JUST A TINY fraction of the €3.26 billion in fines levied by the Data Protection Commission (DPC) over the past five years has been collected.

The DPC said that of all fines issued between 2020 and the end of October this year, only €19.9 million of the total has been paid so far.

The total amount paid represents just 0.6% of the penalties decided on by the DPC, most of which relate to Big Tech. Many of the fines are still subject of court appeals or other legal processes.

Figures released under Freedom of Information laws show €785,000 in fines levied in 2020, of which €75,000 has been paid. For 2021, there was a total of €225 million in fines with only €800,000 of that settled so far.

In 2022, DPC fines exceeded €1 billion; however, the amount collected for that year currently stands at €17.6 million.

Last year, the total fines levied reached a colossal €1.55 billion, which included a €1.2 billion fine for Meta, the parent company of Facebook.

Of that total, only €815,000 has so far been collected by the Data Protection Commission.

Figures for this year covering the period up until the end of October show that fines totalling €401 million have been levied by the DPC. Many of those cases are not long concluded and the only money collected so far has been €582,500.

Asked whether any of the €3.256 billion in fines had been written off or deemed uncollectable, the Data Protection Commission said that none of it had.

The DPC said when they decided to impose an administrative fine on a data controller or processor, it did not become payable until the decision had been confirmed by the Circuit Court.

A spokesman said the process required them to make a formal application to the courts to have each decision confirmed.

He said: “The Circuit Court is required to confirm the decision unless it sees good reason not to do so. Once the decision has been confirmed, the DPC may then proceed to issue a formal notice to the data controller or processor […] to require payment of the fine.”

However, these applications can only be made if the company or person fined had not invoked their statutory right of appeal.

“In these circumstances, it is only in those cases where the data controller or processor has not sought to bring a legal challenge against the underlying decision that the DPC has been able to make the confirmation application and collect in the fine,” he said.