The Changing Tides of Data Protection Regulation and Enforcement in Europe

The European Union’s General Data Protection Regulation (GDPR) is a comprehensive data protection and privacy framework implemented in May 2018. This paper analyzes the change in enforcement trends during the period from May 2018 to December 2021 across the European Union and within seven countries that are the largest EU GDPR enforcers: United Kingdom, France, Germany, Italy, Ireland, Luxembourg, and Spain. It examines GDPR enforcement trends from three different perspectives: 1.) the value, quantity, and severity of GDPR-related fines both across Europe and within each country, 2.) the GDPR provisions most frequently invoked when an EU data protection authority imposes a fine for noncompliance, and 3.) the sectors most heavily impacted for GDPR non-compliance. Using data from over 900 fines issued to date, several trends have recently emerged: the European Union has accelerated the issuance of fines, evidenced by the fact that the value of GDPR fines have quadrupled in the last year relative to the previous two years (totaling €1.32 billion to date). Further, countries that were previously less active in issuing fines initially, such as Ireland and Luxembourg, are now the forerunners in issuing substantial fines for GDPR non-compliance. Conversely, the United Kingdom, once the leader in issuing the largest fines across Europe, has declined in its issuance of fines for non-compliance relative to other major regulatory authorities. This paper also notes the impact the EU GDPR continues to have on U.S headquartered firms, particularly in the technology sector. In addition, certain EU members such as Germany, France, and Ireland have also branched out enforcement during this period to focus on large domestic firms or certain industry sectors such as e-commerce/retail, telecom services, medical services, and even government agencies.