Source: https://www.twobirds.com/en/news/articles/2019/netherlands/dutch-regulators-publishes-guidelines-for-the-calculation-of-administrative-fines-under-the-gdpr
Timestamp: 2019-04-20 06:16:38+00:00

Document:
On 14 March 2019, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens – 'AP') published new Guidelines on Administrative Fines 2019 (Boetebeleidsregels Autoriteit Persoongegevens 2019 – 'Guidelines'). It is a sign on the wall that the Dutch regulator is preparing itself for a new phase in its enforcement of the new data protection regime set by the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet Algemene Verordening Gegevensbescherming – ‘UAVG’). The publication of the Guidelines sends a clear message to organisations: fines are coming!
It is undeniable that part of the GDPR's fame and impact are due to its significant administrative fines for both data controllers and data processors. Violations of the provisions listed in Article 83(5) GDPR can be punished with a maximum fine of to 20 million euros or 4% of the total global turnover of the preceding fiscal year, whichever is higher. For other GDPR violations which are generally considered to be less serious, regulators may 'only' impose a fine up to 10 million euros or 2% of the global turnover. These momentous fines are often emphasized by EU regulators and data protection officers alike to promote and stimulate GDPR compliance.
When the fines and the enforcement regime are looked at in more detail however, it is not self-evident that such high fines will follow from just any violation of the GDPR. The leading principle from a European perspective is that administrative fines must be effective, proportionate and dissuasive. When deciding whether to impose an administrative fine and deciding on the amount of the fine, regulators must always consider the circumstances of each individual case.
Each EU regulator must consider a substantial number of non-exhaustive criteria when administering a fine, and all within the local legal system of administrative laws and traditions. It will come as no surprise that this leaves room for diverging practices and varying fines for comparable cases. In order to achieve a consistent approach for the application of the administrative fines, the European Data Protection Board ('EDPB') has published Guidelines on the application and setting of administrative fines for the purposes of the Regulation 2016/679 ("EDPB Guidelines") in January 2018. While these EDPB Guidelines shed more light on when to impose a fine and how to interpret the factors of Article 83(2), they do not contain guidance on how to set and calculate a fine for a particular case.
The new Guidelines replace the Guidelines Administrative Fines issued by the AP in 2016, which were based on the old Dutch Data Protection Act, the Wbp. In essence, the new guidelines continue and build on the 2016 guidelines, taking the GDPR into account.
* Only in case the legal maximum penalty of EUR 20.000.000/ 4% turnover applies.
This is in particular true in case of multiple violations caused by the same or linked processing activities. According to Article 10 of the Guidelines, the AP may then impose multiple fines up to the legal maximum of the most severe violation. Here, the Guidelines seem to leave the AP considerable freedom to determine the fine – with the constraint that the total amount of the fine always has to be proportionate considering the circumstances of the case.
If you want to know more about the new Guidelines or have other questions with regard to data protection, please feel free to reach out to one of our experts .
 Art. 83(5) GDPR refers to the basic principles for processing pursuant to art. 5, 6, 7 and 9; the data subjects' rights pursuant to art 12 - 22; transfers of personal data pursuant to art 44 - 49; any national obligations as adopted under Chapter IX; non-compliance with an order or a limitation on processing or the suspension of data flows by the DPA pursuant to art. 58(2) or failure to provide access in violation of art 58(1) GDPR.
 Guidelines on the application and setting of administrative fines for the purposes of the Regulation 2016/679, p. 17.

References: Art. 83
 art. 5
 art 12
 art 44
 art. 58
 art 58