GDPR Enforcement Tracker Report 2023 (4th Edition - Anniversary Edition)

In time for the fifth anniversary of the introduction of the General Data Protection Regulation, we have released the fourth edition of our annual GDPR Enforcement Tracker Report. This report analyses all publicly available information on data protection fines across Europe since May 2018.

You can view the report (online) here. For a quick overview, check out the Executive Summary.

The most important findings are:

• Since 25 May 2018, European data protection authorities have imposed more than 1,500 known fines totalling EUR 2.77 billion. In the analysis period of this year's report, 545 new fines were issued totalling around EUR 1.19 billion. This indicates that data protection authorities are continuing to enforce the sanctions outlined by the GDPR.
• In addition to record fines in the hundreds of millions, a large number of smaller fines have also been imposed, providing valuable information on the enforcement practice. The highest risk of fines is in the business-to-consumer sector, for example in the areas of Industry & Commerce and Media, Telecoms and Broadcasting. Data processing without a legal basis, non-compliance with data processing principles and inadequate data/information security measures were the most frequent legal violations.
• Implementation of the GDPR is still strongly influenced by national laws and the local supervisory authorities’ practices, especially in relation to sanctions. This is despite the intention of the GDPR to fully harmonize data protection law in the EU (further information also in the "Enforcement Insights per Country" section). In addition to fines, other measures may become more prevalent in the future, such as the restriction or prohibition of data processing. There are already instances of this, such as in the Italian supervisory authority’s case against a provider of generative AI.
• Numerous questions regarding the interpretation of the GDPR, including those related to sanctions, have not yet been conclusively answered. Ultimately, the European Court of Justice will decide on these issues.

The Enforcement Tracker Report is based on publicly available information in CMS's continuously updated database, the GDPR Enforcement Tracker.

More information on the people behind the EFT report and details of all CMS Data Protection Contacts in Executive Summary.