Top 10 EU Privacy Regulation issues – #2 Will fines be really massive?
A major question when it comes to the upcoming EU privacy regulation is about the actual scope of the new applicable massive fines.
What are the new privacy fines?
The EU privacy regulation provides for fines
- Up to € 10 million or 2% of the total worldwide turnover of the previous year in case of breach of obligations relating, among others, to the
- Implementation of a privacy by design and a security by design approach as well as the performance of a data protection risk assessment in case of new technologies such as those of the Internet of Things;
- Recording of data processing activities,
- Data processor’s main obligations,
- Notification in case of data breaches and
- Appointment of a data protection officer (when necessary);
- Up to € 20 million or 4% of the total worldwide turnover of the previous year in case of breach of obligations relating, among others, to the
- Basic principles for data processing, including the conditions for privacy consent,
- Individuals’ rights such as the right of access, the right to be forgotten and the portability right and
- Transfer of personal data outside of the European Economic Area, which will be crucial in the view of the Privacy Shield now agreed as to the transfer of data to the United States.
What are the criteria of their calculation?
The draft EU data protection regulation provides that the applicable fines shall be
- Proportionate and
- Dissuasive (i.e. if a company is large, it is likely to face larger fines than a start up for the same breach).
And such fines shall be issued taking into account, among others,
- The nature, gravity and duration of the infringement taking into account also the number of individuals affected and the damages suffered by them;
- The measures adopted to mitigate the damages suffered by the individuals;
- The implementation of the organizational measures of privacy by design and security by design that consequently become effective tools also aimed at mitigating the amount of fines in case of issued sanctions.
How much money are we talking about?
It is interesting that see that up until now one of the largest fines issued in the European Union for privacy breaches was of € 1 million issued against Google for the data collected through their Street View service. But under the regime established by the EU privacy regulation, it has been calculated that
Google might face a fine up to $ 2.9 billion
Is time for a cultural revolution?
As I mentioned in this video, such large fines will oblige companies not to considered privacy compliance as a “nice to have” anymore. So far data is stored in some cases for many years or for an indefinite period of time, but
data might become a ticking bomb
that might endanger the whole company since their unlawful data processing might trigger huge fines. It is necessary therefore to run an audit of the data currently processed in order to make sure, among others, that data has been collected in compliance with privacy laws, that has been stored for no longer than required by applicable laws and that has not been used for purposes other than those for which consent was obtained.
The EU privacy regulation will enter into force in 2 years, but it will apply also to data that has been already collected NOW or in the past by a company.
Also given such large fines, even directors might face liabilities if they do not adopt any measure necessary to ensure privacy compliance.
You may find also interesting
WRITTEN BY GIULIO CORAGGIO
IT, gaming, privacy and commercial lawyer at the leading law firm DLA Piper. You can contact me via email at firstname.lastname@example.org or email@example.com or via phone at +39 334 688 1147.