Danish Guidelines Increase Transparency on Fines for GDPR Violations

Basic Amount

Fines are estimated based on a basic amount dependent on the general assessment of the type of violation, including an assessment of the gravity and duration of the violation.

It will first be decided if the violation is subject to the GDPR, Section 83(4) which can be punished by fines of up to EUR 10,000,000 or up to 2% of the annual global turnover of the Company, or Section 83(5) which can be punished by fines of up to EUR 20,000,000 or up to 4% of the annual global turnover of the Company.

The Danish Data Protection Agency has divided each violation of the GDPR into 6 categories based on the gravity of the violations and the consequences for the data subjects. Categories 1-3 relate to violations punishable according to Section 83(4) and categories 4-6 relate to violations punishable according to Section 83(5).

As an example, a category 1 violation punishable according to Section 83(4) is, inter alia, a violation of the obligations of the Company to cooperate with the supervisory authority. The guidelines state that under these circumstances, the basic amount should be set at 5% of the maximum fine, i.e., EUR 500,000. In comparison, a category 3 violation – which is the most severe violation punishable according to Section 83(4) –relates to e.g. violations of the regulation of data processing agreements. According to the guidelines, the basic amount for such violations should be set at 20% of the maximum fine, i.e., EUR 2,000,000.

To ensure that the fines are not disproportionate considering the size of the Company in question, the Danish Data Protection Agency adjusts the basic amount for Companies which are considered minor, small, or medium-sized. The basic amount will be decreased to 0.4% of the basic amount for minor Companies, 2 % of the basic amount for small Companies and 10% of the basic amount for medium-sized Companies.



The Nature of the Violation

The basic amount will be adjusted based on a specific assessment of the nature, the gravity, and the duration of the violation. Based on this assessment, the fine may be increased or decreased.

In this assessment, the Danish Data Protection Agency includes the nature, extent or purpose of the processing activity, the number of registered persons and the extent of the damages incurred on the data subjects.



Aggravating and mitigating Circumstances

The Danish Data Protection Agency will then consider any aggravating and mitigating circumstances according to the GDPR, Section 83(2) and increase or decrease the fine accordingly.

This includes an assessment of whether the violation has been committed with intent or due to negligence, and the degree of negligence, as simple negligence is necessary to impose a fine. In the guidelines it is stated that it is considered negligent if a violation has occurred due to human errors or failure to comply with written the policies implemented in the Company.

The Danish Data Protection Agency will also assess which measures the Company has implemented to mitigate any damages suffered by the data subject as well as any former violations of the Company and the degree of cooperation with the authority, etc.



Maximum Fine Level and Ability to pay

The fine imposed for any violation cannot exceed the maximum fines of the GDPR. This includes circumstances where multiple sections of the GDPR have been violated by related processing activities. In this situation, only one fine will be imposed.

According to the principle of proportionality, whether a large fine will cause serious economic consequences for the data controller will be taken into consideration, upon request from the Company. However, it is stated in the guidelines that this will not be a deciding criterion, if the severity of the violation requires a large fine, even if this potentially means that a Company will be put into liquidation.

The guidelines state that a large fine which puts a Company into liquidation is indeed effective and deterring, but a fine must always be proportionate, and it will always be considered if this aim can be reached via a smaller fine.



Our Comments

It is positive that the authorities have now made the process for deciding the fines for different categories of violations more transparent. The purpose of publishing the guidelines is of course to secure a uniform fine level and provide transparency into the processes of the public authorities.

However, the guidelines also provide us with a much-needed insight into the specific elements considered when the authorities decide on a specific size of a fine. This is expected to give Companies which might be presented with a fine a better standing in any possible opposition against the fine levels introduced by the Data Protection Agency.

The guidelines once again underline that non-compliance with the GDPR constitutes a severe financial risk for companies. The guidelines shows that the Authority foresees situations where a maximum fine may be proportionate. Accordingly, we urge all Companies to continuously follow the GDPR compliance status of the Company.



The above does not constitute legal counselling and Moalem Weitemeyer does not warrant the accuracy of the information. With the above text, Moalem Weitemeyer has not assumed responsibility of any kind as a consequence of any reader’s use of the above as a basis for decisions or considerations.

This news piece has been produced in the English language only. Are you a client or a prospective client, and should you require a Danish version, please email us at news@moalemweitemeyer.com with a link to the article that you would like to request to receive in Danish, and we will attend to your request without undue delay.