--- title: "European Economic Area — Enforcement & Redress | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/european-economic-area-bloc/enforcement-and-redress/ source_html: /jurisdictions/european-economic-area-bloc/enforcement-and-redress/index.html description: "European Economic Area (Bloc) — Enforcement & Redress (Green, 6 sub-modules, 10 claims): Enforcement powers are broad, actively used at scale (billion-euro-class fines), collective redress mechanisms are in force, and a further procedural-h" generated_at: 2026-10-25T04:46:50Z content_sha256: 68767c05033912c14804ce591d32ed94901fa9d514c5b167578ac4ad2e2fa002 generator: "fe-fleet/md-twin@1.0" --- # European Economic Area — Enforcement & Redress | Data Protection Monitor ### D10Enforcement & Redress6 sub-modules10 claimsGreen▾# Enforcement powers are broad, actively used at scale (billion-euro-class fines), collective redress mechanisms are in force, and a further procedural-harmonisation regulation is already adopted (pending 2027 application). Primary framework GDPR Articles 77-84, 58, 83 (Regulation (EU) 2016/679); Regulation (EU) 2025/2518; Directive (EU) 2020/1828 Supervisory authority [National DPAs with EDPB Article 65 binding-decision oversight (e.g. Irish DPC, CNIL, Czech SA)](https://www.edpb.europa.eu/) Traffic-light rationale — Green Enforcement powers are broad, actively used at scale (billion-euro-class fines), collective redress mechanisms are in force, and a further procedural-harmonisation regulation is already adopted (pending 2027 application). #### Sub-modules (6) Category narrative 334 words Under Art. 83 GDPR, administrative fine ceilings are €10 million or 2% of total worldwide annual turnover (Art. 83(4)) and €20 million or 4% of total worldwide annual turnover (Art. 83(5)–(6)). In three landmark judgments — Case C-807/21 Deutsche Wohnen (5 December 2023), Case C-383/23 ILVA A/S (13 February 2025), and Case C-768/21 (26 September 2024) — the CJEU confirmed that: (1) a legal person can only be fined under Art. 83 if the infringement was committed intentionally or negligently; (2) the concept of 'undertaking' for calculating the 2%/4% turnover ceiling AND for determining the actual proportionate fine amount under Art. 83(1) corresponds to the EU competition-law concept of an economic unit (Arts. 101–102 TFEU), meaning parent-group global turnover governs; and (3) a DPA is not strictly obliged to impose a fine for every established infringement where a reprimand or corrective measure under Art. 58(2) suffices. Cross-border enforcement under the Art. 56/60 One-Stop-Shop is overhauled by Regulation (EU) 2025/2518 of 26 November 2025 (entered into force 1 January 2026; applicable from 2 April 2027), which sets binding 15-month investigation deadlines for simple/standard cross-border cases (extendable by 12 months for complex cases), early-resolution mechanisms, and harmonised complainant and party procedural rights. Cumulative EEA GDPR fines exceed €5.8 billion, led by Meta (€1.2bn, May 2023; €251m, Dec 2024), Amazon (€746m), TikTok (€530m by Irish DPC on 2 May 2025 for China data transfers; €345m in Sept 2023), LinkedIn (€310m, Oct 2024), and Uber (€290m by Dutch AP, Aug 2024). Private redress is governed by Art. 82 GDPR (compensation for material or non-material damage under CJEU Cases C-300/21 Österreichische Post, C-340/21 Natsionalna agentsia za prihodite, and C-507/23 Patēriētāju tiesību aizsardzības centrs of 4 October 2024 confirming an apology alone cannot replace financial compensation where damage is proven but an infringement alone does not automatically equal damage) and by opt-in/opt-out collective actions under Art. 80 GDPR and the Representative Actions Directive (EU) 2020/1828 (confirmed in CJEU Case C-757/22 Meta Platforms Ireland v Verbraucherzentrale Bundesverband of 11 July 2024). Evidence 10 Sources and claims (10) - Confirmed[SEC](https://www.sec.gov/Archives/edgar/data/1830081/000121390026042803/ea0270012-02.htm) — GDPR Article 83 authorises fines for certain violations of up to 4% of an undertaking's total global annual turnover of the preceding financial year or €20 million, whichever is greater.observed 2026-08-05 - Confirmed[IAPP](https://iapp.org/news/a/ireland-dpcs-data-transfers-decision-pragmatic-punch-or-knockout-blow) — Ireland's Data Protection Commission imposed a record €1.2 billion fine on Meta Ireland in May 2023 over unlawful EU-US data transfers, the largest GDPR fine to date, alongside orders to suspend future transfers and cease unlawful US processing of EEA users' data.observed 2026-08-05 - Confirmed[EDPB](https://www.edpb.europa.eu/news/czech-sa-imposed-fine-of-139-million-eur-for-infringement-of-art-6-and-art-13-of-gdpr_en) — The Czech supervisory authority's appellate decision confirmed a first-instance fine of approximately €13.9 million against a controller for infringing Articles 6 and 13(1) GDPR over the transfer of antivirus-software users' browsing data to a sister company.observed 2026-08-05 - Confirmed[IAPP](https://iapp.org/news/a/irish-dpcs-whatsapp-fine-deepens-fissure-with-edpb-over-enforcement-jurisdictions) — CNIL fined IQVIA €5 million over health-data violations, and Ireland's DPC separately fined WhatsApp Ireland €5.5 million for transparency and consent failures in its Terms of Service, illustrating continued multi-jurisdictional enforcement momentum.observed 2026-08-05 - Confirmedunavailable — The European Commission identified fragmented national procedures and limited DPA resourcing as factors hindering effective cross-border GDPR enforcement, a key motivation for the new procedural regulation (EU) 2025/2518. - Confirmed[Publications Office of the EU](https://eur-lex.europa.eu/EN/legal-content/summary/consumer-protection-representative-actions.html) — Directive (EU) 2020/1828 on representative actions for the protection of the collective interests of consumers, applicable in Member States since 25 June 2023, empowers qualified entities to bring both injunctive and redress collective actions against traders for infringements including, where available under national or EU law, data protection.observed 2026-08-05 - Confirmed[IAPP](https://iapp.org/news/a/european-commission-adopts-eu-u-s-adequacy-decision) — Complaints filed in May 2018 by advocacy group NOYB under Articles 77-79/82 GDPR underpinned the enforcement chain leading to the Irish DPC's Meta Facebook, Instagram and WhatsApp fines, and NOYB has indicated it intends to challenge the EU-US Data Privacy Framework adequacy decision before the CJEU.observed 2026-08-05 - Confirmedunavailable — On 11 February 2026, the EDPB and EDPS adopted Joint Opinion 2/2026 on the Digital Omnibus Regulation proposal, supporting simplification aims while urging co-legislators not to adopt the proposed narrowing of the GDPR's personal-data definition. - Confirmed[EDPB](https://www.edpb.europa.eu/public-consultations/guidelines-022026-on-anonymisation_en) — On 7 July 2026, the EDPB published draft Guidelines 02/2026 on Anonymisation for public consultation (open until 30 October 2026), responding to the CJEU's September 2025 EDPS v SRB ruling.observed 2026-08-05 - Confirmed[EDPB](https://www.edpb.europa.eu/news/cef-2026-edpb-launches-coordinated-enforcement-action-on-transparency-and-information_en) — On 19 March 2026, the EDPB launched its 2026 Coordinated Enforcement Framework action, with 25 participating DPAs assessing controller compliance with GDPR transparency and information obligations (Articles 12-14).observed 2026-08-05