In 2023, data protection authorities across Europe were active in enforcing GDPR regulations, resulting in significant fines. The EDPB reported a total of €1.97 billion in fines issued across various European countries.

Here’s a summary of key findings from various national DPAs:

Overview from the French DPA 🇫🇷

The CNIL (French data protection authority) increased its enforcement actions, issuing 42 sanctions totalling nearly €90 million. They conducted 340 inspections and processed over 16,000 complaints, resulting in 168 formal notices and 33 reminders of legal obligations. 

Record number of formal notices with 168 decisions

The sanctions covered diverse themes including online advertising, data security, and employee surveillance, targeting both small companies and multinational corporations. A simplified sanction procedure introduced in 2022 also contributed to the rise in enforcement actions.

Overview from the Spanish DPA 🇪🇸

The Spanish Data Protection Agency (AEPD) Annual Report highlights a significant increase in data protection activities. 

Key points include:

• a 43% rise in complaints compared to 2022, totalling 21,590; and 
• notable sanctions against public administrations for non-compliance with data protection measures. 

The report also covers legislative trends, significant enforcement actions, educational initiatives, and advancements in technology and innovation in data protection. 

Overview from the Irish DPA 🇮🇪

The Data Protection Commission (DPC) of Ireland imposed significant fines totalling €1.55 billion, with €1.2 billion being placed on Meta Ireland. TikTok was also fined €345 million for non-compliance with GDPR, specifically related to the processing of children’s data. 

Other substantial penalties included €750,000 for the Bank of Ireland and €460,000 for Centric Health, highlighting the severe consequences of data breaches and non-compliance.

The DPC handled a record number of cases in 2023:

• New cases received: 11,200
• Cases concluded: 11,147
• Formal complaints: 2,600

This high volume of complaints indicates a growing awareness and enforcement of data protection laws, emphasizing the need for businesses to have comprehensive compliance frameworks to manage and respond to data protection issues efficiently.

There was a notable 20% increase in valid breach notifications, totaling 6,991 for the year, with 92% of these concluded by year-end. 

DPC concluded 237 investigations related to unsolicited marketing communications, resulting in fines for several companies.

Overview from the German DPA 🇩🇪

The Bavarian Data Protection Authority (BayLDA) took substantial enforcement actions to uphold data protection laws. Among the notable cases, significant fines were imposed on organizations failing to comply with GDPR. 

This strict enforcement underlines the necessity for businesses to maintain robust compliance frameworks to avoid hefty penalties and ensure data protection compliance.

Likewise, the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) took substantial enforcement actions, reflecting their commitment to upholding data protection laws. The number of data breach notifications reached a new high with 925 reported cases, including 235 hacker attacks. 

This increase underscores the need for businesses to have robust data protection measures and effective breach management systems in place.

Overview from the Italian DPA 🇮🇹

The authority investigated several thousand cases, received over 10,000 complaints, issued 221 compliance orders, and adopted 146 sanctions. 

These fines were mainly for:

1. infringements of data subject rights, 
2. unlawful telemarketing practices; and 
3. data breaches affecting both public and private bodies.

High-Profile Cases

• OpenAI (ChatGPT): The Italian DPA temporarily limited the processing of data belonging to Italian users following a data breach involving ChatGPT. The inquiry addressed several concerns, including the lack of information provided to users, unclear legal basis for data processing, risks from inaccurate data, and the absence of effective age verification mechanisms. In response, OpenAI updated its privacy policy and provided opt-out options for users. However, further efforts were required for age verification, leading to the establishment of an ad-hoc task force by the EDPB to address these issues across the EEA.
• Aggressive Telemarketing Practices: The Italian DPA took significant actions against aggressive telemarketing practices.

These actions highlighted the importance of oversight and complying with data protection laws in telemarketing activities.

Adoption of National Code of Conduct

A national Code of Conduct was adopted to regulate telemarketing and teleselling activities. The Code includes specific commitments such as:

• Obtaining explicit consent for each purpose of data processing.
• Providing clear and precise information to individuals regarding the use of their data.
• Guaranteeing the exercise of privacy rights (right to object, right to rectification).
• Including penalties in contracts between operators and service providers for any sales conducted without proper customer consent.

What Can You Do to Avoid Receiving the Next Big Fine?

2023 saw data protection authorities across Europe demonstrating their commitment to enforcing strict regulations through significant fines, rigorous investigations, and proactive regulatory engagements. 

Businesses are facing increasing scrutiny and complex compliance challenges, highlighting the necessity for robust and adaptive compliance solutions. 

But, why choose iubenda…?

1. Mitigate Risks and Avoid Penalties

With authorities cracking down on businesses it’s clear that non-compliance can have severe financial consequences. Thats why, ensuring you stay ahead of regulatory requirements is crucial to mitigate risks and avoid costly penalties.

2. Efficient Complaint and Breach Management

The rise in data breach notifications and complaints underscores the need for efficient management systems. Being able to quickly detect, manage, and report data breaches ensures compliance with GDPR requirements and safeguards your business.

3. Adapt to Evolving Regulations

Data protection regulations are continually evolving, with new guidelines and codes of conduct being adopted regularly. Staying compliant with the latest regulatory changes through continuous updates and guidance is essential for maintaining a proactive approach to data protection.

4. Comprehensive Coverage

Managing data subject rights, ensuring lawful telemarketing and direct email marketing practices, providing clear information, and obtaining explicit consents are all critical aspects of data protection compliance. Effective tools designed to handle multi-jurisdictional requirements make it easier for businesses operating across different regions.

Take Control of Your Data Compliance Today!

Don’t wait for a data breach or regulatory fine to highlight the gaps in your compliance framework. Our solutions can help you avoid making the same mistakes:

• Provide a privacy and cookie policy. You can create one in minutes with our Privacy and Cookie Policy Generator
• Display a cookie banner and block cookies before consent. It’s easy with our Privacy Controls and Cookie Solution
• Make your forms GDPR compliant. You can prove your newsletter consents with our Consent Database