GDPR Fines Drop in 2024: Activists Demand Stronger Enforcement
European data protection authorities imposed fines totaling €1.2 billion in 2024, marking a 33% decrease from the previous year. This decline is attributed to the absence of fines comparable to the €1.2 billion penalty imposed on Meta by Ireland in 2023. Since the General Data Protection Regulation (GDPR) came into force in 2018, fines have amounted to €5.88 billion, with large technology companies, particularly in the social media sector, facing the majority of penalties. Ireland remains the leading enforcer, having levied €3.5 billion in fines, while Germany has imposed €89.1 million in penalties.
Despite the significant monetary penalties, data protection activists argue that the enforcement of GDPR is insufficient. According to the noyb association, only 1.3% of cases result in fines, and proceedings often take years. Activists criticize the authorities for not adequately sanctioning violations, suggesting that they act more in the interests of companies than data subjects. In 2022, Spain’s data protection authority received over 15,000 complaints but issued only 378 fines, highlighting a discrepancy in enforcement compared to other legal areas.
Fines are crucial for motivating companies to comply with GDPR, as evidenced by a survey indicating that two-thirds of respondents improved compliance following a fine. The Dutch Data Protection Authority’s move to investigate personal liability for GDPR violations could signal a shift towards holding individuals accountable. This approach may lead to more stringent enforcement and serve as a warning to companies about the consequences of non-compliance.
The increasing focus on personal liability reflects a new phase in GDPR enforcement. Legal experts suggest this shift sends a strong message to companies that data protection breaches will have consequences, even at the individual level. As data protection authorities continue to refine their strategies, the emphasis on personal accountability could drive greater adherence to GDPR regulations.
Source: GDPR authorities accused of ‘inactivity’
