OPINION OF ADVOCATE GENERAL
MEDINA
delivered on 12 September 2024 (1)
Case C‑383/23
Anklagemyndigheden
v
ILVA A/S
(Request for a preliminary ruling from the Vestre Landsret (High Court of Western Denmark, Denmark))
( Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 83 – Administrative fines – Fines other than administrative fines – Concept of ‘undertaking’ – Articles 101 and 102 TFEU – Parent company and subsidiary – Infringement of Regulation 2016/679 by a subsidiary – Calculation of the amount of the fine – Consideration of the total turnover of the group of which the company concerned forms part – Criminal proceedings )
1. The present request for a preliminary ruling from the Vestre Landsret (High Court of Western Denmark, Denmark) seeks an interpretation of Article 83(4) to (6) of Regulation (EU) 2016/679. (2) It has been made in the context of criminal proceedings initiated by the Anklagemyndigheden (Public Prosecutor, Denmark) against the company ILVA A/S (‘ILVA’) (3) for having failed to fulfil its obligations under Article 5(1)(e), Article 5(2) and Article 6 of the GDPR in its capacity as controller of personal data of no fewer than 350 000 former customers.
2. The case concerns the issue whether the term ‘undertaking’ in Article 83(4) to (6) of the GDPR must be interpreted, in the light of recital 150 of that regulation, as meaning that it corresponds to the concept of ‘undertaking’ under EU competition law (Articles 101 and 102 TFEU). That raises the question whether, in the context of imposing a fine for a GDPR infringement on a company, it is appropriate to take into account the total annual turnover of the economic entity (or group) of which the infringing company forms part, and not just the total annual turnover of that company itself.
3. The particularity of the present case lies in the fact that, in the main proceedings, the fine was imposed not by the national data supervisory authority in the context of its powers of supervision, but by a court in criminal proceedings. Indeed, the EU legislature inserted in the GDPR a specific provision in this regard, which is applicable, in particular, to Denmark.
I. Legal framework
A. European Union law
4. According to recitals 150 and 151 of the GDPR:
‘(150) In order to strengthen and harmonise administrative penalties for infringements of this Regulation, each supervisory authority should have the power to impose administrative fines. This Regulation should indicate infringements and the upper limit and criteria for setting the related administrative fines, which should be determined by the competent supervisory authority in each individual case, taking into account all relevant circumstances of the specific situation, with due regard in particular to the nature, gravity and duration of the infringement and of its consequences and the measures taken to ensure compliance with the obligations under this Regulation and to prevent or mitigate the consequences of the infringement. Where administrative fines are imposed on an undertaking, an undertaking should be understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those purposes. …
(151) The legal systems of Denmark and Estonia do not allow for administrative fines as set out in this Regulation. The rules on administrative fines may be applied in such a manner that in Denmark the fine is imposed by competent national courts as a criminal penalty and in Estonia the fine is imposed by the supervisory authority in the framework of a misdemeanour procedure, provided that such an application of the rules in those Member States has an equivalent effect to administrative fines imposed by supervisory authorities. Therefore the competent national courts should take into account the recommendation by the supervisory authority initiating the fine. In any event, the fines imposed should be effective, proportionate and dissuasive.’
5. Article 83 of the GDPR, entitled ‘General conditions for imposing administrative fines’, provides:
‘1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.
2. Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:
…
3. If a controller or processor intentionally or negligently, for the same or linked processing operations, infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement.
4. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher:
…
5. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher:
…
6. Non-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance with paragraph 2 of this Article, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher.
…
8. The exercise by the supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process.
…’
B. National law
6. Lov nr. 502 af 23. maj 2018 om supplerende bestemmelser til forordning om beskyttelse af fysiske personer i forbindelse med behandling af personoplysninger og om fri udveksling af sådanne oplysninger (Law No 502 of 23 May 2018 supplementing the regulation on protection with regard to the processing of personal data and on the free movement of such data) provides, in Paragraph 41 thereof:
‘[Subparagraph 1.] Unless a greater penalty is justified under other legislation, a fine or a term of imprisonment of up to six months shall be imposed on anyone who infringes the provisions on:
…
(4) the basic principles of processing, including the conditions for consent, in Articles 5 to 7 and 9 of the [GDPR],
…
Subparagraph 3. Article 83(2) of the [GDPR] must be followed when imposing a penalty according to subparagraphs 1 and 2.
…
Subparagraph 6. Companies and so forth (legal persons) may be held criminally liable in accordance with the rules set out in Chapter 5 of the Criminal Code. …’
II. The facts giving rise to the dispute in the main proceedings and the questions referred for a preliminary ruling
7. ILVA is charged before the Danish courts with having failed –from May 2018 to January 2019 - to fulfil its obligations, under Article 5(1)(e), Article 5(2) and Article 6 of the GDPR, as controller in relation to the retention of personal data concerning its former customers.
8. ILVA operates a chain of furniture shops and forms part of the Lars Larsen Group (‘the group’). The total group turnover in the 2016/2017 financial year amounted to 6.57 billion Danish kroner (DKK) (some EUR 881 million). Of that, the turnover of the subsidiary ILVA amounted to DKK 1.8 billion (some EUR 241 million).
9. On the recommendation of the Datatilsynet (‘Data Protection Agency’, Denmark, which is the Danish data protection authority or the ‘supervisory authority’ under the GDPR), the Public Prosecutor claimed that a fine of DKK 1.5 million (some EUR 201 000) should be imposed on ILVA. The turnover-related framework for calculating the amount of that fine is based not on the turnover of ILVA, but on the total turnover of the entire group.
10. By judgment of 12 February 2021, the Retten i Aarhus (Aarhus District Court, Denmark) found ILVA guilty as charged, but ruled that it had acted negligently, contrary to what was alleged by the Public Prosecutor. That court ordered ILVA to pay a fine of DKK 100 000 (some EUR 13 400). Furthermore, according to that court, in so far as charges had been brought only against ILVA and not against the entire group, it was not necessary to take into account the turnover of that group in order to calculate the amount of the fine. It also pointed out that ILVA was engaged in an independent retail activity and that the group had not set up that subsidiary for the sole purpose of entrusting it with the processing of the group’s personal data.
11. The Public Prosecutor brought an appeal against that judgment before the Vestre Landsret (High Court of Western Denmark), which is the referring court. That court seeks to ascertain whether the term ‘undertaking’ in Article 83(4) to (6) of the GDPR must be understood as meaning that, in order to set a fine in the event of an infringement of the GDPR by a company, it is necessary to have regard to the turnover of the group of which the company concerned forms part.
12. The Public Prosecutor argues that that is the case. It maintains that it follows from recital 150 of the GDPR that that term must be understood in accordance with Articles 101 and 102 TFEU.
13. ILVA, on the other hand, contends that, when setting a fine for an undertaking’s infringement of the GDPR, regard should not be had to the total turnover of the group of which the company forms part. In this specific case, charges have been brought only against ILVA, which is a subsidiary, and not against the parent company.
14. The referring court considers that the answer to that question is not clear from the GDPR.
15. In those circumstances, the Vestre Landsret (High Court of Western Denmark) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1) Must the term “undertaking” in Article 83(4) to (6) of the [GDPR] be understood as an undertaking within the meaning of Articles 101 and 102 TFEU, in conjunction with recital 150 of that regulation, and the case-law of the [Court of Justice] [on] EU competition law, so that the term “undertaking” covers any entity engaged in an economic activity, regardless of that entity’s legal status and the way in which it is financed?
(2) If the answer to … Question 1 is in the affirmative, must Article 83(4) to (6) of the [GDPR] be interpreted as meaning that, when imposing a fine on an undertaking, regard must be had to the total worldwide annual turnover of the economic entity of which the undertaking forms part, or only the total worldwide annual turnover of the undertaking itself?’
III. Procedure before the Court of Justice
16. Written observations were submitted by ILVA and the European Commission. A hearing was held on 19 June 2024, at which both parties were represented.
IV. Assessment
A. Introduction
17. The backdrop to the specific provisions of the GDPR, which are relevant in the present case (4) and are applicable, in particular, to Denmark, is the fact that the Data Protection Agency cannot, in principle, impose any administrative fines for infringements of data protection legislation. The Data Protection Agency must instead turn in a police report if it finds it necessary. (5) The police then investigate and determine whether there are grounds for a formal charge. If so, the case is referred to the courts, which assess the case and determine the level of the fine.
B. Consideration of the questions referred
18. In my view, it is appropriate to consider the two questions together. By those questions, the referring court asks, in essence, whether the term ‘undertaking’ in Article 83(4) to (6) of the GDPR must be interpreted, in the light of recital 150 of that regulation, as meaning that it corresponds to the concept of ‘undertaking’ within the meaning of Articles 101 and 102 TFEU. That raises the question whether, in the context of imposing a fine for a GDPR infringement on a company, it is necessary to take into account the total annual turnover of the whole undertaking (the economic entity or group, in casu the Lars Larsen Group, that is, some EUR 881 million) of which the infringing company forms part, (6) and not just the total annual turnover of that company itself (ILVA, that is, some EUR 241 million).
1. The judgment in Deutsche Wohnen
19. Article 83 of the GDPR provides the legal basis for the imposition of fines for infringements of that regulation. The GDPR contains no definition of the concept of ‘undertaking’ for enforcement purposes, but recital 150 of that regulation states that EU competition law principles should be used to interpret that concept. (7)
20. The Court has recently had an opportunity to interpret some (but not all) paragraphs of Article 83 of the GDPR and to touch upon certain issues which are related to the questions referred in the present case.
21. In the judgment in Deutsche Wohnen, (8) the Court ruled, in particular, that ‘it is apparent from Article 83(4) to (6) of the GDPR, which concerns the calculation of administrative fines in respect of the infringements listed in those paragraphs, that, where the addressee of the administrative fine is or forms part of an undertaking, within the meaning of Articles 101 and 102 TFEU, the maximum amount of the administrative fine is calculated on the basis of a percentage of the total worldwide annual turnover in the preceding business year of the undertaking concerned’.
22. The Court makes clear that the maximum amount of the administrative fine is based on the total worldwide annual turnover (9) of the ‘undertaking’, whereby that term must be understood in accordance with EU competition law (Articles 101 and 102 TFEU). The Court is thus noting that the EU legislature sought to form a bridge between the GDPR rules and the EU competition law rules, when setting the maximum amount of GDPR fines.
23. Indeed, in that regard, Article 83(4) to (6) of the GDPR is similar to Article 23(2) of Regulation (EC) No 1/2003, (10) in so far as both set a statutory ceiling for fines under the respective regulations.
24. The Court further developed its reasoning and addressed the conditions applicable to determining the amount of the administrative fine. The Court noted in the judgment in Deutsche Wohnen (paragraph 58) that ‘only an administrative fine determined on the basis of the actual or material economic capacity of the person on which it is imposed, and therefore imposed by the supervisory authority, relying, as regards the amount of that fine, on the concept of an economic unit within the meaning of the case-law, … [(11)] is capable of satisfying the three conditions set out in Article 83(1) of the GDPR, namely to be effective, proportionate and dissuasive’. Although the Court referred in this respect to a ‘person on which [the fine] is imposed’, thereby underlining the link between the fine and the person specifically charged with the GDPR infringement, further on the Court returned to the concept of ‘undertaking’ (‘economic unit’) under EU competition law.
25. Furthermore, in paragraph 59 of that judgment, the Court held that ‘where a supervisory authority decides, by virtue of its powers under Article 58(2) of the GDPR, to impose on a controller, which is or forms part of an undertaking, within the meaning of Articles 101 and 102 TFEU, an administrative fine pursuant to Article 83 of that regulation, that authority is required to take as its basis, under Article 83 GDPR, read in the light of recital 150 of that regulation, when calculating administrative fines in respect of the infringements referred to in Article 83(4) to (6) of the GDPR, the concept of an “undertaking”, within the meaning of Articles 101 and 102 TFEU’. (12)
26. I conclude that it follows from the judgment in Deutsche Wohnen that, in a case where a GDPR infringement is committed by a controller or a processor that is (or forms part of) an undertaking, when setting the maximum amount of the fine, the reference to the total worldwide annual turnover of the ‘undertaking’ is understood in accordance with Articles 101 and 102 TFEU. However, it is not only the issue related to the maximum amount of the fine that can potentially be imposed on that controller or processor which is thereby clarified. What it also means is that the highly nuanced (and quite case-specific) case-law relating to the concepts of ‘undertaking’ and ‘economic unit’ becomes relevant, to a certain extent, also in order to set the conditions for determining the actual fine imposed for that specific GDPR infringement.
27. In the following points, I will analyse the impact of the Deutsche Wohnen case-law in the specific context of the present case in order to propose a framework that should guide the referring court in determining ILVA’s fine.
2. Step 1 of the analysis after the judgment in Deutsche Wohnen: general analysis in order to establish the maximum amount of the fine
28. As indicated in points 25 and 26 above, it follows from the wording of Article 83 of the GDPR, read in the light of recital 150 of that regulation, and from the Deutsche Wohnen case-law that in cases where the controller or processor is (part of) an ‘undertaking’ within the meaning of Articles 101 and 102 TFEU, the overall turnover of such an undertaking as a whole should be used in order to determine the maximum amount of the fine.
29. The Court’s competition case-law has determined that the term ‘undertaking’ ‘encompasses every entity engaged in an economic activity, regardless of the legal status of the entity and the way in which it is financed’. (13)
30. It also follows from the Court’s case-law that the term ‘undertaking’ in Articles 101 and 102 TFEU can refer to a single economic unit, even if that economic unit consists of several natural or legal persons. Whether several entities form such a unit depends largely on whether the individual entity is free in its decision-making ability or whether a leading entity, namely the parent company, exercises decisive influence over the others. The criteria for determining this are based on the economic, legal and organisational links between the parent company and its subsidiary, for example, the amount of the participation, personnel or organisational ties, instructions and the existence of company contracts. (14)
31. The case-law also makes clear that the actual exercise of decisive influence by a parent company over its subsidiary’s conduct may be inferred from a body of consistent evidence, even if some of that evidence, taken in isolation, is insufficient to establish the existence of such influence. (15) The Courts of the European Union relied in this respect, inter alia, on the parent company’s power to appoint the members of the various boards of directors of the subsidiary and the power to call shareholders to meetings and to propose the revocation of directors or of entire boards of directors of the subsidiary. (16)
32. It is settled case-law that, in the particular case in which a parent company holds, directly or indirectly, all or almost all of the capital in a subsidiary which has committed an infringement of the competition rules, the parent company is able to exercise decisive influence over the conduct of the subsidiary and there is a rebuttable presumption that the parent company does in fact exercise such influence. (17)
33. According to paragraph 2 of the order for reference, ILVA is part of the Lars Larsen Group. If the referring court were to find that the parent company of that group exercises decisive influence over ILVA, the ‘undertaking’ within the meaning of Article 83(5) of the GDPR would consist of: (i) the parent company of that group; (ii) ILVA; and (iii) any other company over which the parent company also exercises decisive influence. The latter category potentially includes the other companies in the Lars Larsen Group.
34. ‘Turnover’ is expressly referred to in Article 83(4) to (6) of the GDPR in the context of calculating the maximum amount of the fine that could be imposed on companies. That maximum amount concerns very large companies, since the limit does not apply if the fine is lower than the absolute amount cited in those three paragraphs of Article 83, namely EUR 10 million or EUR 20 million. The ceiling set on the basis of turnover is therefore only relevant for companies with a total worldwide turnover of more than EUR 500 million. (18)
35. It follows that, if the referring court were to find that the parent company of the Lars Larsen Group exercises decisive influence over ILVA, then, in an abstract way, the maximum amount of the fine to be imposed in the main proceedings is to be calculated on the basis of a percentage of the total worldwide annual turnover in the preceding business year of the undertaking concerned, that is, the Lars Larsen Group (of which ILVA forms part).
3. Step 2 of the analysis after the judgment in Deutsche Wohnen: analysis in order to establish the actual fine for the infringements in the main proceedings
36. The issue of establishing the maximum amount of the fine, as envisaged by the EU legislature in Article 83(4) to (6) of the GDPR, should neither be confused nor conflated with the subsequent task of a supervisory authority, (19) that is, to determine the actual fine to be imposed for the specific GDPR infringement(s) in question.
37. For that purpose, first, it should be noted that paragraph 1 of Article 83 of the GDPR sets out three key conditions (20) that must be observed by the supervisory authority. Each of those conditions requires an individual balancing of all the elements of the infringement in question and of the appropriate actual fine to be imposed. Further, paragraph 2 of Article 83 obliges that authority to comply with a number of requirements so as to decide ‘whether to impose an administrative fine and [what] the [appropriate] amount of the [actual] administrative fine [is]’. Therefore, in order to understand fully the application of Article 83(4) to (6) of the GDPR in the context of setting the actual fine in an individual case, those paragraphs must be read in conjunction with Article 83(1) as well as Article 83(2) of that regulation. The latter, more importantly, lists specific factors that a supervisory authority must take into account when determining the actual amount of the fine in a given case.
38. The very wording of paragraph 2 of that article requires due regard to be given to multiple elements of ‘each individual case’ whilst, at the same time, leaving it to the supervisory authority to identify those specific elements which are pertinent to the case before it and to establish their relevance for the purpose of setting the actual fine. (21)
39. Contrary to Article 83(4) to (6) of the GDPR (see point 34 of the present Opinion), Article 83(2) thereof, or Article 83(1) or Article 83(3) thereof, for that matter, (22) contains no reference to the turnover of the undertaking. It follows that the EU legislature made a choice not to include ‘turnover’ as a specific factor for determining the actual fine. Instead, Article 83(2) lists other factors (23) that characterise the behaviour of a controller or processor which is charged with an infringement, in order to ensure that each infringement is assessed on the basis of all relevant individual circumstances. In my view, it can be inferred from the foregoing that the EU legislature sought to distinguish between the factors that form the basis for determining the maximum amount of the fine (step 1) and the list of requirements that are binding on the supervisory authority when it is setting the actual fine (step 2).
40. In that connection, I would point out that the Court has emphasised that ‘a penalty, even of a non-criminal nature, cannot be imposed unless it rests on a clear and unambiguous legal basis’. (24) That is a fortiori the case in criminal law proceedings such as those in the present case. The Court’s case-law refers to ‘the principle of legality [which] requires legislation to define clearly offences and the penalties which they attract … [and] the criteria for assessing the clarity of the law under the case-law of the European Court of Human Rights [(ECtHR)]’. (25)
41. In that regard, the Commission argues, in essence, that, in the present case, the GDPR implies that not only must the maximum amount of the fine be based on the turnover of the undertaking to which the company belongs, but so must the calculation of the actual fine. However, the considerations that have been laid out in points 37 to 40 of the present Opinion do not permit the conclusion that Article 83(1) to (6) of the GDPR is to be interpreted as meaning that the rules for establishing the maximum amount of the fine (step 1) must also be used as the main or only reference for setting the actual fine (step 2).
42. Second, as part of the spillover effect from forming a bridge between the two fields of law, the need to distinguish between the maximum amount of a fine (step 1) and the actual fine (step 2) can also be inferred from EU competition law. Indeed, in EU competition law, as far as the maximum amount of the fine is concerned, similar to Article 83 of the GDPR, the Commission uses the turnover for the purpose of calculating the maximum amount of the fine (which is set at 10% of the total turnover of the undertaking per infringement). However, it is important to point out that the basic fine itself is not determined on the basis of the turnover. (26)
43. Instead, the basic fine is determined, in essence, as a percentage of the value of relevant sales (which are directly or indirectly related to the competition infringement) multiplied by duration (years or periods of less than one year), plus 15 to 25% of the value of relevant sales (as an additional deterrence for cartels). That basic fine is then increased by way of aggravating factors or decreased by way of mitigating factors. That amount is then subject to the overall cap of 10% of turnover (there is a further possibility, where applicable, to decrease the fine on the basis of leniency, settlement and/or inability to pay). That clearly shows that it is the factors directly characterising the infringement (such as the relevant sales, the duration of the infringement and the specific circumstances characterising the case) which play a central role when setting the actual fine, and not the total worldwide annual turnover.
44. As has already been pointed out by legal commentators, ‘there is no direct read-across from the fining methodology used by the Commission in respect of Articles 101 [and] 102 TFEU to the GDPR, as EU competition fines seek to capture the effect of the [anticompetitive] conduct on the market concerned rather than look at turnover per se. For example, in respect of cartels, the fines are based upon the value of sales relating to the “cartelised product” rather than global turnover’. (27)
45. Indeed, the Court’s case-law confirms that the proportion of the overall turnover deriving from the sale of products in respect of which the infringement was committed (that is, ‘the value of sales’) is best able to reflect the economic importance of that infringement. (28) By contrast, what the concept of ‘turnover’ under the GDPR seeks to reflect is the economic importance of the undertaking. (29) These two approaches may not be conflated as they serve different objectives: the former seeks to assess the gravity of the infringement, while the latter seeks to evaluate the economic importance of the undertaking.
46. Thus, the foregoing considerations and the Court’s case-law (cited in point 40 of the present Opinion) lead me to conclude that the principle of legality must frame the limits of the impact of EU competition case-law on the imposition of actual fines for GDPR infringements. In particular, it must be ensured that the actual GDPR fines are calculated solely in relation to the acts of the perpetrator and take fully into account all the characteristics of the specific infringement. Therefore, the interpretation of the concepts of ‘turnover’ and ‘undertaking’ when setting the maximum amount of the fine cannot automatically be grafted onto the calculation of the actual fine.
47. For a fine to meet the objective of the GDPR - to strengthen the enforcement of the rules of that regulation - and in the light of the Court’s case-law discussed above, the interpretation of the terms ‘undertaking’ and ‘turnover’ when setting the amount of the actual fine should comply with the following requirements. In the process of determining the actual fine, the supervisory authority must, first, take as a basis all the individual circumstances of that specific case, as required by Article 83(2) of the GDPR, including the relationship within the ‘undertaking’ as determined by the EU competition case-law. Second, as a result of the balancing of all the relevant circumstances, the actual fine must be effective, proportionate and dissuasive. Lastly, yet importantly, where appropriate, aspects of criminal law relevant to the case must be respected.
48. In order to meet those requirements, I would like to recall the following points.
49. As has been observed by Advocate General Pitruzzella, (30) in EU law the concept of ‘undertaking’ has a meaning and scope defined by the legislative framework and the various objectives pursued by that legislation. In EU competition law, there are two aspects to the functional nature of the concept of ‘undertaking’. In the first place, that concept focuses on the type of activity performed rather than on the characteristics of the actors which perform it. Competition consists of and is influenced by economic activities. For that reason, Articles 101 and 102 TFEU refer in general terms to ‘undertakings’, omitting any mention of their legal structure. In the second place, the classification of an activity as economic - and therefore of an entity as an ‘undertaking’ - for the purposes of EU competition law depends on the context examined. Similarly, the identification of the entities within the scope of the ‘undertaking’ depends on the subject matter of the contested infringement.
50. These observations rightly point out that, in EU competition law, primacy is given to economic concerns, disregarding the legal structures of the entity in question. Having said that, the second aspect limits that view to the effect that the identification of the entity or person liable for the infringement and, consequently, the actual fine depends on the contested infringement itself.
51. Consequently, one of the elements characterising the term ‘undertaking’ that should be considered in determining the basic fine and its adjustment (in order to set the actual fine) is the level of participation of other companies of that undertaking in the GDPR infringement. In that regard, it has been argued in national case-law relating to EU competition law that ‘conceptually, the question as to the existence of an “undertaking” and the question as to the attribution of liability between different companies within an “undertaking” are distinct … [(31)] [and] a person is not ipso facto liable for an infringement of Article 101 [TFEU] by reason only of the fact that he, she or it is a member of an undertaking responsible as a matter of EU law for the infringement, in circumstances where the person in question neither participated in the infringement nor had decisive influence over the conduct in the relevant market of other member(s) of the undertaking who did participate. … [I]n such circumstances it may well be unlikely that the person in question would in fact be held to be part of that “undertaking”’. (32)
52. In my view, the above arguments are also relevant when considering which persons fall under the concept of ‘undertaking’ in order to determine the actual fine for the infringement of the GDPR. That is particularly the case when the supervisory authority has explicitly established that the parent company was not involved as controller or processor in the infringement in question, (33) as is the case in the main proceedings.
53. Even though the EU legislature has, to a certain limited extent, formed a bridge between the two fields of EU law for the purpose of setting maximum fines, the GDPR rules and EU competition rules clearly pursue different objectives. The regulatory scheme of the GDPR is different from that of EU competition rules and is based on the concept of the responsibility of the controller (and processor) for the lawful processing of personal data. In other words, while EU competition law is directed at ‘undertakings’ (it expresses its prohibition by reference to an ‘undertaking’), the GDPR focuses on ‘controllers’ and ‘processors’. I also recall that, since the doctrine of ‘economic unit’ cannot be detached from the broad logic of EU competition law and its object, the Court has previously refused to extend its application by analogy to other areas of EU law, for example to non-contractual liability based on the second paragraph of Article 340 TFEU. (34)
54. Bearing in mind those considerations, it becomes apparent why the Court has clearly narrowed down the implications of EU competition law for GDPR enforcement (and GDPR fines, in particular). In the judgment in Deutsche Wohnen (paragraph 53), the Court ruled that the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, ‘has no bearing on whether and under what conditions an administrative fine may be imposed pursuant to Article 83 of the GDPR on a controller who is a legal person, since that question is exhaustively regulated by Article 58(2) and Article 83(1) to (6) of that regulation’. It continued by observing (in paragraph 54) that that concept is ‘relevant only for the purpose of determining the amount of the administrative fine imposed under Article 83(4) to (6) of the GDPR [which deals with the maximum fine] on a controller’ (emphasis added). Moreover, by ruling (in paragraph 53) that the question whether, and under what conditions, an administrative fine may be imposed ‘is exhaustively regulated by Article 58(2) and Article 83(1) to (6) of that regulation’ (emphasis added), the Court has further clarified that, when determining the actual fine, the requirements of Article 83(1) to (6) have to be applied in their entirety and none of those paragraphs is primus inter pares.
55. Therefore, the ‘turnover’ of the ‘undertaking’ is only one of the multiple elements that must be considered when enforcing the responsibility of a controller (or a processor) and imposing a GDPR fine that is effective, proportionate and dissuasive.
56. It is true that the Court’s case-law indicates that, in EU competition law, in certain situations, taking account of a company’s turnover may be justified - but only as one relevant element among others - when calculating the amount of the actual fine (for instance, when increasing the basic fine for the purposes of deterrence). (35)
57. Therefore, to my mind, it should be possible to rely on the concept of ‘undertaking’ within the meaning of Articles 101 and 102 TFEU when fixing the actual fine, but only where this is duly justified for the purposes of the dissuasiveness and effectiveness of the fine. Indeed, in that respect, the use of that concept must be nuanced and individualised in each given case. More specifically, it may be used as an adjustment mechanism when considering the specific circumstances of an individual case once the fine in accordance with Article 83(2) of the GDPR has been established. It is therefore incumbent on the referring court to determine whether, in the present case, circumstances exist which would justify increasing the fine in such a manner, in particular, for the purposes of deterrence.
58. The issue of the individualisation of GDPR fines (36) has also been addressed by the European Data Protection Board (EDPB). (37) In its guidelines on the calculation of GDPR fines, (38) drawn up pursuant to Article 70(1)(k) of the GDPR, the EDPB seeks to standardise the fining power of the supervisory authorities under the GDPR across the European Union. In particular, the EDPB states that it considers ‘three elements to form the starting point for further calculation: the categorisation of infringements by nature under [Article 83(4) to (6) of the] GDPR, the [gravity] of the infringement … and the turnover of the undertaking as one relevant element to take into consideration with a view to imposing an effective, dissuasive and proportionate fine, pursuant to Article 83(1) [of the] GDPR’. Whilst it is true that they are not binding on the Court, these considerations show that only a comprehensive approach that embraces all the elements relevant to a specific case can ensure that the fine meets the key requirements under Article 83 of that regulation, in particular that the actual fine imposed be effective, proportionate and dissuasive.
59. Consequently, for the purpose of determining the amount of the actual fine, I invite the Court to consider that the following aspects should be pertinent when applying the concept of ‘undertaking’ in the context of setting the actual fine under Article 83 of the GDPR. First, it should be evaluated whether the parent company has exercised its decision-making power with respect to specific activities of the controller or the processor at issue in the GDPR infringement(s). Second, it needs to be considered whether specific data processing infringing the GDPR relates to the company concerned and/or to the whole group. Third, it is necessary to establish whether more than one company forming part of the group was involved in the GDPR infringement(s).
60. In that regard, I would point out that the following non-exhaustive list of elements is relevant: (i) in the present case (39) - contrary to the case which gave rise to the judgment in Deutsche Wohnen - it appears that the Lars Larsen Group and/or its parent company was not involved in the criminal proceedings; (ii) the charges were brought only against ILVA and not against the group; (40) and (iii) the GDPR infringement in the main proceedings was limited only to ILVA’s customers and their data, and there was no suggestion that the infringement was carried out at the level of the group itself or that ILVA’s processing was linked to the other companies in the group. It should be stressed that in the case which gave rise to the judgment in Deutsche Wohnen, the ‘company concerned’ assumed all responsibility for the data processing, that is, also for the data processing of the other companies in the group. (41)
61. It is, however, for the referring court - which alone has jurisdiction to rule on the facts - to carry out the necessary verifications in that respect and to consider those elements as well as the relevance and weight that should be given to them in the context of setting the appropriate amount of ILVA’s actual fine.
4. Final observations
62. Although the referring court has not submitted any questions in that regard, I consider that - in order to give that court a complete answer - it is appropriate to address briefly certain specific aspects of the present case.
63. The interpretation of Article 83(1) to (6) in the case in the main proceedings must be carried out, in particular, in conjunction with Article 83(9) of the GDPR (42) - a matter that was not addressed by the Court in the judgment in Deutsche Wohnen. (43) Therefore, the regime for the setting of an appropriate actual fine under Article 83 of the GDPR must, in the present case, be interpreted in a manner which is consistent with the essential guarantees of a criminal law trial.
64. In the context of analysing the impact of Article 83(9) on the present case, it is necessary also to take account of recital 151 of the GDPR, according to which ‘the legal systems of Denmark and Estonia [(44)] do not allow for administrative fines as set out in this Regulation’. The recital, further, provides guidance on the compatibility of different procedures with the three key conditions for the actual fine under the GDPR regime, that is, that ‘in any event, the fines imposed should be effective, proportionate and dissuasive’. Therefore, it is relevant to address briefly the impact of EU law on fines imposed in criminal proceedings in order to ensure that those three conditions are met also in a specific case such as this one.
65. At the hearing, ILVA relied, on the one hand, on Article 41 of the Charter of Fundamental Rights of the European Union (‘the Charter’). That article is entitled ‘Right to good administration’ and, in particular, Article 41(2)(c) points out ‘the obligation of the administration to give reasons for its decisions’, but ILVA has not made any specific arguments in that regard.
66. On the other hand, ILVA also referred to Article 49 of the Charter. Indeed, I consider that, in interpreting Article 83(1) to (6) of the GDPR, account should be taken of that article of the Charter, which is entitled ‘Principles of legality and proportionality of criminal offences and penalties’ and thus is relevant to the case in the main proceedings. Article 49(3) of the Charter states, in particular, that ‘the severity of penalties must not be disproportionate to the criminal offence’.
67. Indeed, it follows from the Court’s case-law that the principle of proportionality is one of the general principles of EU law underlying the constitutional traditions common to the Member States which must be observed by national authorities when they are applying or implementing EU law. It requires the Member States to adopt measures that are appropriate for attaining the objectives pursued and do not go beyond what is necessary for attaining them. (45)
68. The severity of a penalty must thus correspond to the gravity of the offence concerned, that requirement following both from Article 52(1) of the Charter and from the principle of proportionality of penalties in Article 49(3) of the Charter. (46)
69. It follows from the Explanations relating to the Charter (47) that, under Article 52(3) of the Charter, in so far as the right guaranteed by Article 49 of the Charter also corresponds to a right guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms signed at Rome on 4 November 1950 (‘the ECHR’), its meaning and scope are the same as those laid down by the ECHR. Consequently, the requirements of the ECtHR concerning the proportionality of penalties apply to a case such as that in the main proceedings by the combined effect of Article 17(1), Article 51(1) and Article 52(1) and (3) of the Charter. (48)
70. The case-law of the Court makes clear that the principle of proportionality requires, first, that the penalty imposed correspond to the gravity of the offence and, second, that the individual circumstances of the particular case are taken into account in determining the penalty and fixing the amount of the fine. (49) As regards that second element, the case-law stresses that the referring court is required to take into account objective criteria such as the gravity and duration of the infringement as well as any aggravating and mitigating circumstances, in order to ensure that the fine is effective, proportionate and dissuasive. (50)
71. Second, the ECtHR case-law in such cases proceeds to weigh up the various interests at stake and takes account of the nature, severity and chilling effect of the applicant’s criminal penalty. It makes clear that the obligation on States to impose criminal law and attribute punishment (51) in order to protect the public (52) gives rise to a corresponding obligation to ensure that the punishment imposed is not excessive.
72. The ECtHR has held that the ‘requisite balance will not be struck where the person concerned bears an individual and excessive burden’; thus ‘a financial liability arising out of a fine may undermine the guarantee afforded by that provision if it places an excessive burden on the person or fundamentally interferes with his or her financial position’. (53)
73. It follows that the specific procedural aspects of the case in the main proceedings, and EU law and ECtHR case-law in relation to fines imposed in criminal proceedings, require the referring court to take into account all the relevant elements of the case when setting the actual fine for infringements of the GDPR. Procedural guarantees of a person accused as well as the principle of proportionality, as interpreted in the case-law of the Court of Justice and the ECtHR, require penalties to correspond to the gravity of the offence and require that the individual circumstances of the particular case be taken into account.
74. In the light of those requirements, the referring court must ensure that the principle of proportionality is observed in the setting of the actual fine, whereby a fair balance is struck between the demands of the general interest of the community in protecting personal data and the requirements of the protection of the fundamental rights (54) of the controller, the processor or the undertaking of which it forms part.
V. Conclusion
75. I propose that the Court answer the questions referred for a preliminary ruling by the Vestre Landsret (High Court of Western Denmark, Denmark) as follows:
Article 83(4) to (6) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),
must be interpreted as meaning that, where fines are imposed on a controller or processor that is (or forms part of) an undertaking, the concept of ‘undertaking’ must be interpreted as meaning that it corresponds to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, for the purpose of setting the maximum amount of the fine. Hence, the total annual worldwide turnover of the undertaking of which the controller or processor forms part is taken into account.
However, when determining the actual fine to be imposed, the concept of ‘undertaking’ must be interpreted in conjunction with Article 83(1) and (2) of Regulation 2016/679 and used as one relevant element among others when considering the specific circumstances of the individual case. In that connection, specific circumstances may relate to the decision-making power of the parent company, the scope of data processing that infringes the rules of that regulation and the number of entities of the undertaking involved in the infringement.
Moreover, where such a fine is imposed, in conjunction with Article 83(9) of Regulation 2016/679, by a national court in the context of criminal proceedings, the actual fine must be assessed in the light of principles which are applicable in criminal law. In that context, the national court must ensure that the principle of proportionality is observed in the setting of the actual fine, whereby a fair balance is struck between the demands of the general interest of the community in protecting personal data and the requirements of the protection of the fundamental rights of the controller, the processor or the undertaking of which it forms part.
1 Original language: English.
2 Regulation of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’).
3 In national sources, the case in the main proceedings is also referred to as the ‘IDdesign A/S’ case, as that was ILVA’s former company name.
4 In particular, Article 83(9) and recital 151 of the GDPR.
5 See Overby, T., ‘The Danish adaptation of the GDPR’, Blog Droit Européen, June 2018, pp. 4 and 5.
6 As regards the specific wording of the second question referred (see point 15 of the present Opinion), that wording appears to be vitiated by a clerical error. However, it can be inferred from the context that the referring court intended to refer not to the choice between ‘the economic entity of which the undertaking forms part’ and ‘the undertaking itself’, but between ‘the economic entity of which the company forms part’ and ‘the company itself’ (that is to say, the legal person that has infringed the GDPR).
7 That recital is cited in point 4 of the present Opinion.
8 Judgment of 5 December 2023, Deutsche Wohnen (C‑807/21, EU:C:2023:950, paragraph 57; ‘the judgment in Deutsche Wohnen’ or ‘the Deutsche Wohnen case-law’). See also the related judgment, delivered on the same day, Nacionalinis visuomenės sveikatos centras (C‑683/21, EU:C:2023:949).
9 As the Court’s case-law makes clear, ‘turnover, although vague and imperfect, is an adequate criterion for assessing the size and economic power of the undertakings concerned’. See judgment of 8 December 2011, KME Germany and Others v Commission (C‑272/09 P, EU:C:2011:810, paragraph 52).
10 Council Regulation of 16 December 2002 on the implementation of the rules on competition laid down in Articles [101 and 102 TFEU] (OJ 2003 L 1, p. 1).
11 Judgment of 6 October 2021, Sumal (C‑882/19, EU:C:2021:800, paragraph 41 and the case-law cited).
12 For national case-law, see the Landgericht Bonn (Regional Court, Bonn, Germany) (Judgment of 11 November 2020, DE:LGBN:2020:1111.29OWI1.20.00) and the Conseil d’État (Council of State, France) (Judgment of 19 June 2020, FR:CECHR:2020:430810.20200619). Both, in essence, comply with the Court of Justice’s interpretation (even though they predate its judgment). For the opposite interpretation, see the Bundesverwaltungsgericht (Federal Administrative Court, Austria) (Judgment of 19 August 2019, AT:BVWG:2019:W211.2208885.1.00) and the Landgericht Berlin (Regional Court, Berlin, Germany) (Judgment of 18 February 2021, DE:LGBE:2021:0218.526OWI.LG212JS.OW.00; this is the judgment which eventually gave rise to the Court’s judgment in Deutsche Wohnen). For case-law which post-dates and applies the Court’s judgment, see the Bundesverwaltungsgericht (Federal Administrative Court, Austria) (Judgment of 27 March 2024, AT:BVWG:2024:W214.2243436.1.00).
13 See judgment of 23 April 1991, Höfner and Elser (C‑41/90, EU:C:1991:161, paragraph 21). See also, for instance, judgments of 12 September 2000, Pavlov and Others (C‑180/98 to C‑184/98, EU:C:2000:428, paragraph 74); of 12 July 2012, Compass-Datenbank (C‑138/11, EU:C:2012:449, paragraph 35); and of 27 April 2017, Akzo Nobel and Others v Commission (C‑516/15 P, EU:C:2017:314, paragraph 47).
14 See, for instance, judgment of 20 January 2011, General Química and Others v Commission (C‑90/09 P, EU:C:2011:21, paragraph 37). The main criterion for establishing this is ‘decisive influence’, which should be constructed based on factual evidence (economic, organisational and legal links).
15 Judgment of 27 January 2021, The Goldman Sachs Group v Commission (C‑595/18 P, EU:C:2021:73, paragraph 67 and the case-law cited).
16 Ibid., paragraph 71.
17 Ibid., paragraph 32 and the case-law cited.
18 The 2% of a company’s total worldwide turnover exceeds EUR 10 million only if the company’s turnover is above EUR 500 million. Similarly, the 4% of a company’s total worldwide turnover exceeds EUR 20 million only if the company’s turnover is above EUR 500 million.
19 Throughout the present Opinion, I will refer to the/a ‘supervisory authority’ in this connection, but - given the specific context of the case in the main proceedings - it is clear that the same applies by extension to the referring court (which is imposing the fine on ILVA - not the supervisory authority).
20 ‘Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.’ (Emphasis added).
21 See, in that regard, the case-law cited in point 40 of the present Opinion.
22 The latter provision deals with situations where several provisions of the GDPR are infringed at the same time.
23 Some of those factors are: the nature, gravity and duration of the infringement, its intentional or negligent character, action taken to mitigate the damage suffered, previous infringements by the controller or processor, the degree of cooperation with the supervisory authority, the categories of personal data affected and so forth.
24 Judgment of 25 September 1984, Könecke (117/83, EU:C:1984:288, paragraph 11).
25 Judgment of 18 July 2013, Schindler Holding and Others v Commission (C‑501/11 P, EU:C:2013:522, paragraph 57 and the case-law cited).
26 See point 32 (‘Legal maximum’) and point 13 (in relation to the ‘basic amount of the fine’) of the Commission Guidelines on the method of setting fines imposed pursuant to Article 23(2)(a) of Regulation No 1/2003 (OJ 2006 C 210, p. 2) (‘the 2006 Fining Guidelines’).
27 Mayer Brown, Yaros, O. et al., ‘GDPR fines - Lessons from competition law’, December 2018, p. 4.
28 Judgment of 12 November 2014, Guardian Industries and Guardian Europe v Commission (C‑580/12 P, EU:C:2014:2363, paragraph 59).
29 The 2006 Fining Guidelines provide, in point 30 thereof, that ‘the Commission will pay particular attention to the need to ensure that fines have a sufficiently deterrent effect; to that end, it may increase the fine to be imposed on undertakings which have a particularly large turnover beyond the sales of goods or services to which the infringement relates’ (emphasis added). See, in that connection, judgment of 6 February 2014, Elf Aquitaine v Commission (T‑40/10, EU:T:2014:61, paragraphs 350 to 357 and the case-law cited).
30 These points were made in his Opinion in a competition law case, Sumal (C‑882/19, EU:C:2021:293, points 23 to 25).
31 See, for instance, pre-Brexit case-law from the United Kingdom Competition Appeal Tribunal in the case Sainsbury’s Supermarkets Ltd v Mastercard Incorporated and Others (2016) CAT 11, paragraph 363(20) to (22).
32 Ibid., paragraph 363(23).
33 It appears from the documents before the Court that that was the case here, in so far as no charges were brought by the Public Prosecutor against the parent company ‘as there was no basis for doing so’ and the subsidiary (ILVA) ‘runs an independent retail business and … it is … not the case that the parent company has set up a subsidiary with the sole purpose of transferring the group’s data processing to it’. See paragraphs 5 and 21 of the order for reference.
34 In the judgment of 5 September 2019, European Union v Guardian Europe and Guardian Europe v European Union (C‑447/17 P and C‑479/17 P, EU:C:2019:672, paragraphs 105 and 106, the Court ruled that the concept of ‘undertaking’, within the meaning of the ‘economic unit’ doctrine, is used specifically in order to implement the relevant provisions of EU competition law and, in particular, for the purpose of designating the perpetrator of an infringement of Articles 101 and 102 TFEU. That concept is not, on the other hand, applicable in the context of an action for damages, founded on the second paragraph of Article 340 TFEU. Such an action is an ordinary action, governed by general procedural rules, which are subject, in this instance, to company law and are independent of the principles that determine liability in EU competition law.
35 Judgment of 17 June 2010, Lafarge v Commission (C‑413/08 P, EU:C:2010:346, paragraph 102 and the case-law cited). See also footnote 29 to the present Opinion.
36 That is, seeking to establish a balance between the fine and the particular situation of the perpetrator of an infringement.
37 The EDPB is an EU independent body with judicial personality whose purpose is to ensure consistent application of the GDPR and to promote cooperation among the European Union’s data protection authorities.
38 Guidelines 04/2022 on the calculation of administrative fines under the GDPR, Version 2.1, adopted on 24 May 2023, paragraph 48.
39 The order for reference in the present case (page 3) points out that ‘it follows from the principle of prosecution laid down in [national law] that the court cannot hand down a conviction for any offence not covered by the indictment. It would be contrary to the principle laid down in that provision to attach significance to circumstances related to another person, against whom no charges had been brought, when passing a stricter sentence’.
40 Whereas the national fining guidelines state that ‘if the data controller is a subsidiary of a group, it should be investigated whether criminal liability can also be asserted against the parent company’. See Bødevejledning - Udmåling af bøder til virksomheder (Fine guidance - Assessment of fines for companies), January 2021, page 3.
41 Indeed, in the case which gave rise to the judgment in Deutsche Wohnen, the infringements were at the level of the whole group of which the company concerned formed part. See the factual differences between these two cases also in particular in view of paragraphs 10 to 12 of the judgment in Deutsche Wohnen.
42 I recall that that provision provides, in particular, that ‘where the legal system of the Member State does not provide for administrative fines, this Article may be applied in such a manner that the fine is initiated by the competent supervisory authority and imposed by competent national courts, while ensuring that those legal remedies are effective and have an equivalent effect to the administrative fines imposed by supervisory authorities. In any event, the fines imposed shall be effective, proportionate and dissuasive. …’
43 Due to the fact that that provision was not relevant to the resolution of that case.
44 It appears that in Ireland, the administrative fines imposed by the data supervisory authority must be confirmed by a court. See Data Protection Act 2018, sections 141 to 143. Moreover, it appears that, in the light of a decision of the Vrhovno sodišče (Supreme Court, Slovenia) of 16 March 2021, Slovenia does not allow for administrative fines either.
45 See, to that effect, judgment of 4 October 2018, Link Logistik N&N (C‑384/17, EU:C:2018:810, paragraph 40 and the case-law cited; ‘the judgment in Link Logistik’).
46 Ibid., paragraph 42 and the case-law cited.
47 OJ 2007 C 303, p. 17.
48 See also the judgment in Link Logistik, paragraph 43.
49 The judgment in Link Logistik, paragraph 45.
50 See, to that effect, judgment of 10 November 2022, Zenith Media Communications (C‑385/21, EU:C:2022:866, paragraph 41).
51 See, for instance, ECtHR, 4 December 2003, M.C. v. Bulgaria, CE:ECHR:2003:1204JUD003927298.
52 See, for instance, ECtHR, 16 December 1999, T. v. the United Kingdom, CE:ECHR:1999:1216JUD002472494, § 97, citing ECtHR, 23 September 1998, A. v. the United Kingdom, CE:ECHR:1998:0923JUD002559994, § 22, and ECtHR, 28 October 1998, Osman v. the United Kingdom, CE:ECHR:1998:1028JUD002345294, § 115.
53 See, for instance, ECtHR, 27 October 2015, Konstantin Stefanov v. Bulgaria, CE:ECHR:2015:1027JUD003539905, § 55.
54 Ibid., §§ 54, 55, 66, 67, 69 and 70. See also ECtHR, 5 July 2001, Phillips v. the United Kingdom, CE:ECHR:2001:0705JUD004108798, § 35, and ECtHR, 24 June 2021, Imeri v. Croatia, CE:ECHR:2021:0624JUD007766814, § 71.
© European Union
The source of this judgment is the Europa web site. The information on this site is subject to a information found here: Important legal notice. This electronic version is not authentic and is subject to amendment.