GDPR Enforcement Tracker – list of GDPR fines
enforcementtracker.com
enforcementtracker.com
Just open the file yourself https://docs.google.com/spreadsheets/d/1s2eNqf5xpVX8j6LfnL6r...
Full-fat google docs view: https://docs.google.com/spreadsheets/d/1s2eNqf5xpVX8j6LfnL6r...
I'm actually surprised the ICO can fine the UK government. This can't happen in France, for instance.
That was an error with potentially very grave consequences, but it seems the MoD handled it well once they were aware of it (“Soon after the data breach, the MoD contacted the people affected asking them to delete the email, change their email address, and inform the ARAP team of their new contact details via a secure form. The MoD also conducted an internal investigation, made a statement in Parliament about the data breach, and updated the ARAP’s email policies and processes, including implementing a ‘second pair of eyes’ policy for the ARAP team when sending emails to multiple external recipients”)
I don’t think a larger fine would have made them do better, so why make it higher?
OTOH this might just be a case of "temporarily inconvenienced billionaire" logic or the same fear mongering as "if we raise minimum wage you won't be able to afford rent".
From https://gdpr.eu/fines/:
> The more serious infringements go against the very principles of the right to privacy and the right to be forgotten that are at the heart of the GDPR. These types of infringements could result in a fine of up to €20 million, or 4% of the firm’s worldwide annual revenue from the preceding financial year, whichever amount is higher. (emphasis theirs, well, bold not italics, but yeah.)
Meta/Facebook/WhatsApp was fined about 2.4 billion (6 out of top 10 fines), but still nowhere near close to the maximum (which would be about 54 billion).
Everytime a new EU regulation is discussed on HN people are up in arms about the "maximum fines" and some replace the "maximum" with "mandatory".
Fines need to be reasonable and proportional and that is not optional if they should survive a court case.
The big fines are tool used to bring global conglomerates into compliance.
This does not entirely answer your question, but it has some indication:
1. They started fining around 2019. 2. Large fines, over EUR 1mil, started around 2021.
From this I would not say that the fines get bigger, they just start to fine when they have been infringing for long enough.
There is a known far-right extremism problem in the German police force and military, e.g. the founder of GSG9 (think German SWAT) and a brigadier general and former commander of the KSK (think German SOCOM/SEAL) published a book with a far-right publishing house, which was the first in a series of incidents that led to the KSK being reformed in 2020 to (hopefully) address the systemic far-right extremism problem.
There have been credible claims of ties of far-right terrorist groups like Combat 18 and NSU 2.0 to the police. E.g. in one of the biggest news stories there was a find of not only a disturbing cache of weapons and body bags but also "kill lists" found to be sourced from police computers.
There are obvious ideological reasons why police officers are more likely to be supportive of far-right extremism than, say, far-left extremism. That isn't to say police officers are generally far-right but maintaining the status quo, opposing disturbances of the public order and enforcing the letter of the law fit better with conservatism than progressivism and social justice movements, let alone radical leftism.
€ 23000
[1] http://web.archive.org/web/20230805142446/https://twitter.co...
Why? I'm curious what it was you expected to happen?
I often wondered if flagging smaller websites not respecting the GDPR to the relevant watchdogs would have any effect at all, or that it was just a waste of time because small-fish complaints would go straight to the bin.
I stand corrected, and will not hesitate to do so going forward.
Seems an ugly front in the culture war.
They're serious privacy violations because of the nature of the data that was exposed. We're also only talking about two organizations, both of which did have legitimate privacy violation incidents.
You're drawing conclusions based on statistically meaningless sample sizes.
A fine for this seems reasonable. Data on sexuality and medical history is protected beyond the normal level for personal data.
£21,000
> At 14: 22 on 6 September 2019 a member of staff in the - used Microsoft Outlook to generate an email communication which was initially sent to a total of 1,781 GIC patients. The email was sent in two batches comprising 912 and 869 email addresses respectively. In both batches the email addresses were copied from the output report and entered into the "To" field instead of the "Blind carbon copy" ("Bee") field. The recipients of each email could therefore see the email addresses of the other recipients of that email. Four of the emails were returned as undeliverable and so potentially 1,777 emails were delivered and opened
£92,000
I mean, they did accidentally dox their clients which is in scope for GDPR enforcement, and they are the 2nd and 3rd lowest fines (likely due to a low level of intentionality and resources), with the only lower fine going to a HIV charity.
Honestly this seems fine.
The only 'culture war' here is the one you are introducing.
I'm saying for the relatively few fines that have been issued in the UK, a surprising number have been aimed at targets of the culture war of the day and that that's noteworthy.
Data relating to medical records and sexuality is noted by the GDPR as (quite rightly) being particularly sensitive and worthy of extra protection.
Your use of the troll bait term "culture war" attempts to belie this.
I found the proportion of the fines aimed at a particular group of organisations noteworthy; especially specific organisations that are already under intense scrutiny in the UK media.
Charities have to obey privacy law the same as anybody else regardless of what they stand for. It seems the fines were perfectly justified and I see no problem with that.
That said, pretending there is not a deliberate "culture war" around the existence of trans people in the UK is either dishonest or ignorant. UK politics, politicians and media have been extremely hostile towards trans people in recent years even relative to the general attitude of the general population in the UK. The level of artificial moral panic surrounding trans people in UK politics and media is surprising even by American standards. There are a number of astroturfed anti-trans groups present in English-speaking media but the most effective ones are all UK-centric.
The fines, however, seem to be orthogonal to that.