EDPB's Approach To GDPR Fines

The approach to the General Data Protection Regulation ("GDPR") fines has varied significantly across EU member states. On 16 May 2022, the European Data Protection Board ("EDPB") published draft guidelines on the calculation of administrative fines under the GDPR (the "Guidelines")¹. The Guidelines are intended to harmonise the starting point and methodology for calculating GDPR fines but not the outcome, as fines will depend on all the circumstances of the particular case.

Current Approach

GDPR fines have been trending upwards with a sharp increase in the number of headline-grabbing fines imposed on big tech in 2021 and 2022. Prior to August 2021, Google's 2020 fine of €50 million was the highest fine on record. This is now only the sixth highest recorded fine imposed for GDPR breaches². This is also reflected in the Irish Data Protection Commission's ("DPC") approach to fines, with its three largest fines being imposed in the last 12 months.