Privacy & Cybersecurity Law Blog

On September 17, 2019, the German Conference of Data Protection Authorities (Datenschutzkonferenz, (“DSK”) examined a proposal for calculating administrative fines under the EU General Data Protection Regulation (“GDPR”).  The press release of the DSK states that this initiative aims to ensure a calculation of fines against violations of the GDPR that is “systematic, transparent and understandable.” However, the press release refrains from describing the criteria of the fining model officially, as the fining model has not yet been adopted by the DSK.

The German Data Protection Authorities agreed to test the proposed model in the context of concrete fining procedures against companies to ensure that it is practical and accurate. The DSK clarified, however, that this will not apply with regard to fining proceedings that have already been initiated. The DSK committed to decide on whether to publish the proposed model for administrative fines during their conference in November 2019.

The German Data Protection Authorities also have presented the draft GDPR fining model to the European Data Protection Board, which aims to ensure the consistent application of fining practices under the GDPR. If adopted by the German Data Protection Authorities, the German fining model is expected to lead to high GDPR fines.

View the press release (in German).