Tessian Recognized as a Representative Vendor in 2021 Gartner Market Guide for Data Loss Prevention — Read more.

Request a Demo of Tessian Today.
Automatically stop data breaches and security threats caused by employees on email. Powered by machine learning, Tessian detects anomalies in real-time, integrating seamlessly with your email environment within minutes and starting protection in a day. Provides you with unparalleled visibility into human security risks to remediate threats and ensure compliance.

18 Biggest GDPR Fines of 2020 and 2021 (So Far)

  • 21 May 2021

Tessian’s mission is to secure the human layer by empowering people to do their best work, without security getting in their way.

The General Data Protection Regulation (GDPR) came into effect in May 2018. The GDPR allows the EU’s Data Protection Authorities to issue fines of up to €20 million ($24.1 million) or 4% of annual global turnover (whichever is higher).

For the GDPR’s first 18 months, things were a little quiet. Where were the huge fines everyone had been preparing for? While there were plenty of complaints and investigations, they rarely led to the multi-million or billion-dollar fines many had anticipated.

Well, more recently, things have got a lot busier for Data Protection Authorities across the EU (plus Iceland, Liechtenstein, Norway, and the UK, where the GDPR also applies). 

For example, according to research from DLA Piper, between January 26, 2020, and January 27, 2021:

  • GDPR fines rose by nearly 40%
  • Penalties under the GDPR totaled €158.5 million ($191.5 million)
  • Data protection authorities recorded 121,165 data breach notifications (19% more than the previous 12-month period)

And throughout the second quarter of 2021, we’ve seen the Spanish DPA (the AEPD) on an enforcement rampage, breaking its own personal “biggest fine” record multiple times.

Looking for information about achieving and maintaining compliance? We explore solutions for reducing email risk (the #1 threat vector according to security leaders) on this page.

The biggest GDPR fines of 2020 and 2021 (so far)

1. Google – €50 million ($56.6 million) 

Although Google’s fine is technically from 2019, the company appealed against it. In March 2020, judges at France’s top court for administrative law dismissed Google’s appeal and upheld the eye-watering penalty.

How the violation(s) could have been avoided: Google should have provided more information to users in consent policies and should have granted them more control over how their personal data is processed.

2. H&M — €35 million ($41 million)

On October 5, 2020 the Data Protection Authority of Hamburg, Germany, fined clothing retailer H&M €35,258,707.95 — the second-largest GDPR fine ever imposed.

H&M’s GDPR violations involved the “monitoring of several hundred employees.” After employees took vacation or sick leave, they were required to attend a return-to-work meeting. Some of these meetings were recorded and accessible to over 50 H&M managers.

Senior H&M staff gained ”a broad knowledge of their employees’ private lives… ranging from rather harmless details to family issues and religious beliefs.” This “detailed profile” was used to help evaluate employees’ performance and make decisions about their employment.

How the violation(s) could have been avoided: Details of the decision haven’t been published, but the seriousness of H&M’s violation is clear.

H&M appears to have violated the GDPR’s principle of data minimization — don’t process personal information, particularly sensitive data about people’s health and beliefs, unless you need to for a specific purpose.

H&M should also have placed strict access controls on the data, and the company should not have used this data to make decisions about people’s employment.

3. TIM – €27.8 million ($31.5 million)

On January 15, 2020 Italian telecommunications operator TIM (or Telecom Italia) was stung with a €27.8 million GDPR fine from Garante, the Italian Data Protection Authority, for a series of infractions and violations that have accumulated over the last several years. 

TIM’s infractions include a variety of unlawful actions, most of which stem from an overly-aggressive marketing strategy. Millions of individuals were bombarded with promotional calls and unsolicited communications, some of whom were on non-contact and exclusion lists.  

How the violation(s) could have been avoided: TIM should have managed lists of data subjects more carefully and created specific opt-ins for different marketing activities.  

4. British Airways – €22 million ($26 million)

In October, the ICO hit British Airways with a $26 million fine for a breach that took place in 2018. This is considerably less than $238 million dollar fine that the ICO originally said it intended to issue back in 2019.  So, what happened back in 2018?

British Airway’s systems were compromised. The breach affected 400,000 customers and hackers got their hands on log in details, payment card information, and PI like travellers’ names and addresses.  

How the violation(s) could have been avoided: According to the ICO, the attack was preventable, but BA didn’t have sufficient security measures in place to protect their systems, networks, and data. In fact, they didn’t even have basics like multi-factor authentication in place at the time of the breach. Going forward, the airline should take a data-first security approach, invest in security solutions, and ensure they have strict data privacy policies and procedures in place.

5. Marriott – €20.4 million ($23.8 million)

While this is an eye-watering fine, it’s actually significantly lower than the $123 million fine the ICO originally said they’d levy. So, what happened? 383 million guest records (30 million EU residents) were exposed after the hotel chain’s guest reservation database was compromised. PI like guests’ names, addresses, passport numbers, and payment card information was exposed. 

Note: The hack originated in Starwood Group’s reservation system in 2014. While Marriott acquired Starwood in 2016, the hack wasn’t detected until September 2018.

How the violation(s) could have been avoided: The ICO found that Marriott failed to perform adequate due diligence after acquiring Starwood. They should have done more to safeguard their systemswith a stronger data loss prevention (DLP) strategyand utilized de-identification methods. 

6. Wind — €17 million ($20 million)

On July 13, Italian Data Protection Authority imposed a fine of €16,729,600 on telecoms company Wind due to its unlawful direct marketing activities.

The enforcement action started after Italy’s regulator received complaints about Wind Tre’s marketing communications. Wind reportedly spammed Italians with ads — without their consent — and provided incorrect contact details, leaving consumers unable to unsubscribe.

The regulator also found that Wind’s mobile apps forced users to agree to direct marketing and location tracking and that its business partners had undertaken illegal data-collection activities. 

How the violation(s) could have been avoided:Wind should have established a valid lawful basis before using people’s contact details for direct marketing purposes. This probably would have meant getting consumers’ consent — unless it could  demonstrate that sending marketing materials was in its “legitimate interests.”

For whatever reason you send direct marketing, you must ensure that consumers have an easy way to unsubscribe. And you must always ensure that your company’s Privacy Policy is accurate and up-to-date.

7. Notebooksbilliger.de — €10.4 million ($12.5 million)

German electronics retailer notebooksbilliger.de (NBB) received this significant GDPR fine on January 8, 2021. The penalty relates to how NBB used CCTV cameras to monitor its employees and customers.

The CCTV system had been running for two years, and NBB reportedly kept recordings for up to 60 days. NBB said it needed to record its staff and customers to prevent theft. The Lower Saxony DPA said the monitoring was an intrusion on its employees’ and customers’ privacy.

NBB is disputing the fine.

How the fine could have been avoided: The NBB’s fine reflects strict attitudes towards CCTV monitoring in parts of Germany. The regulator said NBB’s CCTV program was not limited to a specific person or period.

Using CCTV isn’t prohibited under the GDPR, but you must ensure it is a legitimate and proportionate response to a specific problem. The UK’s ICO has some guidance on using CCTV in a GDPR-compliant way.

8. Vodafone Spain — €8.15 million ($9.72 million)

Vodafone’s €8.15 million fine, issued by the Spanish DPA (the AEPD) on March 11, 2021, is actually made up of four fines for violating the GDPR and other Spanish laws covering telecommunications and cookies.

The Vodafone fine stands as Spain’s biggest yet—in a year that has seen the AEPD issue several substantial GDPR penalties.

The fine results from 191 separate complaints regarding Vodafone’s marketing activity. Vodafone was alleged not to have taken sufficient organizational measures to ensure it was processing people’s personal data lawfully.

How the fine could have been avoided: Vodafone’s complex series of legal violations all appear to have one thing in common: a lack of organization and control over personal data used for marketing purposes.

Whenever you outsource any processing activity to a third party—for example, a marketing agency—you must ensure you have a clear legal basis for doing so. 

Keep clear records, maintain data processing agreements with contractors, and regularly audit your processing activities to ensure they are lawful.

9. Google – €7 million ($7.9 million)

2020 was not a good year for Google. In March, the Swedish Data Protection Authority of Sweden (SDPA) fined Google for neglecting to remove a pair of search result listings under Europe’s “right to be forgotten” rules under the GDPR, which the SDPA ordered the company to do in 2017. 

How the violation(s) could have been avoided: Google should have fulfilled the rights of data subjects, primarily their  right to be forgotten. This is also known as the right to erasure. How? By “ensuring a process was in place to respond to requests for erasure without undue delay and within one month of receipt.” 

You can find more information about how to comply with requests for erasure from the ICO here

10. Caixabank — €6 million ($7.2 million)

This fine against financial services company Caixabank is the largest fine ever issued by the Spanish DPA (the AEPD). 

The AEPD finalized Caixabank’s penalty on January 13, 2021, breaking Spain’s previous record GDPR fine, against BBVA — issued just one month earlier. This suggests a significant toughening of approach from the Spanish DPA.

The first issue, which accounts for €4 million of the total fine, related to how Caixabank established a “legal basis” for using consumers’ personal data under Article 6. Second, Caixabank was fined €2 million for violating the GDPR’s transparency requirements at Articles 13 and 14. 

How the fine could have been avoided:The AEPD said Caixabank relied on the legal basis of “legitimate interests” without proper justification. Before you rely on “legitimate interests,” you must conduct and document a “legitimate interests assessment.” 

The company also failed to obtain consumers’ consent in a GDPR-compliant way. If you’re relying on “consent,” make sure it meets the GDPR’s strict “opt in” standards.

The AEPD criticized Caixabank’s privacy policy as providing vague and inconsistent information about its data processing practices. Make sure you use clear language in your privacy notices and keep them consistent across websites and platforms.

11. BBVA (bank) — €5 million ($6 million)

This fine against financial services giant BBVA (Banco Bilbao Vizcaya Argentaria) dates from December 11, 2020. 

The BBVA’s penalty is the second biggest that the Spanish DPA (the AEPD) has ever imposed, and it shares many similarities with the AEPD’s largest-ever penalty, against Caixabank, issued the following month.

Taken together with the record fine against Caixabank, it’s tempting to conclude that the Spanish DPA has its eye on the GDPR compliance of financial institutions.

How the fine could have been avoided: The AEPD fined BBVA €3 million for sending SMS messages without obtaining consumers’ consent. In most circumstances, you must ensure you have GDPR-valid consent for sending direct marketing messages.

The remaining €2 million of the penalty related to BBVA’s privacy policy, which failed to properly explain how the bank collected and use its customers’ personal data. Make sure you include all the necessary information under Articles 13 and 14 in your privacy policy.

12. Fastweb — €4.5 million ($5.5 million)

Italy’s DPA (the Garante) fined telecoms company Fastweb €4.5 million on April 2 2021 for engaging in unsolicited telephone marketing without consent.

In particular, the Garanta noted that Fastweb was using “fraudulent” telephone numbers that the company had not registered with Italy’s Register of Communication Operators.

How the fine could have been avoided:Fastweb’s fine derives from telemarketing rules that are set out in Italy’s implementation of the ePrivacy Directive, rather than the GDPR. However, the company still appears to have violated the GDPR by failing to obtain valid consent.

It’s important to remember this interplay between the EU’s main privacy laws. The ePrivacy Directive requires you to obtain consent for certain activity, but the GDPR sets the standard of consent—and the standard is very high.

13. EDP Energia — €1.5 million (€1.83 million)

Spain’s AEPD fined energy provider EDP Energia €1.5 million on May 4 2021. 

The AEPD’s penalty is yet another example of a fine issued for the failure to obtain proper consent for direct marketing activities. However, the AEPD made some additional criticisms of EDP Energia that are important to note.

Firstly, the AEPD said that EDP Energia failed to implement the principles of “data protection by design and by default,” as is required under Article 25 of the GDPR.

EDP Energia also allegedly failed to provide proper notice to people whose personal data it had obtained via contractors, as is required under Article 13 of the GDPR.

How the fine could have been avoided: The GDPR’s concept of “data protection by design and by default” means always implementing privacy and respect for personal data into your operations. 

Whether you’re developing a piece of software or working with a contractor to collect your customers’ email addresses, you must consider the most privacy-respecting manner in which to do so.

Then there’s the issue regarding EDP Energia’s apparent failure to provide notice pursuant to Article 13 of the GDPR. Providing people with information about how you’ll be using their personal data is one of the essential duties of a data controller.

Providing notice is easiest when you collect someone’s personal data directly. But if you’re asking a contractor to collect people’s personal data on your behalf, you’ll still need to find a way to present them with a privacy notice as soon as reasonably possible.

14. AOK (Health Insurance) — €1.24 million ($1.5 million)

On June 30, the Data Protection Authority of Baden-Wuerttemberg, Germany, imposed a €1.24 million fine on health insurance company Allgemeine Ortskrankenkasse (AOK). 

AOK set up contests and lotteries using its customers’ personal information — including their health insurance details. The company also used this data for direct marketing. AOK tried to get consent for this, but it ended up marketing to some users who had not consented.

The regulator found that the company had sent people marketing communications without establishing a lawful basis. AOK also failed to implement proper technical and organizational privacy safeguards to ensure they only sent marketing to those who consented.

How the violation(s) could have been avoided: What’s the main takeaway from the AOK case? Be very careful when sending direct marketing. If you need people’s consent, make sure you keep adequate, up-to-date records of who has consented.

15. Equifax Iberica — €1 million (€1.22 million)

Spain’s AEPD fined Equifax €1 million on April 26, 2021. The company collected information from public records and used it to build a database of people with alleged debts without obtaining their consent.

The AEPD noted that although the personal data was publicly available, Equifax’s further processing of the data lacked a lawful basis—and was not compatible with the purposes for which the data was originally collected. Some of the data was also inaccurate, which put data subjects at risk of unfairness.

How the fine could have been avoided: Publicly available data is not “fair game” under the GDPR. Equifax should have ensured it had a valid legal basis for processing the personal data of people listed on public registers. 

The GDPR also has strict rules about the further processing of personal data for new purposes. Equifax should only have proceeded with the processing operation if it could show that its purposes were compatible with the context for which the personal data was collected.

16. BKR (National Credit Register) — €830,000 ($973,000)

On July 6, the Dutch Data Protection Authority fined the Bureau Krediet Registration (‘BKR’) €830,000 for charging individuals to access their personal information digitally. BKR allowed customers to access their personal information for free on paper, but only once per year.

BKR is appealing the fine.

How the violation(s) could have been avoided: BKR shouldn’t have been charging individuals to access their personal information, and they shouldn’t have been imposing a once-per-year limit. The GDPR is clear — you may only charge for access to personal information, or refuse access, if a person’s request is “manifestly unfounded or excessive.”

17. Iliad Italia — €800,000 ($976,000)

On July 13, the Italian Data Protection Authority fined telecoms company Iliad Italia €800,000 for processing its users’ personal information unlawfully in numerous ways.

One issue was Iliad’s collection of consent for its marketing activities, which the regulator found had been “bundled” with an acknowledgment of the company’s terms and conditions. Iliad also failed to store its users’ communications data securely.

How the violation(s) could have been avoided: Consent under the GDPR is defined very narrowly. If you’re going to ask for a person’s consent, you must make it specific to a particular activity. Don’t “bundle” your consent requests — for example, by asking people to agree to marketing and sign a contract using one tickbox.

Data security is one of the cornerstones of the GDPR. Iliad appears to have failed to implement proper access controls on its users’ personal information. You must ensure that personal information is only accessible on a “need to know” basis.

18. Unknown – €725,000 ($821,600)

In April, the Dutch Data Protection Authority handed out its largest fine to date to a so-far unknown company for unlawfully using employees’ fingerprint scans for its attendance and timekeeping records. The violation took place over the course of 10 months. Note: Under the GDPR, biometric data like fingerprints are classified as sensitive personal data and it is subject to more stringent protections. 

How the violation(s) could have been avoided: The company should have had a valid, lawful reason to collect employees’ fingerprints. They should have also had technical measures in place to process the data and a clear process for deleting the data. 

What else can organizations be fined for under GDPR? 

While the biggest fines so far in 2020 involve marketing activities, failure to remove personal data when requested by EU citizens, and unlawfully requiring employees to have their biometric data recorded, there are a number of ways in which a breach can occur. 

In fact, so far this year, misdirected emails have been the primary cause of data loss reported to the ICO. But, how do you prevent an accident? By focusing on people rather than systems and networks.

How does Tessian help organizations stay GDPR compliant?

“Tessian exceeded the expectations of our GDPR team. You simply cannot beat seeing for yourself what the product is capable of against your own organization’s data.”
Mark Elias IT Infrastructure Manager at Coastal Housing

Powered by machine learning, Tessian’s Human Layer Security technology understands human behavior and relationships, enabling it to automatically detect and prevent anomalous and dangerous activity, including misdirected emails. Tessian also detects and prevents spear phishing attacks and data exfiltration attempts on email

Importantly, though, Tessian doesn’t just prevent breaches. Tessian’s key features – which are both proactive and reactive – align with the GDPR requirement “to implement appropriate technical and organizational measures together with a process for regularly testing, assessing and evaluating the effectiveness of those measures to ensure the security of processing” (Article 32).

To learn more about how Tessian helps with GDPR compliance, you can check out this page, our customer stories or book a demo

[if lte IE 8]
[if lte IE 8]