- EDPB guidelines describe a five-stage, harmonized procedure for calculating GDPR fines with a starting amount, turnover adjustment and final assessment.
- Fines increase disproportionately with company turnover; in the case of groups, the consolidated turnover (antitrust definition of a company) can be used.
- Authorities retain discretionary powers: adjustments, fixed fines for bulk business and consideration of aggravating/mitigating circumstances possible.
On May 12, 2022, the European Data Protection and Privacy Authority (EDSA) adopted the 40-page Draft guidelines for harmonization of the methods used by the national authorities to Calculation of fines adopted (Guidelines 04/2022 on the calculation of administrative fines under the GDPR). Comments will be accepted until June 27, 2022.
General
Fines are to be determined in five steps under the guidelines:
The main part of the guidelines is an explanation of these five steps. What quickly becomes apparent (the examples below for clarification): Fines are highly dependent on company size, and disproportionately so,
- because the maximum fine limit increases with high turnovers
- and the fine framework is also more heavily utilized in the case of high-turnover companies).
In other words: Non-compliance disproportionately affects large companies.
The EDSA additionally mentions that authorities can provide for fixed fines for certain violations – probably intended to facilitate mass business. After all:
It is recommended that the supervisory authority communicates the amounts and circumstances for application beforehand.
Step 1: Subject of the fine assessment
In this step, it must be determined which conduct is to be sanctioned, i.e. determination of the relevant processing activities and determination of the applicability of Art. 83(3) GDPR (competition of multiple violations).
Step 2: Determination of the initial amount
This step involves determining an initial amount that can subsequently be increased or reduced.
The EDSA first proceeds from the Bus frame pursuant to Article 83 (4−6) of the GDPR (EUR 10 million/2% or EUR 20 million/4%).
After that the Severity of the violation to be determined pursuant to Art. 83(2)(a), (b) and (g) GDPR, (inter alia) according to the nature, gravity and duration of the breach, type of data, number of data subjects, extent of damage, fault (intent or negligence – indicative of intent is e.g. a failure to follow the advice of the data protection officer or a breach of own guidelines), etc. The result is an initial categorization of the initial amount, whereby the amount is also to be assessed gradually within these categories according to the severity of the breach:
- Low level of seriousness (“Low level of seriousness”): The starting amount shall not exceed 10% of the fine limit.
- medium severity: 10 – 20%
- high severity: 20 – 100%
Subsequently the Company turnover to be taken into account because, among other things, fines must act as a deterrent – here the EDSA proposes the following modifications:
- Annual turnover ≤ EUR 2 million: 0.2% of the starting amount
- Annual turnover ≤ EUR 10 million: 0.4% of the starting amount
- Annual sales ≤ EUR 50 million: 2% of the starting amount
- Annual turnover EUR 50 – 100 million: 10% of the starting amount
- Annual turnover EUR 100 – 250 million: 20% of the starting amount
- Annual sales ≥ EUR 250 million: 50% of the starting amount
One can apply this logic in a Excel as a rudimentary bus calculator map:
However, regulators are not required to consider turnover in this way:
68. as a general rule, the higher the turnover of the undertaking within its applicable tier, the higher the starting amount is likely to be. The latter holds particularly true for the largest of undertakings, for which the category of starting amounts has the widest range.
69. furthermore, the supervisory authority is under no obligation to apply this adjustment if it is not necessary from the point of view of effectiveness, dissuasiveness and proportionality to adjust the starting amount of the fine.
70 It should be reiterated that these figures are the starting points for further calculation, and not fixed amounts (price tags) for infringements of provisions of the GDPR. The supervisory authority has the discretion to utilize the full fining range from any minimum fine until the legal maximum, ensuring that the fine is tailored to the circumstances of the case, as the Court of Justice requires in case an abstract starting point is used.
Examples for illustration (by us):
- Violation of the Data security / serious infringement / annual turnover EUR 50 million → → serious infringement / annual turnover EUR 50 million → serious infringement Initial amount = EUR 120,000
- EUR 10 million/2% of annual turnover (Art. 83(6) GDPR), here EUR 10 million (as higher than 2% of EUR 50 million);
- high severity: 20 – 100% of EUR 20 million, i.e. at 60% = EUR 6 million.
- Turnover: EUR 50 million, therefore 2% of the starting amount
- Violation of the Duty to inform / moderately serious infringement / annual turnover EUR 130 million → → annual turnover EUR 130 million → annual turnover EUR 130 million. Initial amount = EUR 600,000
- EUR 20 million/4% of annual turnover (Art. 83(5) GDPR), here EUR 20 million (as higher than 4% of EUR 130);
- medium severity: 10 – 20% of EUR 20 million, i.e. at 15% = EUR 3 million.
- Sales: EUR 130m, therefore 20% of the starting amount
- Duty to use a Report security breach / minor infringement / annual turnover EUR 1.5 billion. → Initial amount = EUR 750,000:
- EUR 10 million/2% of annual turnover (Art. 83(4) GDPR), here EUR 30 million (2% of 1.5 billion);
- light severity: 0 – 10% of EUR 30 million, i.e. at 5% = EUR 1.5 million.
- Sales: > EUR 250 million, therefore 50% of the starting amount
- Duty, Delete data / serious infringement / annual turnover of EUR 4 billion. → Initial amount = EUR 48 million:
- EUR 20 million/4% (Art. 83(5) GDPR), in this case EUR 160 million (4% of 4 billion).
- high severity: 20 – 100% of EUR 160 million, i.e. at 60% = EUR 96 million.
- Sales: > EUR 250 million, therefore 50% of the starting amount
The disproportionate increase in terms of sales can be illustrated by a moderately serious violation of the obligation to delete:
- Sales of EUR 1 million: EUR 6,000
- Sales of EUR 10 million: EUR 12,000
- Sales of EUR 100 million: EUR 300,000
- Turnover of EUR 1 bn: EUR 3,000,000
- Turnover of EUR 5 bn: EUR 15,000,000
By the way – does the turnover of the company or group concerned apply?
The EDSA unsurprisingly answers this long-discussed question on the basis of the definition of an undertaking under antitrust law:
As for the term “undertaking”, the European legislator provides explicit further clarification. Recital 150 GDPR states: “Where administrative fines are imposed on an undertaking, an undertaking should be understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those purposes.”
Therefore, Article 83(4)-(6) GDPR in light of recital 150 relies on the concept of undertaking in accordance with Articles 101 and 102 TFEU, without prejudice to Article 4(18) GDPR (which gives a definition of an enterprise) and Article 4(19) GDPR (which defines a group of undertakings). The former concept is mainly used in Chapter V GDPR, in the phrase group of enterprises engaged in a joint economic activity. Besides that, the term is applied in a general sense, not as the addressee of a provision or obligation.
120. Accordingly, in cases where the controller or processor is (part of) an undertaking in the sense of Articles 101 and 102 TFEU, the combined turnover of such undertaking as a whole can be used to determine the dynamic upper limit of the fine (see Chapter 6.2.2), and to ensure that the resulting fine is in line with the principles of effectiveness, proportionality and dissuasiveness (Article 83(1) GDPR)47.
The EDSA explains these factors in more detail, particularly the antitrust concept of a single economic unit (SEU).
Step 3: Assessment of aggravating and mitigating circumstances
Under this heading, factors that have an aggravating or mitigating effect must be taken into account. This refers to the previous or current behavior of the company, e.g. damage mitigating measures, previous infringements, cooperation with the authorities, self-disclosure, infringer profit (!), etc. However, the EDSA does not propose a modification of the basic amount in terms of amount here.
Step 4: Maximum amounts
The legal limits (2%/EUR 10 million or 4%/EUR 20 million; whichever is higher) for the relevant processing operations represent a maximum that cannot be exceeded. Actually, this should be step 5, not step 4.
Step 5
In the final step, the authority must assess whether the calculated amount meets the requirements of the Effectiveness, deterrence and proportionality corresponds; if necessary, it will be adjusted.