Since its roll out in May 2018, every one of the 28 EU nations, plus the United Kingdom, has issued at least one GDPR fine. 

A GDPR tracking dashboard from Privacy Affairs displays official data from national data protection bodies to monitor the status of GDPR fines.

During the last 3 years, Spain has issued the largest number of GDPR fines by far with 222 fines, followed by Italy - with just 73 fines. 

The largest GDPR fine of €50,000,000 was issued by French authorities in January 2019, against Google Inc.

 

Highest fines issued to private individuals:

  • €20,000 issued to a private person in Spain for unlawful video surveillance of employees.

  • €11,000 issued to a football coach in Austria who was found to be filming female players in the shower.

  • €9,000 issued to a person in Spain for illegal video surveillance of employees.

  • €2,500 issued to an individual in Germany who sent out emails to several persons, where each could see the other recipients’ email addresses.

  • €2,200 issued to a person in Austria for having illegally filmed public areas using a personal CCTV system.

The success of GDPR can be seen in the number of pieces of legislation that are described as “GDPR-style” as well in the adoption of GDPR-standards worldwide by tech giants such as Microsoft. 

But three years on what is next for GDPR? A key question is the extent to which the legislation needs updating in the face of new technology. Axel Voss, a politician who was a driving force behind the GDPR, warned in March that the legislation is now out of date as it hasn’t kept pace with new technology.

“We have to be aware that GDPR is not made for blockchain, facial or voice recognition, text and data mining… artificial intelligence,” said the German MEP.

 

Hear more about GDPR at ‘Divergence in GDPR and the Financial Services Industry at PrivSec Global at 12pm on 24 June.

Topics