EDPB adopts guidelines on imposing GDPR administrative fines

The EDPB has adopted guidelines to harmonise the methodology for determining whether an administrative fine should be imposed in addition to, or instead of, the other corrective measures under Article 58(2) GDPR.

The European Data Protection Board (EDPB) has adopted these guidelines to harmonise the methodology for determining whether an administrative fine should be imposed – in addition to, or instead of, the other corrective measures under Article 58(2) GDPR.

The guidelines outline a five-step methodology: check if the infringement can lead to a fine, if the party can be fined, if the infringement was intentional or negligent, if factors indicate a minor infringement, and if a fine would be effective, proportionate and dissuasive.

The EDPB has outlined the following methodology, consisting of five steps, for determining whether an administrative fine should be imposed for an infringement of the GDPR.

A culpable infringement, committed intentionally or negligently, is a condition for imposing an administrative fine.

In the third step, the supervisory authority will assess whether the established infringement has been committed intentionally or negligently, since a culpable infringement is a condition for the imposition of an administrative fine.

In a case of a minor infringement, a reprimand may be issued instead of a fine.

Furthermore, as follows from Recital 148 GDPR, in a case of a minor infringement, a reprimand may be issued instead of a fine.

If the infringement is not considered minor, there is a strong presumption to impose an administrative fine.

Conversely, if the infringement is not considered minor, there is a strong presumption to impose an administrative fine.