knowledge 18 February 2025 |

Quite the “undertaking” - CJEU considers the calculation of administrative fines under Article 83 of the GDPR

In addition, the Court confirmed that in order to ensure that the actual fine imposed is effective, proportionate and dissuasive as required under Article 83(1), the concept of “undertaking” must be taken into account to assess the actual or material economic capacity of the recipient of the fine.

Background

On 13 February 2025 the CJEU delivered its judgment in a request for a preliminary ruling from the High Court of Western Denmark (“Vestre Landsret”) in criminal proceedings against ILVA A/S (“ILVA”), the operator of a chain of furniture stores, for infringements of the GDPR in relation to the retention of data of at least 35,000 former customers.¹

Danish law does not allow for administrative fines as set out in the GDPR and so, in Denmark, fines are imposed by competent national courts as a criminal penalty.²

ILVA forms part of the Lars Larsen Group. In calculating the administrative fine to recommend to the Public Prosecutions Office in respect of the infringements of the GDPR, the Datatilsynet (The Data Protection Agency of Denmark) based the amount not only on the turnover of ILVA but also on the overall turnover of the Lars Larsen Group. The Aarhus District Court however held that, since the charges had only been brought against ILVA, it was not necessary to take into account the turnover of the whole Lars Larsen Group and imposed a lower fine.

The Public Prosecutions Office subsequently brought an appeal against this judgement before the Vestre Landsret, which requested the preliminary ruling, taking the view that the meaning of the term “undertaking” was not clear from Article 83 of the GDPR.

Questions referred by the Vestre Landsret

The request for a preliminary ruling concerned the interpretation of Article 83(4) to (6) of the GDPR. Article 83(4) provides that infringements of certain provisions shall be subject to administrative fines up to €10 million, or in the case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher. For infringements of other specified provisions, Article 83(5) provides for administrative fines up to €20 million, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher. Article 83(6) provides for administrative fines for non-compliance with an order of a supervisory authority as referred to in Article 58(2).

Recital 150 of the GDPR provides, amongst other things, that “where administrative fines are imposed on an undertaking, an undertaking should be understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those purposes.”

The following two questions were referred:

1. Must the term “undertaking” in Article 83(4) to (6) of the [GDPR] be understood as an undertaking within the meaning of Articles 101 and 102 TFEU, in conjunction with recital 150 of the [GDPR], and the case-law of the Court concerning EU competition law, so that the term “undertaking” covers any entity engaged in an economic activity, regardless of that entity’s legal status and the way in which it is financed?
2. If the answer to … Question 1 is in the affirmative, must Article 83(4) to (6) of the [GDPR] be interpreted as meaning that, when imposing a fine on an undertaking, regard must be had to the total worldwide annual turnover of the economic entity of which the undertaking forms part, or only the total worldwide annual turnover of the undertaking itself?’

Summary of the Court’s decision

Concept of “undertaking” in calculating maximum fine

The Court firstly noted that the concept of ‘undertaking’ within the meaning of Articles 101 and 102 TFEU has no bearing on whether and under what conditions an administrative fine may be imposed under Article 83 of the GDPR on a controller who is a legal person, since that question is only regulated by Article 58(2) and Article 83(1) to (6) of the GDPR, as held in Deutsche Wohen³. In Deutsche Wohen the Court of Justice had considered, against the backdrop of certain provisions of German law, whether the effect of Article 83 was to incorporate into national law the concept of an undertaking as defined in Articles 101 and 102 TFEU such that an administrative fine can be imposed on a legal person without the infringement first being attributed to a natural person.

The Court again referenced Deutsche Wohen in stating that the concept of an undertaking under Article 101 and 102 TFEU is only relevant for the purpose of determining the amount of the administrative fine to be imposed under Article 83(4) to (6) of the GDPR on a controller. It is in this specific context that the reference, in recital 150 of the GDPR, to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, is to be understood.

The concept of “undertaking” covers any entity engaged in an economic activity, irrespective of the legal status of that entity and the way in which it is financed. It designates an economic unit even if in law that economic unit consists of several persons, natural or legal, where that economic unit consists of a unitary organisation of personal, tangible and intangible elements, which pursues a specific economic aim on a long-term basis.

The Court found that it was apparent from Articles 83(4) to (6) of the GDPR that where the addressee of an administrative fine forms part of an undertaking, within the meaning of Articles 101 and 102 TFEU, it is the total worldwide annual turnover of that undertaking in the preceding business year that is relevant for the calculation of the maximum fine.

The calculation of the maximum amount must however be distinguished from the calculation of the actual amount of fine to be imposed.

Calculating the actual amount of fine

Article 83(1) of the GDPR provides that each supervisory authority must ensure that administrative fines imposed pursuant to Article 83 in respect of infringements of the GDPR are, in each individual case, effective, proportionate and dissuasive.

Article 83(2) sets out a number of factors to which the supervisory authority must have regard in deciding whether it is necessary to impose a fine and in setting the amount of the fine, including the nature, gravity and duration of the infringement, the number of data subjects affected and the intentional or negligent character of the infringement. The Court noted that these factors serve to ensure that each infringement is assessed on the basis of all relevant individual circumstances and that the objectives pursued by the system of penalties provided for in the GDPR are achieved.

Noting that the factors in Article 83(2) do not make reference to the concept of an undertaking within the meaning of Articles 101 and 102 TFEU, the Court highlighted that it had previously ruled in Deutsche Wohen that only a fine which takes into account, where appropriate, the actual or material economic capacity of the person on which the fine is imposed is capable of being effective, proportionate and dissuasive. In order to assess those conditions, it is necessary to take account of whether that person forms part of an undertaking, within the meaning of Articles 101 and 102 TFEU.

The Court therefore answered the questions referred, in summary, as follows:

1. Article 83(4) to (6) of the GDPR, read in the light of recital 150, must be interpreted as meaning that the term ‘undertaking’ in those provisions corresponds to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, with the result that, where a fine for infringement of the GDPR is imposed on a controller of personal data which is or forms part of an undertaking, the maximum amount of the fine is to be determined on the basis of a percentage of the undertaking’s total worldwide annual turnover in the preceding business year.
2. The concept of ‘undertaking’ within the meaning of Articles 101 and 102 TFEU must also be taken into account in order to assess the actual or material economic capacity of the recipient of the fine in ascertaining whether the fine to be imposed is effective, proportionate and dissuasive.

Conclusion

While this decision is helpful in confirming that, for the purposes of ensuring that a fine is effective, proportionate and dissuasive, the economic position of the “undertaking” is to be taken into account, the more difficult question in many cases will remain the determination of what is to be considered as the undertaking, a question in respect of which there is no defined test or set of criteria and which may therefore require consideration on the individual facts of a specific case.

An example of the issues which may arise in defining an “undertaking” for the purposes of Article 83 was seen recently in the October 2024 decision of the Data Protection Commission in respect of LinkedIn in which the DPC, contrary to submissions made by LinkedIn, took account of the turnover of its ultimate parent company Microsoft Corporation for the purposes of calculating the fine to be imposed. This decision is under appeal.

Also contributed to by Eva Keane