DATA PROTECTION
EDPB adopts guidelines on calculation of fines.
The European Data Protection Board ('EDPB') announced that it had adopted, in its latest plenary session held on 12 May 2022, Guidelines on the calculation of administrative fines under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') ('the Administrative Fines Guidelines').
In particular, the EDPB noted that the Administrative Fines Guidelines aim to harmonise the methodology that data protection authorities use, including harmonised 'starting points' for the calculation of a fine. In addition, the EDPB highlighted three elements, which include the (1) categorisation of infringements by nature, (2) the seriousness of the infringement, and (3) the turnover of a business.
The guidelines set out a 5-step calculation methodology.
First, DPAs have to establish whether the case at stake concerns one or more instances of sanctionable conduct and if they have led to one or multiple infringements. The purpose is to clarify if all the infringements or only some of them can be fined.
Second, DPAs have to rely on a starting point for the calculation of the fine for which the EDPB provides a harmonised method.
Third, DPAs have to consider aggravating or mitigating factors that can increase or decrease the amount of the fine, for which the EDPB provides a consistent interpretation.
The fourth step is to determine the legal maximums of fines as set out in Art. 83 (4)-(6) GDPR and to ensure that these amounts are not exceeded.
In the fifth and last step, DPAs need to analyse whether the calculated final amount meets the requirements of effectiveness, dissuasiveness and proportionality or whether further adjustments to the amount are necessary.
The guidelines will be submitted for public consultation for a period of 6 weeks (elapsing on June 27th, 2022). Following public consultation, a final version of the guidelines will be adopted, taking into account stakeholder feedback, and will include a reference table with a range of starting points for the calculation of a fine, correlating the seriousness of an infringement with the turnover of an undertaking.
(Source: One Trust DataGuidance - Ownership of the contents: One Trust DataGuidance).
In particular, the EDPB noted that the Administrative Fines Guidelines aim to harmonise the methodology that data protection authorities use, including harmonised 'starting points' for the calculation of a fine. In addition, the EDPB highlighted three elements, which include the (1) categorisation of infringements by nature, (2) the seriousness of the infringement, and (3) the turnover of a business.
The guidelines set out a 5-step calculation methodology.
First, DPAs have to establish whether the case at stake concerns one or more instances of sanctionable conduct and if they have led to one or multiple infringements. The purpose is to clarify if all the infringements or only some of them can be fined.
Second, DPAs have to rely on a starting point for the calculation of the fine for which the EDPB provides a harmonised method.
Third, DPAs have to consider aggravating or mitigating factors that can increase or decrease the amount of the fine, for which the EDPB provides a consistent interpretation.
The fourth step is to determine the legal maximums of fines as set out in Art. 83 (4)-(6) GDPR and to ensure that these amounts are not exceeded.
In the fifth and last step, DPAs need to analyse whether the calculated final amount meets the requirements of effectiveness, dissuasiveness and proportionality or whether further adjustments to the amount are necessary.
The guidelines will be submitted for public consultation for a period of 6 weeks (elapsing on June 27th, 2022). Following public consultation, a final version of the guidelines will be adopted, taking into account stakeholder feedback, and will include a reference table with a range of starting points for the calculation of a fine, correlating the seriousness of an infringement with the turnover of an undertaking.
(Source: One Trust DataGuidance - Ownership of the contents: One Trust DataGuidance).
