During the plenary meeting of the European Data Protection Board (EDPB) held on May 24, 2023, EDPB adopted a final version of the Guidelines 04/2022 on the calculation of administrative fines following public consultation. These guidelines aim to harmonise the methodology data protection authorities (DPAs) use to calculate fines and include harmonised ‘starting points’. Hereby, three elements are considered: the categorisation of infringements by nature, the seriousness of the infringement and the turnover of a business. The guidelines set out a 5-step methodology, taking into account the number of instances of sanctionable conduct, possibly resulting in multiple infringements; the starting point for the calculation of the fine; aggravating or mitigating factors; legal maximums of fines; and the requirements of effectiveness, dissuasiveness and proportionality.
Following public consultation, an annex was added with a reference table summarising the methodology and two examples of practical application. As explained in the reading guide, the table and the examples are for illustration purposes only and have to be read in conjunction with the Guidelines. The guidelines are an important addition to the framework the EDPB is building for more efficient cooperation among DPAs on cross-border cases, a strategic priority for the EDPB.
The Guidelines 04/2022 on the calculation of administrative fines are published here.
