GDPR begins to bare its teeth with two record fines reaching nearly €1bn

Messaging service WhatsApp was fined €225m for GDPR breaches by Ireland’s Data Protection Commission (DPC) last week, just a month after the record €746m levy against Amazon, as the regulation begins to bite. The WhatsApp fine is significantly higher than the proposed DPC penalty after objections from other European regulators that it was too low. The European Data Protection Board (EDPB) instructed the DPC to “reassess and increase” its proposed fine, which was reported to be capped at €50m. The EDPB argued that the turnover of parent firm Facebook should be included to calculate the maximum levy of up to 4% of global annual turnover under GDPR rules, to ensure the fine is “effective, proportionate and dissuasive”. WhatsApp said it disagrees with the decision and severity of the fine. It plans to appeal. The WhatsApp fine becomes the second-largest GDPR fine to date and follows hot on the heels of the record €746m penalty against Amazon in July, which is also subject to an appeal. Both seem to strengthen the force of Europe’s data protection rules introduced in 2018 and smash the previous GDPR record of €50m against Google in 2019/2020. Although the sums involved may not make the tech giants quake in their boots, they are significantly higher than anything that has gone before. Risk managers may well be a bit more nervous today about the GDPR than they were a couple of months ago. The EDPB has also now set a precedent in the WhatsApp case by clarifying that all multiple GDPR infringements for the same or linked processes, under Article 83, should be taken into account when calculating fines. The DPC was designated as lead supervisor for Europe’s GDPR investigation into WhatsApp Ireland at the end of 2018, after concerns users were not made aware their information could be shared with owner Facebook and its other companies. Towards the end of 2020, the DPC submitted its draft decision to Europe’s supervisory authorities involved in the case for approval. However, eight objected and the EDPB stepped in after the DPC “was unable to reach consensus” with the other regulators. The EDPB said its review found “additional shortcomings” with WhatsApp’s transparency and instructed the DPC to add an infringement of Article 13 and Article 5 “in light of the gravity and the overarching nature and impact” of the breaches. The DPC has also reduced the order-to-comply period, during which WhatsApp is expected to correct GDPR infringements, from six months to three months. This in line with a request from the EDPB. Facebook is reported to have set aside €300m for regulatory fines in Europe for 2021 and almost €78m for WhatsApp. Amazon fine The Amazon fine by Luxembourg’s National Commission for Data Protection (CNPD) was for processing personal data in violation of the GDPR’s rules. The news was revealed in an Amazon US Securities and Exchange Commission (SEC) filing. In that document, the e-commerce giant said that it believes the CNPD’s decision is “without merit” and said it intends to defend itself “vigorously in this matter”. “There has been no data breach and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD’s ruling,” stated the firm, according to Bloomberg. The decision concludes an inquiry that was sparked in 2018 by a complaint brought by French privacy rights group La Quadrature du Net. It cautiously welcomed the decision.

GDPR begins to bare its teeth with two record fines reaching nearly €1bn

Want to read this article?

Read Next

Partnership is key as Allianz Commercial plays its role in ESG and PPPs

Insurance market hardening to moderate further at year-end

Ferma’s president says pan-European vehicle for systemic risks not dead

Marsh urges buyers to prepare for net-zero underwriting

Hardening reinsurance market set to prolong primary buyers’ pain

Partnership is key as Allianz Commercial plays its role in ESG and PPPs

Insurance market hardening to moderate further at year-end

Ferma’s president says pan-European vehicle for systemic risks not dead

Marsh urges buyers to prepare for net-zero underwriting

Hardening reinsurance market set to prolong primary buyers’ pain

Want to read this article?

Read Next

Partnership is key as Allianz Commercial plays its role in ESG and PPPs

Insurance market hardening to moderate further at year-end

Ferma’s president says pan-European vehicle for systemic risks not dead

Marsh urges buyers to prepare for net-zero underwriting

Hardening reinsurance market set to prolong primary buyers’ pain

Related Articles