As threatened earlier this year, the Hamburg Data Protection Commissioner Johannes Caspar has announced enforcement actions against a handful of multinational companies for noncompliance with German data protection law. After the Schrems decision in the European Court of Justice in October 2015 that invalidated USEU Safe Harbor as a valid data transfer mechanism from the EU to the U.S., the Article 29 Working Party a collective of the individual EU Member States' Data Protection Authorities (DPAs) announced an enforcement grace period to allow companies to get into compliance with other data transfer mechanisms, such as Model Contracts or Binding Corporate Rules. Caspar and his office have since audited 35 multinational companies operating in Hamburg. The enforcement actions, and the administrative fines levied therein, are related to the earlier audits, but may not be the end of the DPA's investigations.
The Hamburg DPA had announced on February 29, 2016 that the enforcement actions had taken place. Recently, a German news article reported that the DPA fined three multinational companies as a result of the enforcement actions. As reported, the companies' fines ranged from EUR 8,000 to EUR 11,000. At this point, the companies can no longer challenge the DPA's decision. Fines could have been as much as 300,000 EUR the fines are less than originally expected, in part because we understand that the companies transitioned their business practices during the review period. Future fines are threatened to be higher.
The Hamburg DPA has announced that it is pursuing other Hamburgbased entities (possibly related to multinational companies) under open administrative proceedings.
The Hamburg enforcement actions are the first enforcement actions made public against U.S. companies that did not update their data transfer compliance in a timely fashion, but they certainly will not be the last. Companies should anticipate enforcement actions for noncompliance from other DPAs.
Thanks to Taylor Wessing attorney Stefan Alich for his counsel.