EU Data Protection Advisory Body Issues Guidance On Setting "Effective, Proportionate And Dissuasive" Fines Under The GDPR

The EU's data protection advisory body, the Article 29 Data Protection Working Party (WP29), has adopted Guidelines on the application and setting of administrative fines for the purposes of the General Data Protection Regulation 2016/679/EU. Administrative fines are described in the introduction as central to enforcement and "a powerful part of the enforcement toolbox of the DPAs". The Guidelines are intended for use by data protection authorities (DPAs) to ensure better application and enforcement of the GDPR. They set out principles that DPAs must observe when addressing non-compliance from a controller or processor, as well as assessment criteria they should use when considering both whether a fine should be imposed and if so, the amount. Although not targeted at organisations looking to comply with the GDPR, the Guidelines provide a valuable insight into which areas organisations should focus on in order to mitigate risk arising from any breach of the GDPR.