GDPR Fines & Penalties So Far

By Laurence Williams | March 18, 2021

ANALYTICS

Fines and Penalties from the General Data Protection Regulation (GDPR) were designed to be effective, proportionate and dissuasive.

Minor infractions Fines up to €10 million or 2% of the total global annual turnover of the prior financial year. Serious infractions Fines up to €20 million or 4% of the total global annual turnover of the prior financial year.

GDPR’s Two-Tiered Fine Structure

Implemented in May 2018, 91 fines worth €55,955,871 were issued that year. Minus the €50 million fine to Google, the average fine faced was about €66,000.

Average Fines for GDPR Violations

Notable Instances of GDPR Enforcement

British Airways $25.85 million UK, 2020

A breach from processing too much data without adequate security compromised 400,000 peoples' data. The fine was reduced from $229 million due to COVID-19’s economic impact and upgrades to IT security in post.

Marriott $23.8 million UK, 2020

A breach exposed 339 million records, affecting 30 million users. Though starting in 2014, the penalty only covers the portion from when GDPR was in effect. The fine was reduced from $123 million due to COVID-19’s economic impact and mitigation efforts from the company.

Google $57 million France, 2018

Google has been the ire of French data regulators. It was fined €50 million for "lack of transparency, inadequate information and lack of valid consent regarding ads personalisation."

Google $121 million France, 2020

This time, France fined Google because when users visited google.fr “seven cookies were placed on their terminal equipment, before any action on their part.” Google is fighting it in court.

Amazon $42 million France, 2020

Amazon was fined for the same cookies violation. French authorities said neither Google or Amazon met “the requirement of prior, clear and complete information for users, nor the requirement to obtain their consent...”

H&M $41.3 million Germany, 2020

H&M was fined for monitoring its employees private lives. Since 2014, members of the staff had been subject to "extensive recording of details about their private lives.”

We’re not lawyers

But we can build a kick-ass website that meets GDPR requirements. We work with your team to build consumer confidence in your brand and meet your business goals. Reach Out