EU Law and Practice Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
(Article 47, Charter). Data subjects must be informed of the progress or outcome of their complaint and have the right to challenge legally binding decisions or inaction before national courts (Articles 78–79, GDPR). Controllers must respond to data subject requests within one month, extendable by two further months where necessary (Article 12 (3), GDPR). Failure to respond may prompt a complaint and subsequent enforcement. In practice, national laws may provide for hearings, written submissions and settlement-like discussions during investigations, but there is no har - monised EU-level “transaction” mechanism; informal resolution or commitments may nevertheless influ - ence the authority’s choice of corrective measures. Sanctions and Remedies The GDPR provides for a harmonised regime of administrative fines (Article 83, GDPR), structured in two tiers: up to EUR10 million or 2% of the total world - wide annual turnover (Article 83 (4)), and up to EUR20 million or 4% of worldwide annual turnover (Article 83 (5)), whichever is higher. Fines must be effective, pro - portionate and dissuasive (Article 83 (1)). In addition, supervisory authorities may impose non-pecuniary corrective measures (Article 58 (2)). Member states may lay down additional penalties, including criminal sanctions, for infringements not subject to administra - tive fines or to supplement them (Article 84). Data subjects are entitled to compensation for mate - rial or non-material damage resulting from a GDPR infringement (Article 82). Controllers and processors may be held jointly and severally liable, subject to rights of recourse between them. Criteria for Setting Penalties Article 83 (2), GDPR lists the factors to be taken into account when deciding whether to impose a fine and determining its amount. These include: the nature, gravity and duration of the infringement; the number of data subjects affected and the level of damage; whether the infringement was intentional or negli - gent; actions taken to mitigate damage; the degree of responsibility, taking into account technical and organisational measures; previous infringements; co-operation with the authority; categories of per - sonal data involved; how the infringement became
known; compliance with prior measures; adherence to approved codes of conduct or certification mech - anisms; and any financial benefits gained or losses avoided. Recent CJEU case law (eg, Joined Cases C-683/21 and C-807/21, 5 December 2023) confirms that administrative fines require a culpable infringement (intentional or negligent conduct) attributable to the controller or processor. Overall, EU enforcement combines harmonised sub - stantive with national procedural frameworks. The system is designed to ensure consistent application across the Union, while preserving judicial oversight by national courts and, ultimately, the CJEU. 1.9 Enforcement Trends In the last 24 months, EU enforcement has centred on the accountability principle. National supervisory authorities and the CJEU increasingly require opera - tional compliance frameworks, not merely formal documentation. Accountability, Automated Decision-Making and Minimisation Recent CJEU case law has clarified fault require - ments for administrative fines in Deutsche Wohnen (C-807/21) and National Police of Latvia (C-683/21), strictly interpreted the prohibition on automated deci - sion-making in SCHUFA (C-634/21), and reinforced data minimisation and purpose limitation in Schrems v Meta (C-446/21). In its 4 October 2024 judgment in Schrems v Meta (C-446/21), the court held that large- scale, indefinite processing for behavioural advertising cannot be justified simply because some data was made public. Together, these rulings confirm that accountability and privacy by design/default (Articles 24–25 GDPR) are concrete, documented governance obligations. Practical takeaway GDPR compliance must function as embedded, risk- based governance infrastructure, evidenced in prac - tice.
94 CHAMBERS.COM
Powered by FlippingBook