Higher fines are assessed for GDPR violations due to which of the following?

Question

Options

• AFailure to notify a supervisory authority and data subjects of a personal data breach
• BViolations of a data controller's obligations to obtain a child's consent
• CFailure to appoint a data protection officer.
• DViolations of a data subject"s rights

• A
  3% (1)
• B
  6% (2)
• C
  3% (1)
• D
  87% (27)

Explanation

The GDPR establishes a two-tier system of administrative fines for infringements of its provisions, depending on the nature, gravity, and duration of the infringement, as well as other factors such as the intentional or negligent character of the infringement, the actions taken to mitigate the damage, the degree of co-operation with the supervisory authority, and any previous infringements. The lower tier of fines can be up to 10 million euros or 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher. The lower tier of fines applies to infringements of the GDPR relating to the following aspects1: The obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39, and 42 The obligations of the certification body pursuant to Articles 42 and 43; The obligations of the monitoring body pursuant to Article 41 (4). The higher tier of fines can be up to 20 million euros or 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher. The higher tier of fines applies to infringements of the GDPR relating to the following aspects1: The basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7, The data subjects' rights pursuant to Articles 12 to 22; The transfers of personal data to a recipient in a third country or an international organisation pursuant to Articles 44 to 49; Any obligations pursuant to Member State law adopted under Chapter IX; Non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows by the supervisory authority pursuant to Article 58 (2) or failure to provide access in violation of Article 58 (1). Therefore, higher fines are assessed for GDPR violations due to violations of a data subject's rights, as these are among the infringements that fall under the higher tier of fines. Data subjects' rights are the rights granted to individuals whose personal data are processed by controllers or processors, such as the right to access, rectify, erase, restrict, object, or port their data, as well as the right to be informed, to withdraw consent, and to lodge a complaint. Violations of these rights can cause significant harm to the data subjects and undermine the objectives of the GDPR. Therefore, option D is the correct answer.

No community discussion yet for this question.