Notable GDPR Fines: The Largest, Most Impactful, and Most Avoidable Penalties
Notable GDPR Fines: The Largest, Most Impactful, and Most Avoidable Penalties
TL;DR — Quick Answer
1 min readFrom Meta's record EUR 1.2 billion fine to Uber's entirely avoidable EUR 290 million penalty, GDPR enforcement actions show that the cost of non-compliance far exceeds the cost of doing it right.
Notable GDPR Fines: The Largest, Most Impactful, and Most Avoidable Penalties
A selection of GDPR enforcement actions that stand out for their scale, significance, or the lessons they teach about data protection compliance.
The Largest Fines
Meta received a record EUR 1.2 billion fine in 2023 for data transfer violations following the Schrems II ruling. Amazon was fined EUR 746 million in 2021 for violations related to targeted advertising practices.
The Most Impactful Fine
Two 2023 fines against Meta, totaling EUR 390 million, addressed how the company justified collecting and analyzing personal data for personalized advertising on its social media platforms. These decisions clarified the legal bases that major platforms can rely on for ad targeting.
The Most Underwhelming Fine
Those same EUR 390 million fines were widely criticized as insufficient given the scope of violations. The investigating authority failed to examine claims about sensitive data collection, and eleven significant data breaches occurred between the initial complaints and the final decision.
The Most Avoidable Fine
Uber received a EUR 290 million fine for data transfer violations that could have been entirely avoided by implementing Standard Contractual Clauses -- a standard practice that most other companies in similar positions had already adopted.
The Emerging Threat
Clearview AI accumulated EUR 110 million in fines from Italian, Greek, and Dutch authorities for large-scale non-consensual web scraping. This precedent has significant implications for how technology companies collect training data for artificial intelligence systems. European data protection regulators have signaled a strict approach to AI training data collection.
Was this article helpful?
Let us know what you think!
Before you go...
Related Articles
Why Meta Faces Existential Regulatory Challenges in Europe
The CJEU Bundeskartellamt ruling combined with accumulated GDPR enforcement creates unprecedented threats to Meta's European operations, connecting competition law with data protection.
Meta Receives $102 Million Fine for Storing Passwords in Plain Text
The Irish DPC fined Meta $102 million after discovering up to 600 million user passwords were stored unencrypted since 2012. Learn about the GDPR violations and lessons for all organizations.
Meta Loses Major Privacy Battle: What the Ruling Means for Big Tech
Meta suffered a significant privacy defeat that challenges data-driven business models across big tech. Learn about the ruling, its business model implications, and the precedent it sets.