GDPR Fines Q4 2021
The Fourth quarter of 2021, really confirmed that 2021 is the year of fines. We did an overview of the following period so kindly find information about the fines issue at the end of the year.
GDPR fines in total
In the last quarter of 2021, data protection authorities have steadily continued dishing out fines. These fines across the EEA amounted to 17.2 million euros (93 fines in total).
Fines by Violation Type
#1 The by far leading violation type in terms of fines continues to be the insufficient legal basis for data processing amounting to 12.4 million euros.
#2 Non-compliance with general data processing principles (2.1 million euros)
#3 Insufficient technical and organisational measures to ensure information security (1.7 million euros).
Most active data protection authorities
The Norwegian authorities have stepped up their fines game and are leading the fines ranking in terms of the fine sum total (6.8 million euros). This is due to the 6.3 million euros fine imposed on the dating app Grindr for the unlawful sharing of personal data with third parties for marketing purposes.
In second place we see the Spanish authorities with issued fines amounting to 3.4 million euros. Again, this number is heavily influenced by a single fine – namely, a 3 million euros fine against Caixabank based on insufficient legal basis for data processing.
And in third place we have the Netherlands with fines issued amounting to 3.15 million euros. The Dutch authorities issued two prominent fines: 2.75 million euros against the Ministry of Finance (insufficient legal basis for data processing) and 400 000 euros against the airline Transavia (insufficient technical and organisational measures to ensure information security).
We suggest every company to be careful and really to follow the GDPR and other relevant Data Protection legislation in order to avoid this fines, and to make their life easier.
Hope you find this useful. If you need an EU Rep, have any GDPR questions, or have received a SAR or Regulator request and need help then please contact us anytime. We are always happy to help...
Zlatko, Adam, Hristina, Marin.
As your Article 27 Representative we will always help if you receive a SAR, RTE, or other data prot
We have said this previously but we are still seeing a huge number of Subject Access Requests [
Summary: The Right to Be Forgotten is one of the fundamental rights defined in GDPR. Also