Companies filed 15 appeals of GDPR fines in the last six months and EU courts overturned or reduced most of them, as regulators struggle with small budgets
Catherine Stupp / Wall Street Journal :
Context & Ripple Effects
GDPR enforcement had been on an upward curve: after a cautious first wave of decisions in the law's opening year, fines grew roughly 40% to €159M in the past year versus the first 20 months, per FT research. The WSJ report marks the counter-move: 15 appeals filed in just six months, with EU courts overturning or reducing most of them while data protection authorities work with small budgets.
First-order effects
- Fined companies win direct relief — courts are voiding or shrinking penalties regulators spent scarce resources to impose, undercutting the deterrent value of each fine.
Second-order effects
- Consumer groups and privacy activists were already bypassing slow-moving authorities for court action, as Politico reported in their turn to litigation; successful corporate appeals push even more enforcement onto courts, where deep-pocketed litigants hold an advantage.
Third-order effects
- If the pattern holds, GDPR enforcement splits into a two-tier system: headline fines like France's €50M against Google set the tone, while appeals erode the tail — pressuring the EU to properly fund national regulators or accept courts as the real arbiters of privacy penalties.
The trend: GDPR enforcement is shifting from regulator-issued fines to contested courtroom outcomes, with underfunded authorities increasingly overruled by judges.