GDPR infringements: Fine-tuning the new data protection rules

26 October 2018   |   By Paul Nemitz

GDPR infringements
Fine-tuning the new data protection rules

With the enactment of the EU General Data Protection Regulation (GDPR) last May, data protection does not only move from a directive to a regulation but also from low (or no) fines to high fines.

Imposing fines will often have a higher disciplinary function than other remedies. Fines serve to discourage further infringements. Article 83 of the GDPR serves both special and general prevention purposes since high fines for misconduct are attracting widespread attention, especially in the case of controllers or processors known in the market and to the general public. They ensure that efforts of compliance are undertaken in addition to pure profitability investments and a fortiori that the economic advantage that controllers or processors derive from infringements of the regulation, if any, do not remain with them.

The fines, if high enough, will provide an incentive to act lawfully and to respect the rights of data subjects in the processing of their personal data. The GDPR thus ensures that the market continues to serve the interests of individuals and the general public.

Private data is not a commodity

The market regards any data more and more as a tradable standardised commodity. Catch phrases like “Data is the new oil” or “Data is the currency of the future” can often be heard. However, personal data cannot legally be treated and traded in Europe like commodities such as oil, or currencies.

Whether Article 83 of the GDPR can fulfil its function in practice largely depends on its implementation by the respective national Data Protection Authorities (DPAs), which will have to impose the fines.

Competition law as the model

Both data protection and competition law fall within the category of special economic administrative law. In these fields of law, infringements are often a matter of cost reducing intention or negligence, motivated by the pursuit of profit. There are costs related to compliance and in some cases high financial incentives for both competition and data protection breaches. The experience in competition law also shows that public enforcement is the main driving force for compliance. Private enforcement and actions for damages, even where special legislation for that purpose exists, play a smaller role. In many cases, considerations similar to those in competition law will be applied.

That became apparent recently when the European Commission imposed a fine of €110m on Facebook. This case is important as it demonstrates the risk – one might call it the temptation – to lie when it comes to describing facts pertaining to the processing of personal data to the regulator. This is usually done in the hope that the regulator will not master the technical complexities involved.

DPAs are expected to increase fines at the slightest sign of negligent or intentionally misleading statements made to them as at the core of the duty to cooperate with DPAs (Articles 31 and 39 of the GDPR) is the duty to state the truth.

Guiding principles underlying decisions

According to Article 83, the decision of the supervisory authorities to impose fines must be guided by the principles of effectiveness, proportionality and the objective of dissuasion.

According to the case law of the European Court of Justice in the field of competition law, supervisory authorities have no unlimited discretion when it comes to the imposition of fines. The general principles of EU law require that fines are motivated and justified on the basis of the method of calculation used, and this in such a way as to allow the addressee to comply and, if necessary, seek judicial remedy.

Article 83 obliges supervisory authorities in each individual case to fully investigate the matter. In particular, supervisors can oblige companies to provide all the information they need to carry out their duties.

The economic situation of the controller or data processor is irrelevant to the amount of the fine, as long as the fine is not imposed on a natural person. This is based on the consideration that otherwise a controller or processor in economic difficulties might gain illegal and unjustified competitive advantages from illegal behaviour.

However, in all cases the amount of the fine must be based on the principle of proportionality. The number of data subjects concerned may be an important indicator of systemic errors and a lack of proper data protection routines. The fine does not depend on proof of a causal link between the infringement and the damage, but the amount of the damage and the duration of the infringement are criteria to be taken into account.

Who is at fault matters

Article 82 makes it possible to take account of the degree of fault on the part of the data controller or processor. In that regard, the question arises as to which fault of which person should be assigned to a legal person. To require an organ fault, i.e. of the Board or the CEO, is not necessary according to the wording of the regulation. Deliberate or negligent conduct of a manager, a person responsible for processing or even the person entrusted with the specific processing operation, will also have to be taken into account, depending on the circumstances of the specific case.

The allegation against the controller or processor becomes all the more serious (and thus the fine higher) the more signs of organizational negligence can be found, and the more this degree of fault can be attributed to organs of the company, or to senior managers rather than merely to the possibly unforeseeable or unavoidable misconduct of a lower-ranking individual.

Intent or negligence?

The instruction of an organ for unlawful processing is regularly regarded as intent under the GDPR Guidelines. Given the principle that a businessman must know the law and thus take measures to ensure compliance of his company. Given the now numerous actions for awareness-raising and offers to ensure compliance with the GDPR in the markets, it is hard to imagine a constellation with repeated infringements of the GDPR without at least negligence being present.

If data controllers or processors have doubts about the legality of processing, they need to remove these doubts – or stop processing until the doubts are removed. Not taking any action in such a situation constitutes deliberate acceptance of potentially breaking the GDPR and thus certainly gross negligence, if not intent. A scarcity of funds in the implementation of the rules cannot excuse non-compliance.

Negligence shall be considered under the Guidelines if existing data protection policies of the company have not been read or followed or no data protection rules have been adopted by the company in the first place.

Stopping infringements and repairing the damage

Article 83 of the GDPR sets an incentive for controllers and processors to stop infringements committed as soon as possible, immediately reverse practice and make up for damages. A controller or processor must also strive to make up for impairments of non-financial nature in order to benefit. Although not explicitly mentioned by the wording, the supervisory authority will conversely have to take into account that no efforts were made to make amends. The timely and intensive efforts of the controller for “repairs” should, according to the Guidelines, play a role in the determination of the fine, as well as the fact that other involved persons or processors were informed and thus further damage was prevented.

The exemplary financial benefit of a violation will have to correspond to a mathematical value, which in turn must be related to a specific personal date. As an example of a possible way to calculate the value of a record about a person, for example, in a social network, the company value is divided by the number of members of that network. The GDPR Guidelines make it clear that profits from violations in any case give rise to a fine.

If a controller has committed a number of different infringements in the same processing operation or, in the case of ‘linked processing operations’, to several provisions of the GDPR, the total amount of the fine is limited to the amount for the most serious infringement. The purpose of this rule is also to clarify that the quantitatively increased disregard for the provisions of the GDPR is particularly in need of sanction. In practical terms, this means that the fine will be increased.

High fines necessary to enforce better compliance

The European legislator has expressed a clear will that the rules of the GDPR are fully and coherently applied across Europe. DPAs are entrusted with the duty to ensure this and have obtained substantial new powers for this purpose, comparable to those of competition authorities. The experience in competition law shows that high fines are necessary to better compliance, as only they can bring about a deterrent against non-compliance.

Paul Nemitz currently serves as Principal Advisor to the Directorate-General Justice and Consumer Affairs of the European Commission. As the long-time Director for Fundamental Rights, he is one of the architects of the GDPR.  A longer print version of this article was published Hart Publishing as part of the CPDP 2017 Conference Book.

Comment or question? Don’t hesitate to contact:  feedback@inhouse-legal.eu

© iStock:guvendemir/erhui1979