You are here

Calculation guidelines on GDPR fines in Germany

26 September 2019 | Germany
Legal Briefings – By Dr. Simone Ziegler and Anna Rosón Eichelmann

Share

In our latest report, we informed you about new developments regarding imposed sanctions by Data Protection Authorities (“DPA”) in Germany and Austria and about a model for calculating fines imposed under the General Data Protection Regulation (“GDPR”) proposed by the Conference of the German “Independent Data Protection Supervisory Authorities of the Federal Government and the States” (Datenschutzkonferenz – “DSK”). The DSK is the joint coordination body of the German data protection authorities.

According to publicly available information, in a recent case, the Berlin DPA calculated the fine on the basis of this new model. After the DSK was requested to publish the guidelines, the DSK back-pedalled in a press release dated 17 September 2019 and declared its model as still in the draft stage which is still being further developed. According to the press release, the DSK is currently drawing up a concept for the imposition of fines for violations of the GDPR by companies with the aim of ensuring systematic, transparent and comprehensible allocation of fines. While the model shall be used as an accompanying measure in fine proceedings to assess its suitability and accuracy in practice, Article 83 GDPR shall prevail.

The DSK stated that the concept will be discussed at the Conference of the DSK on 6 and 7 November 2019. After prior examination, a decision will be taken on the publication of the guidelines for calculating fines under the GDPR.

At European level, negotiations are currently being conducted to develop a harmonised European approach, which will then be laid down, at least in principle, into a guideline to calculate fines. To this process, the DSK has already contributed its assessment considerations.

Dr. Simone Ziegler, data protection specialist in our Frankfurt office, says, “the DSK will not publish its model for the calculation of fines under the GDPR until November 2019. It remains to be seen whether the DSK will revise the model in the near future and whether fines which have already been calculated on the basis of the model will stand up."

Key Contacts