EU competition and data protection fines explained

Competition fines: the legal rules

Council Regulation 1/2003 lets the Commission fine undertakings that infringe EU competition rules ¹. In fixing the amount, regard is had to both the gravity and the duration of the infringement. The fine cannot exceed 10% of total turnover in the preceding business year ¹. The Regulation states that these decisions are not of a criminal law nature, and the Court of Justice has unlimited jurisdiction to review them ¹.

The Commission's 2006 fining guidelines start from the value of the company's sales to which the infringement relates. The basic amount is set at up to 30% of that value, multiplied by the years of infringement ². The Commission may add an entry fee of 15% to 25% of the value of sales, and may raise the basic amount by up to 100% for each earlier infringement of the same kind ².

How an EU antitrust case moves

• Start: cases can arise from a leniency application, a complaint or the Commission's own investigation, among other routes ⁴.
• Statement of Objections: sets out the Commission's competition concerns. The parties may see the investigative file and attend an oral hearing ⁴.
• Prohibition decision: formally finds an infringement against the parties ⁴.
• Commitment decision: makes commitments binding without establishing an infringement ⁴.
• Review: Commission decisions are subject to legal review by the EU courts under Article 263 of the Treaty on the Functioning of the European Union ⁴.

Cartel fines imposed by the Commission

The Commission's cartel statistics give totals adjusted for later court judgments, counting only cartel infringements under Article 101 ³.

Largest cartel cases

The highest adjusted cartel fine in a single case is €3,807,022,000 in the trucks case, decided in 2016 and 2017 ³. Other cases on the Commission's top ten list include TV and computer monitor tubes in 2012 at €1,409,588,000 and Forex in 2019 and 2021 at €1,358,900,000 ³. Over 2015 to 2019 the Commission imposed €8,182,654,159 in cartel fines ³.

GDPR fines

GDPR fines are set by national supervisory authorities. The European Data Protection Board guidelines on calculating them, adopted on 24 May 2023 and published as version 2.1, describe five steps ⁵. The authority identifies the processing operations, sets a starting point, weighs aggravating and mitigating factors, applies the legal maximum, and checks that the final amount is effective, dissuasive and proportionate ⁵.

Where authorities disagree in a cross-border case, the Board can settle the dispute under Article 65 ⁶. In May 2023, Ireland's Data Protection Commission fined Meta Ireland €1.2 billion for infringing Article 46(1) GDPR in transfers of personal data to the US ⁶. The fine and orders followed a decision of the Board under the Article 65 dispute resolution mechanism, adopted on 13 April 2023, after four of 47 concerned authorities objected to the draft ⁶. Meta Ireland was ordered to suspend future transfers within five months ⁶.

Digital Markets Act

The Commission can fine gatekeepers up to 10% of total worldwide annual turnover, or up to 20% for repeated infringements, and impose periodic penalty payments of up to 5% of average daily turnover ⁷. For systematic non-compliance, it can impose behavioural or structural remedies after a market investigation, as a last resort ⁷.