Who is Europe’s worst student when it comes to GDPR compliance? A study published by Surfshark offers a glimpse…
The cybersecurity solutions publisher tallied sanctions imposed since 2020 against ten of the world’s most-used platforms. Note that penalties under €200,000 were not counted.
In Europe, the total hits $5.16 billion in fines, about one-fifth of the more than $26 billion recorded globally, which also includes the United States, Australia, and South Korea.
Ireland, set apart
Ireland accounts for $4.87 billion, or 94% of the European total. This situation stems from the special role of the Data Protection Commission (DPC). As many companies (Alphabet, Meta, etc.) have their European headquarters in Ireland, it often acts as the lead regulator to conduct investigations and apply pan-European sanctions.
In other words, the gap owes as much to how oversight is organized as to the scale of the breaches.
Behind this, France records $245 million in sanctions. It is ahead of the United Kingdom ($36 million), Spain ($11.6 million), and the Netherlands ($870,000).
The study, covering countries subject to the GDPR or to an equivalent national framework, does not specify either the platforms targeted or the grounds for the French sanctions.
Transfers outside the EU, the leading source of sanctions
Two of Europe’s heaviest penalties concern international data transfers.
Facebook was fined $1.39 billion for transferring European users’ data to the United States. TikTok faced a $615 million penalty for transfers to China. Taken together, these two cases account for about $2 billion, or nearly 40% of the European total.
The remaining penalties break down as follows:
- Data processing: $1.22 billion, including $401 million for TikTok, $360 million for LinkedIn, $244 million for Facebook, $209 million for Instagram, and $11.6 million for YouTube.
- Data breaches: $1.09 billion, including $618 million for Facebook, $470 million for Instagram, and $522,000 for X.
- Insufficient security: $594 million, including $452 million for Facebook, $106 million for Instagram, $19.3 million for Reddit, and $16.8 million for TikTok.
- Cookie consent: $243.6 million, including $174 million for YouTube and $69.6 million for Facebook.
- Data retention: $928,000 for Discord, the smallest category.
Facebook appears in nearly every category, while LinkedIn only features in the data-processing category.
*Methodology Only sanctions of at least €200,000 were considered for Europe, converted into dollars at the rate of 1 USD for €0.87. The data come from the GDPR Enforcement Tracker, Violation Tracker, Violation Tracker Global, and Osano’s tool, supplemented by regulator announcements, court decisions, and press reports.
