processor for the damage suffered which is granted to any data subject who has
suffered material or non-material damage as a result of an infringement of the GDPR
(art. 82).
Article 83 GDPR establishes the general conditions under which the supervisory
authorities of the Member States shall impose administrative fines in respect of
infringements of the Regulation, including the general data protection rules, activities in the context of services provided by electronic means, the electronic
processing of personal data of employees, the security of personal data processed
by electronic means. Concerning the protection of personal data in the context of
electronic communications for marketing purposes, it is to be noted that the ePrivacy
Regulation establishes that in principle the relevant provisions of the GDPR are also
applicable to infringements of the ePrivacy Regulation and includes specific provisions with similarities regarding the right to compensation and liability (Article
22); and the general conditions for imposing administrative fines (Article 23).
Article 83 GDPR envisages the imposition of administrative fines up to
€20,000,000, or in the case of an undertaking, up to 4% of the total worldwide
annual turnover of the preceding financial year, whichever is higher. Such fines may
be imposed, for example, in case of infringement of: the basic principles for
processing, including conditions for consent; the data subjects’ rights; or transfer
of personal data to third countries. The maximum limit of fines is the same in Article
23 of the ePrivacy Regulation and applies to infringements of the principle of
confidentiality of communications, permitted processing of electronic communications data and certain time limits for erasure.
EU Law does not provide for criminal sanctions but it establishes that Member
States shall lay down the rules on other penalties applicable to infringements of data
protection law, particularly for infringements which are not subject to administrative
fines [see Article 84 GDPR, Article 24 ePrivacy Regulation; and Article 57 Directive
(EU) 2016/680].
4.2 Territorial Reach of EU Data Protection Law
The territorial scope of the GDPR is governed by Article 3.
32 First, the GDPR
applies to the processing of personal data in the context of the activities of an
establishment of a controller or a processor in the Union, regardless of whether the
processing takes place in the Union or not [Article 3(1)]. The GDPR maintains a
broad concept of establishment in line with the case law of the CJEU regarding the
previous regime.
33 Establishment implies the effective and real exercise of activity
32 De Miguel Asensio (2017), pp. 78–86. On some concerns raised by the territorial reach of EU
Data Protection Law, see Svantesson (2013), pp. 89–111.
33 CJEU Judgment of 1 October 2015 in case C-230/14, Weltimmo s.r.o. v. Nemzeti Adatvédelmi és
Információszabadság Hatóság, ECLI:EU:C:2015:639, and CJEU Judgment of 28 July 2016,
C-191/15, Verein für Konsumenteninformation v. Amazon EU Sàrl, ECLI:EU:C:2016:612, para.
31, and paras 73–81.
Data Protection in the Internet: A European Union Perspective
473
suffered material or non-material damage as a result of an infringement of the GDPR
(art. 82).
Article 83 GDPR establishes the general conditions under which the supervisory
authorities of the Member States shall impose administrative fines in respect of
infringements of the Regulation, including the general data protection rules, activities in the context of services provided by electronic means, the electronic
processing of personal data of employees, the security of personal data processed
by electronic means. Concerning the protection of personal data in the context of
electronic communications for marketing purposes, it is to be noted that the ePrivacy
Regulation establishes that in principle the relevant provisions of the GDPR are also
applicable to infringements of the ePrivacy Regulation and includes specific provisions with similarities regarding the right to compensation and liability (Article
22); and the general conditions for imposing administrative fines (Article 23).
Article 83 GDPR envisages the imposition of administrative fines up to
€20,000,000, or in the case of an undertaking, up to 4% of the total worldwide
annual turnover of the preceding financial year, whichever is higher. Such fines may
be imposed, for example, in case of infringement of: the basic principles for
processing, including conditions for consent; the data subjects’ rights; or transfer
of personal data to third countries. The maximum limit of fines is the same in Article
23 of the ePrivacy Regulation and applies to infringements of the principle of
confidentiality of communications, permitted processing of electronic communications data and certain time limits for erasure.
EU Law does not provide for criminal sanctions but it establishes that Member
States shall lay down the rules on other penalties applicable to infringements of data
protection law, particularly for infringements which are not subject to administrative
fines [see Article 84 GDPR, Article 24 ePrivacy Regulation; and Article 57 Directive
(EU) 2016/680].
4.2 Territorial Reach of EU Data Protection Law
The territorial scope of the GDPR is governed by Article 3.
32 First, the GDPR
applies to the processing of personal data in the context of the activities of an
establishment of a controller or a processor in the Union, regardless of whether the
processing takes place in the Union or not [Article 3(1)]. The GDPR maintains a
broad concept of establishment in line with the case law of the CJEU regarding the
previous regime.
33 Establishment implies the effective and real exercise of activity
32 De Miguel Asensio (2017), pp. 78–86. On some concerns raised by the territorial reach of EU
Data Protection Law, see Svantesson (2013), pp. 89–111.
33 CJEU Judgment of 1 October 2015 in case C-230/14, Weltimmo s.r.o. v. Nemzeti Adatvédelmi és
Információszabadság Hatóság, ECLI:EU:C:2015:639, and CJEU Judgment of 28 July 2016,
C-191/15, Verein für Konsumenteninformation v. Amazon EU Sàrl, ECLI:EU:C:2016:612, para.
31, and paras 73–81.
Data Protection in the Internet: A European Union Perspective
473