Can the DPC fine a company for GDPR breach?

What the Law Says

The Data Protection Commission (DPC) is Ireland’s independent authority responsible for enforcing the GDPR and domestic data protection law. Under the Data Protection Act 2018, it has explicit statutory power to impose administrative fines for GDPR infringements.

Section 141 of the Data Protection Act 2018 gives the DPC the power to impose administrative fines on controllers and processors for breaches of the GDPR. These fines align with the maximum levels set by the GDPR itself — up to €20 million or 4% of the company’s total worldwide annual turnover for the preceding financial year, whichever is higher.

The DPC must consider factors like the nature, gravity and duration of the infringement; whether it was intentional or negligent; any action taken to mitigate harm; and the degree of responsibility of the controller or processor. Fines are imposed following a formal investigation and decision-making process that respects fair procedures.

Statutory Text

The Commission may, in accordance with Article 83 of the GDPR, impose an administrative fine on a controller or processor for an infringement of the GDPR.

— Data Protection Act 2018, s. 141 — Power to impose administrative fines

What to Do

Sources