International Corporate Practice and Data Privacy Law Penalties for violating data laws can be significant, especially in Europe and Canada. By law, European “data subjects” have a private right of action for data law violations. Separately, every European country has a dedicated data agency to enforce data laws. These agencies are getting vigilant. For example, Spain’s data agency—said to be self-funded from the fines it collects—can impose fines up to €600,000, and in recent years has imposed a number of €300,506 fines for illegal data transfers. France’s cap on fines is €150,000 for a first offense, plus five years in prison. German data fines can reach €250,000. In the United Kingdom, fines are unlimited. Further, in 2007, the United Kingdom took steps to amend its data law to add a penalty of two years in prison for unauthorized data disclosures. 4. Publicity.Violating data privacy law imposes costs beyond the penalties. In Europe especially, citizens jealously guard their privacy, and so any multinational caught flouting privacy rights can suffer a significant public relations hit. In Europe, news of a data privacy law violation can have an effect similar to news stateside of a breach of sex harassment laws