How to Avoid a $20.3M GDPR Fine: What US Companies Need to Know

You may have heard the acronym GDPR but do you know what it means for consumers and how it affects companies?

The European Union’s General Data Protection Regulation (GDPR) went into effect in 2018 to help protect the personal data of people in the EU. The regulations give consumers more control over their personal information when dealing with companies online. These regulations apply to businesses of all sizes — even those based in the U.S. — that gather any kind of personal data related to people in the EU.

These fines make it clear that following all GDPR rules and regulations is critical — even for U.S. companies that serve customers who live in the EU. Read on to find out more about what’s required for GDPR compliance.

Does GDPR apply to me?

While the GDPR regulates personally identifiable information in the EU, it also applies to companies that collect personal data from citizens of the EU. So if you’re a U.S.-based e-commerce company that sells to European citizens, you need to know the rules of GDPR and ensure you’re protecting the information of your customers.

The data protected by the GDPR may be provided by the consumer, or it may be personal data from computer cookies.

So what information do companies need to protect? The GDPR defines personal data as any information related to a natural person (data subject) that can directly or indirectly identify that person. This includes names, addresses, payment information, medical history, and more.

While the EU specifically protects its citizens, protecting this type of information for other customers can help businesses anywhere in the world.

The GDPR is based on seven principles to protect the personal data of consumers. Those seven principles include:

1. Lawfulness, fairness, and transparency: Consumers should be able to understand what data they’re using, how they’re using it, and for what purpose.
2. Purpose limitation: Data should only be collected and used for specific purposes.
3. Data minimization: Companies should only collect the data necessary based on the purpose of the interaction.
4. Accuracy: Data should be accurate and up to date.
5. Storage limitation: Personal data should only be kept for as long as it is needed.
6. Integrity and confidentiality: Companies should protect the data of their customers and only use it for the purposes defined.
7. Accountability: You’re responsible for the data of your customers and should be able to prove your GDPR compliance.

How to avoid GDPR fines

So how do you avoid GDPR fines? The GDPR outlines several critical things every company must do to ensure they’re compliant. For the most part, companies should have a written document that outlines their approach to the GDPR and compliance. According to the GDPR, “If you think you are compliant with the GDPR but can’t show how, then you’re not GDPR compliant.”

The GDPR infractions that have had the most amount of fines include:

• Non-compliance with general data processing principles.
• Insufficient legal basis for data processing.
• Insufficient fulfillment of information obligations.

Companies can learn from these statistics to understand the infractions that have had the highest enforcement and make sure the company is in compliance. There are six main things companies should do to help avoid a GDPR violation.

1. Create a GDPR-compliant privacy policy

An important first step in GDPR compliance includes your website privacy policy. The GDPR requires that a company’s privacy policy is:

• “In a concise, transparent, intelligible, and easily accessible form
• Written in clear and plain language, particularly for any information addressed specifically to a child
• Delivered in a timely manner
• Provided free of charge”

According to the GDPR, a privacy policy should include the following if a company is getting information directly from consumers:

• “The identity and contact details of the organization, its representative, and its Data Protection Officer
• The purpose for the organization to process an individual’s personal data and its legal basis
• The legitimate interests of the organization (or third party, where applicable)
• Any recipient or categories of recipients of an individual’s data
• The details regarding any transfer of personal data to a third country and the safeguards taken
• The retention period or criteria used to determine the retention period of the data
• The existence of each data subject’s rights
• The right to withdraw consent at any time (where relevant)
• The right to lodge a complaint with a supervisory authority
• Whether the provision of personal data is part of a statutory or contractual requirement or obligation and the possible consequences of failing to provide the personal data
• The existence of an automated decision-making system, including profiling, and information about how this system has been set up, the significance, and the consequences”

If you need to create a policy, you can use a privacy policy template (PDF download) to get started. Another solution to stay up to date with compliance is Termly. Termly is a compliance solution that comes with a consent management platform, terms and conditions generator, privacy policy generator, and more features for your business to stay compliant and save on legal fees. It offers a free plan that's ideal for home-based businesses or small businesses on a tight budget, with coverage for one site, one user, and one legal policy, as well as several higher tiers with more extensive features. 

2. Update your privacy policy

Your privacy policy isn’t a “set it and forget it” type of document. Companies should evaluate their privacy policy anytime data practices or privacy policies change. There’s no specific time that you need to update your privacy policy, so it may be helpful to set a calendar reminder every six months to evaluate and make any necessary changes.

3. Get express consent

An important aspect of GDPR includes the express consent of consumers. This means that companies must get permission to store a person’s information. As part of this, customers should also be able to remove consent easily as well.

Article 4 of the GDPR defines consent as “any freely given, specific, informed and unambiguous indication of a data subject’s wishes by which he or she, by a statement or by clear affirmative action, signifies agreement to the processing of personal data relating to him or her.”

There are a few specifications to gaining consent, including:

• The user must perform the action of giving consent. You cannot have a pre-checked box permitting the use of personal data. The user must check the box.
• Asking for consent must be its own question. It cannot be a part of other terms and conditions.
• Consent must be specific and include data such as:

It’s important that users can change their express consent at a later date.

4. Limit the personal data you collect

When collecting personal data from consumers, you should only collect data that applies to the task. Requiring additional information that’s not required to complete the task is a violation of the GDPR.

For example, if you’re an e-commerce store, you should only ask for the information necessary to process payment and ship the goods. Information such as social security numbers or other information outside of payment and order processing isn’t necessary.

Let’s say you’re signing users up for a newsletter. In this case, you should only require an email address and possibly their name. It’s not necessary to ask for their birth date, mailing address, etc.

5. Make sure personal data is protected

Now that you’ve received consent to a consumer’s personal information, you should take steps — and document those steps — to protect the data.

The GDPR requires that companies use “appropriate technical and organizational measures” to protect their customer’s data. These might include two-factor authentication for employees to access any customer data. Companies should also have other data security measures in place to protect data such as antivirus software and end-to-end encryption.

Companies should also conduct security training regularly to ensure that all employees understand data privacy policies.

6. Report data breaches

The final piece of the regulations set by the GDPR requires a company to notify a Data Protection Authority (DPA) or Data Protection Commission (DPC) within 72 hours of noticing a breach. Each country in the European Union has its own DPA, which are independent entities that investigate GDPR violations. A full list of each country’s DPA is available here.

Once the DPA is notified, the company should investigate the breach, understand the extent of it, and notify any customers whose data may have been jeopardized.

The GDPR also stipulates that the company should inform the data subject about the breach without delay. This means that the company needs to communicate with any customer whose data was breached and notify them of it immediately.

Types of GDPR fines

In Article 83 of the GDPR, the EU outlines the infractions and administrative fines that are a part of the GDPR. The regulations outline a set of criteria to understand the violation. These criteria also help determine in which tier the company’s infraction will be placed. The 10 criteria, according to the GDPR, include:

1. “Gravity and nature — The overall picture of the infringement. What happened, how it happened, why it happened, the number of people affected, the damage they suffered, and how long it took to resolve.
2. Intention — Whether the infringement was intentional or the result of negligence.
3. Mitigation — Whether the firm took any actions to mitigate the damage suffered by people affected by the infringement.
4. Precautionary measures — The amount of technical and organizational preparation the firm had previously implemented to be in compliance with the GDPR.
5. History — Any relevant previous infringements, including infringements under the Data Protection Directive (not just the GDPR), as well as compliance with past administrative corrective actions under the GDPR.
6. Cooperation — Whether the firm cooperated with the supervisory authority to discover and remedy the infringement.
7. Data category — What type of personal data the infringement affects.
8. Notification — Whether the firm, or a designated third party, proactively reported the infringement to the supervisory authority.
9. Certification — Whether the firm followed approved codes of conduct or was previously certified.
10. Aggravating/mitigating factors — Any other issues arising from circumstances of the case, including financial benefits gained or losses avoided as a result of the infringement.”

Each country has its own independent Data Collection Authorities who use the criteria to determine the fine associated with an infraction. The GDPR splits the infractions into two tiers, each with its own fine limitations.

The first tier carries a fine of up to 10 million euros ($10.5 million), or 2% of the company’s revenue from the prior year, whichever is greater. Tier 1 violations may include infractions that fall into the following Articles of the GDPR:

• Controllers and processors (Articles 8, 11, 25-39, 42, and 43)
• Certification bodies (Articles 42 and 43)
• Monitoring bodies (Article 41)

Tier 2 violations are more serious and carry increased fines up to 20 million euros ($21 million), or 4% of revenue from the previous year, whichever is greater. These violations may involve articles of the GDPR such as:

• The basic principles for processing (Articles 5, 6, and 9)
• The conditions for consent (Article 7)
• The data subjects’ rights (Articles 12-22)
• The transfer of data to an international organization or a recipient in a third country (Articles 44-49).

Tier 2 violations may also be levied because of the following:

• Any violation of member state laws adopted under Chapter IX, which gives EU states the ability to add additional data privacy restrictions. Violation of those additional restrictions may be a Tier 2 fine.
• Non-compliance with an order by a supervisory authority: If a company ignores or does not comply with requests by a GDPR authority, it may be subject to Tier 2 fines regardless of the original infraction.

What happens if you ignore GDPR fines?

Ignoring a GDPR fine or not complying with an investigation can result in an even greater financial penalty. Companies that ignore a fine and remain uncompliant with the GDPR could face Tier 2 fines because of it.

What are the 10 biggest GDPR fines of 2024?

In 2021, there were more than 8,700 fines for GDPR violations. Those infractions added up to more than 9 billion euros ($9.5 billion) in fines. So far in 2022, the fines continue to add up. Here are the biggest fines for 2022.

10 biggest GDPR fines 2024

Company	Country	Fine
Clearview AI Inc	Italy	€20 million ($21.1 million)
Meta Platforms Ireland Limited	Ireland	€17 million ($17.9 million)
Google LLC	Spain	€10 million ($10.5 million)
Clearview AI Inc	United Kingdom	€9 million ($9.5 million)
REWE International AG	Austria	€8 million ($8.4 million)
Cosmote Mobile Telecommunications S.A.	Greece	€6 million ($6.3 million)
Vodafone España, S.A.U.	Spain	€3.9 million ($4.1 million)
Dutch Tax and Customs Administration	Netherlands	€3.7 million ($3.9 million)
OTE Group	Greece	€3.2 million ($3.3 million)
Amazon Road Transport Spain S.L	Spain	€2 million ($2.1 million)

Data effective 06/17/2022.

Other notable GDPR infringements include:

• WhatsApp Ireland Ltd.: Fined 225 million euros ($229 million) in September 2021
• British Airways: Fined 22 million euros ($22.3 million) in October 2020
• TIM (an Italian telecommunications operator): Fined 27.8 million euros ($28 million) in January 2020

GDPR fine FAQs

Bottom line

The GDPR is the strictest data privacy regulation out there, and while it’s focused on the EU, it still plays an integral role for companies around the world.

The GDPR, and the fines that go along with it, are applicable to any company that does business in the EU. So if you sell goods or services in the EU, you should also comply with GDPR standards.

While the fines may seem daunting, the GDPR outlines the necessary protections to be compliant, including:

• A clear and concise privacy policy.
• Getting express consent from consumers.
• Only asking for information that’s necessary to the purpose of your business.
• Protecting the data that’s given to you.
• Reporting any data breaches in a timely manner.

Even if you don’t do business in the EU currently, following these data privacy practices will help give your customers peace of mind. For other privacy solutions for your business, here's our list of the best VPNs for small businesses.