Following our previous publications regarding the GDPR, we shall now look into the most sensitive GDPR-related topic, namely fines and penalties.
We shall discuss the limits for these administrative fines, the criteria applicable to determining the amount thereof, as well as the specificities in work when determining fine amounts in case of undertakings and how group corporate structures shall be affected by the specificities in question.
The Regulation provides for two limits of administrative fines depending on the type of infringement:
- Infringements of any of the obligations of the controller/processor (stipulated in Article 8, 11, 25-39, 42 and 43 of the GDPR) are subject to administrative fines up to 10 000 000 EUR, or up to 20 % of the total worldwide annual turnover of the preceding year of an undertaking.
- Infringements of the principles of processing inherent in the Regulation, the data subjects’ rights, the transfers of personal data to a recipient in a third country, any obligations pursuant to Member State law and pertinent to special processing situations, as well as non-compliance with an order or a temporary definitive limitation by the supervisory authority are subject to administrative fines up to 20 000 000 EUR, or up to 4 % of the total worldwide annual turnover of the preceding financial year of an undertaking.
The aforementioned amounts are the upper limits of administrative penalties to be imposed. Depending on the specific infringement and the ratio between due care and care actually exercised, the amounts of administrative fines may vary greatly. Different circumstances weigh in when assessing amounts. For instance, in case of infringement of several provisions of the Regulation for the same or linked processing operations, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement. In case of a minor infringement or if the fine likely to be imposed would constitute a disproportionate burden to a natural person, a reprimand may be issued instead of a fine.
This raises the question of the criteria for setting the amounts of fines. The Regulation allows for a number of interpretations, but the Article 29 Working Party considers that assessment must depend on the degree of interference and remedy needed for any wrongful conduct or on whether any such interference or remedy is dissuasive or punitive in nature.
So far as the general rules and conditions for imposing administrative fines are concerned, those are detailed in Article 83 of the Regulation. A key element is the requirement to impose effective and proportionate fines. Such fines may be settled based on a number of circumstances such as:
- The nature and duration of infringement;
- The purpose of the processing concerned as well as data categories affected thereby. Certain special data categories, such as the ones revealing racial or ethnic origin, political opinions and religion are subject to higher protection;
- The circumstances surrounding the infringement, namely if it is of intentional or negligent character;
- The degree of responsibility of the controller/processor when establishing the infringement and upon termination thereof. Notification to the supervisory body and cooperation with the supervisory body in order to mitigate the infringement constitute mitigating factors;
- Any other mitigating or aggravating factors also matter, such as previous infringements, financial benefits from the infringement, etc.
The amounts of fines imposed to undertakings may be significant. It is, therefore, reasonable to specify what is meant by “undertaking” in the Regulation. Here the legislator refers to Articles 101 and 102 of the Treaty on the Functioning of the European Union (TFEU).
Although not explicitly defined therein, the term is given a broader interpretation in the case law of the Court of Justice of the EU, and according to it, for the purposes of Articles 101 and 102, the term “undertaking” is to be understood as an economic unit that may consist of a parent unit and any subsidiaries thereof. Any structures where one company exerts control over another company, whereby both companies are economically and organizationally related, shall constitute one undertaking. Such an interpretation of “undertaking” is likely to result in significant increase in the amounts of fines based on the total worldwide annual turnover of the entire corporate group, not the turnover of the specific business entity to have committed the infringement.
In conclusion, we would like to specify that the amounts of administrative fines discussed above and stipulated in the Regulation, are the upper limits of fines and sanctions that may be imposed in case of graver infringements. The Regulation reads that any case of infringement has to be subjected to extensive evaluation with due consideration of any mitigating or aggravating factors. We would like to reiterate that due to the broad interpretation of the term “undertaking”, the annual turnover of the entire group of companies may be considered when determining the amount of the fine, thus significantly increasing thereof. That is why compliance with the requirements of the Regulation is of paramount importance.
THE TEAM OF DIMITROV, PETROV & CO.
 Articles 9 and 10 of the Regulation provide definitions of these special categories.
 Guidelines of the Article 29 Working Party on the application and setting of administrative fines for the purposes of the Regulation 2016/679.