Sanctions for non-compliance with the EU General Data Protection Regulation (GDPR) are increasingly being applied across the European Union. The Austrian, German, English, French, Dutch, Danish, Polish and Portuguese data protection authorities have been particularly active since the GDPR came into force on 25 May 2018.
The authorities’ initiatives are not only directed at companies located inside the EU, they also target those outside the EU. For instance, on 24 October 2018 the UK data protection authority (ICO) issued an Enforcement Notice against AIQ, a Canadian data services company. The breaches related to the processing of personal data of individuals in the UK obtained from UK political organisations for the purposes of data analytics, political campaigning and other advertising objectives. The ICO gave AIQ 30 days to comply with its obligations or potentially face a fine of either €20 million or 4% of the company’s global turnover, whichever is higher. This was the first enforcement action under the GDPR against a data controller located outside the EU.
More recently, French data protection watchdog (CNIL) imposed a whopping fine of €50 million on Google, following grouped complaints from the associations None of Your Business (NOYB) and La Quadrature du Net (LQDN). On the basis of its inspections, the CNIL found that Google was infringing various requirements of the GDPR, among other things by providing inadequate information to users and failing to obtain valid consent for personalised advertisements. This is the largest sanction to date for non-compliance with the GDPR. The tech giant has since announced its intention to appeal the CNIL’s decision.
In Belgium, members of the Executive Committee of the national data protection authority (DPA-APD-GBA) have been formally appointed by the Parliament on 27 March 2019. The appointment of the other members of the DPA - which will make the country’s national authority fully operational - is expected to take place in April 2019 (for more information about the Belgian DPA, see our previous news item). The DPA announced that it already initiated its first inspections.
Also interesting to note, is the European Commission’s infographic on GDPR enforcement as well as the European Data Protection Board’s first overview of the GDPR’s implementation. The overview provides interesting key statistics and confirms that supervisory authorities from 11 EEA countries have already imposed administrative fines under the GDPR for a total amount of €55.955.871.
Please contact Karel Janssens for further information or general legal advice relating to privacy and data protection.