The DSK, the joint coordination body of the German data protection authorities, has recently set out a new model for calculating EU General Data Protection Regulation fines, which, if adopted and applied, is likely to lead to higher GDPR fines, more frequently at the top end of the maximum fine limits under Article 83.

Some German authorities have started applying this new model in practice; for example, the Berlin data protection commissioner has already announced her intention to impose multimillion-euro GDPR fines based on this model.

Some of the first cases defending clients against fines calculated under this new model are being heard.

Per the guidelines, parent companies and subsidiaries are regarded as an economic unit, so that the total turnover of the group of companies is taken as the basis for calculating the fine.

Details from the International Association of Privacy Professionals