[RIRs-LEA] FW: Framework for GDPR Fines Published by the Dutch Authorities

Tue Apr 9 17:23:01 CEST 2019

Thought you guys might be interested in the information below.  It is a blog from a US based attorney who we used to work with.

Best,
Leslie

From: Melise Blakeslee <melise at achievedcompliance.com>
Reply-To: "melise at achievedcompliance.com" <melise at achievedcompliance.com>
Date: Tuesday, April 9, 2019 at 10:32 AM
To: Leslie Nobile <leslie at arin.net>
Subject: Framework for GDPR Fines Published by the Dutch Authorities

[Image removed by sender. This is my logo]<https://t.e2ma.net/click/cfnmv/sfy354/wucc3c>

PRIVACY BLOG
Updates and Analysis on GDPR, Global Privacy, Cybersecurity, Compliance and the Law.

[Image removed by sender.]

Framework for GDPR Fines Published by the Dutch Authorities

The Dutch Data Protection Authority (AP) has announced a new policy for determining the fines to be imposed for violations of the General Data Protection Regulation (GDPR) and its national implementing act.

The AP’s assessment will first take into account the maximum amounts specified by the European Regulation: either 10 million euros or 2% of the annual worldwide turnover, or 20 million euros or 4% of the annual worldwide turnover, depending on the violation incurred. Violations that are subject to fines are divided into three or four categories designed by the data protection authority to take into account the weight of the breached requirements, with each assigned a minimum-maximum fine range.

According to the policy regarding cases of violations subject to a maximum fine of 10 million euros or 2% of the annual worldwide turnover, the failure to appropriately record processing activities in accordance with GDPR’s Article 30 would fall in categories I or II and be subject to fines of € 0 - € 200,000 or € 120,000 - € 500,000 respectively. Failure to cooperate with the Supervisory Authority or to notify it of an incident falls within category III and results in fines of € 300,000 - € 750,000. When violations give rise to the maximum fine of 20 million euros or 4% of the annual turnover, failure to comply with the rights of access, rectification or erasure fall within category III, while non-compliance with an order from the supervisory authority falls within category IV and can result in fines of € 450,000 - € 1,000,000.

Within the ranges, the AP will adjust the level of fines based on many relevant factors, including:
• the nature, seriousness and duration of the infringement;
• the number of affected data subjects and the extent of the damage
• the nature and extent of the data compromised;
• whether the infringement was intentional or the result of negligence;
• the measures taken by the controller or processor to limit the damage suffered by affected individuals;
• the extent to which the controller or processor is responsible in view of the technical and organizational measures that it has implemented;
• previous relevant breaches by the controller or processor;
• the extent to which the offending party has cooperated with the supervisory authority;
• the categories of personal data involved;
• the manner in which the supervisory authority became aware of the infringement, in particular whether, and if so to what extent, the controller or processor has reported the infringement.

The policy reaffirms the importance given by the GDPR to the Principle of Accountability. It states clearly that fines may be reduced if an offender is able to prove that it has taken appropriate steps to comply with the regulation, to limit the damage to Data Subjects, and to cooperate with the Data Protection Authority.

Both the original policy in Dutch and Achieved Compliance’s English translation are available to read here<https://t.e2ma.net/click/cfnmv/sfy354/cndc3c>.

READ MORE BLOGS<https://t.e2ma.net/click/cfnmv/sfy354/sfec3c>

Before any tool can be useful, GDPR demands a combination of review, risk analysis and thoughtful decision-making on the part of your company. The PRIVACY BLOG<https://t.e2ma.net/click/cfnmv/sfy354/87ec3c> by Achieved Compliance can help you stay on top of compliance and regulators’ expectations in the complex world of data compliance.

[Image removed by sender.]

[Image removed by sender.]

Achieved Compliance brings together experience and innovation, breaking new ground in data privacy compliance. With combined 60 years of experience in data protection in client counseling, government, and Fortune 100 companies, Achieved Compliance provides companies with a software-guided, team-oriented solution that helps them easily and cost-effectively comply with complex privacy requirements around the globe.
+1-571-366-1784
info at achievedcompliance.com<mailto:info at achievedcompliance.com?subject=Privacy%20Blog>

Share this email:

[Image removed by sender. Email]<https://t.e2ma.net/share/outbound/e/cfnmv/sfy354>

[Image removed by sender. Twitter]<https://t.e2ma.net/share/outbound/t/cfnmv/sfy354>

[Image removed by sender. Facebook]<https://t.e2ma.net/share/outbound/f/cfnmv/sfy354>

[Image removed by sender. LinkedIn]<https://t.e2ma.net/share/outbound/l/cfnmv/sfy354>

Manage<https://app.e2ma.net/app2/audience/signup/1877171/1888902/1867437702/?s=mNiOx9VR4HA5cAup29W3K0wOLNZ08V_Lc-gTsKxU54E> your preferences | Opt out<https://t.e2ma.net/optout/cfnmv/sfy354?s=n5ElB5IaSriOvSDWwfSbvkOEbvhGZ4WM0v0ONGC3ysM&r=aHR0cHM6Ly9hcHAuZTJtYS5uZXQvYXBwMi9hdWRpZW5jZS9vcHRfb3V0LzE4NzcxNzEvMTg4ODkwMi8xODY3NDM3NzAyLz9zPXNfYTNiRG54SmtHa2tOSWc3QTk4aFE5QWFNV01MaUdmMHdTTGNZR1BBX1k%3D> using TrueRemove™
Got this as a forward? Sign up<https://app.e2ma.net/app2/audience/signup/1877171/1888902.35848838/> to receive our future emails.
View this email online<https://t.e2ma.net/message/cfnmv/sfy354>.

1800 Diagonal Road Suite 600
Alexandria, VA | 22314 US

This email was sent to leslie at arin.net.
To continue receiving our emails, add us to your address book. <leslie at arin.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ripe.net/ripe/mail/archives/rirs-lea/attachments/20190409/8562c3e2/attachment-0001.html>