The GDPR came into force in May 2018 and the first fine was delivered in July 2018 for € 400,000.
By May 2019, the first full year of enforcement, the collective DPAs had issued a total of 48 fines amounting to € 51,833,345. Some fines were obvious and did not require in-depth investigations, but for the most part, responsible enforcement requires significant rigour in the process of determining fines in a fair and reasonable manner. Many of the DPAs were still struggling with legal interpretation of the GDPR and how the courts would interpret the regulations. With enforcement powers comes great responsibility and it seems most DPAs sought to be fair but strict in their enforcement activities.
There has been a lot of criticism for the lack of fines under the GDPR but enforcementtracker.com reveals the reality. In the first 3 years of enforcement (May 2018 – May 2021) there have been 669 fines for a total of € 288,253,602.
The increase from July 2020 (332 fines for a total of € 130,696,258) to July 2021 (730 fines for a total of € 1,045,767,202) signals a direction most organizations should pay attention to. The sheer number of fines more than doubled – and that was amidst a global pandemic! As we learn to live with COVID, is it reasonable to expect that kind of increase in the coming year?
More important…
