GDPR flag lock

On May 25, 2018, the European Union's General Data Protection Regulation (GDPR) went into effect.

During the two-year preparation phase, after the bill was passed in April 2016, legal observers wondered how severely data commissioners would enforce the law. A little over a year and a half later, GDPR fines are rolling out, and it appears regulators aren't shy about penalizing companies they find at fault.

Although no company was hit with the maximum GDPR fine of 4% of the company's worldwide annual revenue, GDPR fines issued in 2019 were still a force to be reckoned with.

Below are the hotel chains, tech giants and airlines that faced significant GDPR fines in 2019.

France Takes the First Shot at US Tech

On Jan. 21 Google became the first U.S. tech company hit with a GDPR penalty, with France's Commission Nationale de l'Informatique et des Libertés (CNIL) imposing a €50 million ($55 million) fine against the tech giant. 

In its press release, CNIL said Google's alleged GDPR violations included a "lack of transparency, inadequate information and lack of valid consent regarding the ads personalization."

In the aftermath of the announcement, in-house counsel said the regulator's findings should serve as a "red flare" for corporations to double-check their data consent policies, according to a January Corporate Counsel article.

For Google's part, a mere two days after CNIL's announcement, the tech giant announced it would appeal the fine.

British Airways Breach Woes

The United Kingdom announced July 8 its intention to levy a £183.39 million ($230 million) fine on British Airways in the aftermath of the airliner's 2018 data breach that compromised 500,000 customers' personal data.

Although prospective British Airways clients were diverted to a fraudulent British Airways site where hackers siphoned personal data entered into the fake web page, the U.K.'s Information Commissioner's Office found information was ultimately compromised by "poor security arrangements at the company."

The ICO's press release noted unauthorized access or damage to personal data is more than an inconvenience.

"When you are entrusted with personal data you must look after it," said ICO Commissioner Elizabeth Denham in the press release. "Those that don't will face scrutiny from my office to check they have taken appropriate steps to protect fundamental privacy rights."

UK Takes Aim at Marriott

Before the dust could entirely settle after the British Airways announcement, the ICO dropped a proposed fine on Marriott a day later.

A year prior the hotel chain announced it was the victim of a cyber incident when the information of up to 500 million guests was compromised. Less than a year after the breach, the ICO proposed a £99 million ($124 million) fine for alleged GDPR violations. The ICO specifically said Marriott failed to "undertake sufficient due diligence when it bought Starwood [in 2016] and should also have done more to secure its systems," according to the regulator's press statement.

Lawyers contacted by Legaltech News at the time said the dual Marriott and British Airways announcements solidified a united approach to data privacy in the EU. 

When the U.K. announced its proposals for significant GDPR fines, the country was entwined in bitter Brexit debates. A softer approach on sanctions could have signaled the U.K. is more corporate-friendly, but it took a different stance, Ahmed Baladi, a Gibson, Dunn & Crutcher partner told Legaltech News at the time. 

"The ICO doesn't care about the political issues surrounding Brexit. What they are concerned about is that the GDPR and Data Protection Act are complied with by organizations operating in the U.K.," he said. "I think it's brave."

Deutsche Wohnen SE and Its 'Data Graveyard' Hit

On Oct. 30, real estate company Deutsche Wohnen SE was issued a €14.5 million ($16 million) fine for GDPR violations.

The Berlin commissioner for data protection and freedom of information alleged the company's archive system for personal data of tenants held onto data longer than needed, according to the regulator's press release.

The data included tenants' personal and financial information, such as salary, tax, Social Security and health insurance data and bank statements, according to the commissioner.

After the Berlin regulator in 2017 "urgently recommended" the company change its archiving system, in March 2019, the commissioner found it violated Article 25 (1) and Article 5 of the GDPR. Deutsche Wohnen's alleged archiving practices are a common occurrence in various companies, according to the regulator.

Berlin commissioner for data protection and freedom of information Maja Smoltczyk noted, "Sadly, in the course of our supervisory practice, we frequently come across data graveyards like the one we found at Duetsch Wohen SE."