Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

EU: CJEU clarifies imposition and calculation of fines under GDPR

On December 5, 2023, the Court of Justice of the European Union (CJEU) announced that it had issued its judgments in cases C-579/21 Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija and C-807/21 Deutsche Wohnen SE v Staatsanwaltschaft Berlin, where a Lithuanian court and a German court had asked the CJEU to interpret the General Data Protection Regulation (GDPR) regarding the imposition and calculation of penalties for infringements. 

What did the CJEU hold regarding the imposition of fines under the GDPR?

The CJEU took the view that a national data protection supervisory authority (DPA) may not impose a fine on a data controller for an infringement of the GDPR unless that infringement was committed wrongfully, i.e., intentionally or negligently. In this regard, the CJEU clarified that a wrongful infringement may happen where the controller could not have been unaware of the infringing nature of its conduct, regardless of whether or not it was aware of the infringement.

In addition, the CJEU held that, where the controller is a legal person, it is not necessary for the infringement to have been committed by its management body, nor is it necessary for that body to have known such infringement. According to the CJEU, a controller may also be fined in respect of operations performed by a processor, to the extent that the controller may be held responsible for such operations.

What did the CJEU hold regarding the calculation of fines under the GDPR?

Lastly, the CJEU posited that where the addressee of a fine is, or forms part of, an undertaking, a DPA must take as its basis the concept of an 'undertaking' under EU competition law. Accordingly, for the calculation of a fine, the CJEU clarified that a DPA must take into account the total worldwide turnover of the entire group, in the preceding business year.

You can read the press release here, the judgment in case C-579/21 here, and the judgment in case C-807/21 here.