Within analysis of the system of sanctions in GDPR, focus is usually set on the significant figures provided for by article 83, which succeeds reaching Controllers and Processors with administrative fines up to 20 millions euro or up to 4% of global annual turnover.
Article 83 General conditions for imposing administrative fines
…
4. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:
…
5. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:
…
6. Non-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance with paragraph 2 of this Article, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.
…
In reality, as already established by current legislation, supervisory authorities have several correctional powers provided for by article 58. Such powers provide among others the possibility of limiting or banning data processing.
Economic consequences of such dispositions could be even more severe than those deriving from administrative sanctions.
The impossibility of processing data might involve, as an example, the suspension of the supply of services to the customers, with possible consequence of legal actions on their behalf.
Thus, if administrative sanctions may have economic and reputational consequences, actions provided by for article 58 may also imply risks for own survival of the company.
Article 58 Powers
…
2. Each supervisory authority shall have all of the following corrective powers:
(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;
(b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;
(c) to order the controller or the processor to comply with the data subject’s requests to exercise his or her rights pursuant to this Regulation;
(d) to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;
(e) to order the controller to communicate a personal data breach to the data subject
(f) to impose a temporary or definitive limitation including a ban on processing;
(g) to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19;
(h) to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met;
(i) to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case
(j) to order the suspension of data flows to a recipient in a third country or to an international organisation.
Lastly, single States may define, according to article 84 of GDPR, further sanctions they intend to establish. This by May 25th 2018.
A system of penalties thus very articulated, which is however vital to know for an adequate economic evaluation of non-compliance risks, also with the purpose to assess appropriate investments to comply with law.
Article 84 Sanctions
1. Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. Such penalties shall be effective, proportionate and dissuasive.
2. Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.