No regulator publishes an aggregate GDPR fine appeal rate, but the documented rulings that do exist show real movement in both directions. The UK's Information Commissioner's Office cut its GDPR fine against retailer Easylife by 81%, from GBP 1.35 million to GBP 250,000, following a First-tier Tribunal settlement approved on 16 March 2023, while a Luxembourg appeals court fully annulled Amazon's EUR 746 million fine in March 2026. Both extremes, and everything in between, are covered below.
How many GDPR fines have actually been appealed?
Nobody publishes that number. CMS Law's GDPR Enforcement Tracker Report 2026, the most widely cited aggregator with 2,685 confirmed fines totaling EUR 6.11 billion, tracks fines by country, sector, and violation type but does not include an appeal-status field. enforcementtracker.com's live database, running ahead of CMS at 3,202 recorded actions, has the same gap. Neither DLA Piper's annual GDPR fines survey nor any EU-level body maintains a public tally of how many fines were formally challenged, let alone how those challenges resolved.
What does exist is a scattered public record of individual court and tribunal rulings, each reported separately by the DPA involved, the court itself, or specialist legal press. This review compiles the outcome of every major, publicly documented GDPR fine appeal ruling identified through that scattered record: 6 cases since 2022, spanning four EU member states plus the UK's post-Brexit UK GDPR regime.
Figure 1: The path a GDPR fine takes once a controller challenges it. Source: this review's compilation of the Amazon, Clearview AI, IAB Europe, and Easylife rulings below.
Getting a fine finalized in the first place can also take years, since some decisions are non-final the moment they are announced. Poland's UODO fined a Krakow medical center a combined 1,145,891.25 PLN (roughly EUR 267,700) on 17 January 2025 over hidden neonatal-ward cameras, and the regulator's own case database still listed the decision as "nieprawomocna," non-final and open to appeal, at time of publication. One line from a headline count of "how many fines exist" says nothing about how many of those fines are actually settled.
Which GDPR fines have been reduced on appeal?
Two of the six cases in this review ended in a reduction, though only one came from an actual court ruling. Easylife's GDPR portion dropped 81%, and British Airways' provisional notice dropped 89%, but the mechanism behind each cut was different.
The ICO fined Easylife GBP 1.35 million in October 2022 under UK GDPR for using 145,000 customers' purchase histories to infer health conditions without a lawful basis, plus a separate GBP 130,000 penalty under PECR for 1,345,732 unsolicited marketing calls. Easylife appealed the GDPR portion to the First-tier Tribunal, which approved a settlement cutting it to GBP 250,000 on 16 March 2023. The PECR fine was paid in full and never contested.
British Airways' case looks similar on paper but is not the same kind of appeal. The ICO's original 2019 notice of intent proposed GBP 183.39 million, calculated as 1.5% of the airline's 2017 turnover. After BA formally objected to that methodology, the regulator recalculated using its published Regulatory Action Policy: a GBP 30 million starting figure, reduced by GBP 6 million for mitigating steps BA had taken, then by a further GBP 4 million under the ICO's COVID-19 financial-hardship policy, for a final GBP 20 million fine issued 16 October 2020. That is a pre-finalization representations process, not a judicial appeal against an already-final penalty, and it is worth keeping the distinction straight when comparing GDPR fine outcomes across cases.
Sites collecting customer purchase history or inferring anything from it, health conditions included, are exactly the kind of processing that triggered Easylife's fine. A privacy policy generator built for GDPR's lawful-basis and profiling disclosures keeps that kind of consent language current before a regulator ever opens a file.
Which GDPR fines have been annulled or overturned?
Only one fine in this review has been fully annulled outright, and it is also the largest one on the list. Amazon Europe's EUR 746 million fine, issued by Luxembourg's CNPD in July 2021 over ad-personalization consent practices, was upheld by Luxembourg's Administrative Court in 2025, then annulled entirely by a higher Luxembourg appeals court on 13 March 2026. The appeals court confirmed Amazon had breached GDPR but found the CNPD had not properly assessed whether the violation was intentional or negligent, and sent the case back to the regulator to decide whether any fine is warranted at all. For the full context of where that fine ranks historically, see our roundup of the biggest GDPR fines of all time.
Clearview AI's UK case is messier and still unresolved. The ICO issued a GBP 7,552,800 penalty notice against the facial-recognition company on 18 May 2022. The First-tier Tribunal overturned it entirely in October 2023, ruling the processing fell outside UK GDPR's jurisdiction because Clearview's customers were foreign law-enforcement and government bodies. The ICO appealed that jurisdictional finding, and on 6 October 2025 the Upper Tribunal ruled in the ICO's favor, in the case cited as [2025] UKUT 319 (AAC), finding Clearview's activity did fall within UK GDPR's territorial scope. The Upper Tribunal did not reinstate the fine. It remitted the case to the First-tier Tribunal to decide the substantive appeal now that jurisdiction is settled, so more than 3.4 years after the fine was first issued, its final amount is still unknown. Our look at GDPR fines for CCTV and surveillance covers Clearview's parallel EU fines from Italy, Greece, and the Netherlands, none of which have faced the same jurisdictional challenge.
One-line takeaway: annulment is rare and slow, and even a "win" for the company being fined can mean years of continued uncertainty rather than a closed case.
Which GDPR fines have been upheld on appeal?
Belgium's IAB Europe case is the clearest documented "upheld" outcome in this review, and it came with a procedural twist. The Belgian Data Protection Authority fined IAB Europe EUR 250,000 in February 2022, finding that the Transparency and Consent Framework, the consent-logging system embedded in most EU cookie banners, made IAB Europe a joint data controller and that its TC String constitutes personal data. IAB Europe appealed to Belgium's Market Court, which ruled on 14 May 2025: it annulled the DPA's original decision on procedural grounds, but confirmed both substantive findings and upheld the EUR 250,000 fine itself. As the Litigation Chamber's chair put it at the time, the ruling "confirms our position that the TC String is personal data and that IAB Europe acts as joint data controller," even though the procedural vehicle carrying that fine had to be annulled and replaced. Our GDPR fines for marketing emails post covers Easylife's case in more detail, including the separate PECR penalty that was never appealed.
Figure 2: Every ruling in this review's sample, plotted against the year the underlying fine was first issued and the year each appeal outcome landed. Source: ICO, Belgian DPA, CNPD, and UODO decisions cited in Where the Numbers Come From.
How long does a GDPR fine appeal actually take?
Slowly, and unevenly. Among the four cases in this review with a completed or in-progress court ruling, the time between the original fine and the most recent appeal decision ranges from under half a year to nearly five.
Easylife's appeal was the fastest, resolved in roughly 0.4 years because it settled directly with the tribunal rather than proceeding through a full contested hearing. Amazon's case took the longest measured span, about 4.7 years from the CNPD's original 2021 decision to the 2026 annulment, partly because it passed through two separate court levels. Clearview AI's UK case sits at 3.4 years and counting, since the Upper Tribunal's 2025 ruling only settled jurisdiction and sent the actual fine amount back for a fresh hearing. UODO Poland's CCTV fine is excluded from this chart entirely because it has no appeal ruling yet, only a "non-final" status as of its most recent database listing, which is itself the point: a fine can sit in limbo for well over a year without ever generating a single reportable court decision.
How does a GDPR fine appeal compare across the 6 documented cases?
| Case | Original fine | Appeal outcome | Ruling date |
|---|---|---|---|
| Amazon Europe (CNPD, Luxembourg) | EUR 746 million | Annulled, remanded to regulator | 13 March 2026 |
| British Airways (ICO, UK) | GBP 183.39 million (proposed) | Cut 89% to GBP 20 million pre-finalization | 16 October 2020 |
| Clearview AI (ICO, UK) | GBP 7,552,800 | Overturned, then jurisdiction reversed; fine amount unresolved | 6 October 2025 |
| Easylife (ICO, UK) | GBP 1.35 million | Cut 81% to GBP 250,000 on appeal | 16 March 2023 |
| IAB Europe (Belgian DPA) | EUR 250,000 | Upheld, despite procedural annulment of the original decision | 14 May 2025 |
| UODO CCTV case (Poland) | PLN 1,145,891.25 (approx. EUR 267,700) | Pending, non-final, no ruling yet | Not yet ruled |
Source: ICO, CNPD Luxembourg, Belgian Data Protection Authority, UODO Poland, cited in full below.
Figure 3: How the six documented cases in this review break down by outcome. This is a curated sample of the highest-profile, most publicly reported GDPR fine appeals since 2022, not a statistically representative share of all 2,685-plus fines CMS Law's tracker records. Source: this review's compilation, detailed above.
Info
"Reduced" in the table and pie chart above covers two different processes. Easylife's cut came from a genuine post-finalization court appeal; British Airways' cut came from a pre-finalization representations process that never reached a court at all. Treat the two as related but distinct categories when citing this data.
The Bottom Line
Six documented rulings is not enough to calculate a real appeal success rate, and nobody, not CMS Law's own tracker, not the DPAs themselves, publishes the fuller dataset that would let anyone calculate one honestly. What the six rulings do show is that a GDPR fine's headline number is rarely the final word. Easylife's fine shrank 81% in a matter of months; Amazon's fine, once the runner-up for largest ever recorded, was wiped out entirely after four and a half years; IAB Europe's fine survived a procedural annulment of the decision that created it; and Clearview AI's case shows a company can win a jurisdictional argument and still not know its final bill more than three years later. For a site owner, the practical lesson is less about any one outcome and more about the underlying violations driving every case here: unlawful consent mechanics, unclear legal basis for profiling, and inadequate transparency. A current privacy policy addresses the root cause a fine is meant to punish, regardless of how the appeal eventually lands. See our GDPR fines statistics for 2026 for the fuller enforcement picture beyond just these six appeal cases.
Frequently Asked Questions
How many GDPR fines have been appealed? No regulator, national DPA, or private tracker publishes a comprehensive count of how many of the 2,685-plus fines in CMS Law's GDPR Enforcement Tracker Report 2026 have been formally appealed. This review instead tracks the outcome of every major, publicly documented GDPR fine appeal ruling: 6 cases since 2022, split between reduced, annulled, upheld, and still pending.
What is the largest GDPR fine ever overturned on appeal? Amazon Europe's EUR 746 million fine, issued by Luxembourg's CNPD in July 2021, was annulled by a Luxembourg appeals court on 13 March 2026 and sent back to the regulator for a new decision, making it the largest GDPR fine to date to have its amount vacated on appeal.
Has a GDPR fine ever been reduced instead of overturned? Yes. The UK ICO's GDPR fine against retailer Easylife dropped 81%, from GBP 1.35 million to GBP 250,000, after a First-tier Tribunal settlement approved on 16 March 2023, while a separate GBP 130,000 PECR fine in the same case was paid in full and not appealed.
How long does a GDPR fine appeal take? Among the 4 cases in this review with a completed or in-progress court ruling, the gap between the original fine and the most recent appeal decision ranges from about 0.4 years for Easylife to 4.7 years for Amazon, and the Clearview AI case in the UK remains unresolved more than 3.4 years after the fine was first issued.
Where the Numbers Come From
- MLex. (2026). "Amazon Sees Luxembourg Appeals Court Annul EUR746 Million GDPR Fine." Fine annulled and remanded for reconsideration, ruling dated 13 March 2026.
- UK Upper Tribunal (Administrative Appeals Chamber). (2025). "The Information Commissioner's Office v Clearview AI Inc." [2025] UKUT 319 (AAC), judgment dated 6 October 2025, restoring the ICO's jurisdiction and remitting the case; original GBP 7,552,800 penalty notice issued 18 May 2022, overturned by the First-tier Tribunal in October 2023.
- Belgian Data Protection Authority. "The Market Court Rules in the IAB Europe Case." Original decision dated February 2022 fined IAB Europe EUR 250,000; Market Court annulled the decision procedurally while upholding its substantive findings and the fine, 14 May 2025.
- freevacy.com. (2023). "ICO Settles GBP1.35m Easylife Fine for GBP250,000." First-tier Tribunal settlement approved 16 March 2023, corroborated by iubenda's summary of the original October 2022 penalty notices.
- Wikipedia, citing the ICO's penalty notice. British Airways GDPR fine, reduced from a proposed GBP 183.39 million to a final GBP 20 million, decision dated 16 October 2020, following the airline's formal representations and the ICO's COVID-19 financial-hardship policy.
- Urzad Ochrony Danych Osobowych. (2025). Decision DKN.5131.4.2024 against Centrum Medyczne Ujastek. Combined 1,145,891.25 PLN fine, decision dated 17 January 2025, listed as non-final ("nieprawomocna") at time of publication.
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2026, Numbers and Figures." 2,685 fines, EUR 6.11 billion cumulative total, no aggregate appeal-status field published.
Note: All figures verified as of September 2026. The Clearview AI GBP 7,552,800 fine and the UODO PLN 1,145,891.25 fine are both still unresolved and may change before this post's next refresh. This is a curated sample of the highest-profile, publicly reported GDPR fine appeal rulings, not a comprehensive census, since no regulator or tracker publishes one. This post is refreshed at least twice a year as new appeal decisions are published.
