Penalties, complaints and compensation

Infringements of the law by controllers or processors are punished with administrative penalties imposed by the Commissioner, which must be effective, proportionate and dissuasive (Articles 92 and 93).

The two tiers of fines (Article 94)

• Up to ALL 1 billion or, for a company, up to 2% of total worldwide annual turnover of the preceding year, whichever is higher: for breaches of controller and processor obligations such as documentation, security, breach notification or appointing a data protection officer.
• Up to ALL 2 billion or up to 4% of total worldwide annual turnover, whichever is higher: for breaches of the principles and conditions for consent (Articles 6–9), of data subject rights (Articles 12–20), of the rules on international transfers (Articles 39–42), and for non-compliance with the Commissioner's orders.

How the amount is set (Article 93(2))

• The nature, gravity and duration of the infringement, the number of people affected and the damage caused.
• Whether the infringement was intentional or negligent.
• Action taken to mitigate the damage.
• The technical and organizational measures that were in place.
• Previous similar infringements.
• The degree of cooperation with the Commissioner and whether the organization itself reported the infringement.

Where the same operations infringe several provisions, the total amount does not exceed the amount set for the most serious infringement (Article 93(3)).

Not only fines (Article 83(2))

A penalty may be accompanied or replaced by corrective measures: a warning, a reprimand, an order to comply with a data subject's request, an order to bring processing into compliance within a deadline, a restriction or ban on processing, and suspension of data transfers abroad.

Complaints and compensation

• Any person who claims their data is processed in breach of the law may complain to the Commissioner (Article 86).
• Anyone who has suffered material or non-material damage is entitled to compensation from the controller or processor, under the Civil Code (Article 88).
• The controller or processor may appeal a fining decision to the competent court (Article 95).

How to reduce the risk

The criteria in Article 93 show what the Commissioner weighs: documented measures, a quick response, voluntary notification and cooperation. An organization that can prove the work it has done is in a far better position than one that starts after an inspection.