# Fines — legal context bundle > Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/fines > Sources are cited per item. Verify against the official texts before relying on them. Administrative fines imposed for GDPR violations ## Overview ## Legal Framework Administrative fines under the GDPR are governed primarily by [Article 83](/laws/gdpr/art-83), which sets out the general conditions for imposition, the criteria for determining amounts, and the maximum ceilings. [Article 84](/laws/gdpr/art-84) complements this by requiring Member States to establish "other penalties" for infringements not subject to administrative fines under Article 83. The European Data Protection Board's mandate under [Article 70](/laws/gdpr/art-70) includes issuing guidelines to encourage consistent application, and the Board has exercised this through its Guidelines 04/2022 on the calculation of administrative fines. Article 83(1) establishes the tripartite standard that anchors every fine decision: > "Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive." > — [GDPR Art. 83(1)](/laws/gdpr/art-83#par-1) Article 83(2) enumerates the criteria supervisory authorities must weigh, including the nature, gravity and duration of the infringement, the intentional or negligent character, mitigating actions, the degree of responsibility, previous infringements, cooperation, the categories of data affected, and how the infringement came to light. The maximum fine ceilings differ by tier: up to €10 million or 2% of worldwide annual turnover under Article 83(4), and up to €20 million or 4% under Article 83(5) for the most serious infringements of basic processing principles and data subject rights. ## Key Developments The CJEU in *UI v Österreichische Post AG* clarified the relationship between fines, other penalties, and civil liability under Article 82. The Court drew a sharp distinction between compensation claims and the punitive regime: > "Articles 83 and 84 of the GDPR, which permit the imposition of administrative fines and other penalties, have essentially a punitive purpose and are not conditional on the existence of individual damage." > — [UI v Österreichische Post AG ¶40](/posts/51483#seg-40) This confirms that supervisory authorities need not demonstrate individual harm to impose fines — the punitive and deterrent function operates independently. In enforcement practice, the Spanish DPA in *Caixabank* referenced the Article 29 Working Party's WP253 guidelines, noting that recital 148 introduces the concept of "minor infringements" which may still fall under Articles 83(4) or 83(5) but, depending on the Article 83(2) criteria, may not warrant a fine at all. The EDPB's Guidelines 9/2022 on breach notification confirm that for failures to notify breaches under Articles 33 and 34, fines can reach the Article 83(4)(a) ceiling of €10 million or 2% of turnover. ## Status of the Debate This topic is actively contested in court. While the CJEU has confirmed the punitive independence of fines from individual damage in *UI v Österreichische Post AG*, the methodology for calculating fine amounts remains a live battleground. National supervisory authorities apply divergent approaches to the Article 83(2) criteria, and the EDPB's Guidelines 04/2022 attempt harmonisation but are not legally binding. Challenges to specific fine amounts are working their way through national courts, with parties disputing whether the correspondence between infringement seriousness and fine amount satisfies the proportionality requirement. A future CJEU reference on the calculation methodology — particularly on how turnover thresholds interact with gravity assessments — would resolve the central open question. ## Practical Guidance - **Document mitigation efforts contemporaneously.** Article 83(2)(c) requires authorities to consider actions taken to mitigate damage; maintaining a record of remedial measures implemented before and during investigation directly reduces fine exposure. - **Prioritise cooperation with the supervisory authority.** Article 83(2)(f) treats cooperation as a mitigating factor — timely, substantive responses to information requests and proactive remediation can meaningfully reduce the imposed amount. - **Implement and evidence Article 25 and 32 measures.** Article 83(2)(d) links the degree of responsibility to technical and organisational measures; demonstrable data protection by design and security documentation shifts the responsibility assessment in your favour. - **Track prior infringements and maintain a clean compliance record.** Article 83(2)(e) allows authorities to consider previous infringements; recurring violations of the same provisions attract escalating penalties. - **Distinguish between fine tiers when assessing risk.** Infringements of basic processing principles under Article 83(5) carry the highest ceiling (€20 million or 4% of turnover), while security and breach-notification failures under Article 83(4) are capped at €10 million or 2% — allocate compliance investment accordingly. ## Legislation (full text of key provisions) ### General conditions for imposing administrative fines on essential and important entities *Source: NIS2, nis2-art-34-en, 2022-12-14 — https://overview.legal/posts/96449* ### General conditions for imposing administrative fines *Source: GDPR, gdpr-art-83-en, 2016-04-27 — https://overview.legal/posts/91378* ### Administrative fines on Union institutions, bodies, offices and agencies *Source: AI Act, aiact-art-100-en, 2024-06-12 — https://overview.legal/posts/93564* ### Recital 168 — enforcement penalties and administrative fines *Source: AI Act, aiact-rec-168-en, 2024-06-12 — https://overview.legal/posts/94018* Compliance with this Regulation should be enforceable by means of the imposition of penalties and other enforcement measures. Member States should take all necessary measures to ensure that the provisions of this Regulation are implemented, including by laying down effective, proportionate and dissuasive penalties for their infringement, and to respect the ne bis in idem principle. In order to strengthen and harmonise administrative penalties for infringement of this Regulation, the upper limits for setting the administrative fines for certain specific infringements should be laid down. When assessing the amount of the fines, Member States should, in each individual case, take into account all relevant circumstances of the specific situation, with due regard in particular to the nature, gravity and duration of the infringement and of its consequences and to the size of the provider, in particular if the provider is an SME, including a start-up. The European Data Protection Supervisor should have the power to impose fines on Union institutions, agencies and bodies falling within the scope of this Regulation. ### Recital 130 — administrative fine calculation rules *Source: NIS2, nis2-rec-130-en, 2022-12-14 — https://overview.legal/posts/96788* Where an administrative fine is imposed on an essential or important entity that is an undertaking, an undertaking should be understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those purposes. Where an administrative fine is imposed on a person that is not an undertaking, the competent authority should take account of the general level of income in the Member State as well as the economic situation of the person when considering the appropriate amount of the fine. It should be for the Member States to determine whether and to what extent public authorities should be subject to administrative fines. Imposing an administrative fine does not affect the application of other powers of the competent authorities or of other penalties laid down in the national rules transposing this Directive. ### Recital 129 — competent authority power administrative fines *Source: NIS2, nis2-rec-129-en, 2022-12-14 — https://overview.legal/posts/96786* In order to ensure effective enforcement of the obligations laid down in this Directive, each competent authority should have the power to impose or request the imposition of administrative fines. ### Recital 148 — Penalties including administrative fines *Source: GDPR, gdpr-rec-148-en, 2016-04-27 — https://overview.legal/posts/91811* In order to strengthen the enforcement of the rules of this Regulation, penalties including administrative fines should be imposed for any infringement of this Regulation, in addition to, or instead of appropriate measures imposed by the supervisory authority pursuant to this Regulation. In a case of a minor infringement or if the fine likely to be imposed would constitute a disproportionate burden to a natural person, a reprimand may be issued instead of a fine. Due regard should however be given to the nature, gravity and duration of the infringement, the intentional character of the infringement, actions taken to mitigate the damage suffered, degree of responsibility or any relevant previous infringements, the manner in which the infringement became known to the supervisory authority, compliance with measures ordered against the controller or processor, adherence to a code of conduct and any other aggravating or mitigating factor. The imposition of penalties including administrative fines should be subject to appropriate procedural safeguards in accordance with the general principles of Union law and the Charter, including effective judicial protection and due process. ### Recital 150 — administrative fines for regulation infringements *Source: GDPR, gdpr-rec-150-en, 2016-04-27 — https://overview.legal/posts/91815* In order to strengthen and harmonise administrative penalties for infringements of this Regulation, each supervisory authority should have the power to impose administrative fines. This Regulation should indicate infringements and the upper limit and criteria for setting the related administrative fines, which should be determined by the competent supervisory authority in each individual case, taking into account all relevant circumstances of the specific situation, with due regard in particular to the nature, gravity and duration of the infringement and of its consequences and the measures taken to ensure compliance with the obligations under this Regulation and to prevent or mitigate the consequences of the infringement. Where administrative fines are imposed on an undertaking, an undertaking should be understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those purposes. Where administrative fines are imposed on persons that are not an undertaking, the supervisory authority should take account of the general level of income in the Member State as well as the economic situation of the person in considering the appropriate amount of the fine. The consistency mechanism may also be used to promote a consistent application of administrative fines. It should be for the Member States to determine whether and to which extent public authorities should be subject to administrative fines. Imposing an administrative fine or giving a warning does not affect the application of other powers of the supervisory authorities or of other penalties under this Regulation. ### Recital 151 — Denmark and Estonia fine implementation *Source: GDPR, gdpr-rec-151-en, 2016-04-27 — https://overview.legal/posts/91817* The legal systems of Denmark and Estonia do not allow for administrative fines as set out in this Regulation. The rules on administrative fines may be applied in such a manner that in Denmark the fine is imposed by competent national courts as a criminal penalty and in Estonia the fine is imposed by the supervisory authority in the framework of a misdemeanour procedure, provided that such an application of the rules in those Member States has an equivalent effect to administrative fines imposed by supervisory authorities. Therefore the competent national courts should take into account the recommendation by the supervisory authority initiating the fine. In any event, the fines imposed should be effective, proportionate and dissuasive. ### Recital 127 — minimum enforcement powers and proportionate penalties *Source: NIS2, nis2-rec-127-en, 2022-12-14 — https://overview.legal/posts/96782* In order to make enforcement effective, a minimum list of enforcement powers that can be exercised for breach of the cybersecurity risk-management measures and reporting obligations provided for in this Directive should be laid down, setting up a clear and consistent framework for such enforcement across the Union. Due regard should be given to the nature, gravity and duration of the infringement of this Directive, the material or non-material damage caused, whether the infringement was intentional or negligent, actions taken to prevent or mitigate the material or non-material damage, the degree of responsibility or any relevant previous infringements, the degree of cooperation with the competent authority and any other aggravating or mitigating factor. The enforcement measures, including administrative fines, should be proportionate and their imposition should be subject to appropriate procedural safeguards in accordance with the general principles of Union law and the Charter of Fundamental Rights of the European Union (the ‘Charter’), including the right to an effective remedy and to a fair trial, the presumption of innocence and the rights of the defence. ## Case law ### Deutsche Wohnen SE v Staatsanwaltschaft Berlin *Source: CJEU, C-807/21, 2023-12-05 — https://overview.legal/posts/51487 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0807* Fines can be imposed directly on legal persons without identifying responsible natural person. ### Criminal proceedings against ILVA A/S *Source: Court of Justice of the European Union, C-383/23, 2025-02-13 — https://overview.legal/posts/132149 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0383* The Court of Justice of the European Union ruled on a preliminary reference from the Danish High Court in criminal proceedings against ILVA A/S, addressing whether the GDPR concept of "undertaking" under Article 83 permits calculating administrative fines based on the total worldwide annual turnover of a corporate group when a subsidiary commits the infringement. The Court held that "undertaking" must be interpreted consistently with EU competition law, meaning a subsidiary and its parent company may constitute a single undertaking where the parent exercises decisive influence over the subsidiary, and therefore the fine may be calculated based on the group's total consolidated turnover. No fine amount was specified in this ruling, as the Court's judgment clarifies the legal framework for fine calculation rather than imposing a specific penalty. ### BVwG reduces DPA fine for undisclosed call recording from €25,500 to €22,000 *Source: Federal Administrative Court, 2026-09-03 — https://overview.legal/posts/354162 — original: https://gdprhub.eu/index.php?title=BVwG_-_W256_2337399-1* Facts — A marketing company (controller) that specialises in recruiting personnel for third companies was fined by the DPA for recording telephone interviews with potential customers (data subjects) with €25,500. The records were used for internal training purposes for the controller’s staff. In some occasions, the data subjects were not informed about the recording, in other cases only after the recording has already started. After the DPA’s reprimand, the controller stopped the processing, cooperated with a law firm and a data protection officer to establish and adapt a privacy notice, internal contracts and other documents and guidelines in conformity with the GDPR. The controller employs on average 18-20 people and has an annual turnover of €4,231,213.16 for the year prior the infringement. The controller appealed the DPA’s fine, not the unlawfulness of the processing. Holding — The court partially upheld the DPA’s decision, but reduced the amount of fine to €22,000. As far as the calculation of the fine was concerned, the court added the individual fines for the two violations, but limited the total amount of fine to the specified fine for the graves infringement, in accordance with Article 83(3) GDPR. Since both processing operations were linked to each other, Article 83(3) GDPR applied. Both infringements fell under Article 83(5) GDPR. Therefore, the specified amount of fine for the infringements is €20,000,000 or 4% of the total worldwide annual turnover of the preceding financial year. Since the first sum was higher, the static maximum fine in this case was €20,000,000. The static maximum fine must be adjusted to the individual case at hand: When assessing the amount of fine, Article 83(1) GDPR postulates that the fine must be effective, proportionate and dissuasive. One of the aims of the fine is the specific deterrence of the controller. For this purpose, the amount of fine should be in proportion to the size of the enterprise (in this case 18-20 employees, therefore a small enterprise with a structural adjacency to a micro-enterprise). Its annual turnover can be considered as well. The court held that the infringement at hand was of medium gravity. This is because on the one hand, all data subjects that were interviewed by the controller were affected, several data of each data subject were unlawfully processed and the unlawful processing continued for a period of four months. On the other hand, according to the court, the controller violated the GDPR with negligence not intent, the data processed was not of special importance and the obtained data was merely used for internal training purposes. The court considered, as aggravating factors (Article 83(2)(k) GDPR), that the controller violated the GDPR on two occasions: the unlawful recording of the interviews and failure to comply with the obligation to inform the data subjects pursuant to Article 13 GDPR. From the fact that the specified amount of fine for the infringements was this high, the court concluded a special importance of the protected legal interest. As a mitigating factor (Article 83(2)(k) GDPR), the court took into account that there were no previous GDPR violations by the controller. Moreover, the controller cooperated with the DPA by providing further audio material of interviews. This could be considered a mitigating factor, because with it, the controller exceeded its obligations under Article 31 GDPR and by doing so, did more than what was asked from him under the GDPR anyways. Also, the controller stopped the unlawful processing after the DPA ordered it to do so. The lack of damages suffered by the data subject was not a mitigating factor, contrary to the controllers claim, because the court held that the data subject suffered immaterial damages by loss of control over their data. Neither did the other privacy safety measures that the controller conducted be considered a mitigating factor (technical and organisational measures pursuant to Article 83(4)(a) GDPR) because they did not exceed what was asked from it under the GDPR). ### Cyprus court upholds €5,000 DPA fine on Pancyprian Judo Federation for Article 31 GDPR *Source: ADMINISTRATIVE COURT OF CYPRUS, 2026-05-20 — https://overview.legal/posts/353976 — original: https://gdprhub.eu/index.php?title=ΔΔΚ_-_1421/2022* Facts — On 3 November 2021, a data subject filed a complaint with the Cypriot DPA against an individual who managed a club affiliated with the Pancyprian Judo Federation. The complaint concerned the unauthorised publication of photos and other material, including material depicting the data subject’s minor child, in the context of under-18 Pancyprian judo matches held under the federation’s auspices. It also referred to an earlier lawyer’s letter concerning an alleged personal data breach, which the federation had forwarded to its member clubs. On 13 December 2021, the DPA requested various information from the federation. The federation did not respond. The DPA then sent a reminder on 25 January 2022, but the federation again failed to respond. Subsequently, on 30 March 2022 the DPA issued a prima facie decision finding a breach of Article 31 GDPR due to the federation’s lack of cooperation and invited the federation to submit its position. The federation did not respond to this either. On 11 May 2022, the DPA issued the contested decision, finding that the federation had failed to cooperate with it despite repeated requests. It imposed a €5,000 fine for breach of Article 31 GDPR. The federation appealed against the decision, arguing that it was based on an incorrect application of the GDPR and contained legal and factual errors. Holding — The court noted that, for Article 31 GDPR, Article 58 GDPR and Article 83 GDPR to apply, the federation had to qualify as either a controller or a processor. The court found that the federation did not fall within the definition of processor under Article 4(8) GDPR. It noted that the DPA did not appear to have treated it as such. The court then examined whether the federation could be considered a controller under Article 4(7) GDPR. It held that the contested decision did not clearly explain why the DPA had classified the federation as a controller. The court inferred that the DPA may have reached this conclusion due the fact that the federation had forwarded to its member clubs a lawyer’s letter concerning an alleged personal data breach in the past. However, the court rejected this reasoning. It held that the federation had merely forwarded the letter and had not given any instructions regarding the purposes or means of processing personal data. The DPA had not investigated whether the federation, either alone or jointly with its members, determined the purposes or means of the processing. Nor could such involvement be presumed merely because the federation had registered member clubs. The court concluded that, since the federation did not qualify as either a controller or a processor, Article 31 GDPR, Article 58(2) GDPR and Article 83 GDPR did not apply. It annulled the contested decision and ordered the DPA to pay €2,000 plus VAT in costs to the federation. ### TR v Land Hessen *Source: Court of Justice of the European Union, C-768/21, 2024-09-26 — https://overview.legal/posts/132245 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0768* In Case C-768/21, the Court of Justice of the European Union (First Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning TR's challenge of the Hessischer Beauftragte für Datenschutz und Informationsfreiheit (HBDI) for declining to exercise corrective powers against Sparkasse X following a personal data breach complaint. The Court clarified the limits of supervisory authorities' discretion under GDPR Articles 57(1) and 58(2), holding that while authorities retain discretion in selecting corrective measures, they are legally obliged to exercise those powers when an infringement is established, and complainants have a right to an effective remedy under Article 77 even where no enforcement action was taken. No fine was imposed in this proceeding, as the ruling addressed the supervisory authority's enforcement obligations rather than penalizing a controller. ### Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija *Source: Court of Justice of the European Union, C-683/21, 2023-12-05 — https://overview.legal/posts/132280 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0683* The CJEU Grand Chamber issued a preliminary ruling in Case C-683/21, arising from a dispute between Lithuania's National Public Health Centre (NVSC) and the State Data Protection Inspectorate (VDAI) regarding a fine imposed for GDPR infringements related to a mobile IT application. The Court addressed the interpretation of key GDPR concepts including "processing," "controller," joint control under Article 26, and the conditions for imposing administrative fines under Article 83, particularly the requirement that infringements be intentional or negligent and the liability of controllers for processing carried out by processors. No specific fine amount was addressed in this portion of the judgment, as the ruling provides interpretive guidance to the referring Lithuanian court rather than resolving the underlying penalty. ### GP v juris GmbH *Source: Court of Justice of the European Union, C-741/21, 2024-04-11 — https://overview.legal/posts/132262 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0741* In Case C-741/21, the Court of Justice of the European Union (Third Chamber) addressed a preliminary reference from the Landgericht Saarbrücken in proceedings between data subject GP and juris GmbH concerning GP's claim for compensation under Article 82 GDPR after the company processed his personal data for marketing purposes despite his objections. The Court held that "non-material damage" under Article 82(1) GDPR must be interpreted broadly and is not subject to a seriousness threshold, that a controller may be exempt from liability under Article 82(3) if it proves it was not in any way responsible for the infringement (including where a person acting under its authority under Article 29 was at fault), and that the criteria for administrative fines under Article 83 GDPR do not apply to the assessment of compensation amounts. ### Cypriot court backs DPA fines of €40,000 each on football clubs and €25,000 on processor *Source: Administrative Court of Cyprus, 2026-05-12 — https://overview.legal/posts/353978 — original: https://gdprhub.eu/index.php?title=ΔΔΚ_-_14/2021* Facts — On 26 July 2021, a journalist informed the Cypriot DPA of a security vulnerability on an online platform. This online platform hosted ticket purchase sites of two Cypriot football clubs, OMONIA and APOEL (the controllers). This flaw in the system allowed a user to identify, through a reserved-seat icon, the name and ID number of the fan who had reserved the seat. By using that information, the user could then download the fan card, including the fan’s photograph. The DPA ordered the controllers to submit a personal data breach notification in accordance with Article 33 GDPR. In addition, it asked them to provide information on whether a penetration test had been carried out on the platform and to submit their contracts with the platform provider which acted as the processor of this data. Both controllers submitted the Personal Data Breach Notification Form and the requested documents. The DPA fined each controller €40.000 and the processor €25.000 for the violations of Article 24(1) GDPR, Article 25 GDPR and Article 32(1) GDPR. The controllers and the processor appealed the decision, mainly disputing their responsibility for the required security measures, their respective roles under the GDPR, and the proportionality of the fines. One of the controllers challenged only part of that fine. Holding — The court held that, by submitting the breach notification form, the controllers had accepted both that there had been a personal data breach under Article 33 GDPR and that they acted as controllers for the purposes of the GDPR. The court further held that the platform provider acted as a processor under the relevant contracts and was therefore bound by Articles 28 and 32 GDPR. The court upheld the DPA’s finding that the controllers and the processor had infringed the GDPR. It rejected one of the controllers’ arguments that it had no duty to carry out a penetration test before the platform was launched. The court held that Article 24 GDPR, Article 25 GDPR and Article 32 GDPR impose a continuing obligation on controllers and processors to ensure a level of security appropriate to the risk. Since Article 32 GDPR lists security measures only by way of example, their duties were not limited to the measures expressly mentioned in that provision. The court also held that the processor’s prior internal checks did not change the outcome, as the duty to implement appropriate security measures is ongoing. However, the court annulled the administrative fines, insofar as challenged, because their amount had not been determined in accordance with the principle of proportionality. In particular, the court noted that one controller had been fined €40,000 although the infringement affected 3,652 persons, while the other controller received the same fine despite the fact that only up to 100 persons were affected. By contrast, the processor, which was involved in both infringements, received a lower fine of €25,000. The court held that the DPA had failed to respect the principle of proportionality when imposing the fines, given that the underlying facts were essentially the same and that liability under the GDPR is shared between controllers and processors. ### AT and BT v PS GbR and Others *Source: Court of Justice of the European Union, C-590/22, 2024-06-20 — https://overview.legal/posts/132253 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0590* In Case C-590/22, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Amtsgericht Wesel (Germany) in proceedings between individuals AT and BT and tax consultancy PS GbR, concerning whether the claimants could receive compensation under Article 82(1) GDPR for non-material damage (fear and suffering) after their tax return was disclosed to third parties without consent. The Court held that the concept of non-material damage must be interpreted broadly and that compensation under Article 82 does not require the damage to reach a certain threshold of seriousness, nor can the criteria for administrative fines under Article 83 be applied to compensation claims, though the amount of compensation must correspond to the actual harm suffered. ### CE asks CJEU if GDPR one-stop-shop applies to ePrivacy cookie consent cases *Source: CE, 2022-01-28 — https://overview.legal/posts/122847 — original: https://gdprhub.eu/index.php?title=CE_-_449209* Facts — On 7 December 2020, the French DPA (CNIL) imposed two fines totaling € 100 million on Google LLC and Google Ireland Ltd for violating Article 82 of the French Data Protection Act (which transposes the ePrivacy Directive). Google (1) had not obtained the user’s consent before depositing advertising cookies in the user’s terminal equipment, (2) had lacked to provide information, and (3) had not implemented a mechanism to refuse the cookies. Google did not agree with the CNIL’s decision and brought the issue before court. First, it claimed that, since there is cross-border processing, the Irish DPA (DPC) is the lead supervisory authority since Google’s main establishment in the EU is in Ireland, and the CNIL therefore did not have competence to rule on this matter according to the one-stop-shop mechanism. Second, it found the fine to be disproportionate. Hence, it requested the Council of State to annul the decision, and to refer two preliminary questions to the CJEU, asking: (1) whether the one-stop-shop mechanism provided for in Article 56 GDPR is excluded in the context of cross-border processing that falls within the scope of both the ePrivacy Directive and the GDPR, and (2) whether Article 15a ePrivacy Directive violates the right to data protection because does not provide an obligation, but rather an option, “for the competent national regulatory authorities to adopt measures to ensure effective cross-border cooperation in the enforcement of national laws adopted pursuant to the directive and to create harmonised conditions for the provision of services involving cross-border data flows”. Holding — The Council of State rejected Google’s appeal. First, according to the Council, the ePrivacy Directive, implemented in the French Data Protection Act, does not provide for the application of the one-stop-shop mechanism as mentioned in Article 56 GDPR. Although the requirements for consent are regulated by the GDPR the deposit of cookies is regulated by the ePrivacy Directive. Hence, even if cross-border processing takes place, the CNIL is competent to monitor compliance with the objectives of such Directive. The Council then notes that “it follows that, as regards the control of the operations of access and recording of information in the terminals of users in France of an electronic communications service, even if they are the result of cross-border processing, the measures to monitor the application of the provisions transposing the objectives of Directive 2002/58/EC fall within the competence conferred on the CNIL by the Law of 6 January 1978.” The Council stipulated that there is no need to refer preliminary questions to the CJEU, because it had no doubt as to whether the one-stop-shop mechanism should be excluded in the context of cookies. Second, the Council rejected Google’s argument that their right of defense had been infringed by the CNIL because they did not provide a prior formal notice, since it is not required to provide such a formal notice before imposing a sanction. Third, on the substance of the matter, the Council confirmed the three violations of Article 82 of the Data Protection Act: (1) not obtaining the user’s consent before depositing advertising cookies in the user’s terminal equipment, (2) not providing clear information on the deposit of cookies, and (3) not implementing a mechanism to refuse the cookies. Lastly, the Council stated that the fines were not disproportionate in light of the financial capacities of the “two” companies. It considered Google’s market share of more than 90% with (an estimated) 47 million users in France and the large profits that follow from the targeted online advertisement. Moreover, it stated that Google did not genuinely cooperated with the CNIL since it did not provide advertising revenues, and the breaches were serious. ### A v Patērētāju tiesību aizsardzības centrs *Source: Court of Justice of the European Union, C-507/23, 2024-10-04 — https://overview.legal/posts/132162 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0507* The Court of Justice of the European Union issued a preliminary ruling on a reference from the Latvian Supreme Court in Case C-507/23, involving an individual ("A") and the Patērētāju tiesību aizsardzības centrs (Consumer Rights Protection Centre, Latvia) regarding compensation for non-material damage allegedly suffered from unlawful processing of personal data under Article 82(1) GDPR. The Court addressed whether apologies can constitute compensation for non-material damage and whether the controller's attitude and motivation may be considered in assessing the form and level of compensation. No fine was imposed, as the ruling clarifies interpretive questions of EU law for the referring national court. ### UI v Österreichische Post AG *Source: CJEU, C-300/21, 2023-05-04 — https://overview.legal/posts/51483 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0300* Right to compensation under GDPR Article 82 requires proof of actual damage. ## Guidance ### Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR *Source: EDPB, guidelines-042026-on-the-application-of-the-power-to-impose-administrative-en, 2026-09-17 — https://overview.legal/posts/354309 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-042026-on-the-application-of-the-power-to-impose-administrative_en* Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR Version 1.0 Adopted on 17 September 2026 1 | Adopted Version history Version Date Adoption information version 1.0 17 September 2026 adoption of the guidelines for public consultation 2 | Adopted Executive summary The European Data Protection Board (EDPB) has adopted these guidelines to harmonise the methodology for determining whether an administrative fine… ### Guidelines 04/2022 on the calculation of administrative fines under the GDPR *Source: EDPB, edpb-guidelines-on-the-calculation-of-administrative-fines-under-the-gdpr, 2023-05-24 — https://overview.legal/posts/38068 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-042022-on-the-calculation-of-administrative-fines-under-the-gdpr_en* The European Data Protection Board (EDPB) has adopted these guidelines to harmonise the methodology supervisory authorities use when calculating of the amount of the fine. These Guidelines complement the previously adopted Guidelines on the application and setting of administrative fines for the purpose of the Regulation 2016/679 (WP253), which focus on the circumstances in which to impose a fine. The calculation of the amount of the fine is at the discretion of the supervisory authority, ... ### Response to CCIA Europe concerning EDPB guidelines on calculation of fines *Source: EDPB, response-ccia-europe-concerning-edpb-guidelines-calculation-en, 2025-09-23 — https://overview.legal/posts/51176 — original: https://www.edpb.europa.eu/our-work-tools/our-documents/letters/response-ccia-europe-concerning-edpb-guidelines-calculation_en* Anu Talus Chair of the European Data Protection Board Claudia Canelles Quaroni Privacy and Safety Lead, CCIA Europe Computer & Communications Industry Association (CCIA) Brussels, 17 September 2025 by e - mail only Subject: Response to your letter regarding a call for revision of the EDPB Guidelines on calculation of administrative fines Dear Ms. Canelles Quaroni , Thank you for your letter of 23 April, in which you provide your views regarding the possible effects of the rec ent CJEU judgment… ### EDPB Annual Report 2022 *Source: EDPB, edpb-annual-report-2022-en, 2023-04-17 — https://overview.legal/posts/125861 — original: https://www.edpb.europa.eu/documents/reports-statements-and-letters/edpb-annual-report-2022_en* EDPB Annual Report 2022 1 2022 ANNUAL REPORT STREAMLINING ENFORCEMENT THROUGH COOPERATION An Executive Summary of this report, which provides an overview of key EDPB activities in 2022, is also available. Further details about the EDPB can be found on our website at edpb.europa.eu. 1 GLOSSARY 4 2 FOREWORD 7 3 2022 – HIGHLIGHTS 9 3.1. ENFORCEMENT COOPERATION 9 3.1.1. Vienna statement on enforcement cooperation 10 3.1.2. Guidelines 02/2022 on the application of Art. 60 GDPR 10 3.1.3. Guidelines… ### Guidelines 06/2022 on the practical implementation of amicable settlements *Source: EDPB, edpb-guidelines-on-the-practical-implementation-of-amicable-settlements, 2022-05-12 — https://overview.legal/posts/38072 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-062022-on-the-practical-implementation-of-amicable-settlements_en* The EDPB adopted Guidelines 06/2022 to provide practical guidance on the implementation of amicable settlements between supervisory authorities and controllers or processors under the GDPR. The guidelines address the scope and definition of amicable settlements, the legal basis for this power, and its procedural operation within the one-stop-shop mechanism, including the roles of the complaint-receiving competent supervisory authority and the lead supervisory authority. No fines are imposed as this is a guidance document rather than an enforcement decision. ### Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679 *Source: EDPB, edpb-guidelines-on-relevant-and-reasoned-objection-under-regulation-2016679, 2021-03-09 — https://overview.legal/posts/38061 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-092020-on-relevant-and-reasoned-objection-under-regulation-2016679_en* The European Data Protection Board (EDPB) issued these guidelines to clarify the criteria for a "relevant and reasoned objection" by supervisory authorities within the GDPR's cooperation mechanism under Article 65. The guidelines specify that an objection must be both "relevant" (directed at the substance of the draft decision) and "reasoned" (supported by substantive arguments regarding GDPR compliance or risks to fundamental rights and the free flow of personal data within the Union). No fine amounts are involved, as this document provides interpretive guidance rather than an enforcement decision. ### EDPB LIBE report on the implementation of GDPR *Source: EDPB, edpb-libe-report-on-the-implementation-of-gdpr-en, 2019-02-26 — https://overview.legal/posts/126238 — original: https://www.edpb.europa.eu/documents/reports-statements-and-letters/edpb-libe-report-on-the-implementation-of-gdpr_en* 1 First overview on the implementation of the GDPR and the roles and means of the national supervisory authorities Executive Summary This document sets out an overview of the implementation and enforcement of the General Data Protection Regulation (GDPR) covering both the cooperation mechanism and the consistency findings . In comparison with the EC Directive 95/46/EC , where Supervisory Authorities (SAs) were working separately even on cross - border cases , the GDPR created a duty for the SAs… ### EDPB-EDPS Joint opinion 1/2026 on the Proposal for a Regulation as regards the simplification of the implementation of harmonised rules on artificial intelligence *Source: EDPB, edpb-edps-joint-opinion-12026-proposal-en, 2026-01-21 — https://overview.legal/posts/53738 — original: https://www.edpb.europa.eu/documents/legislative-opinion/edpb-edps-joint-opinion-12026-on-the-proposal-for-a-regulation-as_en* EDPB, EDPB-EDPS Joint opinion 1/2026 on the Proposal for a Regulation as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) ## Enforcement decisions ### UODO fines company PLN 29,112 for failing to comply with Art. 58(2)(c) GDPR order *Source: UODO (Poland), 2026-08-18 — https://overview.legal/posts/593204 — original: https://gdprhub.eu/index.php?title=UODO_(Poland)_-_DKE.561.3.2026* Facts — The DPA issued a decision in the case DKE.560.206.2025 ordering a limited liability company (the controller) to fulfil its information obligations under Articles 14(1) and 14(2) GDPR in June 2025. The DPA sent the controller this decision by letter in June and July 2025. Both times, the letters were returned to the sender. The DPA sent the controller a letter requesting it to provide evidence of compliance with the order set forth in the decision in September 2025. Following a phone call in October, a copy of the decision and a reminder to reply to the previous request were sent to the email address of the controller's CEO. In November 2025, the DPA sent the company a warning stating it would initiate proceedings with the possibility of imposing an administrative fine on the controller. The DPA initiated enforcement proceedings against the controller in March 2026. It requested the company to submit financial statements in May 2026. These letters also remained unanswered. Holding — The DPA issued the controller a fine of PLN 29,112 (€6,700) for a failure to comply with an order issued by the DPA pursuant to Article 58(2)(c) GDPR. The company had not responded to any of the letters addressed to it in the initial complaint proceedings or the subsequent proceedings. In particular, it had failed to provide evidence of compliance with the order to fulfil its information obligations under Articles 14(1) and 14(2) GDPR. When determining the amount of the fine, the DPA took into account that the violation had been of significant gravity – the controller's failure to comply with the DPA order indicated that the data subject remained in a state of uncertainty regarding the ground and scope of the processing of their personal data and could not effectively exercise their rights under the GDPR. The violation had also persisted for nearly a year. On the other hand, the DPA considered it to be a mitigating factor that the violation only concerned one data subject. ### AEPD (Spain) - ps-0035-2025 *Source: AEPD (Spain), 2026-09-08 — https://overview.legal/posts/353747 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_ps-0035-2025* Facts — The controller owned an apartment rented by the data subject, who had lived in the property since late 2021. Following a dispute concerning the tenancy and an alleged outstanding debt, the controller asked the data subject to leave the property. On 1 October 2023, the controller sent an email stating that, unless the data subject vacated the property and returned the keys, it would provide the data subject’s workplace with a report concerning the data subject’s alleged fraudulent and criminal conduct. On 4 October 2023, the controller sent an email to several email addresses at the data subject’s workplace concerning the alleged debt. The email identified the data subject by name and disclosed, among other information, their identification document number, position at work, telephone number, email address and information concerning the alleged debts. The email was read by the data subject’s colleagues. The controller then followed-up, on 6 October 2023, with another email both the company and the data subject stating that it would cease further communications. The data subject lodged a complaint with the DPA. After the complaint was initially declared inadmissible, the data subject lodged an administrative appeal to the DPA. The DPA upheld the appeal and subsequently initiated sanctioning proceedings against the controller. Holding — The DPA held that the controller infringed Article 5(1)(f) GDPR. The DPA considered that (i) the landlord determined the purposes and means of that processing and therefore acted as the controller; (ii) the information disclosed by the controller constituted personal data; (iii) its communication to the data subject’s workplace qualified as processing under the GDPR; and (iv) that colleagues qualified as unauthorised third parties. The DPA then found that the disclosure to the data subject's colleagues of information relating to the data subject’s identity, contact details, employment and alleged debts breached the principles of integrity and confidentiality under Article 5(1)(f) GDPR. Taking into account the circumstances of the case, including the consequences for the data subject and the controller’s subsequent commitment to cease such communications, the DPA imposed a €200 administrative fine. Before the final decision was issued, the controller voluntarily paid the proposed fine and benefited from the 20% reduction available under Spanish Administrative Law (39/2015). The amount payable was therefore reduced to €160. The DPA nevertheless formally declared the infringement and confirmed the €200 sanction before terminating the proceedings following the voluntary payment. ### LATVIA DPA: Insufficient cooperation with supervisory authority *Source: Data State Inspectorate (DSI), 2022-01-01 — https://overview.legal/posts/48016 — original: https://www.enforcementtracker.com/ETid-1901* Five fines for failing to comply with orders issued by the DPA. ### NAIH (Hungary) - NAIH-450-7-2026 *Source: NAIH (Hungary), 2026-05-12 — https://overview.legal/posts/184727 — original: https://gdprhub.eu/index.php?title=NAIH_(Hungary)_-_NAIH-450-7-2026* Facts — The DPA initiated an investigation into the processing of personal data of customers (the data subjects) by the operator of an online store (the controller) in April 2025. The period under review extended from January 2020 to November 2025. During this time, the company had multiple privacy notices in force, as well as other documents that contained relevant information on the processing of personal data. Holding — The DPA found the controller guilty of multiple GDPR violations and issued it a fine of HUF 15,000,000 (€41,500). In addition, it ordered the controller to bring its processing operations in compliance with the GDPR by amending the information system used on its website, in particular the data processing provisions of the general terms and conditions and the data processing notices related to prize contests. First, the DPA held that the controller had violated the principle of transparency laid down in Article 5(1)(a) GDPR: several separate documents contained partially conflicting, irrelevant, and incomplete information regarding the processing of personal data. The information was not organised within a uniform, transparent system. Second, the DPA determined that the controller had failed to provide concise, transparent, and intelligible information regarding the purposes and the legal basis for each processing activity and therefore infringed Article 12(1) GDPR. Finally, the DPA found infringements of Articles 13(1) and 13(2) GDPR – the controller had not provided the data subjects all information necessary when personal data is collected from data subjects. In particular, the controller had failed to adequately distinguish the purposes and the legal bases for each processing operation, recipients of personal data, and retention periods. The controller’s website also contained contradictory information on whether or not personal data was transferred to the United States. ### IDdesign A / S: Non-compliance with general data processing principles *Source: Danish Data Protection Authority (Datatilsynet), 2021-02-12 — https://overview.legal/posts/46137 — original: https://www.enforcementtracker.com/ETid-22* Original summary: On June 3, 2019, the Danish DPA (Datatilsynet) reported IDdesign to the police and demanded payment of a fine in the amount of EUR 200,850 for the processing of personal data of approximately 385,000 customers for a longer period than necessary for the purposes for which they were processed. Additionally, the company had not established and documented deadlines for deletion of personal data in their new CRM system. The deadlines set for the old system were not deleted after the ### NAIH (Hungary) - NAIH-11443-3/2026 *Source: NAIH (Hungary), 2026-07-22 — https://overview.legal/posts/156361 — original: https://gdprhub.eu/index.php?title=NAIH_(Hungary)_-_NAIH-11443-3/2026* Facts — The DPA initiated an investigation into the GDPR compliance of an online store (the controller) processing the data of its customers (the data subjects) in April 2025. The processing activities in question included, inter alia, cookies, registration, billing, shipping, consumer complaint, and processing of orders. The privacy notice of the company operating the online store had been in force unchanged from May 2018 to May 2025, and the period under investigation extended from 1 January 2020 to 27 June 2025. Holding — The DPA held that the controller had violated Articles 12(1), 13(1)(c), (d) and (f), and 13(2)(a) GDPR and issued the controller a fine of HUF 2,000,000 (€5,500). In addition, the DPA ordered the controller to bring its data processing operations into compliance with the GDPR and to amend the content of its privacy notice. First, the DPA found an infringement of Article 12(1) GDPR: the structure of the privacy notice was confusing and difficult to follow. The privacy notice also contained incomplete, incorrect, and unnecessary information as well as repetitive details. Based on this, the DPA concluded that the controller had failed to provide data subjects with information regarding the processing of personal data that was sufficiently concise, transparent, intelligible and easily accessible. Second, the DPA held that the controller had also violated Articles 13(1)(c), (d) and (f) GDPR by failing to specify a legal basis for certain processing operations such as the use of cookies, not specifying its legitimate interests when relying on Article 6(1)(f) GDPR as a legal basis, and not providing detailed information regarding the safeguards ensuring the lawfulness of data transfers to the United States. Finally, the DPA found a violation of Article 13(2)(a) GDPR as the controller had also failed to provide the data subjects information on the period for which the personal data processed would be stored. ### AEPD sanctions Iberdrola Clientes for improper identity verification and unauthorized *Source: AEPD (Spain), 2026-09-16 — https://overview.legal/posts/353975 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_EXP202406239* Facts — Iberdrola Clientes, S.A.U., an electricity retailer of the Iberdrola group (the controller), verified the identity of customers calling its call centres under an internal guide dated 19 March 2023. Under this protocol, a caller passed the identity check (PSI) by providing 4 out of 9 possible categories of data, such as surname, national ID number (DNI), contract reference, address, telephone number, e-mail address, bank account or supply point code (CUPS). According to the controller, on 20 January 2023 the data subject called to request a copy of an invoice and provided an e-mail address, which the controller then linked to the contract as a permanent contact address. The e-mail address belonged to the data subject's daughter. No recording of the call was kept, nor any record of the data requested to verify the caller's identity. On 22 November 2023, the distributor of the group sent an e-mail concerning a request to modify the technical conditions of the data subject's contract to that address. On 17 January 2024, the distributor informed the data subject that the controller had provided the address. The data subject denied ever having given it as a contact address and filed a complaint with the DPA. The DPA initially declared the complaint inadmissible, but admitted it after the data subject successfully appealed that decision internally. On 17 January 2025, the DPA opened sanctioning procedure PS/00459/2024 against the controller for a violation of Article 32 GDPR. On 14 January 2026, the DPA imposed a fine of €1,000,000 under Article 83(4)(a) GDPR and, under Article 58(2)(d) GDPR, ordered the controller to demonstrate within three months the adoption of security measures adequate to the risk, including protocols guaranteeing identity verification. On 16 February 2026, the controller filed an internal appeal (recurso de reposición, file EXP202406239). It argued that (i) the DPA had ignored its submissions to the proposed resolution, causing a violation of its right to be heard and the nullity of the decision; (ii) the DPA had violated the presumption of innocence by imposing the fine without sufficient evidence or reasoning; (iii) the DPA had applied impermissible strict liability, since no intent or negligence had been established; (iv) the fine was disproportionate, in particular compared with a €500,000 fine imposed on a bank in file EXP202500113 for an incident the controller considered more serious; (v) the DPA had not considered mitigating factors; and (vi) the corrective measures had lost effect because, in the controller's view, the final resolution had not included them. Holding — The DPA rejected all grounds of appeal and confirmed the fine of €1,000,000 and the corrective order. First, on the alleged violation of the right to be heard, the DPA held that no submissions to the proposed resolution had ever been received, neither around the date claimed by the controller (14 November 2025) nor under the registry number it cited, and that the controller had not even attached the alleged proof of filing to its appeal. Since the controller had been able to make submissions at every stage of the procedure, no violation of its right of defence had occurred. The DPA also recalled, under Article 118 LPACAP, that facts and documents which a party could have submitted during the hearing phase but did not cannot be taken into account when deciding an appeal. Second, on the presumption of innocence, the DPA held that the sanctioning resolution had established, on the basis of the documents in the file, that the verification protocol did not meet the requirements of Article 32 GDPR. The guide listed nine categories of data but did not specify which four an agent had to request in each case or according to which criteria. The data used were static and, in many cases, easily accessible to third parties, and allowing verification with any 4 of 9 categories widened the combinations an unauthorised third party could know or deduce. The DPA held that this did not amount to multi-factor verification, since the system combined only personal data of the holder without any additional authentication factor such as passwords or one-time codes. It also held that the guide itself allowed agents to update a customer's telephone number or e-mail address when these appeared spontaneously during a conversation, without asking for the customer's confirmation, which could compromise future authentication and the accuracy of the database. Finally, the lack of any record of which data were requested and provided during verification made it impossible to reconstruct the process in case of an incident or audit, contrary to Article 32(1)(b) GDPR and the accountability duty in Article 24 GDPR. Third, on strict liability, the DPA held that the infringement had been committed at least negligently. Citing the CJEU judgment of 5 December 2023, C‑807/21 (Deutsche Wohnen), and Spanish case law, it noted that a controller can be fined under Article 83 GDPR when it could not have been unaware of the infringing nature of its conduct. Although Article 32 GDPR imposes an obligation of means rather than of result, an entity of the controller's size could not be considered to have adopted measures adequate to the risk when its verification, traceability and database update procedures showed clear deficiencies. Fourth, on proportionality, the DPA held that the fine was calculated under the GDPR's own system, which applies as lex specialis over the general rules of administrative law. Starting from a turnover of €11,353,755,000, the maximum fine under Article 83(4) GDPR was €227,075,100. To set the level of seriousness under Article 83(2) GDPR and the EDPB Guidelines 04/2022 on the calculation of administrative fines, the DPA considered that all of the controller's customers were potentially affected (contextualised with the figure of 7,146,778 supply points), that the infringement lasted more than 18 months, and that the data at stake, including DNI and bank account numbers, qualified as sensitive within the meaning of the Guidelines even though they were not special categories under Article 9 GDPR. Negligence was assessed as neutral. As aggravating factors, the DPA applied Article 83(2)(e) GDPR, given a previous infringement in PS/00398/2021, and Article 76(2)(b) LOPDGDD in relation to Article 83(2)(k) GDPR. It rejected the comparison with the €500,000 fine in EXP202500113, since that bank had a turnover more than ten times lower, an infringement lasting less than six months and no prior sanctions. Fifth, the DPA rejected the mitigating factors invoked, holding that circumstances which the law defines as aggravating cannot be applied as mitigating, and that cooperation with the supervisory authority is an obligation under the GDPR rather than a mitigating factor. Sixth, the DPA dismissed the claim that the corrective measures had lost effect, pointing out that both the legal reasoning and the operative part of the sanctioning resolution expressly ordered the controller to demonstrate, within three months, the adoption of technical and organisational security measures adequate to the risk, including identity verification protocols. ### LATVIA DPA: Insufficient cooperation with supervisory authority *Source: Data State Inspectorate (DSI), 2022-01-01 — https://overview.legal/posts/48017 — original: https://www.enforcementtracker.com/ETid-1902* Six fines for failing to provide information requested by the DPA during an investigation. ## Recent developments ### Annual Report 2025 out now! *Source: noyb - European Center for Digital Rights, 2026-10-13 — https://overview.legal/posts/595733 — original: https://noyb.eu/en/annual-report-2025-out-now* noyb remains one of the leading European forces pushing for the fundamental right to data protection for all users. To date, our legal work has resulted in administrative fines totalling €2 billion. In 2025, we not only filed several new GDPR complaints, but also began preparations for our first first collective redress case and dedicated significant resources to the EU Commission's Digital Omnibus package. Read the Annual Report for 2025! Our biggest projects in 2025. In 2025, noyb has started ### Italian DPA fines Wind Tre EUR 16 700 000 for unlawful telemarketing and data protection infringements *Source: European Data Protection Board, 2026-10-12 — https://overview.legal/posts/595686 — original: https://www.edpb.europa.eu/news/italian-dpa-fines-wind-tre-eur-16-700-000-for-unlawful-telemarketing-and-data-protection_en* Background informationDate of final decision: 05/06/2026National caseController: Wind Tre S.p.A.Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 15 (Right to access by the data subject), Article 21 (Right to object), Article 24 (Responsibility of the controller), Article 25 (Data protection by desig ### Italian DPA fines BBVA EUR 5 508 000 for failing to respect a customer’s objection to direct marketing *Source: European Data Protection Board, 2026-10-09 — https://overview.legal/posts/593301 — original: https://www.edpb.europa.eu/news/italian-dpa-fines-bbva-eur-5-508-000-for-failing-to-respect-a-customers-objection-to-direct_en* Background informationDate of final decision: 3 July 2026National caseController: Banco Bilbao Vizcaya Argentaria, S.A., Italian branch (BBVA)Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 21 (Right to object), Article 24 (Responsibility of the controller)Decision: Administrative fine, Compliance orderWebsite topics: Basic principles, ### Italian DPA fines Emirates EUR 180 000 for infringements concerning passengers’ health data *Source: European Data Protection Board, 2026-10-09 — https://overview.legal/posts/593300 — original: https://www.edpb.europa.eu/news/italian-dpa-fines-emirates-eur-180-000-for-infringements-concerning-passengers-health-data_en* Background informationDate of final decision: 14 May 2026National caseController: EmiratesLegal Reference(s): Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) and Article 13 (Information to be provided where personal data are collected from the data subject)Decision: Administrative fine, Compliance orderWebsite topics: Health and research, Basic principlesSummary o ### Hellenic DPA decision on a data breach involving E.E.T.A.A. S.A. as processor for the Ministry of Social Cohesion and Family Affairs *Source: European Data Protection Board, 2026-10-08 — https://overview.legal/posts/593252 — original: https://www.edpb.europa.eu/news/hellenic-dpa-decision-on-a-data-breach-involving-eetaa-sa-as-processor-for-the-ministry-of_en* Background informationDate of final decision: 28/07/2026National caseController: Ministry of Social Cohesion and Family AffairsLegal Reference(s): Article 25 (Data protection by design and by default), Article 28 (Processor), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority) and Article 34 (Communication of a personal data breach to the data subject)Decision: Administrative fine, Compliance order, Summary of the DecisionOrigin o ## Literature ### Unveiling transparency in data protection enforcement across the EU: Assessing the level and quality of disclosure of GDPR fines by data protection authorities *Source: European Law Journal, 2025-10-01 — https://overview.legal/posts/132503 — original: https://doi.org/10.1111/eulj.70008* Abstract Despite the increasing recognition of data protection rights across the European Union (EU), evidence suggests they are often underenforced, thereby undermining the effectiveness of the General Data Protection Regulation (GDPR). This article shows that an often neglected aspect in GDPR enforcement is the variability in transparency exhibited by data protection authorities across EU Member States concerning the disclosure of fines. To bridge this research gap, we gathered data from 23 ou ### Collective Damages for GDPR Breaches: A Feasible solution for the GDPR Enforcement Deficit? *Source: European Data Protection Law Review, 2022-01-01 — https://overview.legal/posts/132504 — original: https://doi.org/10.21552/edpl/2022/4/8* The GDPR should have strong and effective enforcement mechanisms. However, in practice, these mechanisms are lacking, as Data Protection Authorities (DPAs) are underfunded and un-dermanned. Collective claims could be a solution. By pooling resources, individually insignifi-cant damages (scattered damages) can be claimed in an economically sensible way. To facili-tate collective claims, in December 2020 the European Union (EU) adopted a new directive con-taining a union-wide framework for collective claims. This paper explores whether collective claims are a feasible enforcement mechanism for data protection violations given the concept of damages under article 82 GDPR. So, it will be explained what types of damages can be claimed collectively. The current concept of damages under article 82 GDPR is analysed at the EU level, taking into account the principle of autonomy, case law, and literature. This will show the bound-aries within which Member States must operate when awarding damages under the GDPR. The paper explores the Dutch jurisdiction, to illustrate the interchange between EU law and Mem-ber state law. The Dutch jurisdiction is of special interest here, first, because Dutch courts have recently been applying the GDPR to award damages of up to € 2,500 per case. Second, because the Dutch framework for collective damages was renewed in 2020, which contains many simi-larities with the Collective Claim Directive. Currently, several collective GDPR claims have been filed in the Netherlands under the new framework, with a collective worth of several billion eu-ros. A 'perfect storm' is forming due to the combination of stronger collective claims frameworks and a tentative trend to award non-pecuniary GDPR damages on an individual level. GDPR non-compliance can thus lead to multi-billion claims that scale with the number of victims. Such claims can dwarf even the heftiest GDPR fines DPAs can impose. Collective GDPR claims have the potential to become a bright scenario for data subjects and daring legal entrepreneurs, and to result in a daunting future for data controllers and processors, who face scalable liability in a world of scalable business models. However, all hinges on the concept of damages. ### Personal data protection enforcement under GDPR—the Slovak experience *Source: International Data Privacy Law, 2024-06-20 — https://overview.legal/posts/132513 — original: https://doi.org/10.1093/idpl/ipae008* Personal data protection enforcement in the European Union (EU) has evolved significantly since the adoption of Directive 95/46/EC.1 Despite the Directive’s objective to harmonize data protection regulation in the EU, its implementation resulted in differing enforcement practices of its Member States. The Directive called for the adoption of suitable measures to ensure its full implementation but did not specify the framework to be followed in practice. This led to the adoption of different sanction mechanisms throughout the EU. Studies provided by such institutions as the European Union Agency for Fundamental Rights,2 or in academic writing,3 summarized the state of personal data protection in the EU during the Directive’s application and identified its deficits. Papers analysing individual sanctions applicable under this Directive,4 highlighted its toothlessness,5 elucidated deficits regarding the imposition of administrative fines by national authorities,6 and discussed possible solutions considering the potential of competition law to influence the sanctioning of data protection infringements in the future legislation.7 ### GDPR: A new challenge for personal data protection *Source: Bankarstvo, 2017-01-01 — https://overview.legal/posts/132473 — original: https://doi.org/10.5937/bankarstvo1704166m* stručni članak Erne Mraznica Raiffeisen banka ad Beograd erne.mraznica@raiffeisenbank.rs GDPR - NOVI IZAZOV ZAŠTITE PODATAKA O LIČNOSTI Rezime Dana 4. maja 2016. godine objavljena je Opšta Uredba o zaštiti podataka o ličnosti u Sl. glasniku EU, koja će se primenjivati od 25. maja 2018. godine. Cilj propisa je harmonizacija zaštite podataka o ličnosti na nivou EU, veći stepen kontrole za lica čiji se podaci obrađuju i unapređeno upravljanje savremenim rizicima iz ove oblasti. Banke, po prirodi svog poslovanja, spadaju među najveće rukovaoce podataka o ličnosti i u postupku usklađivanja sa obavezama utvrđenih Uredbom biće u prilici da izvrše punu analizu svog postojećeg regulatornog i infrastrukturnog okvira zaštite podataka o ličnosti. Istovremeno, pruža im se prilika da isprave eventualne nedostatke u postojećim procesima, odnosno da značajno povećaju svest organizacije o standardima zaštite podataka o ličnosti, posebno imajući u vidu zaprećene stroge sankcije za slučaj neusklađenosti. Ključne reči : GDPR, podatak o ličnosti, osnovni principi, prava lica, rukovalac, obrada podataka, transfer podataka, sankcije, usklađivanje JEL : F52, G14 doi: 10.5937/bankarstvo1704166M 166 Bankars ### Italy’s Artificial Intelligence Act and Global AI Governance: The EU Model’s Practice and Prospects *Source: Law and Economy, 2026-02-25 — https://overview.legal/posts/132619 — original: https://doi.org/10.63593/le.2788-7049.2026.03.004* The Italian Artificial Intelligence Act, enacted on September 17, 2025, represents the first comprehensive national implementation of the European Union’s AI Act. This study examines the Italian legislation through the theoretical lens of multi-level governance, analyzing its dual function as both a “bridging legislation” that translates EU framework into domestic practice and a site of significant regulatory innovation. Through detailed textual analysis and case studies, particularly in healthc ## Tools ### GDPR Enforcement Tracker (fines and penalties database) *Source: CMS, 2026-07-17 — https://overview.legal/posts/125626 — original: https://www.enforcementtracker.com/* Continuously updated database by CMS of thousands of GDPR fines and penalties across all member states: authority, amount, date, sector, violated articles and a summary per decision, with filtering and statistics. The de-facto reference for fine benchmarking. ## Related topics - **Personal Data** — https://overview.legal/topics/personal-data Information relating to identified or identifiable natural persons - **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities National data protection authorities and their powers - **Controllers** — https://overview.legal/topics/controllers Entities that determine purposes and means of processing - **Supervision** — https://overview.legal/topics/supervision Oversight and enforcement by supervisory authorities - **Processing** — https://overview.legal/topics/processing Any operation performed on personal data - **Processors** — https://overview.legal/topics/processors Entities that process data on behalf of controllers --- Generated by overview.legal · https://overview.legal/topics/fines · 2026-10-13