Looking back over three years of the GDPR
1 for Germany, one significant change is clear: German data protection authorities are imposing heavy fines for infringements.
Although the old legal data protection framework implementing the repealed Privacy Directive 95/46/EC
2 already contained most of the GDPR principles and obligations, the fines just mounted up to €50,000 or €300,000 and the German data protection authorities did not even make use of this range: Fines stayed far below these levels and usually had no deterrent effect at all.
With the ability to impose fines amounting up to 4% of the total worldwide annual turnover of the preceding financial year, or €20 million, data protection finally emerged from the shadows. To be ready for significant increases of fines, the 16 data protection authorities of the German Länder (states) and the federal authority gathered together at the German Data Protection Conference (Datenschutzkonferenz –