Guidelines for fines in Germany published

In the case of groups of companies with an annual turnover of more than 500 million euros, this comes close to the limitations of a fine pursuant to Art. 83 para 4 or para 5 and 6 GDPR: Seven times the daily rate for very severe formal infringements corresponds to 1.9%, 13 times the annual rate for very severe material infringements corresponds to 3.6% of the annual turnover, whereas DGPR provides for a fine of 2% an 4% respectively.

The fine calculated in this way will be adjusted to the individual case, taking into account perpetrator-related circumstances of Art. 83 para 2 GDPR as well as other circumstances such as long proceedings or the threat of insolvency of the company.

In particular, it can be criticized that the determination of the basic economic value is not made directly from the annual turnover of the companies concerned. Rather, comparable companies or groups of companies are grouped into a total of 20 clusters. The daily rate is then the same for all companies within a cluster. Thus, in the smallest cluster, a simple formal data protection infringement leads to the same fine of 972.00 EUR for a microenterprise with an annual turnover of 70,000.00 EUR as for a small enterprise with an annual turnover of 700,000.00 EUR. Thus, the focus on the annual turnover is not implemented here: a direct calculation of the daily rate for both companies would rather lead to fines of 194.00 EUR and 1,944.00 EUR respectively.

In addition, the concept of calculating the daily rate is excessively broad, while the assessment of the degree of seriousness of the offence relevant to the factor or the influence of perpetrator-related circumstances is practically only mentioned. Finally, despite these guidelines, there is still considerable room for the supervisory authority to maneuver, which can lead to a quadrupling of the fine in the case of minor material infringements, for example.

In any event, the German supervisory authorities make it clear that they intend to link the amount of fines in particular to the turnover of those responsible. Further differentiation by the supervisory authorities will have to be observed. Nevertheless, there are already gaps in the approach presented here.