Additionally, despite the barrage of available opinions and guidelines on the GDPR put together by regulators and data protection experts, there is a lack of practical, easy to understand and targeted guidance about data protection law for SMEs. Uncertainty over the interpretation of the revised data protection requirements is increased by those areas where national laws can diverge (‘derogate’) from certain GDPR provisions. Regulators do recognize the unique challenges that SMEs face in regard to GDPR compliance, and do assist when possible. However, Data Protection Authorities (DPAs) apply the GDPR irrespective of the size of an organization. The enforcement actions taken by several DPAs across Europe demonstrate that they are willing to fine SMEs they find in breach of data protection rules in a similar manner to larger enterprises. The most illustrative examples in this regard include the 15,000 EUR fine
Introduction
issued by the Belgian DPA in late 2019 to an SME for not complying with information obligations stemming from the GDPR when using cookies;4 a 20,000 EUR fine issued by French DPA to a translation company for continuously filming its employees at their workstations and thereby breaching the data protection rights of employees;5 and a 5,000 EUR fine for a shipping company that did not conclude a data processing agreement with one of its business partners.6
Structure With this background in mind, the STAR II consortium prepared this handbook to help SMEs meet core GDPR requirements. Different
18
4
EDPB, ‘The Belgian DPA has imposed a fine of € 15,000 on a website specialized in legal news’ https://edpb.europa.eu/news/national-news/2019/ belgian-dpa-has-imposed-fine-eu15000-website-specialized-legal-news_sv.
5
CNIL, Délibération SAN-2019-006 du 13 juin 2019 https://www.legifrance.gouv.fr/ cnil/id/CNILTEXT000038629823/.
6
Odia Kagan, ‘Hessian DPA Fines Shipping Company For Missing Data Processing Agreement’ https://www.jdsupra.com/legalnews/hessian-dpa-fines-shipping-companyfor-76851/.
