Search

The GDPR gives data protection authorities (DPAs) the power to impose an administrative fine of up to 4% of a company’s annual turnover or € 20 million if they violate the GDPR, depending on which sum is higher.

The purpose of these fines is to deter similar infringements in the future. Although a noyb study found that they are among the most effective enforcement tools available to authorities, significant fines for GDPR violations are extremely rare. The fines go to the country where the proceedings take place, which almost always the country where the fined company has its headquarters.

Since 2018, the following fines have been imposed on the basis of noyb complaints:

In line with the requirements of Article 4(3) of the Collective Redress Directive (EU) 2020/1828, as well as relevant national implementation laws, we are happy to provide the following information:

We are committed to enhancing freedom, democracy and consumer protection in the digital sphere. Therefore, we use SecureDrop to protect people who make the public aware of unlawful corporate and institutional behavior.