Questions that land on a privacy desk

Our cookie banner has no “reject” button. How big are the fines?

Potentially very big. Refusing must be as easy as accepting.

Fined by France’s regulator (CNIL) in Dec 2021: accepting took one click, refusing took several.

• ePrivacy Art. 5(3)
• GDPR Art. 7(3)
• Recital 42

Sources: CNIL decisions of 31 Dec 2021, via GDPRhub. Checked 6 Oct 2026.

We want to monitor staff laptops. Has a regulator ruled on this?

Yes, many times. Limited, announced monitoring can be lawful. Constant or hidden monitoring gets fined.

Fined in 2020 for notes on staff’s private lives. Others: screen recording, reading email, tracking apps.

• GDPR Art. 5(1)(c)
• Art. 6(1)(f)
• Art. 88

Sources: Hamburg regulator, Oct 2020, via CMS; other decisions via GDPRhub. Checked 6 Oct 2026.

The board wants to know our worst-case fine for this data breach.

Up to €20 million or 4% of group turnover, whichever is higher.

Real fines are usually far lower: British Airways was first told £183m, and paid £20m.

• GDPR Art. 32
• Art. 33
• Art. 83

Sources: Irish regulator, Dec 2024; UK regulator, Oct 2020; via CMS. Checked 6 Oct 2026.

We’re training AI on customer data. Has anyone been fined?

Yes. Training is usually a new purpose: justify it, tell customers, let them object.

Italy fined OpenAI (Dec 2024) for training ChatGPT without a proper legal basis.

• GDPR Art. 5(1)(b)
• Art. 6(4)
• Art. 21

Sources: Italian and Dutch regulators, 2024, via GDPRhub and CMS. Checked 6 Oct 2026.