and EUR 725,000. It appears from the latter fine that organisations do not always have to expect a notice of default from the supervisory authority before a fine is imposed. In this case, the Dutch AP ruled that the infringement was so serious that the immediate imposition of a fine was justified.

The Irish DPA has also recently imposed its first GDPR fine. This despite the fact that Ireland has relatively the highest number of complaints. An investigation by IntoTheMinds showed that for every 10,000 Irish people 8.6 submit a complaint to the Irish DPA. This is the highest figure in the EU and contrasts sharply with the figure in Belgium (0.32 complaints per 10,000 Belgians). This is the second last place. A fine of EUR 75,000 was imposed on an Irish State agency Tusla (Child and Family Agency) for three cases of unlawful sharing of personal data of minors. In one case the contact and location details of a mother and child were disclosed to an alleged abuser. In the two other cases, data relating to minors in foster families were wrongly disclosed to blood relatives, including in one case to a detained father. 

3.2. Is there a trend in sectors or infringements?

Although supervisory authorities can still issue a warning, there has been an increase in the number of fines imposed, as well as in the level of those fines. At present, however, supervisory authorities do not appear to act more frequently against certain sectors or companies, nor against certain types of infringements.

Fines are thus imposed in various sectors and companies, including:

• health care organisations,
• organisations active in the financial sector and insurance sector,
• organisations active in the (social) media sector,
• telecom companies, 
• real estate companies,
• companies active in transport and mobility, 
• companies active in entertainment and leisure,
• non-profit organisations,
• government agencies, 
• etc.

Fines are also imposed for various types of infringements, including: 

• failure to comply with basic data processing principles,
• a lack of transparency towards data subjects,
• the use of an erroneous legal basis,
• failure to take appropriate technical and organisational security measures,
• failure to respond, or to respond in a timely manner, to requests from data subjects,
• failure to report a data breach or to notify it in time,
• etc.

Please have a look at the bottom of this blog for an overview of the fines imposed!

4. relevant case law (in Belgium)?

4.1. Belgian fine successfully challenged before the Market Court

In Belgium, fines imposed by the DPA can be challengedbefore the Market Court (Dutch: Marktenhof). The abovementioned fine of EUR 10,000 imposed on a Belgian liquor store was successfully challenged before the Market Court. The main reason for this was the lack of justification by the DPA. 

Unlike the Netherlands and Germany, the Belgian DPA does not have a fining policy. Therefore, according to the Market Court, the Belgian DPA must justify the reason why a less far-reaching sanction than the imposition of a fine of EUR 10,000 would not put an end to the infringements. Moreover, the sanctions imposed were based on legislation that was not applicable at the time of the infringement by the liquor store.

4.2. The Facebook case: preliminary questions asked

The GDPR provides for a new cooperation mechanism between the European supervisory authorities, being the one-stop shop mechanism. In the Facebook case in Belgium, the court therefore raised the question of whether this one-stop shop mechanism also affects the possibility of initiating proceedings before the court. Interesting to mention is that the one-stop shop mechanism was not applied by the French DPA when it imposed a multi-million fine on Google. 

The Facebook case was initiated in 2015 by the former Privacy Commission and continued by the current Belgian Data Protection Authority. The former Privacy Commission argued that the Belgian courts have jurisdiction and claimed that Facebook must comply with the Belgian and European data protection rules. 

In first instance, the former Privacy Commission was proved right, but Facebook appealed. On 8 May 2019, the Brussels Court of Appeal ruled to refer a number of preliminary questions to the Court of Justice of the European Union (CJEU) before ruling on the merits. The preliminary questions can be found here.

5. What does the future bring?

5.1. Perhaps more (and higher) fines

Compared to 2018 and the first half of 2019, more and higher fines were imposed in the second half of 2019 and in the first half of 2020. It is probable that this trend will continue in 2020 and the coming years. 

It is likely that future fines will be in line with the strategic objectives of the supervisory authorities. As cookies and online trackers are among the priorities of several supervisory authorities, we certainly expect more cookie fines in 2020 and the coming years. The Belgian, Spanish and Turkish supervisory authorities have already issued such cookie fines.

However, a fine will not always be imposed. Although notifying a data breach may lead to a (high) fine, as in the case of British Airways, it appeared that reporting a data breach does not necessarily lead to a fine. This was apparent from a recent decision by the Belgian DPA. In that case, the Belgian DPA did not impose a fine on a telecommunications operator since it appeared from the investigation that the data breach was correctly notified and appropriate organisational and technical measures were taken.

5.2. Insurability of fines

As more and higher fines are imposed, the question of their insurability is becoming increasingly pressing. A fine for an infringement of the GDPR imposed by a supervisory authority is an administrative fine and can, in principle, be insured (in Belgium), but this raises two questions, namely whether administrative fines are excluded by the insurance policy, and whether the coverage of the insurance policy is sufficiently high. 

For a further discussion of these questions we refer to our overview from last year.

5.3. Are complainants entitled to compensation?

It happens that complainants also ask the Belgian DPA to award damages to them, but the DPA does not have the power to do so. While the DPA may establish an infringement and impose an administrative fine, the award of damages is reserved to the competent courts. In addition, the DPA cannot award damages either, as this is an administrative procedure.

In the Netherlands, the Dutch Administrative Jurisdiction Division of the Council of State decided that the GDPR does not stipulate how immaterial damage should be determined. This must therefore be determined by national law. With respect to the concept of damage, recital 146 of the GDPR states the following: “The concept of damage should be broadly interpreted in the light of the case-law of the Court of Justice in a manner which fully reflects the objectives of this Regulation. This is without prejudice to any claims for damage deriving from the violation of other rules in Union or Member State law”. Although not every breach of the GDPR will give rise to damages, the Council of State granted an amount of EUR 500 (ex aequo et bono) to a data subject whose medical data were included by the director of the Pieter Baan Centre in a defence in the context of disciplinary proceedings.

5.4. Will there be fining policies in more Member States?

In order to ensure that supervisory authorities do not impose arbitrary fines, it is useful to draft a so-called fining policy, as in the Netherlands and Germany. To this end, the Dutch DPA has based itself on the WP29 guidelines published in 2017 and distinguishes between four categories of infringements. Each category consists of a basic amount which can be adjusted upwards or downwards depending on the circumstances.

5.5. More guidelines in terms of strategic objectives

In addition to the competence to sanction, the supervisory authorities also have the power to issue guidelines on the processing of personal data. These guidelines are usually to be found on the local supervisory authority’s website. For the Belgian DPA, the following guidelines have been in place since the application of the GDPR:

• A memo on the concepts of controller/processor (also read our blog about this),
• A recommendation on direct marketing (also read our blog about this),
• A recommendation on the protocol obligation (a protocol is mandatory for sharing of personal data between certain authorities),
• A dedicated page about cookies,
• Practical support for SMEs (project BOOST in 2020).

When issuing guidelines, it is not excluded that there may be differences between the guidelines of the different supervisory authorities. As an example, according to a recommendation of the Dutch DPA, purely commercial interests cannot qualify as a legitimate interest, whereas according to the Belgian DPA, direct marketing may be possible on the basis of a legitimate commercial interest. 

Conversely, guidelines issued by one supervisory authority may also be confirmed or followed by other supervisory authorities. For example, almost all supervisory authorities have in the meantime stated that a cookie wall is illegal. This means that a website can only be used if all cookies are accepted by the website visitor, including marketing cookies for example. 

5.6. Evaluation of the GDPR and the new ePrivacy Regulation

On the basis of Article 97 of the GDPR, the European Commission was required to submit a report to the European Parliament and the Council on the evaluation and review of the GDPR by 25 May 2020 and every four years thereafter. The May 2020 report is available here.

That being said, the EDPB published on 18 February 2020 an evaluation document stating that it is currently too early to revise the GDPR. At the same time, the EDPB calls for work to be done on the new ePrivacy Regulation, which is not yet in place. We already wrote about this on our blog.

5.7. Update of standard contractual clauses

The current versions of the Standard Contractual Clauses (SCCs) were drafted before the entry into force of the GDPR. Timelex has advised the European Commission on an adaptation of the Standard Contractual Clauses to the GDPR. If you would like to stay informed, you can follow us on LinkedIn.

5.8. More certification in 2020 and the coming years

GDPR certification is a way for an organisation to demonstrate its compliance with the GDPR. In the case of certification, an accredited certification body can assess, approve, and issue a certificate to an organisation. An example of a GDPR certification scheme is EuroPrivacy. Timelex also assists organisations in obtaining a GDPR certificate. 

6. Will the coronavirus affect enforcement?

Several supervisory authorities are currently busy with corona apps and enforcement also seems to be affected by the current exceptional circumstances. For example, the ICO shows understanding for organisations that currently have other priorities: “We understand that resources, whether they are finances or people, might be diverted away from usual compliance or information governance work. We won't penalise organisations that we know need to prioritise other areas or adapt their usual approach during this extraordinary period. “

Although the ICO does not extend the deadlines, the CNIL does. In certain cases, the CNIL will extend the deadlines for the notice of default until 24 June 2020. In addition, CNIL states that it will continue to take action against serious breaches of data protection laws in these exceptional circumstances.

7. An overview of fines imposed

The overview below is arranged in ascending order according to the amount of the fine and provides an anthology of the fines imposed up to now (mainly) in the EU member states.

Please note, however, that this overview is not intended as a complete overview. Our ambition is to include the most high-profile fines, but if you are looking for more information on enforcement in a particular Member State or sector, please contact us.