1 Methodology

The figures and findings in this article are based on the General Data Protection Regulation (GDPR) fines that have been imposed up until June 2021 following the entry into effect of the GDPR, where the main cause for the fine was a breach of article 32. As not all fines are made public, the dataset of article 32 fines used in this article is not exhaustive: it is a compilation of enforcement decisions that were officially published or confirmed by the national data protection authorities (DPAs).Footnote 1 The dataset offers insights into the DPAs’ focus areas and on emerging trends. The graphics in this article are based on that dataset and aim to help visualise the findings. Also included are some general insights on GDPR enforcement as a whole, and the impact that the findings of this article might have on organisations is discussed.

2 What are organisations being fined for?

Organisations can breach article 32 in various ways; the type of breach determines the severity of the fine and other compliance actions that they may face.Footnote 2 To analyse what types of breaches have attracted fines, the authors classified them as: internal or external data breaches; cyber security breaches; and/or technical and organisational measures (TOM) only. TOM only cases are those where an organisation is fined for general non-compliance with article 32 (i.e. has inadequate TOM in place) but no data or cyber security breach has occurred.

A data breach is defined in the GDPR as any breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of or access to personal data transmitted, stored or otherwise processed (article 4.12 GDPR).

The article distinguishes between fines levied for external and internal data breaches. In this article, internal data breaches are classified as breaches where either a generally authorised person has destroyed, lost, altered, disclosed or accessed personal data by exceeding his/her authorisation, or where an unauthorised person from within the organisation has performed any of these actions. External data breaches are breaches where personal data is manipulated, as defined in article 4.12 GPDR, by any unauthorised person outside the organisation.

The term cyber security breach is not defined in the GDPR. Therefore, the definition of cyber security breach is based on the current European Union (EU) network and information systems (NIS) Directive and the EU Cybersecurity Act. The NIS Directive defines cyber security breaches as ‘events having an actual adverse effect on the security of network and information systems’,Footnote 3 i.e. where IT applications, services, networks or devices are accessed (i.e. breached) by bypassing the underlying security mechanism.Footnote 4

3 External data breaches

The dataset shows that, since 2018, 42% (49 out of 117) of the fines for article 32 breaches have been imposed on organisations that DPAs have determined as having suffered from an external data breach. For example, the Danish DPA has issued three fines for article 32 breaches. According to the Danish DPA, all three organisations had suffered from an external data breach.Footnote 5 (Similarly, many of the Romanian penalties have been issued for external data breaches; these were across a variety of sectors, including financial, technology, media and telecom [TMT] and consumer). The UK Information Commissioner’s Office (ICO) has also issued all three of its article 32 fines against organisations that it deemed to have suffered from external data breaches. As of June 2021, two of the three ICO finesFootnote 6 were the highest ever GDPR fines. Notably, both fines were reduced because the organisations co-operated with the ICO during its investigation. The Italian DPA has issued the third highest fine, of € 27.8 m, against a telecoms company for what it considered to be an external data breach.Footnote 7 While some EU DPAs show a particular interest in external data breaches, others have focused less on this type of breach. For example, none of the article 32 fines issued by the Swedish DPA were for external data breaches.

4 Internal data breaches

Roughly 25% (29 of 117) of all fines imposed for article 32 breaches were for internal data breaches.Footnote 8 Of the fines imposed for internal data breaches, about 50% were given to organisations that deal with sensitive personal data (e.g. personal health data or children’s data).Footnote 9 For example, the Dutch DPA has fined two hospitals for internal data breaches where unauthorised staff had access to personal health data.Footnote 10 The Portuguese DPA has only issued one penalty for an article 32 breach, which was also to a hospital for what the DPA deemed to be an internal unauthorised manipulation of personal health data.Footnote 11 Various German DPAs have also levied fines on organisations for internal data breaches. For example, the DPA of Baden-Wuerttemberg has issued a fine against a financial company for wrongly deleting personal data.Footnote 12 Another German DPA, the DPA of Rhineland Palatinate, has fined a hospitalFootnote 13 for unauthorised staff having access to personal health data, which led to hospital bills being sent to the wrong patients. The Swedish DPA has also shown a particular interest in internal data breaches: six of its 11 penalties for article 32 breaches were for internal data breaches concerning sensitive medical or financial data, with four of those fines being over € 1 m.Footnote 14

This suggests that regulators are taking internal data breaches very seriously, especially where sensitive personal data is involved.

5 Cybersecurity breaches

This study also looks at article 32 fine decisions that have been handed down for cybersecurity breaches, within the meaning of the NIS Directive. As the EU DPAs do not have powers to enforce the NIS Directive per se, publicly available information about the facts of the cases was used to determine whether a cybersecurity element was present. Notably, not every article 32 fine includes a cybersecurity element. In fact, only about a fifth of data breaches occurred because the underlying security mechanism was bypassed through IT applications, services, networks or devices.

Interestingly, all cases that included a cybersecurity breach also fell under the definition of an external data breach. This means that the breach of security, which occurred by accessing or bypassing the security of network or information systems, was orchestrated by an unauthorised external person in all cases. Although enforcement against cybersecurity breaches are rarer, the penalties for them are high. For example, the Spanish DPA fined an organisation € 600,000Footnote 15 for a cybersecurity attack, as it found that the organisation did not have sufficient TOM in place. Similarly, the French DPA fined an organisation € 180,000Footnote 16 for a cybersecurity breach. In this case, personal accounts were accessible via hyperlinks on search engines, which resulted in many of the accounts being compromised. The French DPA deemed that this gap in the organisation’s security system led to the cybersecurity breach and was an infringement of article 32 GDPR.

Given the continuous increase in digital data management, working from home and moves to the cloud, the number of combined data and cyber breaches is likely to increase. Organisations should be on alert and make sure their security networks are airtight.

6 Technical and organisational measures

In all cases where article 32 fines were issued for data or cyber breaches, EU DPAs found that there had been insufficient TOM. In all, 31% (36 of 117) of the fines were for insufficient TOM alone (i.e. there was no data or cyber breach). When a data or cyber breach occurs, DPAs tend to see this as a sign that the TOM were insufficient: appropriate TOM should, by definition, prevent breaches from happening. DPAs will also assess the scope of TOM in place when setting any fines. This means that having effective TOM in place can be beneficial for organisations even if a data or cyber breach occurs.Footnote 17 Organisations should regularly revisit their TOM to keep them up to date.

Figure 1 shows how many fines were given for each of the different types of article 32 GDPR since the GDPR became effective up until June 2021. It distinguishes between internal or external data breaches and TOM only cases, i.e. where DPAs found that inadequate TOM were in place but where no data breach had occurred.

Fig. 1
figure 1

Types of article 32 General Data Protection Regulation non-compliance. TOM technical and organisational measures. (Source: Freshfields research, data correct on 22 June 2021)

Full size image

7 National trends

Significant national trends in relation to article 32 breaches were identified. For example, some regulators focus on data breach and data security incidents in general, while others target specific sectors or types of breach.

Figure 2 shows how many fines the DPAs in each European country have issued for article 32 GDPR infringements.

Fig. 2
figure 2

Article 32 General Data Protection Regulation enforcement activities by country. (Source: Freshfields research, data correct on 22 June 2021)

Full size image

Figure 3 shows the total value of fines the DPAs in each European country have issued for article 32 GDPR breaches.

Fig. 3
figure 3

Total value of fines for article 32 General Data Protection Regulation non-compliance by country. (Source: Freshfields research, data correct on 22 June 2021)

Full size image

UK

The ICO issued four GDPR fines between 2018 and June 2021.Footnote 18 Three of those four cases involved an article 32 breach—specifically an external data breach. This suggests that the ICO’s focus is on external data breaches. The combined total of the three fines is € 44.4 m, which means that the average fine is € 14.8 m. These penalties are some of the highest fines that have been issued under the GDPR as of June 2021. The ICO has repeatedly noted that co-operating with the regulator can significantly lower the penalty and encourages organisations to do so.

Italy

The Italian DPA (Garante) is currently one of Europe’s more active regulators.Footnote 19 This also holds true when it comes to data breaches and data security incidents. Within the last 3 years, the Garante has issued 17 fines for article 32 breaches.Footnote 20 Many of these fines were given to universities and local municipalities, suggesting that the Garante is coming down hard on public and governmental institutions. The highest fine issued by the Garante is for € 27.8 m.Footnote 21 The Garante noted that the organisation had repeatedly failed to correct the shortcomings that it had pointed out.

Romania

The Romanian DPA also shows a particular interest in data breaches and data security incidents. As of June 2021, it had issued the most article 32 fines (23) of all the EU DPAs.Footnote 22 Although the fines are at the lower end of the spectrum (ranging from € 500 to € 10,000), the DPA targets organisations across a variety of sectors, including financial, TMT and consumer.

Spain

The Agencia Española de Protección de Datos (AEPD) is generally known as Europe’s most active data protection regulator. It has issued over 200 penalties since the GDPR came into force.Footnote 23 The AEPD does not seem to particularly focus on data breaches and data security incidents but imposed about 15 fines for them.

Sweden

The Swedish DPA has issued 11 penalties for data breaches or data security incidents, totalling € 8.62 m; this averages out to € 784,000. The regulator has repeatedly targeted organisations in the healthcare sector and public institutions that process sensitive personal data, such as health data or children’s data.

France

The French DPA (Commission Nationale de l’Informatique et des Libertés, CNIL) has issued seven penalties for article 32 breaches. It levied a single fine of € 2.25 m on an organisationFootnote 24 that it deemed had insufficient TOM in place. Notably, two of the seven penalties were for breaches that included a cybersecurity element.Footnote 25 The two penalties related to the same incident, but the CNIL decided to fine the data controller and the data processor individually—this is rare, but is possible.Footnote 26

Germany

Generally, most of the German DPAs do not seem to focus particularly on article 32 breaches, instead spreading their enforcement activities across a variety of GDPR breaches.Footnote 27 However, the DPA of Baden-Wuerttemberg seems to be Germany’s primary watchdog when it comes to article 32. Of the seven article 32 fines issued by German DPAs,Footnote 28 five were levied by the DPA of Baden-Wuerttemberg. The highest penalty it has issued is for € 1.24 m, for insufficient TOM and unlawful data processing in the context of direct marketing.Footnote 29 The seven German fines amount to € 2.52 m in total.

Netherlands

The Dutch DPA (Autoriteit Persoonsgegevens, AP) has imposed six finesFootnote 30 for article 32 breaches, with most being in the six-digit range; this is at the higher end of the EU spectrum. When looking at fines given for data breaches and data security breaches, the AP seems to focus on the healthcare sector and on infringements involving sensitive personal data. For example, it separately fined two hospitals for internal data breaches involving sensitive personal data where it held that unauthorised staff had access to personal health data.Footnote 31

Figure 4 shows how many fines were imposed for each of the different types of article 32 GDPR infringements by country. It distinguishes between internal or external data breaches and TOM only cases, i.e. where DPAs found that inadequate TOM were in place but where no data breach has occurred.

Fig. 4
figure 4

Types of article 32 General Data Protection Regulation non-compliance by country. TOM technical and organisational measures. (Source: Freshfields research, data correct on 22 June 2021)

Full size image

8 Conclusion: what does this mean for organisations?

The key takeaway from this article is that the EU DPAs are coming down hard on article 32 breaches. Every organisation can, and most likely will, suffer a data and/or cyber breach at some point. They should focus on making sure that they have sufficient TOM in place, as DPAs can and will issue fines for insufficient TOM alone. Organisations should regularly update their TOM: this will help to minimise the risk of a breach and might also reduce any fine if there is a breach.Footnote 32 The fines for article 32 breaches can, as explained above, be very high—and it can be predicted that enforcement action will only continue to increase.