Fines and enforcement
Data protection fines reduced or cancelled on appeal
Short answer
- Bonn court ruling, 11 November 2020
- €9,550,000 fine reduced to €900,000 1
- CNIL fine on Google
- €50 million, upheld on 19 June 2020 2
- CNPD fine on Amazon
- €746 million, annulled on 12 March 2026 as reported 3
- Garante fine on OpenAI
- €15 million, annulled as reported on 20 March 2026 4
- PIPC fine on SK Telecom
- 134.8 billion won as reported by Light Reading, court challenge filed January 2026 10
Appeal, reduction, annulment and referral
An appeal asks a court or tribunal to review a regulator's decision. The court can confirm the fine, change the amount, or cancel the decision. A reduction keeps the finding of a breach but lowers the amount. The Landgericht Bonn did this on 11 November 2020. It found the company guilty of failing to secure personal data with suitable technical and organisational measures and set the fine at €900,000 1.
An annulment cancels the decision. What happens next depends on the court's reasons. In the UK Clearview AI case, the First-tier Tribunal held on 17 October 2023 that the ICO lacked jurisdiction. The Upper Tribunal allowed the ICO's appeal and sent the case back to the First-tier Tribunal to decide the substance 5,6.
A preliminary ruling is different again. A national court asks the EU Court of Justice how the GDPR should be read, and the Court answers that question. In Deutsche Wohnen (C-807/21), the Grand Chamber ruled on 5 December 2023 that a company can be fined without first identifying a natural person who committed the breach. It held that a fine requires proof that the controller acted intentionally or negligently. The Berlin authority's fine at issue was €14,385,000 7.
Landmark outcomes
| Case | Regulator decision | Court outcome |
|---|---|---|
| Google, France 2 | CNIL fine of €50 million, 21 January 2019 2 | Upheld by the Conseil d'État, 19 June 2020 2 |
| Company fined by the BfDI, Germany 1 | €9,550,000, notice of 27 November 2019 1 | Reduced to €900,000 by the Landgericht Bonn, 11 November 2020 1 |
| Amazon, Luxembourg 3 | CNPD fine of €746 million, 2021, as reported by Chronicle.lu 3 | Annulled by the Administrative Court on 12 March 2026, as reported by Chronicle.lu 3 |
| OpenAI, Italy 4 | Garante fine of €15 million, end of 2024, as reported by Punto Informatico 4 | Annulled by the Tribunale di Roma, as reported on 20 March 2026 4 |
| Clearview AI, United Kingdom 5 | ICO penalty of £7,552,800, 18 May 2022 5 | Upper Tribunal allowed the ICO appeal and remitted the case 5,6 |
| City of Dublin ETB, Ireland 8 | DPC fine of €125,000, 18 June 2025 8 | Confirmed in the Dublin Circuit Court in 2025 and collected 8 |
| SK Telecom, South Korea 10 | PIPC fine of 134.8 billion won, August 2025, as reported by Light Reading 10 | Challenge filed in the Seoul Administrative Court, pending as reported in January 2026 10 |
Why a court cut the amount
The Bonn judgment gives its reasons in full. The court found the breach serious but not at the level the Federal Commissioner had assumed. No sensitive data was involved and only one case of actual harm to a customer was proven. The company had not acted on purpose, cooperated with the regulator, quickly raised its security and had no earlier GDPR fine. The court said the high first figure had caused reputational damage 1.
Press reports on the 2026 annulments did not give the courts' reasons. Chronicle.lu reported a statement from Amazon that it was pleased with the outcome 3. Punto Informatico reported that the reasons in the OpenAI ruling were not yet known, that the Rome court had suspended the sanction in 2025 during its review, and that the Garante had not commented 4.
Amounts can rise before any court hearing
Appeals are not the only stage where an amount changes. In cross-border EU cases other authorities can object to the lead authority's draft. In the WhatsApp inquiry the EDPB adopted a binding decision on 28 July 2021 that required the Irish DPC to reassess and increase its proposed fine. The DPC then imposed €225 million, with a reprimand and an order to bring processing into compliance 9.
The DPC challenged binding decisions of this kind in the EU General Court. Its 2025 annual report says the General Court dismissed that action on 29 January 2025 8.
Appeals still open
- TikTok appealed the DPC's decision of 30 April 2025, which imposed two fines totalling €530 million, according to the DPC's 2025 annual report 8.
- The Department of Social Protection appealed its €550,000 fine of 9 June 2025 8.
- The ICO said in December 2025 that the Upper Tribunal had given Clearview AI permission to appeal to the Court of Appeal 6.
- SK Telecom filed its lawsuit on the last day of the 90-day appeal period, as reported by Light Reading 10.
Common questions
Can a GDPR fine be appealed?
Yes. Each fine on this page was challenged before a national court or tribunal, and the route depends on the country. In Germany the case went to the Landgericht Bonn 1. In France the Conseil d'État heard the challenge 2. In Ireland a fine was confirmed in the Dublin Circuit Court 8.
Does an annulled fine mean no breach happened?
Not always. An annulment cancels the decision, and the reasons decide what follows. In the OpenAI case the reasons were not public when the ruling was reported on 20 March 2026 4. In the Clearview case the Upper Tribunal sent the matter back to the First-tier Tribunal to decide the substance 6.
Which large data protection fines were annulled in 2026?
Chronicle.lu reported that Luxembourg's Administrative Court annulled the CNPD's €746 million Amazon fine on 12 March 2026 3. Punto Informatico reported that the Tribunale di Roma annulled the Garante's €15 million OpenAI fine 4.
Why did the Bonn court lower the fine?
It found the breach serious but less grave than the regulator assumed. It weighed that no sensitive data was involved, the company cooperated and improved security, and it was a first GDPR fine 1.
Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com.
Sources
- Landgericht Bonn: Urteil 29 OWi 1/20 (11 November 2020)
- Conseil d'État: RGPD, le Conseil d'État rejette le recours dirigé contre la sanction de 50 millions d'euros infligée à Google par la CNIL (19 June 2020)
- Chronicle.lu: Luxembourg Court Annuls CNPD Ruling in Amazon Data Protection Case (14 March 2026)
- Punto Informatico, Luca Colantuoni: OpenAI, annullata la multa per violazione della privacy (20 March 2026)
- The National Archives, Find Case Law: The Information Commissioner v Clearview AI Incorporated, 2025 UKUT 319 (AAC)
- Information Commissioner's Office: UK Upper Tribunal hands down judgment on Clearview AI Inc (8 October 2025, updated 19 December 2025)
- EUR-Lex: Judgment of the Court (Grand Chamber), Deutsche Wohnen SE v Staatsanwaltschaft Berlin, Case C-807/21 (5 December 2023)
- Data Protection Commission: Annual Report 2025 (undated)
- Data Protection Commission: Data Protection Commission announces decision in WhatsApp inquiry (2 September 2021)
- Light Reading, Gigi Onag: SKT challenges $91M data breach fine in court (20 January 2026)
Related
- How GDPR fines are calculated
The GDPR fine ceilings, the Article 83 factors and the EDPB five-step method, with seriousness levels, turnover bands and real decisions.
- Largest GDPR fines and their appeal status
Large GDPR fines from regulators' own records, from the €1.2 billion Meta decision to Uber and TikTok, with the appeal status each record shows.
- How long data protection investigations take
Legal deadlines and recorded timelines for data protection complaints, inquiries and court cases in the EU, Ireland, Norway, Australia and Canada.
- EU data protection authorities compared
Complaints, fines, breach notices, staff growth and handling times at EU data protection authorities, from the Commission and national annual reports.
- How UK ICO enforcement works
The UK ICO's enforcement tools, how its fines are calculated under the 2024 fining guidance, the statutory maximums and the Capita case.