Kemp Little
  • Looking for someone?
  • Email us
  • Search
MENU MENU
Insights overview

Data protection & privacy · 15 October 2019 · Marta Dunphy-Moriel · Alex Dittel

The maths behind GDPR fines

The Conference of German data protection authorities DSK has proposed a model for calculating fines.

All details have not yet been published but the model is understood to consist of a number of steps.

  • Step 1 involves establishing a daily rate by looking at the aggregate global annual revenue of the entire group of the offending company.
  • Step 2 is a severity level assessment. A range of multipliers is determined for minor, average, severe or very severe breaches. The multipliers are then applied to the daily rate which gives a range of possible fines. The median value of that range is then taken to the next step.
  • In step 3 the nature of the offence and consequences are considered, such as duration and nature of the offence, number of affected individuals and the extent of harm. Scores from 0 – 4 are assigned and used to determine any resulting increases or decreases.
  • Step 4 considers culpability and conduct and allows for increases of up to 300% for repeat offenders and reductions of up to 25%.
  • In the final step, aggravating or mitigating factors are considered and an assessment is made whether the fine is effective, proportionate and dissuasive.

The model, which is championed by the authority in Berlin, is reported to have gained interest with the European Data Protection Board.

Those in favour of the model defend that a transparent and systematic fine calculation model will certainly be welcomed by the private sector and regulators. Those sceptical about it question if it is fit to be proportionate and adapt to every scenario as well as raising concerns that the use of this model could lead to higher fines for companies with higher group income.

How this programmatic model will operate in the different legal systems remains to be analysed and may bring some challenges (for example, determining how the model will take into account binding case law and precedent in those jurisdictions where jurisprudence is a source of law).

In any case, any fine that is not effective, proportionate and dissuasive can be subject to judicial review.

  • Share this blog

  • Twitter
  • Facebook
  • Linkedin

Need to talk about this?

Marta Dunphy-MorielMarta Dunphy-Moriel

Alex DittelAlex Dittel

Get in touch

Sign up for our newsletters

  • Share this Blog

  • Twitter
  • Facebook
  • Linkedin

Other stuff you might like


    Notice: Undefined variable: show_default in /home/kemplittle/test.kemplittle.com/wp-content/themes/kemplittle/single.php on line 349
  1. Podcast | DPO Update: ICO on direct marketing, scientific research opinion, CCTV and fines
  2. From Denmark with love: Our analysis of the new Danish standard contractual clauses
  3. Podcast | DPO Update: Joint controller status, cookies guidance, DP by Design and Default and latest fines
The hottest topics in technology
  • Adtech & martech
  • Agile
  • Artificial intelligence
  • Brexit
  • Cloud computing
  • Complex & sensitive investigations
  • Connectivity
  • Cryptocurrencies & blockchain
  • Cybersecurity
  • Data analytics & big data
  • Data breaches
  • Data rights
  • Digital commerce
  • Digital content risk
  • Digital health
  • Digital media
  • Digital infrastructure & telecoms
  • Emerging businesses
  • Financial services
  • Fintech
  • Gambling
  • GDPR
  • KLick DPO
  • Open banking
  • Retail
  • SMCR
  • Software & services
  • Sourcing
  • Travel
close
The hottest topics in technology
  • Adtech & martech
  • Agile
  • Artificial intelligence
  • Brexit
  • Cloud computing
  • Complex & sensitive investigations
  • Connectivity
  • Cryptocurrencies & blockchain
  • Cybersecurity
  • Data analytics & big data
  • Data breaches
  • Data rights
  • Digital commerce
  • Digital content risk
  • Digital health
  • Digital media
  • Digital infrastructure & telecoms
  • Emerging businesses
  • Financial services
  • Fintech
  • Gambling
  • GDPR
  • KLick DPO
  • Open banking
  • Retail
  • SMCR
  • Software & services
  • Sourcing
  • Travel
Kemp Little

Lawyers
and thought leaders who are passionate about technology

Expand footer

Kemp Little

138 Cheapside
City of London
EC2V 6BJ

020 7600 8080

hello@kemplittle.com

Services

  • Commercial technology
  • Consulting
  • Disputes
  • Intellectual property
  • Employment
  • Immigration

 

  • Sourcing
  • Corporate
  • Data protection & privacy
  • Financial regulation
  • Private equity & venture capital
  • Tax

Sitemap

  • Our people
  • Insights
  • Events
  • About us
  • Contact us
  • Cookies
  • Privacy
  • Terms of use
  • Compliants
  • Debt recovery charges

Follow us

  • Twitter
  • LinkedIn
  • FlightDeck
  • Sign up for our newsletters

Kemp Little LLP is a limited liability partnership registered in England and Wales (registered number OC300242) and is authorised and regulated by the Solicitors Regulation Authority. Its registered office is 138 Cheapside, London EC2V 6BJ. The SRA Standards and Regulations can be accessed by clicking here.

  • Cyber Essentials logo
  • Tech Nation logo
  • LORCA logo
  • ABTA Partner+ logo
  • Make Your Ask logo
  • FT Innovative Lawyers 2019 winners logo
  • Law Society Excellence Awards shortlisted
  • Legal Business Awards = highly commended
  • Home
  • Our people
  • Services
    • Commercial technology
    • Consulting
    • Corporate
    • Data protection & privacy
    • Disputes
    • Employment
    • Financial regulation
    • Immigration
    • Innovation
    • Intellectual property
    • Private equity & venture capital
    • Sourcing
    • Tax
  • Insights
  • Quick reads
  • Events
  • About us
    • Who we are
    • Our social responsibilities
    • Our partnerships
    • Join us
  • Contact us
  • FlightDeck
  • LORCA
  • Sign up for our newsletters
  • Follow us
    • Twitter
    • LinkedIn
close
close
close

Send us a message

Fill in your details and we'll be in touch soon


Notice: Trying to get property of non-object in /home/kemplittle/test.kemplittle.com/wp-content/plugins/contact-form-7-dynamic-text-extension/contact-form-7-dynamic-text-extension.php on line 330

close

Sign up for our newsletter

I would like to receive updates and related news from Kemp Little *

Please select from the areas of interest below.

Themes

Services

Please select below any publications that you would like to receive:

Newsletters

close

Register for future event information

close
close
Looking for someone?
Generic filters
Exact matches only

Can't remember their name? View everyone

  • Home
  • Our people
  • Services
    • Commercial technology
    • Consulting
    • Corporate
    • Data protection & privacy
    • Disputes
    • Employment
    • Financial regulation
    • Immigration
    • Innovation
    • Intellectual property
    • Private equity & venture capital
    • Sourcing
    • Tax
  • Insights
  • Quick reads
  • Events
  • About us
    • Who we are
    • Our social responsibilities
    • Our partnerships
    • Join us
  • Contact us
  • FlightDeck
  • LORCA
  • Sign up for our newsletters
  • Follow us
    • Twitter
    • LinkedIn