In its second report on the application of the EU General Data Protection Regulation (GDPR) of 25 July(1) (Communication from the Commission to the European Parliament and the Council), the European Commission highlights the increase in enforcement activity by Data Protection Authorities in recent years. The DPAs have launched over 20,000 own-initiative investigations, and imposed over 6,680 fines amounting to around €4.2 billion. Ireland’s DPA has issued fines totalling €2.8 billion followed by Luxembourg (€746 million), Italy (€197 million) and France (€131 million). The lowest level of fines have been imposed by Liechtenstein (€9,600), Estonia (€201,000) and Lithuania (€435.000).