The EU Regulation on the protection of personal data (GDPR) has introduced two main groups of administrative fines: a first group for less serious violations, and one for more serious violations.
First-tier violations are subject to administrative fines of up to €10 million or, for undertakings, up to 2% of total worldwide annual turnover of the preceding financial year. This category includes, among others, the following cases:
-
Failure to keep the record of processing activities;
-
Failure to appoint a DPO (Data Protection Officer);
-
Failure to carry out a DPIA (Data Protection Impact Assessment);
-
Failure to notify a personal data breach (data breach).
More serious violations, by contrast, carry a fine of up to €20 million, or an administrative fine of up to 4% of the company's total worldwide annual turnover (calculated at group level). This second category includes violations of the general principles of the GDPR, such as:
-
Failure to obtain consent to data processing;
-
Failure to respect data subjects' rights;
-
Absence or inadequacy of the privacy notice;
-
Breach of the provisions on data transfers to third countries.
In addition, the European Union has left Member States room for manoeuvre to decide whether or not to classify certain GDPR violations as criminal offences. Italy, after revising the Privacy Code, introduced with Legislative Decree 101/2018 new criminal offences that further toughen the penalty system for GDPR violations. These include, by way of example:
- Unlawful processing of personal data;
- Fraudulent acquisition of personal data processed on a large scale (from 1 to 4 years' imprisonment);
- False statements to the Italian Data Protection Authority (the Garante) (imprisonment of up to 1 year);
- Failure to comply with the Garante's orders (imprisonment from 3 months to 2 years).
The authority responsible for imposing penalties is the Garante, although, under the Memorandum of Understanding signed in March 2016, it may cooperate with the privacy unit of the Guardia di Finanza.
Examples can nonetheless be drawn from penalties already imposed. In January 2020 the Garante imposed a fine of €11.5 million on Eni Gas e Luce for unlawful processing of personal data in the context of promotional activities and the activation of unsolicited contracts. Similarly, on 1 February 2020 the Garante imposed a fine of €27.8 million on TIM for the indiscriminate use of personal data for marketing activities.
To stay up to date, we recommend frequent and careful consultation of the Garante's website – Decisions section, as well as the GDPR Hub website created by the Austrian activist Max Schrems.