Case Study: GDPR's Largest Fines: Enforcement Patterns

"Fines are not the measure of enforcement success. The measure is whether behavior changes." — Andrea Jelinek, Chair, European Data Protection Board

Overview

Since the GDPR's enforcement date of May 25, 2018, data protection authorities across the EU have imposed thousands of fines totaling billions of euros. The headline numbers are impressive — individual fines in the hundreds of millions — but the enforcement record, examined closely, reveals patterns that complicate the narrative of GDPR success. This case study analyzes the largest GDPR fines, the entities they targeted, the DPAs that imposed them, and what the pattern reveals about the strengths and structural weaknesses of GDPR enforcement.

Skills Applied: - Analyzing enforcement data to identify systemic patterns - Evaluating whether penalties achieve deterrence and behavioral change - Assessing institutional capacity and its impact on enforcement effectiveness - Distinguishing between enforcement as spectacle and enforcement as governance

The Enforcement Record: By the Numbers

Scale and Distribution

By 2025, GDPR enforcement had produced:

• Over 2,000 individual fines across EU/EEA member states
• A cumulative total exceeding €4.5 billion in penalties
• Enforcement actions in all 30 EU/EEA member states, though highly concentrated in a handful of jurisdictions

The Top Ten Fines

The largest fines paint a picture of enforcement focused overwhelmingly on a small number of very large technology companies:

Pattern Analysis

Pattern 1: Meta Dominance

The most striking pattern is Meta's presence in the top ten. Five of the ten largest fines target Meta entities (Facebook, Instagram, WhatsApp). This concentration reflects both Meta's enormous scale of data processing and the strategic litigation efforts of privacy advocates — particularly noyb — who have systematically targeted Meta's data practices.

But it also reflects something deeper: Meta's business model is fundamentally built on personal data processing at scale. The company's advertising revenue depends on behavioral profiling that pushes against GDPR constraints. The recurring fines suggest not isolated compliance failures but a structural tension between Meta's business model and the GDPR's requirements.

Pattern 2: The EDPB Override

Four of the five largest Meta fines involved the EDPB overriding the Irish DPC's initial proposed decision. In each case, other DPAs objected to the Irish DPC's proposal as insufficiently strong, triggering the EDPB's dispute resolution mechanism. The EDPB consistently imposed higher fines and stronger corrective measures than the Irish DPC had proposed.

This pattern reveals a structural dynamic: the GDPR's one-stop-shop mechanism concentrates initial enforcement authority in Ireland (where Meta is headquartered), but the EDPB serves as a corrective — a check on any single DPA's potential leniency. Whether this system works well (producing consistent outcomes through institutional checks) or poorly (requiring multi-year processes to reach decisions that could have been made faster) depends on perspective.

Pattern 3: DPA Specialization

Different DPAs have developed enforcement specializations:

• CNIL (France): Has focused aggressively on cookie consent and advertising technology, issuing major fines against Google, Amazon, Microsoft, and TikTok for consent violations.
• Irish DPC: Handles the largest cases by volume (due to Big Tech headquarters) but has been criticized for slow processing times.
• Italian Garante: Has taken the lead on biometric data enforcement, including the Clearview AI fine and actions against facial recognition technology.
• Hamburg DPA (Germany): Enforced notable cases involving employee surveillance (H&M) and demonstrated that sub-national DPAs can be significant enforcement actors.

Pattern 4: Small Fines Are the Norm

The headline-grabbing multi-million-euro fines dominate media coverage but represent a tiny fraction of total enforcement actions. The median GDPR fine is approximately €10,000-€20,000 — imposed on small and medium businesses for relatively straightforward violations (inadequate security, failure to appoint a DPO, processing without legal basis). These routine enforcement actions are largely invisible to the public but represent the day-to-day reality of GDPR enforcement.

Pattern 5: The Time Problem

Major enforcement actions take years. The Meta data transfer case that produced the €1.2 billion fine was initiated in 2020 and resolved in 2023. The Amazon case took over two years from complaint to decision. This timeline means that by the time a fine is imposed, the practices that triggered it may have already changed — or they may have been embedded for years before consequences arrive.

The speed gap between data processing (which occurs in milliseconds) and enforcement (which occurs over years) is one of the GDPR's most significant structural challenges.

Do Fines Work?

The Deterrence Question

The fundamental question about GDPR fines is not whether they are large but whether they change behavior. The evidence is mixed:

For deterrence: The GDPR's fine authority has clearly changed corporate behavior — companies invest in compliance, appoint DPOs, conduct DPIAs, and restructure data practices in ways they did not before 2018. The threat of fines, even more than actual fines, has been a powerful motivator. Companies like Apple have made privacy a competitive differentiator, in part because the regulatory environment rewards privacy-protective behavior.

Against deterrence: For the largest technology companies, even billion-euro fines represent a manageable cost of doing business. Meta's €1.2 billion fine, the largest ever, represents roughly one to two weeks of company revenue. If the practices that generated the fine produced more than €1.2 billion in revenue over the period they were in effect, the fine is not a deterrent — it is a cost of operation. Critics argue that only fines that exceed the financial benefit of non-compliance can achieve genuine deterrence.

The Structural Reform Question

Fines punish past behavior. Corrective orders (ordering a company to change its practices, cease processing, or delete data) address future behavior. The most consequential GDPR enforcement actions have combined fines with corrective orders — the Meta behavioral advertising decision, for example, ordered Meta to cease relying on "contractual necessity" as a legal basis, forcing a fundamental restructuring of its EU data processing.

Corrective orders may be more effective than fines at producing lasting change, because they address the practice rather than just its consequences. But they require DPAs to have the technical expertise to design effective orders and the monitoring capacity to verify compliance — both of which are resource-dependent.

Structural Challenges

Resource Asymmetry

DPAs enforce the GDPR against some of the world's wealthiest and most legally sophisticated companies. The resource asymmetry is stark: Apple's legal team alone has more lawyers than many DPAs have total staff. Companies can challenge fines through years of litigation, employing top-tier law firms. DPAs must defend their decisions in court while simultaneously processing new complaints and conducting new investigations. This asymmetry systematically favors well-resourced defendants.

The Appeal Funnel

Major GDPR fines are routinely appealed. Amazon appealed its €746 million fine. Meta appealed multiple fines. The appeal process can take years and may result in reduced penalties. This creates a "fine inflation" dynamic: DPAs impose large headline fines knowing that the final amount may be reduced on appeal. The true enforcement impact is often lower than the announced figure.

The Small Company Problem

While public attention focuses on Big Tech enforcement, DPAs' routine caseloads involve smaller companies — many of which lack dedicated compliance staff, legal expertise, or awareness of their obligations. Enforcement against small companies raises proportionality concerns: a €20,000 fine can be existential for a ten-person startup while being negligible for a multinational.

Discussion Questions

1. Are GDPR fines large enough to deter the largest technology companies? If not, what level of fine — or what alternative sanction — would be necessary for genuine deterrence?

2. The pattern of EDPB overrides suggests that the one-stop-shop mechanism produces initial decisions that are too lenient. Should the mechanism be reformed? If so, how?

3. Is it appropriate for enforcement to be concentrated on a small number of very large companies while thousands of smaller violations receive less attention? How should DPAs allocate their limited enforcement resources?

4. The time gap between violation and fine (often 2-4 years) means enforcement is always backward-looking. How could enforcement be made more timely? Should DPAs have the power to issue interim orders suspending processing before an investigation is complete?

Your Turn: Mini-Project

Option A: Using the GDPR Enforcement Tracker, analyze all fines imposed in a single year. Categorize by: DPA, company size, violation type, and amount. Write a one-page analysis of what the year's enforcement record reveals.

Option B: Select one major GDPR fine and trace its complete lifecycle: from initial complaint through investigation, decision, and any appeals. Write a 1,000-word case study of the enforcement process.

Option C: Compare the enforcement records of two DPAs (e.g., CNIL and the Irish DPC). Analyze: number of actions, total fines, types of violations targeted, and average time to decision. Write a one-page comparative assessment.

References

• GDPR Enforcement Tracker (CMS). Available at https://www.enforcementtracker.com.

• European Data Protection Board. Annual Reports, 2019-2024.

• Irish Data Protection Commission. Annual Reports and Decision Publications.

• CNIL. "Annual Activity Report." Paris, various years.

• Peukert, Alexander, et al. "European Privacy Law and Global Markets for Data." SAFE Working Paper 283, 2020.

• Ryan, Johnny. "Europe's Enforcement Problem: How the GDPR's One-Stop-Shop Fails." Irish Council for Civil Liberties, 2021.