# Data protection fines in Europe — amount per capita Presented on 30 October 2026, with data cut off on 25 October 2026. [Article and tables](https://www.legiscope.com/blog/europe-data-protection-fines-per-capita.html). The collection contains 1 042 decisions across ten countries. Each selection includes up to 200 decisions, sorted by the available date: decision, publication or report year. It covers the decisions observed, without certifying that they are the latest 200 national decisions. It includes the GDPR, cookies and national rules related to data protection; it is not a series based exclusively on the GDPR. National sources, periods and limitations are retained in `dataset.json`. The [30 October review](audit-2026-10-30.json) corrects the amounts and scope in the [25 October historical log, in French](audit-2026-10-25.md). Fines under general administrative procedure are excluded; penalties for non-cooperation based on data protection legislation remain included. ## Calculation **Fines per capita = sum of documented euro amounts in the selection / country population on 1 January 2026.** Population figures come from [Eurostat](https://ec.europa.eu/eurostat/databrowser/view/tps00001/default/table?lang=en). Verified reductions recorded in the entries are taken into account. The amounts remain those documented by the sources: they are not revenue collected, nor are all amounts final. In Poland, conversions use the [ECB daily exchange rate](https://data.ecb.europa.eu/data/datasets/EXR/EXR.D.PLN.EUR.SP00.A) on the decision date or the latest earlier rate available. Totals add the amount on each row rounded to the nearest cent. An amount that is missing, cannot be converted, is inconsistent across sources or has been annulled without a verified replacement remains `null` in the sum, never zero. Initial amounts and appeal sources are retained separately; an annulment at first instance is not presented as final. `amount_known_count` and `amount_unknown_count` indicate monetary coverage. The ratio uses known amounts. The totals and individual fines in the table are rounded to the nearest euro; per-capita ratios are displayed to two decimal places. The charts show the weight of identified US Big Tech decisions across the full collection and the concentration of fine amounts in the French sample. Exports retain their precision, and ratios between countries are calculated before rounding. The decisions table displays 10 rows per page, with search and a country filter. Differences in periods and coverage prevent this ratio from being interpreted as an individual risk of receiving a fine or an amount paid by residents. ## US Big Tech This category covers Alphabet/Google, Amazon, Apple, Meta and Microsoft, including subsidiaries whose identity is verified in an official source. The identified cases in this version are `cnil-2025-022` (Google, €325 million) and `cnil-2023-038` (Amazon France Logistique, €15 million after appeal). A case mentioning YouTube, WhatsApp or another service does not make the sanctioned party a US Big Tech company. Unidentified anonymised entities remain unclassified. The fine-amount share divides the known fines in these cases by the known total across all ten countries; the decision share divides their number by all 1,042 collected decisions, whether or not their amount is known. Country columns use the same calculations within each country; the “Full collection” row uses the global denominators. Percentages are rounded to at most one decimal place so shares below 1% remain visible. Zero means no case involving these groups was identified in the selection; it does not certify the absence of other national sanctions. Ireland is outside the collection. ## Files - `cases.csv`: the 1 042 decisions, their amounts, grounds, references and available sources. - `dataset.json`: decisions, country summaries and coverage notes. - `recent.csv` and `recent.json`: population, number of decisions, known amounts and amount per capita for each country. `certified_latest_200` remains `false`: the sorting applies to the observed collection. - `greece-screening.json`: the historical review of 191 Greek acts under its former GDPR criterion. The 130 current totals, verified in the PDFs, include related national law; this historical file does not provide their corrected amounts. - `input-manifest.json`: SHA-256 hashes of the inputs used. - `audit-2026-10-30.json`: review findings, corrections by decision, sources, before-and-after amounts and remaining limitations. The generator is `tools/europe-fines/build_dataset.py`. National inputs and review reports are retained in `tools/europe-fines/inputs/` and `tools/europe-fines/audits/2026-10-25/`. ## Review of 30 October 2026 The initial 1 044 rows were reviewed country by country against the available official decisions, publications or reports. After excluding two Latvian general procedure fines of 150 € each, the corpus contains **1 042 decisions: 965 amounts included and 77 amounts unavailable or excluded**. The [detailed findings](audit-2026-10-30.json) retain the before-and-after values and sources. - **Greece: 37 399 749 €**, compared with 24 113 400 €. The PDFs establish 31 previously unknown totals and correct four incomplete amounts. The total covers data protection broadly: the GDPR and related national law, with GDPR-only components retained separately where they can be isolated. - **Poland: 19 160 846,02 €**, compared with 25 909 212,28 €. Six cases involve known annulments: only the minister’s 100 000 PLN component is retained in the Poczta case; five other annulled amounts without a verified replacement are excluded. Reported cassation appeals remain distinguished from final decisions. - **Germany: 50 826 200 €**. The initial 525 000 € in the DPO conflict-of-interest case remains historical; the report describes a judgment setting the fine without giving its amount. This exclusion does not establish that the initial figure was incorrect or that a specific reduction was ordered. - **Latvia: 1 833 059,93 €**. In addition to the two excluded general procedure fines, the Andy corporation total is excluded: the register and the amount in words state 491,18 €, while the figures in the operative part state 491,28 €. Initial and revised amounts in four other cases have been separated without changing the amounts included. - **Italy: 37 214 293 €**. The 5 000 € previously attributed to Aprilia cannot be verified in the official text, which is currently redacted, with no earlier official copy retained. The amount remains unknown; it is not declared incorrect or zero. - The totals for **France, Spain, Lithuania, Estonia and Luxembourg** remain unchanged. The official English link supporting a French fine of 17 000 € is retained. Counts of financial components have been corrected where verified; an unknown count remains unknown. The ten population figures and their statuses match the Eurostat download of 30 October; the ECB exchange-rate file matches the fresh download byte for byte. Conversions, sums, ratios, France/Spain ratios and the shares of major French penalties were independently recalculated before rounding. This verification of sources and calculations does not certify national completeness, all appeals, all amounts finally due or payments. ## Reuse Legiscope’s original structure, selection and annotations are offered under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/). Suggested attribution: “Legiscope, Data protection fines in Europe, version of 30 October 2026”, with a link to the article and an indication of modifications. This licence does not apply to decisions, authority publications, Eurostat/ECB data or their publishers’ trademarks. The files do not reproduce the full texts of decisions.