GDPR Fines Q4 2021

The Fourth quarter of 2021, really confirmed that 2021 is the year of fines. We did an overview of the following period so kindly find information about the fines issue at the end of the year.

GDPR fines in total

In the last quarter of 2021, data protection authorities have steadily continued dishing out fines. These fines across the EEA amounted to 17.2 million euros (93 fines in total).

Fines by Violation Type

#1 The by far leading violation type in terms of fines continues to be the insufficient legal basis for data processing amounting to 12.4 million euros.

#2 Non-compliance with general data processing principles (2.1 million euros)

#3 Insufficient technical and organisational measures to ensure information security (1.7 million euros).

Most active data protection authorities

The Norwegian authorities have stepped up their fines game and are leading the fines ranking in terms of the fine sum total (6.8 million euros). This is due to the 6.3 million euros fine imposed on the dating app Grindr for the unlawful sharing of personal data with third parties for marketing purposes.

In second place we see the Spanish authorities with issued fines amounting to 3.4 million euros. Again, this number is heavily influenced by a single fine – namely, a 3 million euros fine against Caixabank based on insufficient legal basis for data processing.

And in third place we have the Netherlands with fines issued amounting to 3.15 million euros. The Dutch authorities issued two prominent fines: 2.75 million euros against the Ministry of Finance (insufficient legal basis for data processing) and 400 000 euros against the airline Transavia (insufficient technical and organisational measures to ensure information security).

We suggest every company to be careful and really to follow the GDPR and other relevant Data Protection legislation in order to avoid this fines, and to make their life easier.