Administrative fine

An administrative fine is a financial penalty imposed by a public authority to sanction infringements of statutory provisions. In data protection law, the competent supervisory authorities may impose administrative fines under Article 83 GDPR if controllers or processors breach certain data protection obligations. These sanctions must be effective, proportionate and dissuasive.

When can an administrative fine be imposed for a data protection infringement?

A data protection administrative fine may be imposed where a provision of the GDPR that carries an administrative fine has been infringed.

Various types of breaches of obligations may be relevant.

Typical examples include:

• Unlawful data processing: Personal data is processed without an appropriate legal basis.
• Infringement of data subjects’ rights: An organisation fails to comply with its statutory obligations to provide access to or erase personal data.
• Inadequate data security: Required technical and organisational measures to protect personal data are not implemented.
• Defective processing on behalf of a controller: Statutory requirements governing cooperation with processors are disregarded.
• Unlawful data transfers: Personal data is transferred to a third country in breach of the applicable legal requirements.
• Breach of notification obligations: A personal data breach that must be notified is not duly reported to the competent supervisory authority.

Not every data protection infringement automatically results in an administrative fine.

The competent supervisory authority examines the circumstances of each individual case and decides which remedial measure is appropriate.

In addition to, or instead of, an administrative fine, other measures may be considered, such as warnings, orders requiring compliance with the law or restrictions on data processing.

How high can administrative fines under the GDPR be?

Article 83 GDPR essentially distinguishes between two main administrative fine limits.

1. Administrative fines of up to €10 million or 2% of worldwide annual turnover

Under Article 83(4) GDPR, certain infringements may be sanctioned with administrative fines of up to €10 million.

For undertakings, a fine of up to 2% of their total worldwide annual turnover for the preceding financial year may apply instead, if that amount is higher.

These infringements include, for example, breaches of certain obligations relating to processing on behalf of a controller, data security or the appointment of a data protection officer.

2. Administrative fines of up to €20 million or 4% of worldwide annual turnover

For certain more serious infringements, Article 83(5) GDPR provides for a higher administrative fine limit.

This amounts to up to €20 million or, in the case of undertakings, up to 4% of their total worldwide annual turnover for the preceding financial year, whichever amount is higher.

These infringements include, in particular, violations of:

• The basic principles of data protection under Article 5 GDPR
• The requirements governing the lawfulness of processing
• The rights of data subjects
• The provisions governing international data transfers

The amounts specified are statutory maximum limits and do not constitute fixed administrative fines.

The administrative fine actually imposed may be considerably lower and depends on the circumstances of the individual infringement.

What criteria determine the amount of a data protection administrative fine?

The amount of an administrative fine is not determined solely by the organisation concerned or the provision that has been infringed.

Article 83(2) GDPR sets out various criteria that must be taken into account when deciding whether to impose an administrative fine and determining its amount.

These include, in particular:

• The nature and seriousness of the infringement
• The duration of the infringement
• The number of data subjects affected
• Whether the infringement was intentional or negligent
• Remedial measures taken
• Cooperation with the supervisory authority
• Previous infringements

The categories of personal data affected and other circumstances provided for by law may also play a role in determining the amount.

The supervisory authority must ensure that the administrative fine is effective, proportionate and dissuasive in the individual case.

An organisation’s turnover may also be relevant when determining the amount. However, high turnover does not automatically result in the statutory maximum fine being imposed.

Who imposes data protection administrative fines and how does the procedure work?

Data protection administrative fines are imposed by the competent data protection supervisory authorities.

In Germany, these include, in particular, the data protection supervisory authorities of the federal states and the Federal Commissioner for Data Protection and Freedom of Information, within the scope of their statutory responsibilities.

Administrative fine proceedings may be initiated, for example, following a complaint, an inspection by the authorities or notification of a personal data breach.

The supervisory authority first examines the facts and investigates whether an infringement of the GDPR that carries an administrative fine has occurred.

In doing so, it may request information and exercise further investigative powers under Article 58 GDPR.

The relevant procedural rights must be observed before an adverse decision is made. These generally include the opportunity to comment on the allegations.

If the authority establishes that an infringement has occurred, it may impose an administrative fine, subject to the applicable statutory requirements.

The persons or organisations concerned may exercise the legal remedies provided for by law against an administrative fine notice. The specific procedure depends on the applicable provisions.

Practical example: Administrative fine for inadequate protection of customer data

A company operates a telephone-based customer service.

When customers call, employees disclose personal customer data. To verify a caller’s identity, they ask only for the customer’s name and date of birth.

No further identity checks are carried out.

This creates a risk that unauthorised persons may obtain information by using another customer’s personal data.

During an inspection, the competent data protection supervisory authority finds that the security measures in place do not meet the requirements of Article 32 GDPR.

As infringements of Article 32 GDPR may be subject to administrative fines under Article 83(4) GDPR, the authority examines whether an administrative fine should be imposed.

In doing so, it takes particular account of the seriousness and duration of the infringement, its potential consequences for the data subjects and the remedial measures taken by the company.

After weighing the relevant circumstances, the supervisory authority imposes an appropriate administrative fine on the company.

legal data assessment: Companies should not wait until a supervisory authority initiates proceedings before taking data protection infringements seriously. The key is to identify data protection obligations at an early stage and implement appropriate protective measures. If weaknesses are identified, they should be assessed in a transparent and traceable manner and remedied promptly. An appropriate data protection management framework can reduce the risk of infringements and the resulting administrative fines.

Legal bases

In particular, Articles 58(2), 83 and 84 GDPR; supplemented by Articles 5, 6, 12–22, 28, 32 and 33 GDPR, as well as the applicable national procedural and administrative fine provisions.