On 12 September 2024, Advocate General Medina delivered her Opinion in Case C-383/23, Public Prosecution Service v ILVA A/S (Ilva). In the case, referred to the Court of Jutice of the European Union by the Western High Court (Vestre Landsret) of Denmark, she is of the view that the General Data Protection Regulation (GDPR) fine to be levied on Ilva for breaching customers personal data can be attributable to the entire company group (Lars Larsen Group)), and not just Ilva as a subsidiary of that company group.
Background
The Western High Court (Vestre Landsret) of Denmark made a reference for a preliminary ruling under Article 267 TFEU to the Court of Justice of the European Union on the issue of fines for companies that have admitted to breaches of GDPR.
Previously, before Aarhus City Court (Retten i Aarhus), Denmark, ILVA A/S was fined 100,000 DKK for breaching the personal data of natural persons (retention of personal data of 350,000 former customers) under the General Data Protection Regulation (GDPR). The Public Prosecution Service is appealing that fine, as the Public Prosecution Service believed it had acted ‘intentionally’, whereas the Aarhus City Court had found that ILVA A/S had only acted ‘negligently’. The Public Prosecution Service was seeking a fine of 1.5 million DKK to be levied on ILVA A/S.
ILVA A/S is part of a larger group of companies. ILVA A/S had an annual turnover of 1.8 billion DKK, whereas the group it is part of (the Lars Larsen Group) had a turnover of 6.57 billion DKK in the year concerned.
The ILVA A/S case centres around interpretation of Article 83(5) of the GDPR. The referring national court has considered that uncertainty arises as to whether the term ‘undertaking’ in Article 83(5) of the GDPR should be understood as meaning that, when setting a fine for an undertaking’s infringement of the GDPR, regard must be had to the turnover of the group of which the company forms part.
The Public Prosecution Service argues that the term ‘undertaking’ in Article 83(5) of the GDPR should be understood as taking into account the turnover of the entire group of companies, in line with competition law (Articles 101-102 TFEU). ILVA A/S, on the other hand, argues that charges were only taken against it, ILVA A/S, and not the company group that it is a part of.
Opinion of the Advocate General
For her, the term “undertaking” in the GDPR should be interpreted in line with EU competition law, meaning the total turnover of the economic entity should be considered when setting the maximum fine. This includes parent companies and subsidiaries if the parent exercises decisive influence over the subsidiary.
In addition, the maximum fine should be based on the total worldwide annual turnover of the entire economic entity (group) to ensure fines are effective, proportionate, and dissuasive. But for the actual fine in this case, for her, this has to consider the specific circumstances of the case, including the nature, gravity, and duration of the infringement, and any mitigating or aggravating factors.. The turnover of the economic entity can be one of the factors, but should not be the sole determinant.
This meant that, in the Ilva case,
- The term ‘undertaking’ in Article 83(4) to (6) of the GDPR should be interpreted in line with EU competition law, considering the total turnover of the economic entity.
- When determining the actual fine, the concept of ‘undertaking’ should be one of several factors, ensuring the fine is effective, proportionate, and dissuasive.
- In criminal proceedings, the fine must respect principles of proportionality and fairness, balancing the need to enforce GDPR compliance with the rights of the infringing entity.
Or in the formal operative part of her Opinion, textually,
‘Article 83(4) to (6) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),
must be interpreted as meaning that, where fines are imposed on a controller or processor that is (or forms part of) an undertaking, the concept of ‘undertaking’ must be interpreted as meaning that it corresponds to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, for the purpose of setting the maximum amount of the fine. Hence, the total annual worldwide turnover of the undertaking of which the controller or processor forms part is taken into account.
However, when determining the actual fine to be imposed, the concept of ‘undertaking’ must be interpreted in conjunction with Article 83(1) and (2) of Regulation 2016/679 and used as one relevant element among others when considering the specific circumstances of the individual case. In that connection, specific circumstances may relate to the decision-making power of the parent company, the scope of data processing that infringes the rules of that regulation and the number of entities of the undertaking involved in the infringement.
Moreover, where such a fine is imposed, in conjunction with Article 83(9) of Regulation 2016/679, by a national court in the context of criminal proceedings, the actual fine must be assessed in the light of principles which are applicable in criminal law. In that context, the national court must ensure that the principle of proportionality is observed in the setting of the actual fine, whereby a fair balance is struck between the demands of the general interest of the community in protecting personal data and the requirements of the protection of the fundamental rights of the controller, the processor or the undertaking of which it forms part.’
Read the Opinion
The judgment of the Fifth Chamber of the Court will be delivered in due course. For now however, the Opinion of Advocate General Medina in Case C-383/23, Public Prosecution Service v ILVA A/S (Ilva) can be read here.