According to the report, the EDPB’s case register in 2024 included 350 cross-border cases, which, along with the procedures initiated under the so called “one-stop-shop” mechanism, underscored “the high degree of coordination among DPAs in tackling complex, cross-jurisdictional data protection issues.”
The fines levied in the EU as a result of local authorities’ enforcement efforts totalled more than €1.2bn ($1.4bn).
In addition to a table breaking down the fines by jurisdiction, the report includes a “non-exhaustive” list of national enforcement actions.
Three very large fines, two by the Irish DPA against Meta and LinkedIn at €91m ($103m) and €310m ($352m) respectively and one by the Dutch DPA against Uber at €290m ($329m) account for approximately 55% of the fines levied in the Bloc.
The German DPA led in terms of activism with 416 enforcement decisions handed down, but was in seventh place when it came to the total number of fines levied, which came in at a modest total of over €13m ($15m).
The Italian DPA was active in 2024 with 140 enforcement decisions and with over €145m ($165m) in fines levied. It is unclear why the sizeable fine levied by the Garante against Enel Energia SpA at approximately €79m ($90m) did not make the case list included in the document in this instance.
| Country | # Decisions | EUR | USD |
|---|---|---|---|
| Ireland | 7 | 652,029,500 | 740,672,911 |
| Netherlands | 16 | 328,030,000 | 372,625,679 |
| Italy | 140 | 145,332,449 | 165,090,395 |
| France | 87 | 55,212,400 | 62,718,526 |
| Spain | 281 | 35,592,200 | 40,430,960 |
| Germany | 416 | 13,802,044 | 15,678,432 |
| Sweden | 6 | 5,280,000 | 5,997,816 |
| Greece | 22 | 4,301,249 | 4,886,004 |
| Finland | 3 | 4,206,000 | 4,777,806 |
| Poland | 25 | 3,053,976 | 3,469,164 |
| Lithuania | 13 | 2,423,971 | 2,753,510 |
| Austria | 63 | 1,682,880 | 1,911,668 |
| Hungary | 26 | 853,788 | 969,860 |
| Belgium | 8 | 708,371 | 804,674 |
| Croatia | 38 | 552,200 | 627,272 |
| Romania | 83 | 371,116 | 421,569 |
| Denmark | 4 | 298,657 | 339,259 |
| Estonia | 9 | 164,100 | 186,409 |
| Bulgaria | 25 | 159,885 | 181,621 |
| Portugal | 23 | 138,375 | 157,187 |
| Cyprus | 22 | 133,900 | 152,104 |
| Slovakia | 38 | 85,200 | 96,783 |
| Norway | 4 | 63,000 | 71,565 |
| Slovenia | 5 | 51,000 | 57,933 |
| Liechtenstein | 3 | 22,911 | 26,026 |
| Malta | 3 | 18,000 | 20,447 |
| Czech Republic | 18 | 13,882 | 15,769 |
| Iceland | 1 | 9,961 | 11,315 |
| Luxembourg | 1 | 2,300 | 2,613 |
| Totals | 1,390 | 1,254,593,315 | 1,425,155,276 |
The report highlights four of the “most relevant” consistency decisions issued by the EDPB in 2024. These include:
- clarifying the criteria used to determine a controller’s main establishment within the EU in order to ensure accurate and consistent determination of jurisdiction;
- emphasizing the essential requirements for the provision of valid consent by end users;
- critical compliance points including transparency obligations, proportionality assessments, as well as strict safeguards in connection with sensitive data processing;
- guidance on contractual agreements between processors and sub-processors in order to ensure accountability and compliance throughout the data processing chain; and
- mitigation of privacy risk in the processing of personal data in the context of AI models.
It also drew attention to the adoption, in April, of a new strategy for the EDPB spanning the period 2024-2027. The new strategy is organized around four regulatory pillars and focused on promoting compliance, supporting enforcement cooperation and also ensuring that the right to data protection is embedded in the overall regulatory digital framework.
The latter is consistent with the new roles the organization is likely to play in the context of the emerging regulatory architecture focused on all aspects of digital products and services within the EU.
According to EDPB Chair Anu Talus, the actions of the organization in 2024 reaffirmed its “commitment to safeguarding individuals’ fundamental rights to privacy and data protection in a fast-changing digital landscape.”
Although the fines total is sizeable the total number of cases has dropped significantly (by 300 cases) since 2023. This may possibly suggest that the GDPR regulatory regime is beginning to bed down with non-compliance less frequent and less egregious than it has been over the last few years.
