GDPR: France imposes 27x more in fines per resident than Spain

The study covers the most recent documented data protection decisions from ten European authorities, up to 200 per country: 1,042 decisions, €833m in known fines, divided by each country's population.

Some core findings :

- Fines France: €9.58 per resident. Spain: €0.35. Greece €3.61, Germany €0.61. A 27x gap between top and bottom. - Five French decisions carry 89% of the French total. Google (€325m) and Shein (€150m) alone are 72%. The other 195 French decisions add up to €70m, median €11,000. - Two decisions against US Big Tech (Google, Amazon France Logistique) are 0.2% of the decisions and 41% of the money. Google's single fine is almost twice the known fines of the nine other countries combined. - The typical fine is small: median €7,200, and 529 of 965 known amounts are under €10,000. The 11 decisions at €10m or more carry 84% of all the money. - Cookie rules appear in 39 decisions but carry 65% of all the money.

What most fines are about (580 decisions with classified grounds): insufficient security (163), no valid legal basis (146), poor information to individuals (115), not cooperating with the authority (112), excessive collection or monitoring (91). Cookie rules appear in only 39 decisions but carry 65% of all the money.

And Big Tech is still misbehaving. They are serial offenders. We need more fines and higher fines... but with hardcore technical regulation on technical interop with small tech.