Clifford Chance

On 12 September 2024, Advocate-General Leila Medina (AG) delivered her opinion to the Court of Justice of the European Union (CJEU) in Case C-383/23 Anklagemyndighenden v ILVA A/S (ILVA). While this is only an opinion, which may not be taken up by the CJEU, it appears helpfully to clarify the relationship between the basis on which the level of an administrative fine is to be set under articles 83(1) to (3) of the EU General Data Protection Regulation (GDPR), and the maximum level of such a fine under articles 83(4) and (5). In particular, the AG takes the view that the anti-trust definition of an "undertaking", used to determine the maximum level of the fine, cannot be imported uncritically into the determination of the level of the fine within and below that maximum level.

In December 2023 we reported on (amongst other things) the position taken by the CJEU, in  Case C-807-21 (Deutsche Wohnen SE) (DW), on the concept of an "undertaking", borrowed from EU anti-trust law, as used to determine the maximum level of an administrative fine under articles 83(4) and (5) of the GDPR. The CJEU's conclusion was that, for this purpose, the anti-trust concept and case law should be imported directly into the GDPR analysis – the scope of the undertaking, and therefore of the turnover to be taken into account in determining the maximum level of the fine, should be assessed by application of the same "economic influence" analysis used in determining the maximum level of an anti-trust fine.

Actual v maximum fine

The AG's opinion, if adopted by the CJEU, will introduce a significant nuance into this assessment, when it comes to determining the actual, rather than the maximum, level of the fine to be imposed in response to a given infringement of the GDPR.

The AG points out that, while articles 83(4) and (5) make direct reference to the concept of an "undertaking" for the purposes of determining the maximum level of a GDPR fine, there is no equivalent reference in articles 83(1) to (3), which between them set out the factors to be taken into account in determining the actual level of the fine, subject to the application of the maximum level where it would otherwise be exceeded. This point was also made in DW. In fact, the AG points out, articles 83(1) to (3) make no explicit reference to turnover at all. Given the factors that are identified in articles 83(1) to (3), and in particular the overall requirement, in article 83(1), that fines should be "effective, proportionate and dissuasive", the AG takes the view that:

• turnover may be relevant, as one factor amongst others, in assessing "all the individual circumstances of the specific case"; but
• attention should be given to "the subject matter of the contested infringement" (i.e. a GDPR rather than an anti-trust infringement) in assessing the scope of the turnover to be taken into account.

Turnover of all group entities may not be relevant

The AG's conclusion is that, for the purposes of determining the actual amount of a GDPR fine, the starting point should be that only the turnover of the controller or processor (that is, the legal person) that was responsible for the infringement should be taken into account. Turnover of other entities within the same undertaking may then be relevant, as part of an "adjustment mechanism", where they were involved in the decision-making leading to the infringement, or in the infringement itself, or where the infringing processing related to them, but not otherwise. Specifically, the AG spells out the following "undertaking" analysis, to be applied a tentative determination of the appropriate level of fine based on the explicit factors in article 83(2):

• "First, it should be evaluated whether the parent company has exercised its decision-making power with respect to specific activities of the controller or the processor at issue in the GDPR infringement(s).
• Second, it needs to be considered whether specific data processing infringing the GDPR relates to the company concerned and/or to the whole group.
• Third, it is necessary to establish whether more than one company forming part of the group was involved in the GDPR infringement(s)."

One or more of these factors may lead to an increase in the scope of the turnover to be taken into account in adjusting (increasing or decreasing) the basic level of the fine.

It remains to be seen whether the CJEU will agree with the AG's opinion. If it does, the decision may provide some comfort to groups of companies, – for example, private equity houses and their portfolio companies - that may be economically integrated but operate independently from a personal data processing perspective, and particularly to companies that might otherwise be deterred from acquisitions because of a concern that relatively small GDPR infringements within an acquired business may result in huge fines set by reference to groupwide turnover. Groups of companies should give careful attention to the intra-group arrangements and relationships relevant to the processing of personal data to avoid inadvertent exposure of subsidiaries to fines calculated by reference to their parents' turnover.

Opinion and the EDPB's guidelines

The AG's opinion quotes with apparent approval some aspects of the guidelines published by the European Data Protection Board on the calculation of administrative fines under the GDPR. While these guidelines are not explicitly inconsistent with the AG's opinion they do appear to assume a straightforward anti-trust determination of the scope of the relevant undertaking when, in section 4.3, they take a view on the application of turnover as an adjusting factor in setting the actual level of the fine.

The UK position

Outside the EU, the fining guidance published by the UK Information Commissioner's Office (ICO) appears to be based on a similar assumption – the decision in ILVA will not be binding on the ICO or the UK courts and it will be interesting to see what weight is attached to it in the UK if the CJEU agrees with the AG's opinion.