Review of GDPR fines and data breaches 2021

In 2021, there was once again significant momentum in European and German data protection. In June, for example, supervisory authorities began data transfers to the U.S. after the “‘Schrems II’ ruling of the CJEU on July 16, 2020, had declared the Privacy Shield Agreement with the U.S. invalid. To this end, the EU published new standard data protection clauses (SCC). In Germany, the TTDSG came into effect on December 1.

The activities of the European data protection authoritiesactivities of the European data protection authorities have set new records. For example, the total amount of fines imposed 1 billion EUR for the first time. The fine of 746 million EUR imposed by the Luxembourg supervisory authorityCNPD, a fine of 746 million EUR was imposed on Amazon Europe Core S.r.l., the highest fine to date under the GDPR.

In the opinion of the CNPD, Amazon had blatantly violated applicable data protection law in the design of the mechanism responsible for determining which advertisements are displayed to users. The proceedings had already been initiated in 2018 by the French civil rights organization “La Quadrature du Net.” Amazon had announced its intention to appeal the decision. Accordingly, the decision is not yet final at this time. Since the CNPD is not permitted to comment on individual cases, few details about the case are known.

German data protection authorities were also active in 2021. As in previous years, the GDPR Portal asked them what fines they had imposed, as well as how many processing bans or restrictions were imposed and how many data breach reports were registered. With the exception of the State Commissioner for Data Protection and Information Security of Mecklenburg-Western Pomerania and the Bavarian State Office for Data Protection Supervision, all authorities provided information (see below for a detailed overview).

Fines lower than in the previous year

Over the course of the past year, German authorities imposed 373 finestotaling over 2.11 million EUR (since not all authorities disclosed the amounts of the fines, this figure should be considered a lower limit). With 72 decisions, the Thuringian regulatory authority led the way. North Rhine-Westphalia (57) and Lower Saxony (42) followed in second and third place.

Comparing these figures with those from the previous year, it becomes clear that while the number of German fines has increased, their totalamount has, however, decreased noticeably. The 284 sanctions from 2020 still totaled over 48 million EUR. It is also striking that in 2021, there were spectaculardecisions by German supervisory authorities—such as the fines imposed in 2020 against H&M (33.5 million EUR) and notebooksbilliger.de (10.4 million EUR) — failed to materialize. The Federal Commissioner for Data Protection and Information Security once again did not issue a single fine notice in 2021.

The highest fine in 2021—901 thousand EUR—was once again imposed by the supervisory authority in Hamburg. The energy provider Vattenfall Europe Sales GmbH for violations of Art. 12(1) GDPR and Article 13 of the GDPR. Between August 2018 and December 2019, Vattenfall cross-referenced the data of 500,000 customers with prior contractual relationships without informing the data subjects in a transparent manner. The data matches were related to special contracts, which were intended to attract new customers and were accompanied by lucrative switching bonuses for the customers. The purpose of these agreements was to prevent prospective customers from repeatedly taking advantage of such contracts— i.e., signing the contract, receiving the bonus, canceling it, signing the contract again, and so on—so that these contracts could even become a money-losing venture for Vattenfall.

Second place in the 2021 ranking went to the 300,000 EUR fine imposed by the Baden-Württemberg data protection authority on the soccer club VfB Stuttgart 1893 AG. The club failed to fulfill its accountability obligations pursuant to Art. 5(2) of the GDPR. Rounding out the top three is a 200,000 EUR fine imposed by the Lower Saxony supervisory authority. Since German authorities generally do notnotices of fines and, with a few exceptions, do not issue press releases, unfortunately no further details regarding the latter are known at this time.

Most fines ranged in the four-digit or, at most, low five-digit range. Among the most frequently penalized violations were the unlawfulprocessing of data (Art. 5 and 6 of the GDPR), such as through unauthorized video recordings, database queries, or transfers to third parties, as well as violations of the obligations to provide access and information (Art. 12 through 15 of the GDPR) as well as inadequate technical and organizational security measuresmeasures (Art. 32 GDPR). It is noteworthy that—as was already the case in 2020—police officers were sanctioned in several instances due to unauthorized queries of the police database.

Our inquiries also reveal that in 2021, German supervisory authorities imposed several restrictions or bans on data processing pursuant to Art. 58(2)(f) GDPR. The most interesting aspect here is a—unfortunately unspecified— measure taken by the Hamburg data protection authority against Facebook Ireland Limited.

Comparison with other EU countries

It becomes particularly interesting when comparing the activities of the German authorities with the fine-imposition practices of other major EU member states, particularly France, Italy, and Spain.

Last year we reported that in Spain, with a population of approximately 36 million, a total of 152 fines—calculated per capita—a similar number of sanctions had been imposed as in Germany. In 2021, however, the Spanish data protection authority AEPD significantly stepped up its enforcement efforts compared to its German counterpart: 242 fines were issued. Although the vast majority of these were again in the low four- or five-digit range, fines were imposed on the telecommunications company VODAFONE ESPAÑA (8.15 million EUR), the supermarket operator MERCADONA (2.52 million EUR), the energy company EDP (EDP ENERGÍA): 1.5 million EUR, EDP COMERCIALIZADORA: 1.5 million EUR) as well as against the financial service providers CAIXABANK PAYMENTS & CONSUMER EFC (3 million EUR) and EQUIFAX IBÉRICA (1 million EUR) faced a series of fines amounting to millions. In other words: In 2021 &the Spanish AEPD significantly surpassed the German authorities in terms of the amount of fines imposed—and, relative to population size, also in the total number of penalties.

The Italian data protection authority GPDP imposed a total of 82 fines in 2021— a significant increase from the previous year, which saw 45 proceedings. These included several sanctions amounting to millions. Among them were the fines imposed on the energy companies Enel Energia (26.5 million EUR) and Iren Mercato (2.86 million EUR), against the telecommunications company Fastweb (4.5 million EUR), against the pay-TV provider Sky Italia (just under 3.3 million EUR), as well as against the delivery services Foodinho (2.6 million EUR) and Deliveroo Italy (2.5 million EUR). In addition, several public agencies were fined, including, once again, City of Rome (800,000 EUR) as well as various municipalities in the country. Unlike in Italy or the Nordic countries, data protection violations by government institutions in some EU countries(such as France) are not subject to fines.

The pattern of recent years continues in France as well. In 2021, the French supervisory authority CNIL issued only 18 penalty notices—a comparatively small number—, but among them were some of the highest fines imposed across the EU. These were levied against Google (GOOGLE LLC: 90 million EUR, GOOGLE IRELAND LIMITED: 60 million EUR) and Facebook (FACEBOOK IRELAND LIMITED: 60 million EUR) are once again targeting leading U.S. technology companies. As early as 2020, the CNIL had already ruled against Google (Google LLC: 60 million EUR, Google Ireland Limited: 40 million EUR) and Amazon Europe Core (35 million EUR)—the highest fines in the entire EU. Other notable fines in the millions were imposed on the home furnishings group IKEA (1 million EUR) and the insurance company SGAM AG2R LA MONDIALE (1.75 million EUR).

In our previous annual review, we had viewed the activities of the German supervisory authorities as confirming anoteworthy trend in the activities of the German supervisory authorities: that more and more citizens are becoming aware of their data rights and are taking advantage of the opportunities offered by the GDPR. Against this backdrop, the German data protection record for 2021 appears somewhat sobering, especially when compared to the institutions of other major EU countries. While the trend toward more and higher fines seemed to continue there despite the COVID-19pandemic, the trend toward more and higher fines seemed to continue, the average fine amount in Germany decreased noticeably despite the increased number of fines.

Data breaches

In 2021, there were significantly fewer data breaches according to Art. 33 GDPR were reported to the German supervisory authorities than in the record year of 2020. While more than 26,000 reports were recorded back then, the number in 2021 amounted to only 13,890 (since statistics on reported data breaches were not available from all supervisory authorities at the time of this article’s publication, this figure should also be understood as a lower limit). Most breaches were recorded in Baden-Württemberg (3,136), followed by Hesse (2,016) and Lower Saxony (1,658). As in 2020, many of these were related to the mistaken mailing of documents, hacker attacks, data loss, or technical failures.

Outlook

A final decision regarding the record fine imposed on Amazon by Luxembourg is expected this year. The company had sharply criticized and announced that it would file an appeal. As early as December 17, 2021, the Administrative Court of the Grand Duchy of Luxembourg the order issued by the data protection authority to Amazon to adjust its data protection practices by January 15, 2022, due to unclear wording. However, the court did not comment on the actual fine at that time.

Overview by Regulatory Authorities