CJEU - C-383/23 - ILVA
| CJEU - C‑383/23 ILVA | |
|---|---|
 | |
| Court: | CJEU |
| Jurisdiction: | European Union |
| Relevant Law: | Article 83(4) GDPR Article 83(5) GDPR Article 83(6) GDPR Article 83(9) GDPR |
| Decided: | 13.02.2025 |
| Parties: | |
| Case Number/Name: | C‑383/23 ILVA |
| European Case Law Identifier: | ECLI:EU:C:2025:84 |
| Reference from: | Vestre Landsret (Denmark) |
| Language: | 24 EU Languages |
| Original Source: | AG Opinion Judgement |
| Initial Contributor: | tjk |
The CJEU held that DPAs and courts must take into account if a controller is part of an undertaking within the meaning of Articles 101 and 102 TFEU when setting fine amounts. Additionally they must base the fines' maximum amount on the undertaking’s and not the controller's turnover.
English Summary
Facts
ILVA (the controller) operates a chain of furniture stores and is part of the Lars Larsen Group (the undertaking). The total undertaking's turnover was multiple times higher than that of the controller. The controller is charged before the Danish courts with violating the GDPR in relation to the retention of the data of at least 350,000 former customers.
On the recommendation of the Danish DPA, the Public Prosecutor’s Office sought the imposition of a fine of DKK1,500,000 (approximately 201,000€) on the controller. The calculation of that amount was based not only on the turnover of the controller, but also on the overall turnover of the undertaking.
The Aarhus District Court (Retten i Aarhus) found that since the charges had been brought only against the controller, it was not necessary to take into account the turnover of the undertaking to determine the amount of the fine. Furthermore, the court noted that the controller was engaged in an independent retail activity and that it had not been set up by the parent company for the sole purpose of processing the undertaking's data.
The Public Prosecutor’s Office appealed to the High Court of Western Denmark (Vestre Landsret), which decided to stay the proceedings and to request a preliminary ruling asking in essence, whether Article 83(4) to (6) GDPR, read in the light of Recital 150, must be interpreted as meaning that the term ‘undertaking’ in those provisions corresponds to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, with the result that, where a fine for infringement of the GDPR is imposed on a controller which is or forms part of an undertaking, the amount of the fine is to be determined on the basis of a percentage of the undertaking’s total worldwide annual turnover in the preceding business year.
Advocate General Opinion
The AG emphasised that the notion of “undertaking” has been recently interpreted by the CJEU in C-807/21 Deutsche Wohnen. According to the CJEU, the undertaking should be understood in line with EU competition law and Article 101 and Article 102 TFEU. In particular, it is “entity engaged in an economic activity”, no matter its legal form. When it comes to calculations of a fine, it is the undertaking turnover that should be its basis.
In the case at hand, the AG drew the attention to the influence of the parent company on the companies within the group. That influence, as defined in the CJEU case law, amounts, for example, to appointing members of boards of directors or calling shareholders meetings. If the parent company “exercise decisive influence” over the controller, then the undertaking under Article 83(5) GDPR would consist of: 1) the controller, 2) the parent company, 3) other companies under decisive influence of the parent company.
Consequently, the group turnover would form a baseline for the calculation of maximum fine. Nevertheless, the AG pointed out the rules to calculate the maximum fine applicable do not have to be applied as “the main or only reference for setting the actual fine”. This is because the actual fine should reflect all facts of the case, including all aggravating and extenuating circumstances. The AG underlined that one of relevant circumstance is the role of members of undertaking in violation committed.
Additionally, the AG suggested that guarantees of fair criminal proceedings has to be followed as well. Especially, the principle of proportionality must be observed. In conclusion, the AG suggested to consider the following when using the concept of the undertaking in order to determine the amount of the actual fine under Article 83 GDPR:
“First, it should be evaluated whether the parent company has exercised its decision-making power with respect to specific activities of the controller or the processor at issue in the GDPR infringement(s). Second, it needs to be considered whether specific data processing infringing the GDPR relates to the company concerned and/or to the whole group. Third, it is necessary to establish whether more than one company forming part of the group was involved in the GDPR infringement(s).”
Holding
The Court clarified that the concept of ‘undertaking’ within the GDPR is relevant only for the purpose of determining the amount of the administrative fine imposed on a controller in accordance with Article 83(4) to (6) GDPR. The court defined an undertaking generally as concept for applying competition rules and specifically as an economic unit regardless if it legally consists of several natural or legal persons.
The court confirmed its ruling in C‑807/21 Deutsche Wohnen that Article 83(4) to (6) GDPR read in the light of Recital 150 must be interpreted to mean, that where the addressee of the administrative fine is or forms part of an undertaking, within the meaning of Articles 101 and 102 TFEU, the maximum amount of the administrative fine is calculated on the basis of a percentage of the total worldwide annual turnover in the preceding business year of the undertaking concerned.
However, the court stated that pursuant to Article 83(1) GDPR, DPAs must ensure that administrative fines are in each individual case effective, proportionate and dissuasive. Additionally, Article 83(2) GDPR requires that the competent DPA, when deciding whether to impose an administrative fine and when setting the amount have due regard to a number of factors serving to ensure that each of those infringements is assessed on the basis of all the relevant individual circumstances and that the objectives pursued by the system of penalties provided for in the GDPR are achieved. Although, those factors do not make reference to the concept of an undertaking, within the meaning of Articles 101 and 102 TFEU, the court reiterated from it's aforementioned Deutsche Wohnen judgement, that only a fine which takes into account the actual or material economic capacity of a controller is effective, proportionate and dissuasive. To assess those conditions, the court found, it is necessary to take account of whether that controller forms part of an undertaking.
Additionally, the court held, that pursuant to Article 83(9) GDPR this also applies where GDPR infringements are established by competent national courts within criminal proceedings.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
