CJEU - C-383/23 - ILVA (Fine for an infringement of the GDPR): Difference between revisions

Revision as of 16:23, 13 February 2025

CJEU - C‑383/23 ILVA

Court:	CJEU
Jurisdiction:	European Union
Relevant Law:	Article 83(4) GDPR Article 83(5) GDPR Article 83(6) GDPR Article 83(9) GDPR
Decided:	13.02.2025
Parties:
Case Number/Name:	C‑383/23 ILVA
European Case Law Identifier:	ECLI:EU:C:2025:84
Reference from:	High Court of Western Denmark (Denmark)
Language:	24 EU Languages
Original Source:	Judgement
Initial Contributor:	tjk

The court found that when a controller which is or forms part of an undertaking is fined for GDPR violations, the fine's maximum amount is based on a percentage of the undertaking’s total worldwide annual turnover in the preceding business year.

English Summary

Facts

ILVA operates a chain of furniture stores and is part of the Lars Larsen Group. The total group turnover in the 2016/2017 financial year amounted to DKK6.57 Billion (approximately 881,000,000 €) and ILVA’s turnover amounted to almost DKK1.8 billion (approximately EUR 241 million) for the same financial year.

ILVA is charged before the Danish courts with having failed, to fulfil its GDPR obligations as controller in relation to the retention of the data of at least 350,000 former customers.

On the recommendation of the Danish DPA, the Public Prosecutor’s Office sought the imposition of a fine of DKK 1.5 million (approximately EUR 201 000) on ILVA. The calculation of that amount was based not only on the turnover of ILVA, but also on the overall turnover of the Lars Larsen Group.

By judgment of 12 February 2021, the Aarhus District Court found that since the charges had been brought only against ILVA, it was not necessary to take into account the turnover of the Lars Larsen Group in order to determine the amount of the fine. Furthermore, the court noted that ILVA was engaged in an independent retail activity and that it had not been set up by the parent company of that group for the sole purpose of processing the group’s data.

The Public Prosecutor’s Office appealed to the High Court of Western Denmark, which decided to stay the proceedings. and requested a preliminary ruling asking in essence, whether Article 83(4) to (6) of the GDPR, read in the light of recital 150 of that regulation, must be interpreted as meaning that the term ‘undertaking’ in those provisions corresponds to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, with the result that, where a fine for infringement of the GDPR is imposed on a controller of personal data which is or forms part of an undertaking, the amount of the fine is to be determined on the basis of a percentage of the undertaking’s total worldwide annual turnover in the preceding business year, within the meaning of Articles 101 and 102 TFEU.

Holding

The Court ruled in Deutsche Wohnen (C‑807/21, EU:C:2023:950, paragraphs 53 to 59 that the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, is relevant only for the purpose of determining the amount of the administrative fine imposed under Article 83(4) to (6) of the GDPR on a controller

22 In that regard, it should be stated that, for the purposes of applying the competition rules, the concept of an undertaking designates an economic unit even if in law that economic unit consists of several persons, natural or legal. That economic unit consists of a unitary organisation of personal, tangible and intangible elements, which pursues a specific economic aim on a long-term basis (judgment of 5 December 2023, Deutsche Wohnen, C‑807/21, EU:C:2023:950, paragraph 56 and the case-law cited).

23 Accordingly, it is apparent from Article 83(4) to (6) of the GDPR that, where the addressee of the administrative fine is or forms part of an undertaking, within the meaning of Articles 101 and 102 TFEU, the maximum amount of the administrative fine is calculated on the basis of a percentage of the total worldwide annual turnover in the preceding business year of the undertaking concerned (judgment of 5 December 2023, Deutsche Wohnen, C‑807/21, EU:C:2023:950, paragraph 57).

However, under Article 83(1) GDPR, each DPA is to ensure that administrative fines imposed pursuant to Article 83 in respect of infringements of the GDPR referred to in paragraphs 4 to 6 thereof are in each individual case effective, proportionate and dissuasive. Additionally, Article 83(2) GDPR requires that the competent DPA, when deciding whether it is necessary to impose an administrative fine and when setting the amount of that fine in each individual case, have due regard to a number of factors serving to ensure that each of those infringements is assessed on the basis of all the relevant individual circumstances and that the objectives pursued by the system of penalties provided for in the GDPR are achieved.

Although those factors do not make reference to the concept of an undertaking, within the meaning of Articles 101 and 102 TFEU, the Court has already ruled that only a fine which takes into account where appropriate, the actual or material economic capacity of the person on which the fine is imposed is effective, proportionate and dissuasive. In order to assess those conditions, it is necessary to take account of whether that person forms part of an undertaking, within the meaning of Articles 101 and 102 TFEU.

The court found, that the interpretation of Article 83 GDPR is also applicable where the established infringements of the GDPR by the competent national courts as a criminal penalty as Article 83(9) GDPR provides that - when a jurisdiction does not allow for administrative fines under the GDPR - Article 83 may be applied in such a manner that the fine is initiated by the competent DPA and imposed by competent national courts. Rrecital 151 further specifies that the administrative fines imposed by DPAs are to be effective, proportionate and dissuasive.

Thus, the court found that Article 83(4) to (6) GDPR, read in the light of Recital 150 , must be interpreted as meaning that the term ‘undertaking’ in those provisions corresponds to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, with the result that, where a fine for a GDPR infringement is imposed on a controller of personal data which is or forms part of an undertaking, the maximum amount of the fine is to be determined on the basis of a percentage of the undertaking’s total worldwide annual turnover in the preceding business year. The concept of ‘undertaking’ must also be taken into account in order to assess the actual or material economic capacity of the recipient of the fine and thus to ascertain whether the fine is at the same time effective, proportionate and dissuasive.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

@@ Line 56: / Line 56: @@
 On the recommendation of the Danish DPA, the Public Prosecutor’s Office sought the imposition of a fine of DKK 1.5 million (approximately EUR 201 000) on ILVA. The calculation of that amount was based not only on the turnover of ILVA, but also on the overall turnover of the Lars Larsen Group.
-      By judgment of 12 February 2021, the retten i Aarhus (Aarhus District Court, Denmark) found that since the charges had been brought only against ILVA, it was not necessary to take into account the turnover of the Lars Larsen Group in order to determine the amount of the fine. Furthermore, the court noted that ILVA was engaged in an independent retail activity and that it had not been set up by the parent company of that group for the sole purpose of processing the group’s data.
+By judgment of 12 February 2021, the Aarhus District Court found that since the charges had been brought only against ILVA, it was not necessary to take into account the turnover of the Lars Larsen Group in order to determine the amount of the fine. Furthermore, the court noted that ILVA was engaged in an independent retail activity and that it had not been set up by the parent company of that group for the sole purpose of processing the group’s data.
-The Public Prosecutor’s Office brought an appeal against that judgment before the Vestre Landsret (High Court of Western Denmark, Denmark), which  decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling asking in essence, whether Article 83(4) to (6) of the GDPR, read in the light of recital 150 of that regulation, must be interpreted as meaning that the term ‘undertaking’ in those provisions corresponds to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, with the result that, where a fine for infringement of the GDPR is imposed on a controller of personal data which is or forms part of an undertaking, the amount of the fine is to be determined on the basis of a percentage of the undertaking’s total worldwide annual turnover in the preceding business year, within the meaning of Articles 101 and 102 TFEU.
+The Public Prosecutor’s Office appealed to the High Court of Western Denmark, which  decided to stay the proceedings. and requested a  preliminary ruling asking in essence, whether Article 83(4) to (6) of the GDPR, read in the light of recital 150 of that regulation, must be interpreted as meaning that the term ‘undertaking’ in those provisions corresponds to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, with the result that, where a fine for infringement of the GDPR is imposed on a controller of personal data which is or forms part of an undertaking, the amount of the fine is to be determined on the basis of a percentage of the undertaking’s total worldwide annual turnover in the preceding business year, within the meaning of Articles 101 and 102 TFEU.
 === Holding ===
-The Court ruled in Deutsche Wohnen (C‑807/21, EU:C:2023:950, paragraphs 53 to 59 that the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, has no bearing on whether and under what conditions an administrative fine may be imposed pursuant to Article 83 of the GDPR on a controller who is a legal person, since that question is exhaustively regulated by Article 58(2) and Article 83(1) to (6) of that regulation .
+The Court ruled in Deutsche Wohnen (C‑807/21, EU:C:2023:950, paragraphs 53 to 59 that the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, is relevant only for the purpose of determining the amount of the administrative fine imposed under Article 83(4) to (6) of the GDPR on a controller
-     That concept is relevant only for the purpose of determining the amount of the administrative fine imposed under Article 83(4) to (6) of the GDPR on a controller (judgment of 5 December 2023, Deutsche Wohnen, C‑807/21, EU:C:2023:950, paragraph 54).
+     In that regard, it should be stated that, for the purposes of applying the competition rules, the concept of an undertaking designates an economic unit even if in law that economic unit consists of several persons, natural or legal. That economic unit consists of a unitary organisation of personal, tangible and intangible elements, which pursues a specific economic aim on a long-term basis (judgment of 5 December 2023, Deutsche Wohnen, C‑807/21, EU:C:2023:950, paragraph 56 and the case-law cited).
-     It is in that specific context of the calculation of administrative fines imposed in respect of the infringements referred to in Article 83(4) to (6) of the GDPR that the reference, in recital 150 of that regulation, to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, is to be understood (judgment of 5 December 2023, Deutsche Wohnen, C‑807/21, EU:C:2023:950, paragraph 55).
+     Accordingly, it is apparent from Article 83(4) to (6) of the GDPR that, where the addressee of the administrative fine is or forms part of an undertaking, within the meaning of Articles 101 and 102 TFEU, the maximum amount of the administrative fine is calculated on the basis of a percentage of the total worldwide annual turnover in the preceding business year of the undertaking concerned (judgment of 5 December 2023, Deutsche Wohnen, C‑807/21, EU:C:2023:950, paragraph 57).
-      In that regard, it should be stated that, for the purposes of applying the competition rules, referred to in Articles 101 and 102 TFEU, that concept covers any entity engaged in an economic activity, irrespective of the legal status of that entity and the way in which it is financed. The concept of an undertaking therefore designates an economic unit even if in law that economic unit consists of several persons, natural or legal. That economic unit consists of a unitary organisation of personal, tangible and intangible elements, which pursues a specific economic aim on a long-term basis (judgment of 5 December 2023, Deutsche Wohnen, C‑807/21, EU:C:2023:950, paragraph 56 and the case-law cited).
+However, under Article 83(1) GDPR, each DPA is to ensure that administrative fines imposed pursuant to Article 83 in respect of infringements of the GDPR referred to in paragraphs 4 to 6 thereof are in each individual case effective, proportionate and dissuasive. Additionally, Article 83(2) GDPR requires that the competent DPA, when deciding whether it is necessary to impose an administrative fine and when setting the amount of that fine in each individual case, have due regard to a number of factors serving to ensure that each of those infringements is assessed on the basis of all the relevant individual circumstances and that the objectives pursued by the system of penalties provided for in the GDPR are achieved.
-      Accordingly, it is apparent from Article 83(4) to (6) of the GDPR, which concerns the calculation of administrative fines in respect of the infringements listed in those paragraphs, that, where the addressee of the administrative fine is or forms part of an undertaking, within the meaning of Articles 101 and 102 TFEU, the maximum amount of the administrative fine is calculated on the basis of a percentage of the total worldwide annual turnover in the preceding business year of the undertaking concerned (judgment of 5 December 2023, Deutsche Wohnen, C‑807/21, EU:C:2023:950, paragraph 57).
+Although those factors do not make reference to the concept of an undertaking, within the meaning of Articles 101 and 102 TFEU, the Court has already ruled that only a fine which takes into account where appropriate, the actual or material economic capacity of the person on which the fine is imposed is effective, proportionate and dissuasive. In order to assess those conditions, it is necessary to take account of whether that person forms part of an undertaking, within the meaning of Articles 101 and 102 TFEU.
-      However, the determination of that maximum amount must be distinguished from the actual calculation of the amount of a fine to be imposed by the competent supervisory authority for the specific infringement or infringements of the GDPR penalised by that fine.
+The court found, that the interpretation of Article 83 GDPR is also applicable where the established infringements of the GDPR by the competent national courts as a criminal penalty as [[Article 83 GDPR#9|Article 83(9) GDPR]] provides that - when a jurisdiction does not allow for administrative fines under the GDPR - Article 83 may be applied in such a manner that the fine is initiated by the competent DPA and imposed by competent national courts. Rrecital 151 further specifies that the administrative fines imposed by DPAs are to be effective, proportionate and dissuasive.
-      Thus, under Article 83(1) of the GDPR, each supervisory authority is to ensure that administrative fines imposed pursuant to Article 83 in respect of infringements of the GDPR referred to in paragraphs 4 to 6 thereof are in each individual case effective, proportionate and dissuasive.
+Thus, the court found that Article 83(4) to (6) GDPR, read in the light of Recital 150 , must be interpreted as meaning that the term ‘undertaking’ in those provisions corresponds to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, with the result that, where a fine for a GDPR infringement  is imposed on a controller of personal data which is or forms part of an undertaking, the maximum amount of the fine is to be determined on the basis of a percentage of the undertaking’s total worldwide annual turnover in the preceding business year. The concept of ‘undertaking’ must also be taken into account in order to assess the actual or material economic capacity of the recipient of the fine and thus to ascertain whether the fine is at the same time effective, proportionate and dissuasive.
-      In addition to complying with those three conditions, Article 83(2) of the GDPR requires that the competent supervisory authority, when deciding whether it is necessary to impose an administrative fine and when setting the amount of that fine in each individual case, have due regard to a number of factors.
-      Those factors include, in accordance with the latter provision, inter alia, the nature, gravity and duration of the infringement; the number of data subjects affected and the level of damage suffered by them; the intentional or negligent character of the infringement; the actions taken by the controller or processor of personal data to mitigate the damage suffered; the degree of responsibility of that controller or processor; and the categories of personal data affected by the infringement.
-      Those factors characterise either the behaviour of that controller or processor, accused of infringements of certain provisions of the GDPR, or the infringements themselves. They therefore serve to ensure that each of those infringements is assessed on the basis of all the relevant individual circumstances and that the objectives pursued by the system of penalties provided for in the GDPR are achieved.
-      Although those factors do not make reference to the concept of an undertaking, within the meaning of Articles 101 and 102 TFEU, the Court has already ruled that only a fine which takes into account not just all of the factors thus characterising the established infringements of the GDPR, but also, where appropriate, the actual or material economic capacity of the person on which the fine is imposed is capable of satisfying the three conditions set out in Article 83(1) of the GDPR, namely to be effective, proportionate and dissuasive. In order to assess those conditions, it is necessary to take account of whether that person forms part of an undertaking, within the meaning of Articles 101 and 102 TFEU (see, to that effect, judgment of 5 December 2023, Deutsche Wohnen, C‑807/21, EU:C:2023:950, paragraph 58).
-      The interpretation of Article 83 of the GDPR that results from paragraphs 25 to 29 of the present judgment is also applicable where the established infringements of the GDPR are penalised not by an administrative fine but by a fine imposed by the competent national courts as a criminal penalty.
-As Denmark, does not allow for administrative fines under the GDPR [[Article 83 GDPR#9|Article 83(9) GDPR]] provides that, Article 83 may be applied in such a manner that the fine is initiated by the competent DPA and imposed by competent national courts. Rrecital 151 further specifies that the administrative fines imposed by DPAs are to be effective, proportionate and dissuasive.
-      That being said, the fact that the fine is imposed by a criminal court in criminal proceedings means that that court must at all times respect the rules applicable in criminal matters, including, in particular, the procedural rights enjoyed by the accused person and the principle of proportionality of the penalty, as guaranteed by the Charter of Fundamental Rights of the European Union.
-      In that regard, as the Advocate General stated in point 74 of her Opinion, Article 83 of the GDPR requires that the competent supervisory authorities must, without exception, ensure that the principle of proportionality is observed in the calculation of the actual amount of the fine imposed, whereby a fair balance is struck between the demands of the general interest in protecting personal data and the requirements of the protection of the rights of the controller of such data, the processor or the undertaking of which they form part. It follows that an application of the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, in the context of the implementation of Article 83(4) to (6) of the GDPR, does not appear to encounter any obstacles of principle where infringements of the GDPR are penalised not by administrative fines but by fines imposed by criminal courts.
-      In the light of the foregoing considerations, the answer to the questions referred is that Article 83(4) to (6) of the GDPR, read in the light of recital 150 of that regulation, must be interpreted as meaning that the term ‘undertaking’ in those provisions corresponds to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, with the result that, where a fine for infringement of the GDPR is imposed on a controller of personal data which is or forms part of an undertaking, the maximum amount of the fine is to be determined on the basis of a percentage of the undertaking’s total worldwide annual turnover in the preceding business year. The concept of ‘undertaking’ must also be taken into account in order to assess the actual or material economic capacity of the recipient of the fine and thus to ascertain whether the fine is at the same time effective, proportionate and dissuasive.
-The court found that Article 83(4) to (6) GDPR, read in the light of Recital 150 , must be interpreted as meaning that the term ‘undertaking’ in those provisions corresponds to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, with the result that, where a fine for a GDPR infringement  is imposed on a controller of personal data which is or forms part of an undertaking, the maximum amount of the fine is to be determined on the basis of a percentage of the undertaking’s total worldwide annual turnover in the preceding business year. The concept of ‘undertaking’ must also be taken into account in order to assess the actual or material economic capacity of the recipient of the fine and thus to ascertain whether the fine is at the same time effective, proportionate and dissuasive.
 == Comment ==