The sanctions that were imposed last year in 190 proceedings conducted by the European supervisory authorities for the protection of personal data amount to around 410 million euros. It is the result of a study by the Federprivacy Observatory in which the institutional privacy activities carried out in the 30 countries of the European Economic Area (EEA) were analyzed.
In the ranking of the most active authorities last year by number of sanctions, Italy is in first place with 30 measures imposed for a total of 4,341,990 euros. The Spanish authority (AEPD) follows with 28 penalties and the Romanian one (ANSPDCP) in third place with 20 sanctions imposed.
The most severe authority ever was that of the United Kingdom (ICO), which issued few but "heavy" fines, for 312 million euros, equal to 76% of the overall total relative to the countries examined.
Although the Italian Privacy Guarantor has been waiting for more than six months to renew the college which expired on 19 June last year, the Authority led by Antonello Soro, currently under an extended regime with powers limited to the management of ordinary administration and indifferent ones and urgent, however, it continued to carry out its inspection activities regularly, and already at the end of the first half of 2019 - Federprivacy reports - it had enrolled 779 offenders, with a total expected collection of around 11 million euros when the sanctioning procedures will be completed.
Among the supervisory authorities that have not yet imposed sanctions after the entry into force of the Gdpr, there are also those of Ireland and Luxembourg, where most of the foreign multinationals that process personal data on a large scale have their European headquarters.
With regard to the most often sanctioned infringements, in 44% of cases it was illegal data processing, in 18% of the cases insufficient security measures were found. Other sanctions were determined by the omitted or unsuitable information (9%) or by the failure to respect the rights of the interested parties (13%), while 9% of the sanctions were taken following IT accidents and "data breaches".