DLA Piper: 272.5 million euros in fines imposed by European regulators under GDPR
272.5 million euros (about USD332.4 million / GBP245.3 million) of fines have been imposed for a wide range of infringements of Europe’s tough data protection laws, according to international law firm DLA Piper. The figure is taken from the law firm’s latest annual General Data Protection Regulation (GDPR) fines and data breach report of the 27 European Union Member States plus the UK, Norway, Iceland and Liechtenstein.
Italy’s regulator tops the rankings for aggregate fines having imposed more than 69.3 million euros (about USD84.5 million / GBP62.4 million) since the application of GDPR on 25 May 2018. Germany and France came second and third with aggregate fines of 69.1 million euros and 54.4 million eurso respectively. In aggregate there have been more than 281,000 data breach notifications since the application of GDPR on 25 May 2018 with Germany (77,747), The Netherlands (66,527) and the UK (30,536) topping the table for the number of data breaches notified to regulators. France and Italy, countries with populations over 67 million and 62 million people respectively, only recorded 5389 and 3460 data breach notifications for the same period illustrating the cultural differences in approach to breach notification.
The aggregate daily rate of breach notifications in Europe experienced double digit growth for the second year running with 331 notifications per day since 28 January 2020, an 19% increase compared to 278 breach notifications per day for the previous year. Weighting the results against country populations, Denmark takes pole position this year ahead of The Netherlands with 155.6 and 150 reported breaches per 100,000 people respectively. Ireland is in third place with 127.8 reported breaches per 100,000 people. Greece, Italy and Croatia reported the fewest number of breaches per capita since 28 January 2020. The highest GDPR fine to date remains the 50 million euros (aboutUSD61 million / GBP45 million) imposed by the French data protection regulator on Google, for alleged infringements of the transparency principle and lack of valid consent.
