On February 13, 2025, the European Court of Justice (ECJ) issued a ruling in case C-383/23 that has far-reaching consequences for the calculation of fines under the General Data Protection Regulation (GDPR) could have. At the heart of the decision was the question of whether the term "undertaking" in Art. 83 (4) to (6) GDPR is to be interpreted in the sense of EU competition law. The total turnover of a group could then be taken into account when assessing a fine if a subsidiary violates the GDPR violates.
Background to the case
The case concerns the Danish furniture store chain ILVA A/S, a subsidiary of the Lars Larsen Group. ILVA was prosecuted by the Danish public prosecutor's office for a breach of the General Data Protection Regulation (GDPR) has been indicted. The company is said to personal data of at least 350,000 former customers over an unreasonably long period of time. This is said to have been done without a lawful basis and contrary to the requirements of the GDPR with regard to data economy and storage limitation.
Following an investigation, the Danish Data Protection Agency Datatilsyn came to the conclusion that the Infringement was to be classified as serious. It recommended a fine of DKK 1.5 million (approx. EUR 201,000). The calculation of this fine was not only based on ILVA's turnover, but included the total turnover of the parent company Lars Larsen Group. The authority argued that the economic unit was decisive for the amount of the fine. A deterrent effect could only be guaranteed if the fine was based on the entire group turnover.
However, the court of first instance, Ret i Aarhus (Aarhus Court, Denmark), significantly reduced the fine to DKK 100,000 (approx. EUR 13,400). It based this decision on the fact that only ILVA as a legal entity was the subject of the proceedings and not the entire group. The court also assumed that ILVA had acted negligently but not intentionally in this case.
The Danish public prosecutor appealed against this judgment to the Vestre Landsret (Regional Court for Western Denmark). It argued that the term "undertaking" in Art. 83 para. 4 to 6 GDPR should be interpreted in accordance with the concept of an undertaking under EU law. Accordingly, the total turnover of the economic entity, i.e. the group, must be taken into account when calculating the fine. This ultimately led to the case being referred to the ECJ in order to obtain a binding clarification of this legal issue.
These legal issues came before the ECJ
The Vestre Landsret referred two key questions to the ECJ for a preliminary ruling:
- Is the term "undertaking" in Art. 83 para. 4 to 6 GDPR in accordance with EU competition law, i.e. does it include any economic entity irrespective of its legal form?
- If so, must the entire annual turnover of the economic entity be taken into account when calculating the fine or only the turnover of the specific subsidiary?
Reading tip: ECJ ruling on GDPR fines - what discretion does a data protection authority have
ECJ: Companies to be interpreted in accordance with competition law
The ECJ ruled that the term "undertaking" in Art. 83 para. 4 to 6 GDPR must be interpreted in accordance with competition law. The Court of Justice is thus following its previous case law on corporate liability under competition law pursuant to Art. 101 and 102 TFEU.
In its detailed grounds for the judgment, the ECJ emphasized that the GDPR must not be viewed in isolation. It must be understood in the context of EU economic legislation. This means that the term "undertaking" is not limited to individual legal entities, but encompasses the entire economic entity, which may also include parent companies and subsidiaries.
The ECJ also clarified that a fine for a GDPR infringement cannot be calculated solely on the basis of the turnover of the directly responsible subsidiary. Rather, the total turnover of the group is relevant, provided that the affected company is an integral part of the economic entity and the parent company influences its business decisions.
A central aspect of the ruling was the question of whether and to what extent the economic reality overrides the legal view. The Court confirmed that the principle of "economic unity" is already enshrined in EU competition law and is not relevant for the application of the GDPR apply equally. This prevents companies from circumventing lower fines through complex internal structuring.
Finally, the ECJ dealt with the impact on the deterrent effect of fines under the GDPR. A fine that only takes into account the turnover of a subsidiary could represent a relatively low sanction for large groups and therefore not have the desired deterrent effect. A group-wide approach is therefore necessary to ensure that fines are proportionate and effective.
ECJ is pragmatic in its reasoning
With its ruling, the ECJ is pursuing a pragmatic approach that ensures effective implementation of the GDPR without neglecting the rights of the companies concerned.
The ECJ's reasoning is based on the following arguments:
- Harmonization purpose of the GDPR: The GDPR pursues the goal of uniform application of data protection law throughout the European Union. To ensure this, fines must not only be effective and proportionate, but also have a deterrent effect. The ECJ emphasized that it must be prevented that large corporations circumvent the application of the fine regulations through clever corporate structuring and thus receive lower fines.
- Parallels under competition law: The ECJ based its decision on the concept of an undertaking under EU law in accordance with Art. 101 and 102 TFEU. According to this understanding, an economic entity is regarded as a whole, regardless of how many legal persons it consists of. This means that the economic reality is placed above the formal legal structure. This is intended to prevent companies from becoming separated from each other through the internal division of responsibility of the Liability withdraw.
- Deterrent effect of sanctions: The Court emphasized that a fine based solely on the turnover of the directly affected subsidiary often represents a negligible economic burden for large multinational companies. In order to ensure a sufficient deterrent effect, the turnover of the entire economic entity must therefore be taken into account. This would also prevent groups from undermining the GDPR sanction mechanisms by creating numerous small subsidiaries.
- Principle of proportionality: At the same time, the ECJ clarified that the principle of proportionality must always be observed when calculating the fine. This means that the highest fine is not automatically applied, but that all individual circumstances of the case must be taken into account, such as the type, severity and duration of the infringement as well as the company's willingness to cooperate with the supervisory authorities.
Effects on corporate practice
The ECJ's decision has far-reaching implications for the calculation and imposition of fines under the GDPR. It entails considerable changes, particularly for internationally operating companies and groups. The main consequences can be divided into several key aspects:
- Extended Liability for corporate groups: The confirmation of the economic unity principle means that parent companies are potentially more involved in the Liability for data protection violations by their subsidiaries. This means that breaches are not only considered at company level, but also at Group level, which significantly increases the risk exposure for corporate groups.
- Increased fines: As the total turnover of the economic entity can be used as the basis for calculating fines, penalties could be significantly higher in practice than before. This can have considerable financial consequences, particularly for large multinational companies with high total turnover.
- New compliance strategies: Companies must pay greater attention to ensuring that all subsidiaries comply with strict data protection guidelines. This means that data protection management must be systematically extended to entire corporate groups. Internal audit mechanisms and control structures will become increasingly important in order to prevent group-wide breaches.
- Increased pressure on corporate structures: Corporate groups need to define their internal responsibilities more clearly and ensure that GDPR compliance is not limited to a single legal entity. The case law could lead companies to rethink their group structure in order to better manage risks.
- Harmonization of sanctions within the EU: By referring to competition law, the ECJ is creating greater harmonization of sanctions for GDPR violations throughout the European Union. This ensures a more uniform application of the provisions and prevents individual member states from imposing more lenient sanctions through different interpretations.
- Stronger deterrent for companies: The decision ensures that data protection violations can no longer be compensated with comparatively low penalties. Companies must now ensure that data protection compliance remains a central element of corporate governance in order to avoid high financial penalties.
Conclusion
The ECJ ruling in case C-383/23 represents a significant milestone in the enforcement of the GDPR and significantly strengthens the effectiveness of data protection regulations in the European Union. The decision shows that the principles of competition law can also be applied to data protection sanctions in order to ensure that infringements are punished effectively and fairly.
The inclusion of group turnover as a basis for calculating fines ensures that even large corporate groups are held appropriately accountable for data protection violations. This prevents groups from being able to avoid or minimize penalties through clever internal structuring. The decision therefore helps to ensure uniform and fair application of the GDPR throughout the EU.
In addition, the ruling sends a clear signal to companies that data protection violations can have serious financial consequences. The deterrent effect of this ruling will motivate companies to integrate data protection compliance even more strongly into their business strategies and ensure that all subsidiaries comply with the requirements of the GDPR correspond.
Overall, the ruling helps to improve the enforcement of the GDPR by setting clear standards for the assessment of fines and encouraging companies to do so, Data protection as a central legal and ethical obligation. This decision will undoubtedly have a long-term impact on the design of data protection policies and corporate structures.
German 
English 
Italian 
French