DSK data protection fine concept

Background data protection fine concept

Since the entry into force of the GDPR In May 2018, numerous fines were already enforced against data protection violations. So far, however, the calculation of the fines has been rather non-transparent and not very comprehensible. For this reason, the European supervisory authorities and the European Data Protection Board (EDSA) are working on concepts for fines to ensure more transparency.

The German concept of fines was developed as a reaction to the model of the French data protection authority CNIL, which seemed too incomprehensible and too case-specific to the German supervisory authorities. As a result, the German model was developed with considerably more comprehensive calculation steps. The German fine model was presented to the Task Force Fining of the European Data Protection Board (EDPB) and met with interest. In particular, as the concept would ensure a systematic, transparent and comprehensible calculation of fines.

Content of the data protection fine concept

The calculation of the fines is essentially based on 5 assessment criteria, which are defined in the DSK's concept will be explained in more detail.

Calculation criteria:

• The enterprise concerned is first allocated to a size class.
• The average annual turnover of the size class subgroup is determined.
• A basic economic value (daily rate) is then determined.
• Depending on the gravity of the circumstances of the crime, the basic value is multiplied by a factor.
• Finally, the value determined is adjusted if there are other circumstances to be taken into account.