In May 2022, the European Data Protection Board published its Guidelines 04/2022 on the calculation of administrative fines under Regulation (EU) 2016/679 of the GDPR. The Draft Guidelines provide for a harmonized calculation of administrative fines under the GDPR. In general, the calculation of administrative fines is at the discretion of national data protection authorities (DPAs), which must ensure that the latter remains effective, proportionate, and dissuasive in each individual case. Under the Draft Guidelines, what is the five-step methodology that DPAs should apply when calculating administrative fines?
