EDPB adopts new guidelines for GDPR administrative fines

The European Data Protection Board (EDPB) has adopted new guidelines to harmonize how data protection authorities apply administrative fines under the GDPR. These guidelines aim to ensure consistent enforcement and clarity across Europe by aligning how authorities decide to impose fines either independently or alongside other corrective measures.

To determine whether a fine is appropriate, authorities are instructed to follow a five-step methodology: 1. Verify if the infringement allows for a fine under GDPR or national law. 2. Determine the liability of the controller or processor. 3. Assess whether the infringement was intentional or negligent. 4. Evaluate aggravating and mitigating circumstances. 5. Assess if the fine is effective, proportionate, and dissuasive.

Under this framework, minor infringements may result in a reprimand rather than a fine, while more serious violations carry a strong presumption that a fine should be imposed. Additionally, the EDPB finalized guidelines regarding the interplay between the Digital Services Act (DSA) and the GDPR.