One of the key features of GDPR is the level of fines that it introduces for data protection breaches, up to €20 million or 4% of global annual turnover. The inclusion of global annual turnover as a yardstick indicates that the authorities had the big global players in mind when updating our data protection laws. So it is no surprise that the first really significant fine, by the French data protection authority, announced this week, was for Google.

Google was fined €50 million, nowhere near the actual maximum permitted based on its annual global turnover, but it is still a very big fine. Google has already announced that it will appeal the fine. We know that other investigations are in the pipeline too, some of which will lead to new super fines. It should be an interesting year.