GDPR · Domain 5
Enforcement & Penalties
About 10% of the exam
The two fine tiers
- Lower ceiling
- ten million euros or two percent
- Lower tier covers
- design, security, records, breaches, officer
- Upper ceiling
- twenty million euros or four percent
- Upper tier covers
- principles, bases, rights, transfers, orders
- Whichever is higher
- the percentage often beats the cap
- Turnover measured on
- the whole undertaking, parent included
Article 83(3) caps several infringements in one processing operation at the amount for the gravest of them, so violations do not simply stack
Supervisory authority powers
Investigative
- Order information and carry out audits
- Access premises and processing equipment
- Notify a controller of alleged infringement
- Obtain access to all personal data
Corrective
- Warnings before processing would infringe
- Reprimands after it already has
- Order compliance with a request
- Ban processing or suspend transfers
- Impose an administrative fine
Fining factors, Article 83(2)
- Nature, gravity and duration involved
- Intentional conduct or mere negligence
- Steps taken to reduce damage
- Measures already in place beforehand
- Previous infringements by the same body
- Cooperation with the authority
- Whether the breach was self reported
One stop shop
- Applies to cross border processing
- Lead authority at the main establishment
- Central administration usually sets that place
- Concerned authorities keep a say
- Complaints can start locally anywhere
- Purely local cases stay local
Consistency mechanism
- Board opinions on cross border drafts
- Binding decisions when authorities disagree
- Article 65 resolves the dispute
- Article 66 allows urgent provisional measures
- Provisional measures last three months
- Mutual assistance answered within a month
Remedies for people
- Complain to an authority, Article 77
- Challenge an authority that never acts
- Sue the controller or processor directly
- Claim material and non material damage
- Mandate a not for profit body
- Choose home courts or the establishment
How a case unfolds
- Complaint or own initiative inquiry
- Lead authority identified
- Investigation and information requests
- Draft decision circulated to peers
- Objections or a binding board decision
- Corrective measures and any fine
- Appeal to the national courts
- Reprimands are common for first offenses
- Bans often hurt more than fines
- Decisions are published and quoted widely
- Appeals go to the authority's own state
Compensation and liability
- Article 82
- compensation for damage suffered
- Material damage
- financial loss you can count
- Non material damage
- distress, anxiety, loss of control
- Controller liability
- for the processing it decided
- Processor liability
- own duties or instructions ignored
- Joint and several
- each may pay the full amount
- Contribution
- recover the other party's share
- Exemption
- prove no responsibility for the damage
Enforcement themes
- Cookie banners and dark patterns
- Transfers to the United States
- Legal basis for behavioral advertising
- Transparency and vague privacy notices
- Children on social platforms
- Security failures behind large breaches
Reducing your exposure
- Self report and cooperate early
- Show a working accountability program
- Fix the root cause quickly
- Offer redress to affected people
- Keep board level oversight evidence
Who does what
- Supervisory authority
- monitors and enforces in its state
- Lead authority
- runs cross border cases
- Concerned authority
- affected, and may raise objections
- European Board
- guidelines and binding dispute decisions
- Independence
- no instructions from anyone
Rapid recall: enforcement articles
- Article 51
- supervisory authorities established
- Article 56
- the lead authority
- Article 58
- investigative and corrective powers
- Article 60
- cooperation between authorities
- Article 65
- binding board decisions
- Article 77
- the right to complain
- Article 82
- the right to compensation
- Article 83
- administrative fines
Reference strip: tiers, powers, one stop shop, remedies, factors
Tiers
- Two percent or ten million
- Four percent or twenty million
- The higher figure applies
Powers
- Warn, reprimand, order, ban
- Fines are one tool
- Audits count as investigative
One stop shop
- Main establishment sets the lead
- Others remain concerned authorities
- The board settles disagreements
Remedies
- Complaint, judicial review, damages
- Material and non material
- Representative bodies may act
Factors
- Gravity, intent and duration
- Cooperation and self reporting help
- Repeat offending costs more
Quick exam traps
- Trap: Every infringement attracts the four percent ceiling
- Trap: Fines stack without limit when several articles are breached
- Trap: The lead authority decides cross border cases entirely alone
- Trap: Only controllers can be fined, never processors
- Trap: Compensation requires proof of financial loss
- Trap: A complaint must be filed where the controller is established
- Trap: Cooperating with an investigation has no effect on the outcome
cybercertprep.com · original revision sheet written from the public body of knowledge