{"id":8294,"date":"2023-05-12T12:38:45","date_gmt":"2023-05-12T12:38:45","guid":{"rendered":"https:\/\/dpoassociates.eu\/this-is-how-fines-are-calculated-under-the-gdpr\/"},"modified":"2025-02-27T14:31:42","modified_gmt":"2025-02-27T13:31:42","slug":"this-is-how-fines-are-calculated-under-the-gdpr","status":"publish","type":"post","link":"https:\/\/dpoassociates.eu\/en\/this-is-how-fines-are-calculated-under-the-gdpr\/","title":{"rendered":"This is how fines are calculated under the GDPR"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In May 2018, the General Data Protection Regulation (AVG) and its Implementing Act for the General Data Protection Regulation (UAVG) went into effect. Since then, the Personal Data Authority (AP) as regulator has been allowed to issue fines. But how are such fines calculated? That’s what this blog is about.<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Power to impose fines<\/h2>

The regulator can fine both public and private organizations. In the case of non-compliance with the AVG, a maximum of twenty million euros or 4% of annual worldwide turnover can be imposed (Article 83 paragraphs 4 and 5 AVG and Articles 17 and 18 UAVG). In 2021, the AP published 11 fines on its website<\/a>. These range from 7,500 euros to 2.75 million euros. In determining the amount of fines, the AP uses rules from its self-created “Personal Data Authority Fine Policy 2019<\/a>. However, agencies that have violated the AVG want more transparency and predictability of fines. That is why there is a new guideline from the European Data Protection Board (EDPB). This should ensure more uniform fines across European Union member states.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"gdpr\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Uncertainty about how AP operates<\/h2>

Research was commissioned by the Scientific Research and Documentation Center (WODC) to examine, among other things, the application and effectiveness of the AP’s administrative fine. The report<\/a> was published in June of this year. The researchers conclude that there is no apparent policy on AP oversight and enforcement. The AP’s actions are inconsistent. Regularly, the dialogue with the alleged violator of the AVG is lacking. In its response to the report, the AP states that a mathematical comparison between different case positions has little meaning. Of course, the specific circumstances of the case must be considered. But the researchers rightly note that some legal certainty is desirable.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Roadmap for calculating fines<\/h2>

On May 12, 2022, the EDPB published guidance<\/a> on calculating administrative fines under the AVG. The recommendations contained herein can be outlined in the five steps below. In any case, the fines imposed must be effective, proportionate and dissuasive (Article 83(1) AVG).<\/p>

Step 1: Identify processing activities and violation(s)<\/strong>
First, the processing activities must be identified. Then it is assessed whether a controller or processor has intentionally or negligently violated multiple requirements of the AVG. Does the latter apply? Then the fine imposed cannot exceed that of the most serious offense. The EDPB further describes in detail the various (im)possibilities in the case of (non)cumulative violations.<\/p>

Step 2: Classify the breach(s)<\/strong>
After identifying the processing activities, the breach must be classified within the framework of the AVG (Article 83(4-6) AVG). The severity of the breach in the specific case must also be determined. Finally, the turnover of the alleged violator must be determined. The severity of each violation takes into account the nature, severity and duration of the offense. Even more specifically, the EDBP states that the following are relevant:<\/p>