GDPR Enforcement Was Up in 2020. What Does That Mean for You In 2021?
After a relatively low number of enforcement actions in 2019, we saw a drastic increase of enforcement actions by DPAs across the EU in 2020. And considering some of the larger fines issued, DPAs (at least for the time being) are focusing on user consent.
February 17, 2021 at 07:00 AM
6 minute read
After more than two years, GDPR enforcement trends are beginning to emerge. We are seeing the types of enforcement actions that data protection authorities (DPAs) across the European Union (EU) are willing to undertake, as well as the profiles of the targets. In 2020 alone, DPAs issued 318 fines. That is 318 out of 471 GDPR files overall so far. In this alert, we summarize the lessons learned from GDPR enforcement in 2020, which has had the bulk of enforcement action. And we discuss what these actions could mean for companies in 2021.
|Who Should be Worried? Everyone
After a relatively low number of enforcement actions in 2019, we saw a drastic increase of enforcement actions by DPAs across the EU in 2020. These actions were, at times, substantial in amount and targeted both small and large organizations, especially those in the technology industry.
In fact, the Irish Data Protection Commission (IDPC)—one of the most active DPAs in the EU—has launched several investigations into various "Big Tech" firms. An investigation into Twitter's compliance with Articles 33(1) and 33(5) of the GDPR, concerning the company's notification obligation and accountability obligation relating to a January 2019 data breach resulted in a €450,000 fine. The IDPC also launched inquiries into Facebook's processing of children's data on Instagram and issued a formal notice regarding Facebook's Election Day Reminder feature. Though very few decisions have yet been issued, the IDPC is continuing to proceed with a large number of investigations against Big Tech companies, and while the pace of these investigations may not satisfy all GDPR critics, the sheer quantity shows how seriously the IDPC is taking GDPR enforcement, at least as it pertains to U.S. companies.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllLaw Firms Mentioned
Trending Stories
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250