Major risks for enterprises violating general data protection regulation (GDPR)

Violating General Data Protection Regulation (GDPR) not only results in substantial financial losses but also severely damages a company’s reputation. Let’s explore with NPLaw the legal provisions and appropriate responses when such matters occur.

I. The current situation of violating General Data Protection Regulation (GDPR) 

In the digital era, violations of General Data Protection Regulation (GDPR) are increasingly common, posing significant challenges for Vietnamese enterprises operating within the EU market or handling the data of EU citizens.

In practice, major technology corporations such as Meta, Google, and Amazon have repeatedly faced record fines amounting to from hundreds of millions to billions of euros. Such situation stems primarily from two factors:

• Complexity of the regulations: General Data Protection Regulation (GDPR) imposes highly stringent requirements regarding the collection, processing, storage, and transfer of personal data, requiring significant investments in systems and procedures.
• Increase in user awareness: EU citizens have become more conscious of their privacy rights and are willing to file complaints when their data is misused.

For Vietnamese enterprises, especially in sectors such as e-commerce, tourism, and information technology (outsourcing), non-compliance with General Data Protection Regulation (GDPR) can result in loss of clients, prohibition from operating in EU markets, and severe legal sanctions.

II. What constitutes a violation of General Data Protection Regulation (GDPR)?

1. Definition of violating General Data Protection Regulation (GDPR)

A violation of General Data Protection Regulation (GDPR) refers to any conduct that fails to comply with the obligations set forth under the General Data Protection Regulation (GDPR) of the European Union.

Under Article 4 of the General Data Protection Regulation (GDPR), a personal data violation is defined as a security violation leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data that has been transmitted, stored, or otherwise processed.

However, the term General Data Protection Regulation (GDPR) violation is broader and encompasses other forms of non-compliance, such as processing data without a lawful basis.

2. Common cases leading to violations of General Data Protection Regulation (GDPR)

Typical actions that result in General Data Protection Regulation (GDPR) violations include:

• Collecting or processing data without a legal basis: The enterprise processes personal data without valid consent from the data subject or another lawful ground under Article 6 of General Data Protection Regulation (GDPR).
• Failing to notify Supervisory Authorities of breaches: The enterprise fails to inform the competent Supervisory Authority within 72 hours after a data breach, as required by Article 33 of General Data Protection Regulation (GDPR).
• Disregarding data subject rights: The enterprise refuses the data subject’s requests to access, rectify, or erase their data (the right to be forgotten) without legitimate grounds under Article 15 of General Data Protection Regulation (GDPR).
• Improper transferring international data: The enterprise transfers EU citizens’ personal data to a country not recognized by the European Commission as having adequate data protection without appropriate safeguards under Chapter V of General Data Protection Regulation (GDPR).

3. Measures in cases of violating General Data Protection Regulation (GDPR)

Upon detecting violations, enterprises must swiftly and systematically: 

• Prevent and assess: Immediately take steps to prevent continuous violations and assess its scope (types of data affected, number of individuals impacted, and level of risk).
• Notify Supervisory Authorities: If the violation poses a risk to individuals’ rights or freedoms, the enterprise must notify the competent Supervisory Authority within 72 hours of detection (Article 33 of General Data Protection Regulation (GDPR)).
• Inform affected data subjects: If the violation presents a high risk, affected individuals must be promptly informed (Article 34 of General Data Protection Regulation (GDPR)).
• Set up documents and take remedies: Record the violation, its impact, and all remedial actions. Documents serve as evidence of compliance.

III. Legal framework governing violations of General Data Protection Regulation (GDPR)

1. Relevant provisions of violating General Data Protection Regulation (GDPR)

Provisions addressing General Data Protection Regulation (GDPR) violations include:

• Articles 33 & 34: Obligations to notify both Supervisory Authorities and data subjects of personal data violations.
• Article 82 (Right to compensation and liability): The right to seek compensation for material or non-material (mental) damages caused by General Data Protection Regulation (GDPR) violations.
• Article 83 (Administrative fines): Conditions for imposing administrative fines up to 20 million EUR or 4% of the company’s total worldwide annual turnover (whichever is higher).

2. Competent authorities

The primary authority lies with the Supervisory Authority in the EU Member State where the enterprise’s headquarters is located, or where the violation affects EU citizens.

For instance, the Data Protection Commission (DPC) of Ireland often handles cases involving large technology firms headquartered there. These authorities have jurisdiction to investigate, require additional information, and impose sanctions under Article 58 of General Data Protection Regulation (GDPR).

3. Consequences of unresolved violations of General Data Protection Regulation (GDPR)

Failure to adequately resolve General Data Protection Regulation (GDPR) violations may lead to severe consequences:

• Substantial financial sanctions: As per Article 83 of General Data Protection Regulation (GDPR), fine can be a main cause for bankruptcy.
• Processing bans: Supervisory Authorities may temporarily or permanently prohibit unlawful data processing, potentially paralyzing business operations (Point f, Clause 2, Article 58 of General Data Protection Regulation (GDPR)).
• Civil litigation: Affected individuals may pursue compensation claims under Article 82 of General Data Protection Regulation (GDPR).
• Reputational damage: Public disclosure of violations and sanctions can severely harm consumer trust and corporate image.

IV. Questions on violating General Data Protection Regulation (GDPR)

1. Who takes legal responsibility when the company violates General Data Protection Regulation (GDPR) in data processing activities?

Both the Data Controller and the Data Processor may be held liable:

• Data Controller: Data Controller determining the purposes and means of processing takes the primary responsibility for ensuring compliance with General Data Protection Regulation (GDPR) (Article 24).
• Data Processor: Data Processor processing data on behalf of the Controller (e.g., a cloud service provider) also has direct obligations and may take sanctions for non-compliance under Article 28 of General Data Protection Regulation (GDPR). 

2. What sanctions apply to violations of General Data Protection Regulation (GDPR) in e-commerce?

Sanctions are uniform across all industries, including e-commerce:

• Administrative fines: Fine is up to 4% of annual global revenue (Article 83 of General Data Protection Regulation (GDPR)).
• Corrective measures: Supervisory Authorities may request data deletion, suspension of cross-border data transfers, or a permanent ban on data processing (Article 58 of General Data Protection Regulation (GDPR)). For an e-commerce platform, a ban on customer data processing effectively means business shutdown.

3. Can violations of General Data Protection Regulation (GDPR) affect the company’s business license in the EU?

General Data Protection Regulation (GDPR) does not directly revoke business licenses. However, severe violations may render business operations within the EU impossible, especially those resulting in permanent processing bans under Point f, Clause 2, Article 58 of General Data Protection Regulation (GDPR), effectively nullifying the commercial value of such licenses.

4. Is compensation mandatory for individuals harmed by violations of General Data Protection Regulation (GDPR)?

Article 82 General Data Protection Regulation (GDPR) expressly provides that any person suffering material or non-material (mental) damage due to General Data Protection Regulation (GDPR) violations has the right to receive compensation from the controller or processor responsible. Such a right is mandatory, not discretionary.

5. If data is leaked due to a technical error, is it considered a violation of General Data Protection Regulation (GDPR)?

Under Clause 12, Article 4 of General Data Protection Regulation (GDPR), personal data violations include accidental incidents such as technical errors.

Article 32 of General Data Protection Regulation (GDPR) obliges companies to implement appropriate technical and organizational measures to ensure data security proportionate to risks. A technical error resulting in a data violation indicates inadequate protection, and thus constitutes a General Data Protection Regulation (GDPR) violation.

V. Seeking legal assistance for compliance with General Data Protection Regulation (GDPR)

Compliance with General Data Protection Regulation (GDPR) is not merely a legal requirement for accessing EU markets, it is also a critical component of building trust with international clients and partners. Effective compliance safeguards enterprises from massive financial and reputational risks.

However, given the regulation’s complexity and evolving interpretations, self-assessment and remediation may lead to serious errors.

If your enterprise is struggling with compliance with General Data Protection Regulation (GDPR), managing a data breach, or seeking to establish a compliant data protection system, contact NPLaw today. Our team of legal experts specializing in technology and data protection law is ready to assist you.