Fine proceedings under the GDPR
A fine notice is not the end of the road. A challenge takes the matter to court, and the criteria for setting the amount can be influenced before that.
- or 10 million euros for breaches of controller obligations
- 2 %
- or 20 million euros for breaches of principles and data subject rights
- 4 %
- criteria are listed in Art. 83(2) GDPR
- 11
- criterion stays open to influence during proceedings, cooperation
- 1
What can still be influenced
Most of the criteria lie in the past. Two do not, namely the measures taken to mitigate the damage and the degree of cooperation with the authority. Both count, and both come into being during the proceedings.
- Start and document remedial measures early, not only when required to
- Frame submissions so that they match your own records
- Inform data subjects where that is called for, and record it
- Examine the basis for calculation, in particular attribution within a group
- Keep the deadlines in view, including the one for challenging the notice
To whom the infringement is attributed
A fine presupposes fault, that is an intentional or negligent infringement. The authority does not, however, have to identify a particular member of management. Under the case law of the Court of Justice of the European Union it is enough that the infringement was committed in the course of the business and by persons acting for the undertaking.
In practice that shifts the defence. The objection that a single employee acted on their own hardly exonerates by itself. What carries weight is the question of organisation: whether there were rules, whether training took place, whether compliance was checked and whether anomalies were acted on. Those same records also decide the amount.
Negligence is already present where the unlawfulness could have been recognised. A documented and defensible legal assessment is therefore more than a formality, because it is the starting point against the allegation of negligence.
How we support you
We accompany you from the hearing onwards, examine the notice on the facts, the classification and the calculation, and conduct the challenge. Alongside that we assess what the proceedings mean for any civil claims running in parallel.
A fine notice received?
The deadline is short. We will look at it at short notice.
Get in touch nowFrequently asked questions
What determines the amount?
Art. 83(2) GDPR sets out the criteria, among them the nature, gravity and duration of the infringement, intent or negligence, measures to mitigate the damage, previous infringements and the degree of cooperation. The ranges differ depending on which provision was breached, Art. 83(4) and (5) GDPR.
Is challenging the notice worthwhile?
That can only be answered against the specific notice. The usual points of attack are the findings of fact, the classification of the infringement, the basis for calculation and attribution within a group. A challenge leads into court proceedings that follow their own rules.
Does fault have to be proved against us?
Yes, a fine presupposes an intentional or negligent infringement. Under the case law of the Court of Justice of the European Union, however, the authority does not have to identify a particular member of management. It is enough that the infringement was committed in the course of the business and by persons acting for the undertaking. Negligence is already present where the unlawfulness could have been recognised.
Do a fine and damages rule each other out?
No, they stand side by side. The fine under Art. 83 GDPR goes to the state, damages under Art. 82 GDPR go to the person affected. A final decision makes civil claims considerably easier, because the infringement is then no longer in dispute. The two therefore have to be looked at together rather than one after the other.
Is the parent company liable too?
The calculation is based on the turnover of the undertaking in the economic sense, which can bring group turnover into play. Whether and how attribution happens is a central point of dispute and is worth examining, because it produces considerable differences in amount.