16th edition of CMS European M&A Study is available now

Highest GDPR fine of 1.2 billion euros imposed by the Irish data protection authority in May 2023 for a breach of the rules on international data transfers. Further fines imposed by this authority in 2023 amounted to hundreds of millions of euros. The main violations are “Insufficient legal basis for data processing” and “Failure to comply with the general principles of data processing”. The next most common violation is “Insufficient technical and organizational measures to ensure information security”. Spain tops the list of countries with the most fines for the fifth year in a row, followed by Italy and Romania. Ireland, Luxembourg and France have the highest average fines and total amounts per country. Berlin – Today, international law firm CMS has published the fifth edition of its annual Enforcement Tracker Report. The English-language report shows the developments of all publicly known GDPR fines based on CMS's own online database, GDPR Enforcement Tracker. The current edition of the report covers the analysis period between March 2023 and March 2024. 510 fines were added for the past year as of the editorial deadline on 1 March 2024. This brings the total number of data protection fines since the GDPR came into effect in May 2018 to 2,225, or 2,086 if only fines with full details such as the amount of the fine, date and authority are counted. The total amount of fines since the start of the survey is around 4.5 billion euros. This means that fines of around 1.7 billion euros have been added compared to last year’s Enforcement Tracker Report. This shows that authorities are no longer shying away from imposing high fines. The average fine for the entire reporting period was around 2.1 million euros - with high fines against “big tech” companies in 2021/22 and the first fine in the billions in 2023 having a particularly heavy impact.“At the top of the list of GDPR fine triggers is, once again, insufficient legal basis and non-compliance with the general data processing principles as well as insufficient technical and organisational measures. Companies should pay particular attention to this,” says Christian Runte, lawyer and partner at the international commercial law firm CMS Germany. Dr Alexander Schmid from the Enforcement Tracker team at CMS Germany adds: “In addition to data protection authorities, the courts have also increasingly dealt with the interpretation of the GDPR. For example, the Court of Justice of the European Union has further clarified the scope of data subjects' right of access. “These rulings create more clarity, but at the same time tighten the requirements for companies, which is why, in addition to a viable compliance concept, current developments will also be decisive for them in practice in the future.”Read the full Enforcement Tracker Report here; a summary can be found here. Pressekon­takt presse@cms-hs. com

The CMS Data Protection Group is pleased to launch the 5th edition In the six years since the GDPR came into force, this powerful framework to protect personal data has certainly helped to raise awareness and encourage compliance efforts – just as the European legislator intended. At the same time, the risk of fines of up to EUR 20 million or 4% of a company’s global annual turnover can also lead to fear and reluctance or ignorance about compliance issues. We still believe that facts are better than fear. This is why we continuously update our list of publicly known fines in the GDPR Enforcement Tracker and established the GDPR Enforcement Tracker Report as an annual deep dive approach to provide you with more insights into the world of GDPR fines.

Last week (9 and 10 May 2024), our team represented CMS RRH Competition practice at the “Meet to Compete Competition Law and Policy Conference – Tools for New Rules” held in Opatija, Croatia. Dieter Zandler from CMS Austria, Marija Zrno Prošić, Dina Čeliković and Filip Bjelinski from Croatia, Srđan Janković and Maja Živanović (Serbia, Montenegro & North Macedonia), and Robert Kordić and Gašper Hajdu from Slovenia, together spent two wonderful days in interactive discussions with representatives of competition authorities, judges, attorneys, in-house lawyers, and other legal practitioners from all over the Europe. During the first day of the conference, discussions centered on topics including concentrations and FSR, the implications of the "effects-based approach," and recent developments in the Central and Southeast Europe (CEE & SEE) region. The team spent their first conference day pleasantly networking at the coffee break powered by CMS and in the evening at the cocktail and dinner with conference attendees. The second day of the conference was all about workshops covering topics such as exclusionary abuses of dominance, horizontal agreements and disagreements, RPM, etc. Our Marija Zrno Prošić led a focused workshop on the most common vertical restraints, using practical examples from the field and engaging with the audience through survey questions to enhance interaction and understanding. The audience reactions were very positive and discussions continued after the workshop. Overall, we were happy to have our close-nit competition team at this conference, as such events with regional outreach are crucial in fostering collaboration, enhance understanding of regulatory nuances, and promote best practices across different jurisdictions. About the Conference The Conference traditionally offers a platform for discussion about recent antitrust developments, with a particular focus on Central and Eastern Europe (CEE) and South-East Europe (SEE). The Conference is supported by the Croatian Competition Agency, universities and local organizations, with great speakers from the OECD, European Commission, universities, industry and regulators from the entire region and Europe.  

1. Which laws are applicable regarding advertising of medicines and medical devices? 1.1 Medicines  The primary legal source is the Medicinal Products Act (Ar­zneimit­tel­ge­setz – AMG). In addition...