DPA Corrective Measures: It's Not All About The Fine

Last November I moderated a panel at the Privacy + Security Academy Forum on the implications of non-financial sanctions being issued by data protection authorities under the GDPR.

The panel, which included Cian O'Brien, of the Irish DPC, led to a fascinating discussion. The one issue that drew most attention and input from the panellists and audience alike was how organisations should consider the impact of potential corrective measures being issued at the conclusion of an inquiry and the impact it would have on their business model and/or operations.

So when I read the Irish DPC's press release last week announcing the conclusion of two inquiries into Meta Ireland, unlike many others – who have focused on either the fines issued, which at a total €390 million are certainly material, or on the seeming disagreement between the position taken by the Irish DPC on Meta's position and that taken by ten other EU DPAs and the European Data Protection Board – what