EU regulation

Fines

The GDPR empowers supervisory authorities to impose fines of up to 4% of annual worldwide turnover, or EUR 20 million (whichever is higher).

It is the intention of the European Commission that fines should, where appropriate, be imposed by reference to the revenue of an economic undertaking rather than the revenues of the relevant controller or processor. Recital 150 of the GDPR states that 'undertaking' should be understood in accordance with Articles 101 and 102 of the Treaty on the Functioning of the European Union, which prohibit anti-competitive agreements between undertakings and abuse of a dominant position. Unhelpfully, the Treaty does not define ‘undertaking’ and the extensive case-law is not entirely straightforward, with decisions often turning on the specific facts of each case. However, in many competition cases, group companies have been regarded as part of the same undertaking. The assessment will turn on the facts of each case, and the first test cases under the GDPR will need to be scrutinized carefully to understand the interpretation of ‘undertaking’. Under EU competition law case-law, there is also precedent for regulators to impose joint and several liability on parent companies for fines imposed on those subsidiaries in some circumstances (broadly where there is participation or control), so-called "look through" liability. Again, it remains to be seen whether there will be a direct read-across of this principle into GDPR enforcement.

Fines are split into two broad categories. 
The highest fines (Article 83(5)) of up to EUR 20 million or, in the case of an undertaking, up to 4% of total worldwide turnover of the preceding year, whichever is higher, apply to infringement of:

• The basic principles for processing including conditions for consent
• Data subjects’ rights
• International transfer restrictions
• Any obligations imposed by Member State law for special cases such as processing employee data
• Certain orders of a supervisory authority

The lower category of fines (Article 83(4)) of up to EUR 10 million or, in the case of an undertaking, up to 2% of total worldwide turnover of the preceding year, whichever is the higher, apply to infringement of:

• Obligations of controllers and processors, including security and data breach notification obligations
• Obligations of certification bodies
• Obligations of a monitoring body

Supervisory authorities are not required to impose fines but must ensure in each case that the sanctions imposed are effective, proportionate and dissuasive (Article 83(1)).

Fines can be imposed in combination with other sanctions.

Investigative and corrective powers

Supervisory authorities also enjoy wide investigative and corrective powers (Article 58) including the power to undertake on-site data protection audits and the power to issue public warnings, reprimands and orders to carry out specific remediation activities.

Right to claim compensation

The GDPR makes specific provision for individuals to bring private claims against controllers and processors:

• Any person who has suffered "material or non-material damage" as a result of a breach of the GDPR has the right to receive compensation (Article 82(1)) from the controller or processor. The inclusion of “non-material” damage means that individuals will be able to claim compensation for distress even where they are not able to prove financial loss.
• Data subjects have the right to mandate a consumer protection body to exercise rights and bring claims on their behalf (Article 80).

Individuals also enjoy the right to lodge a complaint with a supervisory authority (Article 77). 

All natural and legal persons, including individuals, controllers and processors, have the right to an effective judicial remedy against a decision of a supervisory authority concerning them or for failing to make a decision (Article 78).

Data subjects enjoy the right to an effective legal remedy against a controller or processor (Article 79).

Malta regulation

The position under the Maltese Data Protection Act, 2018

Appealing against a decision of the Commissioner

Any person against whom an administrative fine has been imposed by the Commissioner may appeal to the Data Protection Appeals Tribunal within 20 days from service of the Commissioner’s decision imposing such fine. An appeal to the Tribunal may be made on any of the following grounds:

• That a material error as to the facts has been made
• That there was a material procedural error
• That an error of law has been made
• That there was some material illegality, including unreasonableness or lack of proportionality

Within 2 days of filing an appeal, the Registry of the Tribunal shall:

• Serve a copy of the appeal on the Commissioner and request that he or she file a statement on the decision, together with any other information on which the decision was based within 20 days from the date on which the appeal was served
• Serve a copy of the appeal on the respondent(s) to the appealed decision, and request the respondent(s) file a reply within 20 days of service of the appeal

Appealing against a decision of the Data Protection Appeal Tribunal

Any party to an appeal before the Tribunal may appeal to the Court of Appeal by means of an application filed in the registry of that court within 20 days from the date on which the decision of the Tribunal was notified.

Fines against a public authority or body

The Commissioner may impose an administrative fine on a public authority or body of up to EUR 25,000 for each violation and an additional EUR 25 for each day during which such violation persists for an infringement under Article 83(4) of the GDPR. The fine that the Commissioner may impose on a public authority or body for an infringement of Article 83(5) or (6) of the GDPR shall not exceed EUR 50,000 for each violation and additionally EUR 50 for each day during which such violation persists.

Any person who knowingly provides false information to the Commissioner when so requested or who does not comply with any lawful request pursuant to an investigation by the Commissioner, shall be guilty of an offence and upon conviction shall be liable to a fine (multa) of not less than EUR 1,250 and not more than EUR 50,000 or to imprisonment for six months.

Actions against a controller/processor

Without prejudice to any other available remedy, a person who believes that his or her rights under the GDPR or the Act have been infringed may file a sworn application in the First Hall Civil Court for an effective judicial remedy and in the same way may also institute an action for damages against the controller or processor who processes personal data in contravention of the provisions of the GDPR or this Act. If the court finds that the controller or processor is liable for damage caused pursuant to Article 82 of the GDPR, the court shall determine the amount of damages including, but not limited to, moral damages, due to the data subject.

Any action under Article 30 of this Act shall be instituted within 12 months from when the data subject became aware or should have reasonably become aware of such a contravention, whichever is earlier.