Fine totals circulate as single numbers detached from the decision that produced them. The useful version names the authority, the date, the provisions found to be breached, and whether the amount has survived appeal — because several of these have not finished moving.
How to read a fine figure
Three things about the numbers below. First, a fine is announced by one national supervisory authority under its own procedure; there is no EU register of fines, and the only authoritative text is the authority’s own decision. Second, an announced amount is not a final amount: administrative fines are appealable to national courts, and at least one below has been through a tribunal on whether the authority had jurisdiction at all. Third, a fine is only part of a decision — the corrective measures under Article 58(2), such as an order to delete a dataset or to stop processing, are frequently the more consequential half and are almost never reported.
This is not legal advice, and it is a snapshot. Every figure here is stated as announced by the issuing authority on the date given; appeals and reductions are common. Before citing any of these, check the authority’s own decision page for the current position.
Clearview AI: five authorities, five decisions
Clearview AI built a facial-recognition search product from images scraped from the public web. It is the most-fined AI company in EU data protection history, and its decisions are usually reported as one total, which obscures that five separate authorities reached five separate decisions under their own procedures.
- United Kingdom, ICO, announced 23 May 2022 — a monetary penalty of £7,552,800 plus an enforcement notice to delete UK residents’ data. Clearview appealed on jurisdiction, and the First-tier Tribunal ruled in October 2023 that the ICO lacked jurisdiction because the processing fell within the foreign law-enforcement exclusion. The ICO appealed onward. Treat the current status as one to verify at the ICO’s enforcement register rather than assuming either outcome.
- Italy, Garante, announced 9 March 2022 — €20 million, with an order to delete data relating to individuals in Italy and a ban on further processing, on findings including the absence of a lawful basis and breaches of the transparency and purpose-limitation principles.
- Greece, HDPA, announced July 2022 — €20 million, with a ban on collection and an order to delete.
- France, CNIL, announced 17 October 2022 — €20 million and an order to cease collection and to delete, published at the CNIL’s site. The CNIL subsequently announced a penalty payment for failure to comply with the injunction, reported at €5.2 million in October 2023.
- Netherlands, Autoriteit Persoonsgegevens, announced 3 September 2024 — €30.5 million together with orders subject to periodic penalty payments, published at the AP’s site. The AP also said it was investigating whether directors could be held personally liable, which is the genuinely novel element and the reason this decision matters beyond its size.
The pattern across all five is the same and is worth extracting: the product was found to have no lawful basis for the biometric processing under Article 9, the data subjects were never informed under Articles 13 and 14, and the company did not designate an EU representative under Article 27. Collection from public sources was not treated as curing any of that. A running tally is maintained in the Clearview tally page.
Generative AI: the Italian decisions
Italy’s Garante has issued the decisions that matter most for generative systems, and both came out of proceedings that began with an emergency limitation on processing rather than with a fine.
- OpenAI, announced 20 December 2024 — a fine of €15 million and a corrective measure requiring a six-month information campaign, concluding the proceeding opened after the temporary limitation on ChatGPT of 30 March 2023. The findings included processing without an adequate legal basis, a failure of transparency towards data subjects, and inadequate age verification. OpenAI publicly stated it would appeal. The timeline of the underlying suspension is in the ChatGPT ban timeline.
- Luka Inc. (Replika), announced May 2025 — a fine of €5 million, following the Garante’s February 2023 limitation on the companion chatbot, on findings including the absence of a legal basis and the inadequacy of the age-verification arrangements for a service accessible to minors. The Garante also said it had opened a further investigation into the underlying language model. Background in the Replika ban page.
Both decision texts are published in the Garante’s register of provvedimenti, which is the citation to use. Neither has been tested on appeal in a way that settles the underlying legal-basis question for model training; that question is still open and is the subject of the scraping lawful-basis page.
What the articles cited have in common
Across these decisions the provisions found to be breached are remarkably consistent, and none of them is exotic. Article 5(1)(a) lawfulness, fairness and transparency. Article 6, no valid basis. Article 9, biometric or other special-category data processed without a condition. Articles 13 and 14, people never informed. Article 12, rights not facilitated. Article 27, no EU representative for a non-EU-established controller. Article 35, no DPIA where one was plainly required.
What is conspicuously absent is any finding that turns on model architecture, on training method, or on anything technically specific to AI. Every one of these companies lost on ordinary data-protection fundamentals applied to an unusual product. That is the most useful thing on this page: the enforcement risk for an AI product in the EU has so far been concentrated in the paperwork and the basis, not in the machine learning.
Checking a figure before you repeat it
Every number above is stated as announced by the issuing authority on the date given, and several are contested. Before you put one in a board paper, a pitch or a risk register, do three things.
- Find the authority’s own decision, not a news report of it. The Garante, the CNIL, the AP and the ICO all publish decisions or enforcement summaries on their own sites, and the decision states the provisions and the corrective measures that the coverage usually omits.
- Check for an appeal. Search the authority’s newsroom for the company name after the decision date, and check the national administrative court where the appeal would be heard. The Clearview UK decision is the standing example of why: the announced figure and the enforceable figure diverged for years.
- Record the date you checked next to the figure. A fine table without an as-at date is the artefact that spreads a superseded number for the next three years, which is precisely how the Clearview total gets misquoted.
One more caution about totals. Adding these figures produces a number that means very little: they were imposed by different authorities under different national procedures, against overlapping but non-identical processing, for populations that overlap at the edges. The sum is not what the company owes, and it is not a measure of EU enforcement intensity. Cite the decisions individually or do not cite them at all.
Top comments (0)