Fines, penalties and sanctions
The GDPR introduces sanctions and significant administrative fines.
Further effective, proportionate and dissuasive penalties, such as imprisonment, are to be introduced for other infringements.
The supervisory authority may impose a sanction and/or administrative fine. In a case where a minor infringement has occurred and the likely administrative fine would impose a disproportionate burden on a natural person (such as a sole trader), a reprimand may be issued as an alternative.
Article 58 sets out the following sanctions:
- to issue:
- warnings that intended processing operations are likely to infringe the GDPR;
- reprimands where processing operations have infringed the GDPR;
- to order:
- compliance with the data subject's requests to exercise his or her rights;
- processing operations to be brought into compliance in a specified manner and timeframe;
- the communication of a personal data breach to a data subject;
- the suspension of data flows to a recipient in a third country;
- the rectification, restriction or erasure of data and notify recipients of the data of that action;
- to impose a temporary or definitive limitation including a ban on processing
- to withdraw a certification or to order the certification body to withdraw a certification if the requirements for the certification are not or no longer met.
- to impose an administrative fine
Article 84 details the administrative fines.
These are in two tiers:
Up to €20,000,000 or 4% of total annual worldwide turnover of the preceding financial year(in the case of a group) whichever is the higher
For non- compliance with any order made by the supervisory authority or infringements of
- the basic principles including conditions for consent;
- the data subjects’ rights;
- the obligations relating to transfers of personal data to a recipient in a third country or an international organisation.
Up to €10,000,000 or 2% of total annual worldwide turnover of the preceding financial year(in the case of a group) whichever is the higher
For infringements of:
An appeal mechanism will be available against the imposition of sanctions and administrative fines by the supervisory authority.