Research - 25 July 2021 | By TermsHub
Updated at: 09 December 2021
The Biggest GDPR Fines: Which Companies Have Been Fined the Most?
Alongside the amazing opportunities brought by the Internet are looming threats against data privacy and security. Over the past decade, more than 4.1 billion records have been illegally leaked by multiple organizations. Data breaches have also become rampant and threaten the global economy. And the more pressing matter is that the statistics of unlawful data management have been showing a steady increase throughout the years.
The internet, for the longest time, has remained uncharted territory. But as the world continues to transition its economic and social activities online, lawmakers acknowledge the importance of data protection and privacy. The European Union (EU) is leading this movement with their General Data Protection Regulation (GDPR).
What Is GDPR?
GDPR was enforced on May 25, 2018, in response to a call for protection and safety in the ever-changing world of the internet. It is currently considered one of the strongest privacy and security laws established in the world. Other countries such as Brazil and Singapore are following the EU example and have adopted similar data protection laws.
GDPR is the product of four long years of discussion and dialogues between experts, lawmakers, and concerned parties. It strengthened, updated, and widened the scope of the 1995 Data Protection Directive that was deemed no longer suitable in modern times.
One of the goals of GDPR is to standardize the data privacy laws among the member countries of the EU. Cooperating countries are allowed to make amendments based on what they think is best for their constituents.
It is also in the interest of GDPR to provide individuals with more access and control over their personal data. At the same time, the law transforms the usual management, handling, and storage of data by businesses and organizations.
Moreover, the law is set forth on punishing corporations and organizations that are found guilty of infringement with a huge sum of fines and reputational damage. Since its enforcement, GDPR has amassed almost €300 million worth of fines allocated to fund national projects.
What are the tenets of GDPR?
The data protection of GDPR is governed by seven major principles:
- Lawfulness, Fairness, and Transparency
Under these principles, every organization is required by GDPR to implement a lawful means of collecting, processing, and storing data. To be considered lawful, the processing of the data must abide by any of the following legal grounds:
– Legal obligation
– Public task
– Protection of vital interests
– Legitimate interest
As for fairness, GDPR demands businesses to use the collected data for reasonable purposes only. This principle also emphasizes that data collection must never employ deceit, manipulation, or misleading statements/procedures.
Lastly, transparency requires corporations and organizations to disclose to their clients the purpose and procedures of data collection and management. They are also bound to ask consent before handling the data to another party.
- Purpose Limitation
Purpose limitation of GDPR mandates that every organization or business must clearly state the specific reason (s) or purpose (s) for collecting and processing data. An infringement can be filed against an organization that will collect data for a completely unrelated agenda.
- Data Minimization
This tenet of GDPR restricts the amount of data collected from individuals. Data minimization requires businesses and organizations to only collect the needed information that will help them achieve their purposes.
GDPR recognizes the importance of accuracy in data protection, thus requiring organizations to regularly update the personal data they hold and store. Individuals are also given the right to request for changes, rectification, or deletion of incorrect personal data.
- Storage Limitation
Storage limitation aims to prevent businesses and organizations from keeping and storing your data for more than a reasonable amount of time. This entails a mandatory deletion of information that is no longer necessary for their purpose.
- Integrity and Confidentiality
These tenets are put in place to enforce and ensure data security. GDPR requires businesses and organizations to implement technical and organizational procedures to prevent any form of data breaches and malicious attacks.
Accountability is the newest principle included in GDPR that obliges organizations to substantiate their compliance to the first six principles through elaborate documentation of the strategies implemented by the organization.
For a more detailed discussion of the 7 key principles of GDPR check: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/
Who is covered by GDPR?
Essentially, anyone who lives in any member country of the EU and EEA is protected by GDPR. On the other hand, all organizations and corporations that collect, process, and store data of individuals living in the EU are mandated to comply with GDPR regardless of whether they are based in Europe or not.
What are the GDPR fines?
The lawmakers that authored GDPR made sure that any violation comes with a hefty price.
GDPR has two distinct levels of fines – lower tier and upper tier that are categorized based on the severity of the infringement. The less serious violations entail GDPR fines amounting up to €10M or 2% of the firm’s annual revenue from the previous year while more severe infringements could result in a €20M fine or 20 % of the firm’s annual revenue from the previous year. Whichever is the highest will be the GDPR fine charged to the non-compliant party.
How to compute GDPR fines?
The GDPR fine charged against a company or organization is seldom released to the public. But the data protection regulators explain that the computation takes into consideration 10 major criteria which are listed below:
- Gravity, Nature, and Duration – review all the details of the violation including how it occurred, its effects on the subjects, the number of affected individuals, the severity of the damage, and for how long it took the company to solve the issue.
- Intention – assess whether the violation is encouraged by pure negligence or malicious motive.
- Mitigation – determines whether the company conducted mitigation plans to compensate the affected individuals.
- Precautionary measures – evaluation of the technical and organizational readiness of the company against risks and threats of the data breach.
- History – reviews any past GDPR infringement filed against the same company.
- Cooperation – assess the level of participation of the company in the investigation and mitigation procedures of the government.
- Data Category – determines the type of affected personal data.
- Notification – reviews whether the concerned party has reported the infringement timely.
- Certification – reviews documents that certify compliance or good conduct.
- Aggravating/mitigating factors – investigates other factors including financial benefits that may have resulted from the violation.
Top 5 Biggest GDPR Fines
Since the enforcement of GDPR across Europe in 2018, the total amount of GDPR fines collected has risen to €292 M. The biggest fines were issued by France, Germany, Italy, and the UK against prominent companies – Google, H&M, TIM, British Airways, and Marriott International.
Rank 1: Google LLC (France)
The single lawsuit against Google LLC that resulted in €50M turnover remains the highest GDPR fine issued in the three-year run of the law.
This controversial case was led by two complaints from None Of Your Business (“NOYB”) and La Quadrature du Net (“LQDN”) filed in May 2018.
The complaints pointed out that the tech company has been exploiting smartphone users by requiring them to agree to their terms to use the phone. Moreover, the plaintiffs also brought up the unlawful processing of personal data by Google to personalize ads.
After deliberation, the French Data Protection Authority (or CNIL) charged Google LLC in January 2019 for several violations of the GDPR. According to the CNIL ruling, the major infringement committed by the tech company was a lack of transparency. The investigations concluded that Google did not disclose to its subjects the fact that their data were being used for personalized ads. Their other violations include infringement of Articles 5, 6, and 13 of GDPR.
Google LLC appealed for reconsideration at France’s highest court. However, the court re-affirmed the previous ruling in 2020 due to a lack of substantial evidence proving the company’s compliance with GDPR.
Rank 2: H&M (Germany)
Hamburg’s State Data Protection Commissioner meted the popular clothing company, H&M the second-highest GDPR fine amounting to €35.3M in 2020 for excessive and unlawful surveillance of employees. Hamburg’s State Data Protection Commissioner meted the popular clothing company, H&M the second-highest GDPR fine amounting to €35.3M in 2020 for excessive and unlawful surveillance of employees.
The investigation of the Hamburg Data Protection authority revealed that H&M has been collecting, storing, and using the personal data of their employees since 2014. The more alarming violations committed by the company included the recording of conversations, details of personal life, medical diagnoses, political stands, religion, and experience obtained through unlawful and unconsented means.
These data records were entered into the company’s “HR system” that was accessible to 50 managers. The HR and the management used the personal data of the subjects to make decisions regarding the status of their employment.
The HR system encountered a security glitch in 2019 that gave ALL H&M employees access to the information in the system. This occurrence alerted the commissioner who immediately ordered an investigation.
According to the ruling of the German court, the clothing company violated both GDPR laws (Article 5 and 6) and the civil rights of their employees. On top of the heavy fine, H&M issued a formal apology and financial compensation to all of their affected employees.
Rank 3: TIM – Telecom Italia (Italy)
Telecom Italia was hit with a huge GDPR fine amounting to €27.8M by Italy’s Data Protection Authority in January 2020. This makes the company 3rd in ranking of highest GDPR fines issued since its 2018 enforcement.
Italian DPA said that the number and severity of the GDPR violations committed by the company were significantly alarming. According to the ruling, the company infringed Articles 5, 6, 17, 21, and 32 that pertain to the lawfulness of data processing, consent, valid data retention, data security, accuracy, and right to object.
The main argument raised against the company was the millions of calls it made to non-customers as part of its rather aggressive marketing. According to investigations, during 2017-2019 TIM commissioned several call center companies that contacted subjects without any form of consent. One person revealed that he received a total of 155 promotional calls from the telecom in just a month.
The company not only chose to neglect the accuracy of their database and consent lists, but DPA also noted the intentional ambiguity in the consent forms used by TIM.
On top of these major violations was the data retention of TIM that exceeded the 10-year limit mandated by law. They also enabled customer support staff to access the subjects’ information without consent, infringing the data security clause of GDPR.
Lastly, DPA revealed that Tim refused multiple times to remedy the imminent issues in the data processing of the company that further prove their intentional neglect and malicious motive.
Rank 4: British Airways (UK)
The fourth on the list of highest GDPR fines is worth £20M (around €22M) issued to British Airways by the United Kingdom’s Information Commissioner Office (ICO).
The fine was imposed on the airline due to a cyberattack that occurred in 2018. The incident resulted in the leakage of a substantial amount of personal data of customers involving banking details, customer names, addresses, and other information entered when booking.
It took two whole months before British Airways discovered the anomaly which they immediately reported to ICO.
According to the investigations, the hackers successfully penetrated and remodeled the BA system so that the customer’s data was transmitted to their system in real-time. ICO found British Airways guilty of GDPR violation because of insufficient safety measures placed in the system as well the delayed detection.
The attack affected 400,000 individuals that greatly influenced the ICO decision. Originally, this should have been the largest GDPR fine amounting to €183M. However, due to the Covid-19 pandemic, ICO decided to give the company some leverage and lowered it to €22M since airlines took a serious beating on revenue.
Rank 5: Marriott International (UK)
One of the most luxurious and largest hotel chains in the world, Marriott International faced a huge GDPR fine amounting to £18.4M (around €20.4M) in 2020 due to a cyber attack that compromised approximately 339 million guests records.
The reported incident occurred in 2014 when the hotel was still under Starwood Hotels and Resorts Worldwide Inc. and the anomaly was detected only in 2018. Unfortunately, by this time, Marriott had already formalized their acquisition deal with Starwood hotel group. Although Marriott Inc. reported the data breach, the ICO still decided to fine the company.
In 2019, ICO explained that after deliberations, they found Marriott Inc guilty of GDPR violation because they failed to implement adequate and effective security measures after acquisition.
"Kama ilivyoelezwa katika taarifa ya ""TermHub"" iliyochapishwa tarehe 9 Desemba 2021, ""Mashtaka makubwa zaidi ya GDPR: ni kampuni zipi zimeshtakiwa zaidi?""" Pamoja na fursa za ajabu zilizoletwa na mtandao kuna vitisho vinavyotokea dhidi ya faragha na usalama wa data. Katika miaka ya hivi karibuni, zaidi ya rekodi bilioni 4.1 zimetolewa kwa njia haramu na mashirika kadhaa. Uvunjaji wa data pia umekuwa mkali na kutishia uchumi wa ulimwengu. Na jambo la kusikitisha zaidi ni kwamba takwimu za usimamizi haramu wa data zimekuwa zikionyesha ongezeko la kudumu kwa miaka mingi. Mtandao, kwa muda mrefu zaidi, umebaki eneo lisilojulikana. Lakini kwa kuwa ulimwengu unaendelea kuhamisha shughuli zake za kiuchumi na kijamii mtandaoni, wabunge wanakubali umuhimu wa ulinzi wa data na faragha. Umoja wa Ulaya (EU) unaongoza harakati hii na Kanuni ya Ulinzi wa Takwimu ya Jumla (GDPR). GDPR ni nini? GDPR ilianzishwa mnamo Mei 25, 2018 na inahusu mahitaji ya usalama na usalama katika ulimwengu wa mtandao unaobadilika. Kwa sasa inachukuliwa kuwa moja ya sheria kali zaidi za faragha na usalama zilizoanzishwa ulimwenguni. Nchi nyingine kama vile Brazil na Singapore zinafuata mfano wa EU na zimepitisha sheria kama hizo za ulinzi wa data. GDPR ni matokeo ya miaka minne ya majadiliano na mazungumzo kati ya wataalamu, wabunge na vyama vinavyohusika. Sheria hiyo iliongeza, iliboresha na kupanua mfumo wa sheria ya ulinzi wa data ya 1995 ambayo ilionekana kuwa haifai tena katika nyakati za kisasa. Lengo la GDPR ni kuunganisha sheria za faragha ya data kati ya nchi wanachama wa EU. Nchi zinazoshirikiana huruhusiwa kufanya marekebisho kulingana na kile wanachofikiri ni bora kwa wapiga kura wao. Kwa mujibu wa GDPR, ni muhimu kwa kila mtu kuwa na uwezo wa kupata na kudhibiti data zao za kibinafsi. Wakati huo huo, sheria hiyo hubadilisha usimamizi wa kawaida, utunzaji, na uhifadhi wa data na biashara na mashirika. Kwa kuongezea, sheria imewekwa juu ya kuadhibu mashirika na mashirika ambayo yanapatikana kuwa na hatia ya ukiukaji na kiasi kikubwa cha faini na uharibifu wa sifa. Tangu kutekelezwa kwa GDPR, karibu € 300 milioni zimekusanywa kwa faini zilizowekwa kwa ajili ya kufadhili miradi ya kitaifa. Ni nini kanuni za GDPR? Ulinzi wa data wa GDPR unatawaliwa na kanuni kuu saba: Uhalali, Haki na Uwazi: Chini ya kanuni hizi, kila shirika linahitajika na GDPR kutekeleza njia halali ya kukusanya, kusindika na kuhifadhi data. Ili kuchukuliwa kuwa halali, usindikaji wa data lazima ufuate moja ya misingi ya kisheria ifuatayo: <unk> Wajibu wa kisheria <unk> Kazi ya umma <unk> Ulinzi wa maslahi muhimu <unk> Maslahi halali <unk> Kwa haki, GDPR inahitaji biashara kutumia data zilizokusanywa kwa madhumuni ya busara tu. Kanuni hii pia inasisitiza kwamba ukusanyaji wa data haupaswi kamwe kutumia udanganyifu, udanganyifu, au taarifa au taratibu za kupotosha. Mwishowe, uwazi inahitaji makampuni na mashirika kufichua kwa wateja wao kusudi na taratibu za ukusanyaji na usimamizi wa data. Pia wana wajibu wa kuuliza idhini kabla ya kushughulikia data kwa chama kingine. "Kutokana na ""mipaka ya kusudi"" ya GDPR, kila shirika lazima litajue wazi sababu maalum au kusudi la kukusanya na kusindika data." Uvunjaji wa sheria unaweza kuwasilishwa dhidi ya shirika ambalo litakusanya data kwa ajenda isiyo na uhusiano kabisa. Kupunguza data: Kanuni hii ya GDPR inazuia kiasi cha data inayokusanywa kutoka kwa watu binafsi. Kupunguza data inahitaji biashara na mashirika kukusanya tu habari zinazohitajika ambazo zitawasaidia kufikia malengo yao. GDPR inatambua umuhimu wa usahihi katika ulinzi wa data, na hivyo inahitaji mashirika kusasisha mara kwa mara data ya kibinafsi wanayohifadhi. Watu binafsi pia wanapewa haki ya kuomba mabadiliko, kurekebisha, au kufuta data za kibinafsi zisizo sahihi. Ukombozi wa kuhifadhi: Ukombozi wa kuhifadhi unakusudiwa kuzuia biashara na mashirika kuhifadhi na kuhifadhi data yako kwa zaidi ya muda unaofaa. Hii inahusisha kufuta kwa lazima habari ambayo haihitajiki tena kwa kusudi lao. - Uadilifu na Usiri Kanuni hizi ni kuweka mahali ili kutekeleza na kuhakikisha usalama wa data. GDPR inahitaji biashara na mashirika kutekeleza taratibu za kiufundi na za shirika ili kuzuia aina yoyote ya uvunjaji wa data na mashambulizi mabaya. Uwajibikaji ni kanuni mpya iliyojumuishwa katika GDPR ambayo inaweka mashirika kudhibitisha kufuata kanuni sita za kwanza kupitia nyaraka za kina za mikakati iliyotumika na shirika. Kwa maelezo zaidi kuhusu kanuni za msingi za GDPR, angalia: https: www.gdp.org.uk Kwa ujumla, kila mtu anayeishi katika nchi yoyote ya EU na EEA anajulikana kama mtu wa kawaida na anajulikana kama mtu wa kawaida. Kwa upande mwingine, mashirika na mashirika yote ambayo hukusanya, kusindika, na kuhifadhi data ya watu wanaoishi katika EU yanapaswa kufuata GDPR bila kujali ikiwa iko Ulaya au la. Je, ni nini kifungo cha GDPR? Wanachama wa Bunge waliotunga GDPR walijitahidi kuhakikisha kwamba ukiukaji wowote unakuja na bei kubwa. GDPR ina viwango viwili tofauti vya faini - ngazi ya chini na ngazi ya juu ambayo imegawanywa kulingana na ukali wa ukiukaji. Ukiukaji mdogo wa sheria za GDPR unaweza kusababisha faini ya € 10M au 2% ya mapato ya kila mwaka ya kampuni kutoka mwaka uliopita, wakati ukiukaji mkubwa unaweza kusababisha faini ya € 20M au 20% ya mapato ya kila mwaka ya kampuni kutoka mwaka uliopita. Kwa upande mwingine, ikiwa ni zaidi ya kiwango cha juu, adhabu ya GDPR itashtakiwa kwa upande usiofuata. Jinsi ya kuhesabu faini za GDPR Kutofuata sheria za GDPR kwa kampuni au shirika ni jambo la kawaida. "Wakurugenzi wa ulinzi wa data wanaelezea kwamba hesabu inachukua kuzingatia vigezo vikuu 10 ambavyo vimeorodheshwa hapa chini: ""Uzito, asili, na muda"" - kuchunguza maelezo yote ya ukiukaji ikiwa ni pamoja na jinsi ilivyotokea, athari zake kwa masomo, idadi ya watu walioathiriwa, uzito wa uharibifu, na ni muda gani ilichukua kampuni kutatua suala hilo." - Kusudi <unk> kutathmini kama ukiukaji ni kuhamasishwa na uzembe safi au nia mbaya. - Kupunguza <unk> huamua kama kampuni ilifanya mipango ya kupunguza ili kulipia watu walioathiriwa. - Hatua za tahadhari <unk> tathmini ya utayari wa kiufundi na wa shirika dhidi ya hatari na vitisho vya uvunjaji wa data. - Historia <unk> inachunguza ukiukaji wowote wa zamani wa GDPR uliowasilishwa dhidi ya kampuni hiyo hiyo. - Ushirikiano <unk> tathmini kiwango cha ushiriki wa kampuni katika uchunguzi na taratibu za kupunguza ya serikali. - Data Category <unk> huamua aina ya data ya kibinafsi inayohusika. - Utangazaji <unk> inachunguza kama chama kinachohusika kimeripoti ukiukaji kwa wakati. - vyeti <unk> mapitio ya nyaraka ambayo kuthibitisha kufuata au mwenendo mzuri. - Aggravating/mitigating factors  inachunguza mambo mengine ikiwa ni pamoja na faida za kifedha ambazo zinaweza kuwa zimetokana na ukiukaji. Tangu kutekelezwa kwa GDPR huko Ulaya mnamo 2018, jumla ya faini za GDPR zilizokusanywa zimepanda hadi € 292 milioni, na faini kubwa zaidi zilitolewa na Ufaransa, Ujerumani, Italia na Uingereza dhidi ya kampuni maarufu - Google, H&M, TIM, British Airways na Marriott International. "Mswada mmoja dhidi ya Google LLC, ambao ulisababisha mauzo ya € 50m, unabaki kuwa faini ya juu zaidi ya GDPR iliyotolewa katika miaka mitatu ya sheria hiyo. """ Kesi hii ya utata iliongozwa na malalamiko mawili kutoka kwa None Of Your Business (NOYB) na La Quadrature du Net (LQDN) yaliyowasilishwa Mei 2018. Mashtaka hayo yanasema kampuni hiyo ya teknolojia imekuwa ikiwatumia vibaya watumiaji wa simu za mkononi kwa kuwaomba kukubali masharti yao ya kutumia simu. Kwa kuongezea, walalamikaji pia walileta usindikaji haramu wa data ya kibinafsi na Google ili kubadilisha matangazo. Baada ya kushauriana, Mamlaka ya Ulinzi wa Takwimu ya Ufaransa (au CNIL) ilishtaki Google LLC mnamo Januari 2019 kwa ukiukaji kadhaa wa GDPR. Kwa mujibu wa uamuzi wa CNIL, ukiukaji mkubwa uliofanywa na kampuni ya teknolojia ulikuwa ukosefu wa uwazi. Uchunguzi uligundua kuwa Google haikufunua kwa mada zake ukweli kwamba data zao zilikuwa zikitumiwa kwa matangazo ya kibinafsi. Ukifanya hivyo, utapigwa marufuku kwa sababu ya kukiuka vifungu vya 5, 6 na 13 vya GDPR. Google LLC ilikata rufani kwa ajili ya kuchunguzwa upya katika mahakama ya juu zaidi ya Ufaransa. Hata hivyo, mahakama ilithibitisha uamuzi wa awali mnamo 2020 kwa sababu ya ukosefu wa ushahidi mkubwa unaothibitisha kufuata kwa kampuni hiyo kwa GDPR. H&M, Kamishna wa Ulinzi wa Takwimu wa Jimbo la Hamburg, alikutana na kampuni maarufu ya nguo, H&M, faini ya pili ya GDPR ya € 35.3M mnamo 2020 kwa ufuatiliaji wa kupita kiasi na haramu wa wafanyikazi. Kamishna wa Ulinzi wa Takwimu wa Jimbo la Hamburg alikutana na kampuni maarufu ya nguo, H&M, faini ya pili ya GDPR ya € 35.3M mnamo 2020 kwa ufuatiliaji wa kupita kiasi na haramu wa wafanyikazi. Uchunguzi wa mamlaka ya ulinzi wa data ya Hamburg ulifunua kwamba H&M imekuwa ikikusanya, kuhifadhi, na kutumia data ya kibinafsi ya wafanyikazi wao tangu 2014. Uvunjaji huo ulihusisha kurekodi mazungumzo, maelezo ya maisha ya kibinafsi, utambuzi wa matibabu, msimamo wa kisiasa, dini, na uzoefu uliopatikana kwa njia haramu na bila idhini. Rekodi hizi za data ziliingizwa katika mfumo wa HR wa kampuni ambayo ilikuwa inapatikana kwa mameneja 50. HR na usimamizi walitumia data ya kibinafsi ya masomo kufanya maamuzi kuhusu hali ya ajira yao. Hifadhi ya HR ilipata tatizo la usalama mnamo 2019 ambalo liliwapa wafanyikazi wote wa H&M upatikanaji wa habari katika mfumo. Tukio hilo lilimfanya kamishna awe na wasiwasi na mara moja akaamuru uchunguzi. Kulingana na uamuzi wa mahakama ya Ujerumani, kampuni ya nguo ilivunja sheria za GDPR (Kifungu cha 5 na 6) na haki za kiraia za wafanyikazi wao. H&M pia imetoa ombi la msamaha na fidia kwa wafanyakazi wote waliohusika. TIM Italia ilipata faini kubwa ya GDPR ya € 27.8M kutoka kwa Mamlaka ya Ulinzi wa Takwimu ya Italia mnamo Januari 2020. Hii inafanya kampuni hiyo kuwa ya tatu katika orodha ya faini za GDPR zilizotolewa tangu utekelezaji wake wa 2018. DPA ya Italia ilisema kuwa idadi na ukali wa ukiukaji wa GDPR uliofanywa na kampuni hiyo ni ya kutisha sana. Kulingana na uamuzi huo, kampuni hiyo ilivunja kifungu cha 5, 6, 17, 21, na 32 ambacho kinahusu uhalali wa usindikaji wa data, idhini, kuhifadhi data halali, usalama wa data, usahihi, na haki ya kupinga. Hoja kuu iliyoinuliwa dhidi ya kampuni hiyo ilikuwa mamilioni ya simu alizofanya kwa wasio wateja kama sehemu ya uuzaji wake wenye fujo. Kulingana na uchunguzi, wakati wa 2017-2019, TIM iliagiza kampuni kadhaa za kituo cha simu ambazo ziliwasiliana na masomo bila aina yoyote ya idhini. Mmoja wa waendeshaji wa simu huyo alisema kuwa alipokea simu za matangazo 155 kutoka kwa kampuni hiyo ya simu mwezi mmoja tu. Kampuni hiyo haikuchagua tu kupuuza usahihi wa hifadhidata yao na orodha za idhini, lakini DPA pia ilibainisha kutokuwa na uhakika kwa makusudi katika fomu za idhini zilizotumiwa na TIM. "Kulingana na ripoti hiyo, ""kuhifadhi data kwa TIM ni zaidi ya miaka 10 iliyopendekezwa na sheria.""" Pia, waliruhusu wafanyakazi wa msaada wa wateja kupata habari za wasikilizaji bila idhini, na kuvunja kifungu cha usalama wa data cha GDPR. Mwishowe, DPA ilifunua kwamba Tim alikataa mara nyingi kurekebisha masuala ya karibu katika usindikaji wa data ya kampuni ambayo yanaonyesha zaidi uzembe wao wa makusudi na nia mbaya. "Mfano wa tatu ni British Airways, ambayo ilipewa faini ya £ 20m na Ofisi ya Kamishna wa Habari ya Uingereza (ICO).""" Hatua hiyo ilitokana na shambulio la kibiashara la mtandao lililotokea mwaka 2018. Tukio hilo lilisababisha kuvuja kwa kiasi kikubwa cha data ya kibinafsi ya wateja ikiwa ni pamoja na maelezo ya benki, majina ya wateja, anwani, na habari nyingine zilizowekwa wakati wa kuweka. Ilichukua miezi miwili kabla ya British Airways kugundua anomaly ambayo mara moja waliripoti kwa ICO. Kulingana na uchunguzi, wahasibu walifanikiwa kupenya na kurekebisha mfumo wa BA ili data za mteja zipelekwe kwenye mfumo wao kwa wakati halisi. ICO iligundua British Airways kuwa na hatia ya ukiukaji wa GDPR kwa sababu ya hatua za usalama zisizofaa zilizowekwa katika mfumo na kugundua kucheleweshwa. Shambulio hilo lilihusisha watu 400,000 ambao waliathiri sana uamuzi wa ICO. "Kwanza, hii inapaswa kuwa faini kubwa zaidi ya GDPR ya € 183m. """ Hata hivyo, kutokana na janga la COVID-19, ICO iliamua kumpa kampuni hiyo faida na kuipunguza hadi € 22M tangu mashirika ya ndege yalipochukua mapigo makubwa kwenye mapato. Marriott International, moja ya minyororo ya hoteli kubwa zaidi ulimwenguni, ilikabiliwa na faini kubwa ya GDPR ya £ 18.4M (karibu € 20.4M) mnamo 2020 kwa sababu ya shambulio la mtandao ambalo liliharibu rekodi za wageni milioni 339. "Hatua hiyo ilitokea mwaka 2014 wakati hoteli hiyo ilikuwa chini ya kampuni ya ""Starwood Hotels and Resorts Worldwide"" na iligunduliwa mwaka 2018." Kwa bahati mbaya, wakati huu, Marriott tayari alikuwa rasmi ununuzi wao mpango na Starwood hoteli kundi. Ingawa Marriott Inc. iliripoti ukiukaji wa data, ICO bado iliamua kulipia kampuni hiyo faini. "Mwaka 2019, ICO ilielezea kwamba baada ya majadiliano, walipata Marriott Inc kuwa na hatia ya ukiukaji wa GDPR kwa sababu walishindwa kutekeleza hatua za usalama za kutosha na za ufanisi baada ya ununuzi. """