RIGHTS • LIBERTIES • INSTITUTIONS
Liberty Journal

Examine the principles. Follow the consequences.

Courts / Analysis · European Union

Choosing a GDPR fine is separate from calculating its amount

The European Data Protection Board's September announcement concerns when a fine is appropriate. Its existing calculation guidance addresses another stage, and the two publication statuses differ.

AI-assisted desk article · Automatically published after automated checks. No individual human review.

The European Data Protection Board announced new guidance on decisions to impose administrative fines on September 21, 2026. Its announcement distinguishes choosing a fine from calculating the amount once that choice is made. The new material is open for consultation until November 13, rather than being evidence of a fine imposed on a named organization.

That distinction separates the form of a regulatory response from its size. A discussion about an amount can assume that a financial penalty is the selected instrument. A discussion about whether to impose one examines an earlier question. Treating an amount-calculation method as an automatic answer to the earlier question would skip a decision rather than explain it.

The board describes the new guidance as complementing its existing work on calculation. Its announcement outlines consideration of legal grounds, the party liable, intention or negligence, relevant circumstances and the proportionality and effectiveness of the response. Those are the board's described methodological elements. They do not establish the result of a real case or a uniform penalty for every infringement.

A sequence rather than a price list

Consider a fictional case summary that states only a proposed monetary amount. A reader could learn the figure without learning why a fine was selected, which party was considered liable or which facts informed the reasoning. Adding those explanations would supply different information, not merely more precise arithmetic. This hypothetical example is not a forecast of a regulator's action.

The same point works in the other direction. A reasoned decision about the type of response would not, by itself, establish the final amount. The evidence and reasoning used at each stage would still need to be identified. A single headline number cannot stand in for the complete sequence.

The EDPB's publication page for its calculation guidelines labels that earlier instrument a final version dated May 24, 2023 and provides version 2.1 for download. This establishes the publication status of the calculation document. It does not turn the September 2026 consultation into a final text merely because the newer work is described as complementary.

Publication status is therefore a separate axis from subject matter. Two documents can address adjoining steps while one is final and the other invites comments. They can also be described in one announcement without sharing the same implementation history. Reading their dates and labels separately avoids importing the status of one into the other.

The September announcement also discusses separate DSA-GDPR guidance. This report does not infer detailed rules from a headline combining those subjects or claim to have assessed text not supplied on the cited calculation page. The focus here is the stated distinction between the selection and calculation stages.

Neither linked page provides the evidentiary record of an individual enforcement case. Both originate with the board, so they are not independent evaluations of how consistently national authorities apply the methodology. They cannot establish that a particular organization will be fined or predict an amount.

What the records support is a procedural distinction with different document statuses: existing final calculation guidance and newly announced consultation material about the choice of response. A later final instrument or case decision would need to be read on its own terms before drawing conclusions beyond that distinction.