GDPR Photo: Wright Studio/Shutterstock

Fines imposed under the European Union's General Data Protection Regulation have been relatively low and infrequent. But companies need to prepare for bigger penalties as authorities throughout Europe bolster enforcement efforts and clarify how fines are calculated and imposed. 

"As things develop, as years go by and those holes are understood, it's going to get harder for those companies to say, 'We didn't really understand or know,'" said Kevin Levy, a partner at GrayRobinson's Miami office who chairs the firm's technology transactions practice. 

Since the GDPR took effect in May 2018, data protection regulators have imposed about $126 million in total reported fines, "which is quite low given that supervisory authorities enjoy the power to fine up to 4% of total worldwide annual turnover the preceding financial year," according to a new survey from DLA Piper. 

The report, which notes that not all GDPR fines are made public, cautions that regulators throughout Europe "have been staffing up their enforcement teams and getting to grips with the new regime. It takes time to build a robust case to justify higher fines." The report's authors could not be immediately reached for comment.

With potentially more painful GDPR fines on the horizon, companies that want to avoid getting dinged need to implement and maintain programs to map the personal data that they collect, store and share, Levy said.

"If you want to protect yourself you need to have a program in place that upper management has bought into," he said. "If upper management hasn't bought in, it's not going to get the funding and support it needs and the people below aren't going to take it seriously." 

He added that companies also need to remain vigilant as undeveloped parts of the GDPR are being exposed. For instance, hackers are using the GDPR to request personal information for other people and exploiting companies that lack the ability to identify scammers. 

"They don't even have to hack into your system," Levy said. "They just have to follow the [GDPR] rules." 

Breach notifications across the EU have increased from an average of 247 per day during the first eight months that the GDPR was in effect to 278 notifications per day, a 12.6% bump, from Jan. 28, 2019, to Jan. 27 of this year.  

Last year saw several big companies, including Google, British Airways, Marriott International Inc. and Deutsche Wohnen SE, face significant fines for alleged GDPR infractions. Google, which was fined $55 million for violations related to personalized ads, has vowed to appeal, a move that "will become much more common" as long as the GDPR rules are murky, the survey states.

DLA Piper predicts that it will take "several years if not a decade—before a standard methodology starts to emerge from the jurisprudence of Member State courts, from the European Court of Justice and from the European Data Protection Board."

Read More: 

4 Companies That Were on the GDPR's 2019 Naughty List

GDPR-Based Objections to U.S. Discovery Requests: 2019 Year in Review

Data Privacy: Building Compliant and Adaptable Systems