The Evolution of Personal Data and Privacy Protection Regulations

■Government Trends: Data Protection Authorities Around the World Increasingly Sanctioned


It has been about four years since the GDPR came into force in Europe in May 2018 (Figure 1). The shock we felt at the time is still fresh in our memory. There have already been more than 1,300 cases of sanctions for violating the GDPR, and the number is increasing year by year.


When the GDPR came into force, one of the main concerns for global business managers was the substantial fines that could be imposed for violations. Companies that breach the regulation could face fines of up to 4% of their global sales. There are cases of fines being imposed on companies outside the EU, including under EU competition law, so many managers were likely apprehensive. As expected, the number of fines continues to grow, and the substantial fines imposed on Big Tech companies (Google, Apple, Meta Platforms, Amazon, Microsoft) are particularly eye-catching.


Here, we would like to focus on the number of fines and the amount imposed, which vary from country to country. Even within Europe, Spain stands out for the number of fines imposed, while Luxembourg is notable for the total amount of fines. The Spanish data protection authority AEPD (Agencia Española de Protección de Datos) has imposed approximately 400 fines to date. These fines include those on private individuals, such as cafe owners and website operators, and the amount per case is relatively small. On the other hand, the Luxembourg data protection authority CNPD (Commission nationale pour la protection des données) has imposed approximately 18 fines, but the total amount is substantial. The total amount is approximately 750 million euros, or about 90 billion yen (1 euro = 120 yen). Most of this amount is due to the fine imposed on Amazon Europe Core in July 2021 (746 million euros = approximately 89.5 billion yen). The severity of fines against Big Tech often results in high total fines, especially in countries where these companies are based.


Next, let's look at countries and regions outside of Europe...