2023 was a big year for data protection regulations, with major GDPR fines hitting some of the biggest names in tech.

General Data Protection Regulation (GDPR) is an EU regulation introduced in 2018 which redefined data protection as we know it.

Five years on, GDPR has put the realm of data protection through many trials and tribulations as company’s grapple with changing definitions and the public’s awareness of data privacy increases with targeted advertising, behavioural algorithms, and AI come to the forefront in major court cases and landmark fines.

Here, we’ll go through the top ten largest GDPR fines of 2023.

1. Meta Platforms – £1.2bn

In May, Meta, the parent company of Facebook, Instagram, and WhatsApp, was fined a record breaking £1.2bn by the Irish Data Protection Commission (DPC).

This was the largest fine ever imposed for an infringement of the EU’s GDPR regulations, and for good reason.

Meta was fined for mishandling how it transferred data between the EU and the US.

Essentially, Meta relied on a standard contractual clause to transfer data between the EU and the US, but the EU was concerned that Meta did not offer the proper safeguards to protect EU data from the US’s lax data privacy laws.

The decisions was not just high-profile because it was a record-breaking fine, or because it was against one of the biggest tech companies in the world, but due to the potential precedent it could issue to data transfers.

It challenged the contractual clause Meta relied on to transfer data to the US, which until recently, was restricted.

Now, however, the EU has created a data bridge with the US, enabling for more simplistic data transfers between the two nations.

2. Meta  – €390m

Meta was fined £344 million by the Irish Data Protection Commission for its use of ‘forced consent’ for personalised advertising.

The fine and decision came after two lengthy legal battles that originated in 2018, after GDPR was first introduced to the EU.

Each case, one against Instagram and one against Facebook, dealt with the way Meta obtained a legal basis for using consumer data to generate personal advertisements.

The complainants in both cases alleged that the contractual consent, which required users to accept their personal data was being used for personalised or behavioural advertising, was actually ‘forced consent’, as users could not use the service without agreeing to these terms.

3. TikTok – €345m

The Irish DPC handed out a fine of €345M (£296.92m) for the social media company TikTok, after finding their handling of children’s data to not be compliant with GDPR.

In this case, which was originally brought up in 2021, users questioned if TikTok was in violation of GDPR for having users under the age of 13 on the platform despite what was deemed to be insufficient age-verification methods.

While TikTok has a minimum user age of 13, the DPC was made aware of and found instances of children under 13 using the social media platform.

Further, failing to protect these underage users from the view of the public is also put TikTok at fault, resulting in the fine.

4. Criteo – €40m

Criteo, a major European advertising tech company,  finally received a fine from the French data protection authority for a case which began in 2018, shortly after GDPR was introduced.

Privacy International first brought up the concerns that Criteo was using manipulative data-processing techniques for behavioural advertising.

An initial decision was made in 2022, but was appealed. In 2023, the French data protection agency decreased the fine from €60m to €40m, but Criteo was still found in failure to demonstrate user consent, transparency, and respecting the right of access.

5. TikTok – £12.7m fine

This one brings us back to the UK, where UK GDPR still upholds many of the European version’s laws and regulations, but falls under the jurisdiction of the Information Commissioner’s Office (ICO).

The ICO issued the fine following a number of breaches of data protection law, including failing to use children’s personal data lawfully.

“There are laws in place to make sure our children are as safe in the digital world as they are in the physical world,” John Edwards, UK Information Commissioner said. “TikTok did not abide by those laws.”

The ruling followed much of the same conclusions as the European case did – TikTok was found to have processed the data of 1.4m children under the age of 13, failing to protect these users and conduct adequate checks.

Following the fine, the ICO published its own Children’s Code in order to outline stricter regulations to protect children’s data online.

6. TIM SpA – €7.6m

Italy’s DPA fined this telemarketing company for its abusive call centres, and even illegally published personal data in public telephone records without the consent of those consumers.

Reportedly, the company has more room for improvement when it comes to call centre protocol and privacy considerations.

7. WhatsApp – €5.5m

Similar to the case put forth against Facebook and Instagram, Whatsapp, which is also owned by Meta, was fined £4.8 million by the Irish Data regulator for forcing user consent to personal data collection.

WhatsApp was found to have forced users to consent to personal data collection by putting the clause in their terms of service.

As users could not access the service without agreeing to their personal data being collected and processed, the complainants argued this was forced consent and in breach of GDPR.

This case escalated to the EU’s overriding data protection authority, the European Data Protection Board (EDPB), which found that WhatsApp could not use the contract legal basis to gain user consent to their personal data, fining WhatsApp and giving them six months to get policies GDPR compliant.

8. Clearview AI Inc. – €5.2m

Clearview AI, the AI facial recognition company controversially employed by law enforcement authorities, was issued a penalty fine in 2023 after failing to comply with GDPR after an initial fine was imposed in 2022.

Recommended

• Meta Bends to EU GDPR: Personalised Ads Will Require Consent
• ICO Fines TikTok £12.7M for Misuse of Children’s Data
• WhatsApp GDPR Fine | What You Need to Know

The fine began in France, where the data protection body imposed a fine of €20m, and ordered the company to not collect and process data on individuals in France without a legal bases, and to delete data of any of these individuals after responding to requests for access it received.

The company failed to provide any proof of compliance, and therefore received the penalty fine.

9. Spotify –  €4.9m

Spotify was fined in Sweden for it’s lack of transparency in how it used the data it collected from its users.

While Spotify did release the personal data it processes when requested, it was found to not offer clear enough information on how this data was used by the company.

Since Spotify has users across the globe, the decision was taken in cooperation with other data protection authorities in the EU.

The case was originally brought up by noyb, the privacy and digital rights group, in 2019, which alleged that Spotify did not provide users with the data they requested, or international data transfers.

10. Trygg-Hansa – €3m

Swedish insurance company Trygg-Hansa was found to have failed to prevent the unauthorised access to the data of 650,000 data subjects.

The data included information ranging from names and contact details, to health details, social security numbers, insurance holdings, and financial details.

The alarming findings showed that this data was accessible in plain text on the internet without any authentication required.