The European Union's (EU) General Data Protection Regulation
(GDPR) celebrated its one year anniversary a few weeks ago. In its
first year, data protection authorities (DPAs) in EU member states
brought forth over 200,000 cases and dished out over
€56,000,000 (equal to over $62 million) in fines; although
nearly 90-percent of that amount was imposed on Google alone!
Studies show that over 89,000 breach notifications were made, more
than 144,000 data subject complaints issued and in excess of 440
cross-border data processing cases initiated in the past year.
The most notable characteristic of GDPR enforcement actions
isn't necessarily the monetary value of fines levied; rather,
it is the diversity of enforcement activity. Some cases involve
more conspicuous violations, such as failure to encrypt and failure
to disclose data collection practices; while others involve less
obvious violations, such as insufficient security programs and
data-subject rights protocols, as
