Blog » WORSE THAN PENALTY? THE DATA PROTECTION AUTHORITY’S SANCTION TOOLKIT
WORSE THAN PENALTY? THE DATA PROTECTION AUTHORITY’S SANCTION TOOLKIT
29 January 2018
When it comes to the sanctions under the EU General Data Protection Regulation, everybody speaks about the astronomic penalties up to 10-20 Million Euros, however, it is only one of the 10 corrective measures of the data protection authority. And in some case complying with non-financial corrective measures can be much more painful than simply paying penalty. So, we present the 9 non-financial corrective measures in this article.
The Article 29 Working Party recently published guidelines on setting administrative fines under the GDPR, in which it summarized the circumstances to be taken into account before applying penalties and other sanctions, so that the GDPR have equivalent application throughout the EU, and in order to impose effective, dissuasive and proportional sanctions.
The Working Parties’ opinion stresses that the national data protection authority has wide range of means, and in addition to penalties it can impose 9 other types of corrective measures, that we present in 3 groups, considering their severity.
The warning, as the lightest measure means that the data protection authority draws attention to the breach of GDPR, and informs the data controller about the potential consequences.
A reprimand is still that kind of measure that does not have any direct disadvantage, and by which the data protection authority “only” establishes the fact of data breach, without any immeadiate legal consequences.
Although the warnings and reprimands do not have any direct adverse effect, in case of a future breach, they will be considered as aggravating circumstance.
Compliance orders represent the next level of corrective measures, by which the data protection authority orders the data controller to perform a given action.
It can be that the data controller must comply with the request of a data subject, or it has to inform the data subjects about a personal data breach.
The data protection authority can also oblige the data controller to make its operation compliant with the GDPR, for example by adopting internal rules, or by rectifying, deleting personal data, etc.
You must see that complying with these corrective measures can be at least as costly as paying penalties, let alone the time needed to ensure compliance.
Limitation, ban, withdrawal
In more serious cases the data protection authority can limit, or in certain cases, ban the data processing which can have very severe financial disadvantage on the data controller’s operation.
It is a special case, when the data protection authority suspends the data transfer outside the EU, which can be very delicate for companies whose subsidiary, parent company or business partner is located in non-EU countries.
Last but not least, the data protection authority can withdraw the certification of the company, which proves that its operations are GDPR compliant.
I think the negative effects of these measures to the daily operation of the firm or to the company’s goodwill does not need further explanation.
When it comes to sanctions under GDPR, in certain cases non-financial measures, like compliance orders, data transfer suspension, or certificate withdrawal can be much more painful and critical to the life of the company, than pure monetary penalties.
The Working party highlights, that the 9 above measures must be considered as alternatives of the administrative penalty, at the same time data protection authorities should not be shy to impose fines, if this is the most effective. Of course, the best, if our company respects the provisions of the GDPR and the data protection authority does not have to choose among the 10 corrective measures!
IS THE JUDGE BIASED BECAUSE OF UNFAVOURABLE JUDGMENT IN OTHER CASE?
Can a judge be disqualified from deciding the legal dispute on the grounds of bias if he has delivered a judgment unfavourable to the plaintiff in another case? Can a court be biased if the plaintiff has "challenged" a previous decision of the court before the European Court of Human Rights? In this article, we answer these questions by analysing a recent judgment of the Hungarian Supreme Court.Read more »
CAN INCOMPATIBLE WORKPLACE BEHAVIOUR BE A GROUND FOR DISMISSAL IN HUNGARY?
Refusal of employer 's instructions, unjustified absence, intentional damage: some cases where the justification for dismissing an employee is relatively easy to determine. What happens, however, if the employee does not commit a severe breach of duty similar to the one above, but his or her colleagues consider him incompatible, with whom it is impossible to cooperate, or even afraid of him or her. Can dismissal be justified by behaviour that is incompatible with others and creates disharmony in the working environment? In our article, we seek the answer to this question in the light of Hungarian judicial practice.Read more »
CAN A JUDICIAL ERROR CREATE HUNGARIAN JURISDICTION DESPITE A PLACE OF PERFORMANCE ABROAD?
Can a defendant, domiciled abroad, be sued in Hungary under the Brussels I Regulation in the event of defective performance of an international sales contract if the place of performance is abroad? Can the jurisdiction of a Hungarian court be established based on the fact that the lower court expressly established its jurisdiction at the beginning of the litigation? How is the EXW clause to be interpreted within the meaning of the Brussels I Regulation? In our article, we analyse the recent decision of the Supreme Court of Hungary.Read more »