Finance sector has received the most GDPR fines to date

Auditing and accounting firm Mazars has released a report which analyses the number of GDPR fines issued so far, with the financial services industry finding themselves at the top of the list.

The GDPR came into force in May 2018, changing the legislation for data protection, and applies to all companies operating in the EU.

According to the report, there have been a total of 68 fines across 20 countries, with Czech Republic, Germany and Hungary incurring the highest number of fines, at 9 each. Eight countries, Ireland, Croatia, Estonia, Finland, Luxembourg, Switzerland, Slovakia and Slovenia, have not yet issued any fines. 40% of the countries who have so far issued fines have only issued one.

The data also includes an analysis of the sectors which have been subjected to fines, and the financial services industry has received the most, with a total of 11 fines. Professional services and the public sector are the next highest on the list, with 7 and 5 respectively.

Non-compliance in the processing of personal data provoked the most fines, and accounted for 41 fines in total, each fine averaging €340 million. Discordance in lawfulness of processing data – having a good reason to process personal data – resulted in 23 fines, while failing to report a breach, or reporting incorrectly, prompted 3 fines.

15 companies were fined an average of €21 million for breaching data security rules, but its not just companies that have been in the firing line. Private citizens are also bound to GBPR rules, with 4 fines being administered to individuals.

The large number of fines issued for non-compliance of data processing could simply be due to the infancy of the GDPR are companies not yet being fully conversant with the legislation. Over time, the trends in reasons for charges will likely be different as companies settle into the new rules. Mazars Ireland partner, Liam McKenna states “this pattern may change as organisations become more familiar with the new rules.”