Data Protection Commission owed more than €4 billion in fines

Ken Foxe

The Data Protection Commission (DPC) is owed more than €4 billion in fines that have not been collected or are subject to legal challenge.

The DPC hit companies – including firms in Big Tech – with more than €530 million in fines last year.

However, just €125,000 of that has been collected so far, according to data released under FOI laws.

Over the past six years, the commission has levied an incredible €4.04 billion in fines, mostly on multinational technology companies.

However, of that total, €4.02 billion of it remains uncollected, and just €20 million has been paid in fines so far.

In 2024, €652 million worth of fines were levied, of which €582,500 has been paid.

The year before that, there were a massive €1.55 billion worth of fines imposed by the DPC – yet just €815,000 was collected.

During 2022, the commission decided on fines with a value of just over €1 billion, €17 million of which has been paid so far.

Five years ago, in 2021, companies were ordered to pay €225 million over data protection issues – €800,000 has up to now been collected.

Even for 2020, when just €785,000 in fines were imposed – less than 10 per cent of that, or €75,000, has been paid to date.

The Data Protection Commission said the majority of these cases were currently the subject of appeal in the Irish courts.

It said that under legislation, fines could not be collected until they were confirmed in court.

An information note said: “Where an entity subject to a fine decides to appeal … the DPC is precluded in law from collecting the fine until the appeal has been heard.”

The commission said that many of the fines hinged on a key case involving WhatsApp, which is currently before the Court of Justice of the EU.

Asked about whether any of the fines were considered “uncollectable” for any reason, the DPC said none were.