Blog » 5+5 THINGS AFFECTING HOW MUCH YOU PAY FOR A GDPR BREACH
5+5 THINGS AFFECTING HOW MUCH YOU PAY FOR A GDPR BREACH
12 February 2018
Data protection authorities can impose administrative fines up to 20 Million Euro based on the EU GDPR. But what affects the actual amount that you have to pay in case of infringement? And how can you minimize the risk of an astronomic penalty? We gathered some hints in our latest article.
The Article 29 Working Party recently published guidelines on penalties under GDPR.
First, it must be noted that the guidelines stress that penalties are only one of 10 (ten) corrective measures, that can be applied by data protection authorities.
For this reason, the 5+5 criteria below are not only considered when calculating the amount of the penalty, but also in cases, when the data protection authority assesses, whether penalty or other corrective measure should be applied.
We can put these assessment criteria in two groups: in the first there are those which are connected to the breach itself, while in the second one we find those which relate to the wrongdoer data controller or data processor.
First at foremost, the type of infringement is a starting point when assessing sanctions and fines.
In case of a minor, administrative non-compliance with GDPR, the penalty cannot exceed 2% of annual turnover or EUR 10 Million of your company, while more serious infringements, like the breach of basic principles of data processing, or infringing natural persons rights will lead to the higher thresholds, which is 4% or annual turnover or EUR 20 Million.
The number of data subjects affected by the data breach is important, because it is not the same when there is one isolated case, or when the infringement concerns more hundred, let alone, more thousand private individuals.
It is also important, whether any damage was caused or likely to be caused by the data breach (e.g. bank account details, or health information was leaked), and if yes, what is the extent of the damage.
The duration of the breach must be also taken into account, because a one-time breach will be judged differently than a continuous breach, lasting for more months or even years.
The type of personal data affected by the breach, because the infringement concerning sensitive personal data (eg. health-related data) is always more serious than a data breach relating to other not qualified data.
It goes without saying that intentional data breaches must be judged more seriously than negligent ones. It can be a telling fact, when the top management of the company explicitly or implicitly allowed the data breach, or disregarded the advice of data protection officer. This is the case, if the data breach served the purpose of gaining business benefits (e.g. achieving a market position, etc.).
The organizational, technical and security measures executed by the data controller can influence the degree of responsibility, the consideration of these must be judged on the basis of industry standards and on “best practices”.
The cooperation with the authority by the data controller, and the notification of data breach from its own motion are circumstances that can decrease the amount of the penalty.
The fact that the data controller has done measures mitigating the consequences of the data breach (.e.g the notification of data subjects, etc.) must be considered as mitigating circumstance.
Last, but not least, the eventual earlier data breaches committed by the data controller, or non-compliance with or disrespect of earlier corrective measures imposed by the authority will be considered as aggravating circumstances when calculating the amount of fines.
As you can see, at least half of the 10 assessment criteria depend only on you, on your actions taken (or not taken) before and after an eventual breach of the GDPR.
The good news is that you can dramatically minimize the risk of an astronomic penalty with a careful preparation, and with an honest, cooperative and proactive crisis management, on the basis of policies adopted during your GDPR compliance.
So, it is high time to start your GDPR compliance project!
CAN THE EMPLOYER EXPAND THE EMPLOYEES’ DUTIES WITHOUT CHANGING THE JOB DESCRIPTION IN HUNGARY?
The position and tasks of the employee are one of the key elements of the employment contract and are typically recorded in the job description. It is often a matter of dispute between the parties whether the employer can unilaterally modify the job description at all, and if so, to what extent. In a recent court decision, a Hungarian appellate court addressed the above question in a situation where the employer supplemented the employee's tasks with new tasks similar to his existing tasks. In this article, we analyse the recent decision on this matter.Read more »
CAN A HARSH FACEBOOK COMMENT BE A LAWFUL GROUND FOR DISMISSAL IN HUNGARY?
Social media platforms significantly changed the ways how people express their opinions: sharing views became easier than ever. On the one hand, this is positive, but on the other hand, it is also dangerous in the employment context, as the employee's opinion may be prejudicial to the employer's interests. A recent decision of the Hungarian Supreme Court gives answer to the question whether the employer can dismiss the employee for expressing his opinion on Facebook.Read more »
NEW EU – US DATA PRIVACY FRAMEWORK - SIMPLIFIED DATA TRANSFER TO THE US
With the Schrems II judgment, which invalidated the Privacy Shield, the CJEU (Court of Justice of the European Union) make it more difficult to comply with the GDPR for companies transferring personal data from the EU to the US. However, the new EU-US Data Privacy Framework (or “Framework”) adopted on 10 July aims to put an end to this situation. But how does the Framework make data transfers between the EU and US easier? In this short article, we explain the basics of the new Framework and answer the above question.Read more »