Calculate GDPR fine

The EDPB gives the following examples in its guidelines:

High level of seriousness (Example 5a)

After investigating numerous complaints about unsolicited calls from customers of a telephone company, the competent supervisory authority found that the telephone company used contact details of its customers for telemarketing purposes without a valid legal basis (infringement of Article 6 GDPR). In particular, the telephone company had offered the names and registered phone numbers of its customers to third parties for marketing purposes. The telephone company did this despite advice against it from the data protection officer, without undertaking any efforts to curb the practice or to offer customers a way of objecting. In fact, the practice had been going on since May 2018 and was still ongoing at the time of the investigation. The telephone company in question operated nationwide and the practice affected all of its 4 million customers. The supervisory authority found that all of these customers had been regularly subjected to unsolicited calls by third parties, without any effective means to stop them.

The supervisory authority was tasked with assessing the seriousness of this case. As a starting point, the supervisory authority noted that an infringement of Article 6 GDPR is listed among the infringements of Article 83(5) GDPR and therefore falls within the higher tier of Article 83 GDPR. Secondly, the supervisory authority assessed the circumstances of the case. In that regard, the supervisory authority attributed significant weight to the nature of the infringement, as the infringed provision (Article 6 GDPR) underpins the legality of the data processing as a whole. Non-compliance with this provision removes the lawfulness of the processing as a whole. Also, the supervisory authority attributed significant weight to the duration of the infringement, which started at the entry into force of the GDPR and had not ceased at the time of the investigation. The fact that the telephone company operated nationwide increased the weight of the scope of the processing. The number of data subjects involved was considered very high (4 million, offset against a total population of 14 million people), while the level of damage suffered by them was considered moderate (non-material damage, in the form of nuisance). The latter assessment was made taking into account the categories of data affected (name and phone number). The seriousness of the infringement was increased, however, by the fact that the infringement was committed in contrary to an advice from the data protection officer and, thus, considered intentional.

Taking all the above into account (serious nature, long duration, high number of data subjects, nationwide scope, intentional nature, vis-à-vis moderate damage), the supervisory authority concludes that the infringement is considered to be at a high level of seriousness. The supervisory authority will determine the starting amount for further calculation at a point between 20 and 100% of the legal maximum included in Article 83(5) GDPR.

Medium level of seriousness (Example 5b)

A supervisory authority received a personal data breach notification from a hospital. From this notification, it appeared that several staff members had been able to view parts of patients’ health files that – based on their department – should not have been accessible to them. The hospital had been working on procedures to regulate access to patient files, and had implemented strict measures for restricted access. That entailed that staff from one department could only access medical information relevant to that specific department. In addition, the hospital had invested in privacy awareness amongst its staff members. However, as it turned out, there were issues concerning the monitoring of authorisations. Staff members that transferred between departments were still able to gain access to the patient files from their “old” departments and the hospital had no procedures in place to match the current position of the staff member with their authorisation. Internal investigation by the hospital showed that at least 150 staff members (out of the 3500) had inaccurate authorisations, affecting at least 20,000 of the 95,000 patient files. The hospital could show that in at least 16 instances staff members had used their authorisations to view patient files. The supervisory authority considers that there has been a breach of Article 32 GDPR.

In assessing the seriousness of the case, the supervisory authority first noted that an infringement of Article 32 GDPR is listed among the infringements of Article 83(4) GDPR and therefore falls within the lower tier of Article 83 GDPR. Secondly, the supervisory authority assessed the circumstances of the case. In that regard, the supervisory authority considered that even though the number of data subjects affected by the breach was only 16, this could potentially have been 20,000 in the circumstances of the case and even 95,000 given the systemic nature of the issue. Furthermore, the supervisory authority categorised the infringement as negligent, but to a low degree, which was considered a neutral factor in the circumstances of this particular case due to the fact that the hospital failed to adopt authorisation policies where it surely should have done so but had, otherwise, taken steps to implement strict measures to restrict access. This evaluation was not impacted by the fact that other data protection and security policies were implemented successfully, as the GDPR requires. Lastly, the supervisory authority attributed significant weight to the fact that the patient files include health data, which are special categories of data according to Article 9 GDPR.

Taking all the above into account (nature of the processing and special categories of data vis-à-vis the number of data subjects actually and potentially affected), the supervisory authority concludes that the infringement is considered to be at a medium level of seriousness. The supervisory authority will determine the starting amount for further calculation at a point between 10 and 20% of the legal maximum included in Article 83(4) GDPR.

Low level of seriousness) (Example 5c)

A supervisory authority has received numerous complaints about the way in which an online store handles the right of access of its data subjects. According to the complainants, the handling of their access requests has taken between 4 and 6 months, which is outside the timeframe permitted by the GDPR. The supervisory authority investigates the complaints and finds that the online store responds to access requests a maximum of three months too late in 5% of the cases. In total, the store received around 1,000 access requests on an annual basis and confirmed that 950 of these were handled on time. Moreover, the online store had policies in place to safeguard that all access requests were handled correctly and fully. Nevertheless, the supervisory authority concluded that the online store infringed Article 12(3) GDPR and decided to impose a fine.

During the calculation of the amount of the fine to be imposed, the supervisory authority was tasked with assessing the seriousness of this case. As a starting point, the supervisory authority noted that an infringement of Article 12 GDPR is listed among the infringements of Article 83(5) GDPR and therefore falls within the higher tier of Article 83 GDPR. Secondly, the supervisory authority assessed the circumstances of the case. In that regard, the supervisory authority carefully analysed the nature of the infringement. Even though the timely right to access personal data is one of the cornerstones of the data subject rights, the supervisory authority considered that the infringement was of limited seriousness in this respect, given that all requests were handled eventually and with a limited delay. Considering the purpose of the processing, the supervisory authority found that the processing of personal data was not the core activity of the online store, but still an important ancillary in fulfilling its objective of selling goods online. The supervisory authority considered this to increase the seriousness of the infringement. On the other hand, the level of damage suffered by the data subjects was considered minimal, as all access requests were handled within 6 months.

Taking all the above into account (nature of the infringement, purpose of the processing and level of damage), the supervisory authority concludes that the infringement is considered to be at a low level of seriousness. The supervisory authority will determine the starting amount for further calculation at a point between 0 and 10% of the legal maximum included in Article 83(5) GDPR.

The interim fine limits determined so far generally represent the framework within which a fine is likely to fall. According to Art. 83 (2) GDPR, a number of factors must be considered when specifically determining the fine. You can assess these factors to get an impression of where within the fine framework the data protection authority might set the penalty.

At the same time, determining a fine is not a purely mathematical process. The supervisory authority must always ensure that a fine is effective, proportionate, and dissuasive. If necessary in individual cases, it can therefore also impose fines outside the determined limits.