Data Protection Monitor
Global Privacy & Data Protection Intelligence

European Economic Area (EEA) · Module Detail

European Economic Area: Enforcement & Redress

← Full European Economic Area overview Build report with European Economic Area Request deeper dive

#

Enforcement powers are broad, actively used at scale (billion-euro-class fines), collective redress mechanisms are in force, and a further procedural-harmonisation regulation is already adopted (pending 2027 application).

Primary frameworkGDPR Articles 77-84, 58, 83 (Regulation (EU) 2016/679); Regulation (EU) 2025/2518; Directive (EU) 2020/1828
Supervisory authorityNational DPAs with EDPB Article 65 binding-decision oversight (e.g. Irish DPC, CNIL, Czech SA)
Traffic-light rationale — GreenEnforcement powers are broad, actively used at scale (billion-euro-class fines), collective redress mechanisms are in force, and a further procedural-harmonisation regulation is already adopted (pending 2027 application).

Sub-modules (6)

Category narrative334 words

Under Art. 83 GDPR, administrative fine ceilings are €10 million or 2% of total worldwide annual turnover (Art. 83(4)) and €20 million or 4% of total worldwide annual turnover (Art. 83(5)–(6)). In three landmark judgments — Case C-807/21 Deutsche Wohnen (5 December 2023), Case C-383/23 ILVA A/S (13 February 2025), and Case C-768/21 (26 September 2024) — the CJEU confirmed that: (1) a legal person can only be fined under Art. 83 if the infringement was committed intentionally or negligently; (2) the concept of 'undertaking' for calculating the 2%/4% turnover ceiling AND for determining the actual proportionate fine amount under Art. 83(1) corresponds to the EU competition-law concept of an economic unit (Arts. 101–102 TFEU), meaning parent-group global turnover governs; and (3) a DPA is not strictly obliged to impose a fine for every established infringement where a reprimand or corrective measure under Art. 58(2) suffices. Cross-border enforcement under the Art. 56/60 One-Stop-Shop is overhauled by Regulation (EU) 2025/2518 of 26 November 2025 (entered into force 1 January 2026; applicable from 2 April 2027), which sets binding 15-month investigation deadlines for simple/standard cross-border cases (extendable by 12 months for complex cases), early-resolution mechanisms, and harmonised complainant and party procedural rights. Cumulative EEA GDPR fines exceed €5.8 billion, led by Meta (€1.2bn, May 2023; €251m, Dec 2024), Amazon (€746m), TikTok (€530m by Irish DPC on 2 May 2025 for China data transfers; €345m in Sept 2023), LinkedIn (€310m, Oct 2024), and Uber (€290m by Dutch AP, Aug 2024). Private redress is governed by Art. 82 GDPR (compensation for material or non-material damage under CJEU Cases C-300/21 Österreichische Post, C-340/21 Natsionalna agentsia za prihodite, and C-507/23 Patēriētāju tiesību aizsardzības centrs of 4 October 2024 confirming an apology alone cannot replace financial compensation where damage is proven but an infringement alone does not automatically equal damage) and by opt-in/opt-out collective actions under Art. 80 GDPR and the Representative Actions Directive (EU) 2020/1828 (confirmed in CJEU Case C-757/22 Meta Platforms Ireland v Verbraucherzentrale Bundesverband of 11 July 2024).

Sources and claims (10)
  1. ConfirmedSEC — GDPR Article 83 authorises fines for certain violations of up to 4% of an undertaking's total global annual turnover of the preceding financial year or €20 million, whichever is greater.observed
  2. ConfirmedIAPP — Ireland's Data Protection Commission imposed a record €1.2 billion fine on Meta Ireland in May 2023 over unlawful EU-US data transfers, the largest GDPR fine to date, alongside orders to suspend future transfers and cease unlawful US processing of EEA users' data.observed
  3. ConfirmedEDPB — The Czech supervisory authority's appellate decision confirmed a first-instance fine of approximately €13.9 million against a controller for infringing Articles 6 and 13(1) GDPR over the transfer of antivirus-software users' browsing data to a sister company.observed
  4. ConfirmedIAPP — CNIL fined IQVIA €5 million over health-data violations, and Ireland's DPC separately fined WhatsApp Ireland €5.5 million for transparency and consent failures in its Terms of Service, illustrating continued multi-jurisdictional enforcement momentum.observed
  5. Confirmedunavailable — The European Commission identified fragmented national procedures and limited DPA resourcing as factors hindering effective cross-border GDPR enforcement, a key motivation for the new procedural regulation (EU) 2025/2518.
  6. ConfirmedPublications Office of the EU — Directive (EU) 2020/1828 on representative actions for the protection of the collective interests of consumers, applicable in Member States since 25 June 2023, empowers qualified entities to bring both injunctive and redress collective actions against traders for infringements including, where available under national or EU law, data protection.observed
  7. ConfirmedIAPP — Complaints filed in May 2018 by advocacy group NOYB under Articles 77-79/82 GDPR underpinned the enforcement chain leading to the Irish DPC's Meta Facebook, Instagram and WhatsApp fines, and NOYB has indicated it intends to challenge the EU-US Data Privacy Framework adequacy decision before the CJEU.observed
  8. Confirmedunavailable — On 11 February 2026, the EDPB and EDPS adopted Joint Opinion 2/2026 on the Digital Omnibus Regulation proposal, supporting simplification aims while urging co-legislators not to adopt the proposed narrowing of the GDPR's personal-data definition.
  9. ConfirmedEDPB — On 7 July 2026, the EDPB published draft Guidelines 02/2026 on Anonymisation for public consultation (open until 30 October 2026), responding to the CJEU's September 2025 EDPS v SRB ruling.observed
  10. ConfirmedEDPB — On 19 March 2026, the EDPB launched its 2026 Coordinated Enforcement Framework action, with 25 participating DPAs assessing controller compliance with GDPR transparency and information obligations (Articles 12-14).observed