Privacy sanctions zigzag. 75% of the total amount of penalties imposed in the EU, from May 2018 to date, derives from 10 injunctions to large web platforms, while 25% derives from the other 2335 fines applied by all EU states. The strictest Guarantor is the French one (with an average amount of 5.6 million euros), while the Romanian one has a light hand (average of 6 thousand euros).

The most active Guarantor is the Spanish one with 959 sanctions, while Portugal has adopted 7. This is what emerges from an analysis of the measures adopted by the European Data Protection Authorities drawn up on the occasion of the seventh anniversary of the EU Data Protection Regulation no. 2016/679 (GDPR), which entered into force on 24/5/2016, but became operational on 25/5/2018. The numbers relating to the seven years draw a picture of extreme disparities in application around the EU, both in terms of the number of penalties and the average amounts of the same.

There are countries with a very high number of sanctions and others with a very low number. Spain (959 sanctions) and Liechtenstein, with 1 sanction, are at the antipodes. Reaching the numbers of Spain, however, is also impossible for countries such as Italy (402), Germany (205), and France (66).

Closely behind Germany is Romania with 197 sanctions, which far distances Poland (93), Greece (72), and Hungary (68). Finally, there are also many countries, in which the guarantors have adopted few units of sanctions per year. Thus, Cyprus has 45 sanctions, almost as many as Sweden (43), Luxembourg has 32 sanctions, and Denmark has 28.

But the figures can be even smaller: in Lithuania, there were 14 measures, and next, we have Estonia and Latvia, with 8 sanctions each, and Portugal with 7 sanctions. A possible reading of these data suggests that in some states, the guarantors are more diligent than in others.