ILVA (Amende pour violation du RGPD) (Protection of personal data - Administrative fines - Opinion) [2024] EUECJ C-383/23_O

1.

The present request for a preliminary ruling from the Vestre Landsret (High Court of Western Denmark, Denmark) seeks an interpretation of Article 83(4) to (6) of Regulation (EU) 2016/679. ( 2 ) It has been made in the context of criminal proceedings initiated by the Anklagemyndigheden (Public Prosecutor, Denmark) against the company ILVA A/S (‘ILVA’) ( 3 ) for having failed to fulfil its obligations under Article 5(1)(e), Article 5(2) and Article 6 of the GDPR in its capacity as controller of personal data of no fewer than 350000 former customers.

2.

The case concerns the issue whether the term ‘undertaking’ in Article 83(4) to (6) of the GDPR must be interpreted, in the light of recital 150 of that regulation, as meaning that it corresponds to the concept of ‘undertaking’ under EU competition law (Articles 101 and 102 TFEU). That raises the question whether, in the context of imposing a fine for a GDPR infringement on a company, it is appropriate to take into account the total annual turnover of the economic entity (or group) of which the infringing company forms part, and not just the total annual turnover of that company itself.

3.

The particularity of the present case lies in the fact that, in the main proceedings, the fine was imposed not by the national data supervisory authority in the context of its powers of supervision, but by a court in criminal proceedings. Indeed, the EU legislature inserted in the GDPR a specific provision in this regard, which is applicable, in particular, to Denmark.

4.

According to recitals 150 and 151 of the GDPR:

5.

Article 83 of the GDPR, entitled ‘General conditions for imposing administrative fines’, provides:

‘1.   Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.

2.   Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:

…

3.   If a controller or processor intentionally or negligently, for the same or linked processing operations, infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement.

4.   Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10000000 EUR, or in the case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher:

…

5.   Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20000000 EUR, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher:

…

6.   Non-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance with paragraph 2 of this Article, be subject to administrative fines up to 20000000 EUR, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher.

…

8.   The exercise by the supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process.

…’

6.

Lov nr. 502 af 23. maj 2018 om supplerende bestemmelser til forordning om beskyttelse af fysiske personer i forbindelse med behandling af personoplysninger og om fri udveksling af sådanne oplysninger (Law No 502 of 23 May 2018 supplementing the regulation on protection with regard to the processing of personal data and on the free movement of such data) provides, in Paragraph 41 thereof:

‘[Subparagraph 1.] Unless a greater penalty is justified under other legislation, a fine or a term of imprisonment of up to six months shall be imposed on anyone who infringes the provisions on:

…

…

Subparagraph 3. Article 83(2) of the [GDPR] must be followed when imposing a penalty according to subparagraphs 1 and 2.

…

Subparagraph 6. Companies and so forth (legal persons) may be held criminally liable in accordance with the rules set out in Chapter 5 of the Criminal Code. …’

7.

ILVA is charged before the Danish courts with having failed –from May 2018 to January 2019 – to fulfil its obligations, under Article 5(1)(e), Article 5(2) and Article 6 of the GDPR, as controller in relation to the retention of personal data concerning its former customers.

8.

ILVA operates a chain of furniture shops and forms part of the Lars Larsen Group (‘the group’). The total group turnover in the 2016/2017 financial year amounted to 6.57 billion Danish kroner (DKK) (some EUR 881 million). Of that, the turnover of the subsidiary ILVA amounted to DKK 1.8 billion (some EUR 241 million).

9.

On the recommendation of the Datatilsynet (‘Data Protection Agency’, Denmark, which is the Danish data protection authority or the ‘supervisory authority’ under the GDPR), the Public Prosecutor claimed that a fine of DKK 1.5 million (some EUR 201000) should be imposed on ILVA. The turnover-related framework for calculating the amount of that fine is based not on the turnover of ILVA, but on the total turnover of the entire group.

10.

By judgment of 12 February 2021, the Retten i Aarhus (Aarhus District Court, Denmark) found ILVA guilty as charged, but ruled that it had acted negligently, contrary to what was alleged by the Public Prosecutor. That court ordered ILVA to pay a fine of DKK 100000 (some EUR 13400). Furthermore, according to that court, in so far as charges had been brought only against ILVA and not against the entire group, it was not necessary to take into account the turnover of that group in order to calculate the amount of the fine. It also pointed out that ILVA was engaged in an independent retail activity and that the group had not set up that subsidiary for the sole purpose of entrusting it with the processing of the group’s personal data.

11.

The Public Prosecutor brought an appeal against that judgment before the Vestre Landsret (High Court of Western Denmark), which is the referring court. That court seeks to ascertain whether the term ‘undertaking’ in Article 83(4) to (6) of the GDPR must be understood as meaning that, in order to set a fine in the event of an infringement of the GDPR by a company, it is necessary to have regard to the turnover of the group of which the company concerned forms part.

12.

The Public Prosecutor argues that that is the case. It maintains that it follows from recital 150 of the GDPR that that term must be understood in accordance with Articles 101 and 102 TFEU.

13.

ILVA, on the other hand, contends that, when setting a fine for an undertaking’s infringement of the GDPR, regard should not be had to the total turnover of the group of which the company forms part. In this specific case, charges have been brought only against ILVA, which is a subsidiary, and not against the parent company.

14.

The referring court considers that the answer to that question is not clear from the GDPR.

15.

In those circumstances, the Vestre Landsret (High Court of Western Denmark) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

16.

Written observations were submitted by ILVA and the European Commission. A hearing was held on 19 June 2024, at which both parties were represented.

17.

The backdrop to the specific provisions of the GDPR, which are relevant in the present case ( 4 ) and are applicable, in particular, to Denmark, is the fact that the Data Protection Agency cannot, in principle, impose any administrative fines for infringements of data protection legislation. The Data Protection Agency must instead turn in a police report if it finds it necessary. ( 5 ) The police then investigate and determine whether there are grounds for a formal charge. If so, the case is referred to the courts, which assess the case and determine the level of the fine.

18.

In my view, it is appropriate to consider the two questions together. By those questions, the referring court asks, in essence, whether the term ‘undertaking’ in Article 83(4) to (6) of the GDPR must be interpreted, in the light of recital 150 of that regulation, as meaning that it corresponds to the concept of ‘undertaking’ within the meaning of Articles 101 and 102 TFEU. That raises the question whether, in the context of imposing a fine for a GDPR infringement on a company, it is necessary to take into account the total annual turnover of the whole undertaking (the economic entity or group, in casu the Lars Larsen Group, that is, some EUR 881 million) of which the infringing company forms part, ( 6 ) and not just the total annual turnover of that company itself (ILVA, that is, some EUR 241 million).

19.

Article 83 of the GDPR provides the legal basis for the imposition of fines for infringements of that regulation. The GDPR contains no definition of the concept of ‘undertaking’ for enforcement purposes, but recital 150 of that regulation states that EU competition law principles should be used to interpret that concept. ( 7 )

20.

The Court has recently had an opportunity to interpret some (but not all) paragraphs of Article 83 of the GDPR and to touch upon certain issues which are related to the questions referred in the present case.

21.

In the judgment in Deutsche Wohnen, ( 8 ) the Court ruled, in particular, that ‘it is apparent from Article 83(4) to (6) of the GDPR, which concerns the calculation of administrative fines in respect of the infringements listed in those paragraphs, that, where the addressee of the administrative fine is or forms part of an undertaking, within the meaning of Articles 101 and 102 TFEU, the maximum amount of the administrative fine is calculated on the basis of a percentage of the total worldwide annual turnover in the preceding business year of the undertaking concerned’.

22.

The Court makes clear that the maximum amount of the administrative fine is based on the total worldwide annual turnover ( 9 ) of the ‘undertaking’, whereby that term must be understood in accordance with EU competition law (Articles 101 and 102 TFEU). The Court is thus noting that the EU legislature sought to form a bridge between the GDPR rules and the EU competition law rules, when setting the maximum amount of GDPR fines.

23.

Indeed, in that regard, Article 83(4) to (6) of the GDPR is similar to Article 23(2) of Regulation (EC) No 1/2003, ( 10 ) in so far as both set a statutory ceiling for fines under the respective regulations.

24.

The Court further developed its reasoning and addressed the conditions applicable to determining the amount of the administrative fine. The Court noted in the judgment in Deutsche Wohnen (paragraph 58) that ‘only an administrative fine determined on the basis of the actual or material economic capacity of the person on which it is imposed, and therefore imposed by the supervisory authority, relying, as regards the amount of that fine, on the concept of an economic unit within the meaning of the case-law, … [ ( 11 )] is capable of satisfying the three conditions set out in Article 83(1) of the GDPR, namely to be effective, proportionate and dissuasive’. Although the Court referred in this respect to a ‘person on which [the fine] is imposed’, thereby underlining the link between the fine and the person specifically charged with the GDPR infringement, further on the Court returned to the concept of ‘undertaking’ (‘economic unit’) under EU competition law.

25.

Furthermore, in paragraph 59 of that judgment, the Court held that ‘where a supervisory authority decides, by virtue of its powers under Article 58(2) of the GDPR, to impose on a controller, which is or forms part of an undertaking, within the meaning of Articles 101 and 102 TFEU, an administrative fine pursuant to Article 83 of that regulation, that authority is required to take as its basis, under Article 83 GDPR, read in the light of recital 150 of that regulation, when calculating administrative fines in respect of the infringements referred to in Article 83(4) to (6) of the GDPR, the concept of an “undertaking”, within the meaning of Articles 101 and 102 TFEU’. ( 12 )

26.

I conclude that it follows from the judgment in Deutsche Wohnen that, in a case where a GDPR infringement is committed by a controller or a processor that is (or forms part of) an undertaking, when setting the maximum amount of the fine, the reference to the total worldwide annual turnover of the ‘undertaking’ is understood in accordance with Articles 101 and 102 TFEU. However, it is not only the issue related to the maximum amount of the fine that can potentially be imposed on that controller or processor which is thereby clarified. What it also means is that the highly nuanced (and quite case-specific) case-law relating to the concepts of ‘undertaking’ and ‘economic unit’ becomes relevant, to a certain extent, also in order to set the conditions for determining the actual fine imposed for that specific GDPR infringement.

27.

In the following points, I will analyse the impact of the Deutsche Wohnen case-law in the specific context of the present case in order to propose a framework that should guide the referring court in determining ILVA’s fine.

28.

As indicated in points 25 and 26 above, it follows from the wording of Article 83 of the GDPR, read in the light of recital 150 of that regulation, and from the Deutsche Wohnen case-law that in cases where the controller or processor is (part of) an ‘undertaking’ within the meaning of Articles 101 and 102 TFEU, the overall turnover of such an undertaking as a whole should be used in order to determine the maximum amount of the fine.

29.

The Court’s competition case-law has determined that the term ‘undertaking’‘encompasses every entity engaged in an economic activity, regardless of the legal status of the entity and the way in which it is financed’. ( 13 )

30.

It also follows from the Court’s case-law that the term ‘undertaking’ in Articles 101 and 102 TFEU can refer to a single economic unit, even if that economic unit consists of several natural or legal persons. Whether several entities form such a unit depends largely on whether the individual entity is free in its decision-making ability or whether a leading entity, namely the parent company, exercises decisive influence over the others. The criteria for determining this are based on the economic, legal and organisational links between the parent company and its subsidiary, for example, the amount of the participation, personnel or organisational ties, instructions and the existence of company contracts. ( 14 )

31.

The case-law also makes clear that the actual exercise of decisive influence by a parent company over its subsidiary’s conduct may be inferred from a body of consistent evidence, even if some of that evidence, taken in isolation, is insufficient to establish the existence of such influence. ( 15 ) The Courts of the European Union relied in this respect, inter alia, on the parent company’s power to appoint the members of the various boards of directors of the subsidiary and the power to call shareholders to meetings and to propose the revocation of directors or of entire boards of directors of the subsidiary. ( 16 )

32.

It is settled case-law that, in the particular case in which a parent company holds, directly or indirectly, all or almost all of the capital in a subsidiary which has committed an infringement of the competition rules, the parent company is able to exercise decisive influence over the conduct of the subsidiary and there is a rebuttable presumption that the parent company does in fact exercise such influence. ( 17 )

33.

According to paragraph 2 of the order for reference, ILVA is part of the Lars Larsen Group. If the referring court were to find that the parent company of that group exercises decisive influence over ILVA, the ‘undertaking’ within the meaning of Article 83(5) of the GDPR would consist of: (i) the parent company of that group; (ii) ILVA; and (iii) any other company over which the parent company also exercises decisive influence. The latter category potentially includes the other companies in the Lars Larsen Group.

34.

‘Turnover’ is expressly referred to in Article 83(4) to (6) of the GDPR in the context of calculating the maximum amount of the fine that could be imposed on companies. That maximum amount concerns very large companies, since the limit does not apply if the fine is lower than the absolute amount cited in those three paragraphs of Article 83, namely EUR 10 million or EUR 20 million. The ceiling set on the basis of turnover is therefore only relevant for companies with a total worldwide turnover of more than EUR 500 million. ( 18 )

35.

It follows that, if the referring court were to find that the parent company of the Lars Larsen Group exercises decisive influence over ILVA, then, in an abstract way, the maximum amount of the fine to be imposed in the main proceedings is to be calculated on the basis of a percentage of the total worldwide annual turnover in the preceding business year of the undertaking concerned, that is, the Lars Larsen Group (of which ILVA forms part).

36.

The issue of establishing the maximum amount of the fine, as envisaged by the EU legislature in Article 83(4) to (6) of the GDPR, should neither be confused nor conflated with the subsequent task of a supervisory authority, ( 19 ) that is, to determine the actual fine to be imposed for the specific GDPR infringement(s) in question.

37.

For that purpose, first, it should be noted that paragraph 1 of Article 83 of the GDPR sets out three key conditions ( 20 ) that must be observed by the supervisory authority. Each of those conditions requires an individual balancing of all the elements of the infringement in question and of the appropriate actual fine to be imposed. Further, paragraph 2 of Article 83 obliges that authority to comply with a number of requirements so as to decide ‘whether to impose an administrative fine and [what] the [appropriate] amount of the [actual] administrative fine [is]’. Therefore, in order to understand fully the application of Article 83(4) to (6) of the GDPR in the context of setting the actual fine in an individual case, those paragraphs must be read in conjunction with Article 83(1) as well as Article 83(2) of that regulation. The latter, more importantly, lists specific factors that a supervisory authority must take into account when determining the actual amount of the fine in a given case.

38.

The very wording of paragraph 2 of that article requires due regard to be given to multiple elements of ‘each individual case’ whilst, at the same time, leaving it to the supervisory authority to identify those specific elements which are pertinent to the case before it and to establish their relevance for the purpose of setting the actual fine. ( 21 )

39.

Contrary to Article 83(4) to (6) of the GDPR (see point 34 of the present Opinion), Article 83(2) thereof, or Article 83(1) or Article 83(3) thereof, for that matter, ( 22 ) contains no reference to the turnover of the undertaking. It follows that the EU legislature made a choice not to include ‘turnover’ as a specific factor for determining the actual fine. Instead, Article 83(2) lists other factors ( 23 ) that characterise the behaviour of a controller or processor which is charged with an infringement, in order to ensure that each infringement is assessed on the basis of all relevant individual circumstances. In my view, it can be inferred from the foregoing that the EU legislature sought to distinguish between the factors that form the basis for determining the maximum amount of the fine (step 1) and the list of requirements that are binding on the supervisory authority when it is setting the actual fine (step 2).

40.

In that connection, I would point out that the Court has emphasised that ‘a penalty, even of a non-criminal nature, cannot be imposed unless it rests on a clear and unambiguous legal basis’. ( 24 ) That is a fortiori the case in criminal law proceedings such as those in the present case. The Court’s case-law refers to ‘the principle of legality [which] requires legislation to define clearly offences and the penalties which they attract … [and] the criteria for assessing the clarity of the law under the case-law of the European Court of Human Rights [(ECtHR)]’. ( 25 )

41.

In that regard, the Commission argues, in essence, that, in the present case, the GDPR implies that not only must the maximum amount of the fine be based on the turnover of the undertaking to which the company belongs, but so must the calculation of the actual fine. However, the considerations that have been laid out in points 37 to 40 of the present Opinion do not permit the conclusion that Article 83(1) to (6) of the GDPR is to be interpreted as meaning that the rules for establishing the maximum amount of the fine (step 1) must also be used as the main or only reference for setting the actual fine (step 2).

42.

Second, as part of the spillover effect from forming a bridge between the two fields of law, the need to distinguish between the maximum amount of a fine (step 1) and the actual fine (step 2) can also be inferred from EU competition law. Indeed, in EU competition law, as far as the maximum amount of the fine is concerned, similar to Article 83 of the GDPR, the Commission uses the turnover for the purpose of calculating the maximum amount of the fine (which is set at 10% of the total turnover of the undertaking per infringement). However, it is important to point out that the basic fine itself is not determined on the basis of the turnover. ( 26 )

43.

Instead, the basic fine is determined, in essence, as a percentage of the value of relevant sales (which are directly or indirectly related to the competition infringement) multiplied by duration (years or periods of less than one year), plus 15 to 25% of the value of relevant sales (as an additional deterrence for cartels). That basic fine is then increased by way of aggravating factors or decreased by way of mitigating factors. That amount is then subject to the overall cap of 10% of turnover (there is a further possibility, where applicable, to decrease the fine on the basis of leniency, settlement and/or inability to pay). That clearly shows that it is the factors directly characterising the infringement (such as the relevant sales, the duration of the infringement and the specific circumstances characterising the case) which play a central role when setting the actual fine, and not the total worldwide annual turnover.

44.

As has already been pointed out by legal commentators, ‘there is no direct read-across from the fining methodology used by the Commission in respect of Articles 101 [and] 102 TFEU to the GDPR, as EU competition fines seek to capture the effect of the [anticompetitive] conduct on the market concerned rather than look at turnover per se. For example, in respect of cartels, the fines are based upon the value of sales relating to the “cartelised product” rather than global turnover’. ( 27 )

45.

Indeed, the Court’s case-law confirms that the proportion of the overall turnover deriving from the sale of products in respect of which the infringement was committed (that is, ‘the value of sales’) is best able to reflect the economic importance of that infringement. ( 28 ) By contrast, what the concept of ‘turnover’ under the GDPR seeks to reflect is the economic importance of the undertaking. ( 29 ) These two approaches may not be conflated as they serve different objectives: the former seeks to assess the gravity of the infringement, while the latter seeks to evaluate the economic importance of the undertaking.

46.

Thus, the foregoing considerations and the Court’s case-law (cited in point 40 of the present Opinion) lead me to conclude that the principle of legality must frame the limits of the impact of EU competition case-law on the imposition of actual fines for GDPR infringements. In particular, it must be ensured that the actual GDPR fines are calculated solely in relation to the acts of the perpetrator and take fully into account all the characteristics of the specific infringement. Therefore, the interpretation of the concepts of ‘turnover’ and ‘undertaking’ when setting the maximum amount of the fine cannot automatically be grafted onto the calculation of the actual fine.

47.

For a fine to meet the objective of the GDPR – to strengthen the enforcement of the rules of that regulation – and in the light of the Court’s case-law discussed above, the interpretation of the terms ‘undertaking’ and ‘turnover’ when setting the amount of the actual fine should comply with the following requirements. In the process of determining the actual fine, the supervisory authority must, first, take as a basis all the individual circumstances of that specific case, as required by Article 83(2) of the GDPR, including the relationship within the ‘undertaking’ as determined by the EU competition case-law. Second, as a result of the balancing of all the relevant circumstances, the actual fine must be effective, proportionate and dissuasive. Lastly, yet importantly, where appropriate, aspects of criminal law relevant to the case must be respected.

48.

In order to meet those requirements, I would like to recall the following points.

49.

As has been observed by Advocate General Pitruzzella, ( 30 ) in EU law the concept of ‘undertaking’ has a meaning and scope defined by the legislative framework and the various objectives pursued by that legislation. In EU competition law, there are two aspects to the functional nature of the concept of ‘undertaking’. In the first place, that concept focuses on the type of activity performed rather than on the characteristics of the actors which perform it. Competition consists of and is influenced by economic activities. For that reason, Articles 101 and 102 TFEU refer in general terms to ‘undertakings’, omitting any mention of their legal structure. In the second place, the classification of an activity as economic – and therefore of an entity as an ‘undertaking’ – for the purposes of EU competition law depends on the context examined. Similarly, the identification of the entities within the scope of the ‘undertaking’ depends on the subject matter of the contested infringement.

50.

These observations rightly point out that, in EU competition law, primacy is given to economic concerns, disregarding the legal structures of the entity in question. Having said that, the second aspect limits that view to the effect that the identification of the entity or person liable for the infringement and, consequently, the actual fine depends on the contested infringement itself.

51.

Consequently, one of the elements characterising the term ‘undertaking’ that should be considered in determining the basic fine and its adjustment (in order to set the actual fine) is the level of participation of other companies of that undertaking in the GDPR infringement. In that regard, it has been argued in national case-law relating to EU competition law that ‘conceptually, the question as to the existence of an “undertaking” and the question as to the attribution of liability between different companies within an “undertaking” are distinct … [ ( 31 )] [and] a person is not ipso facto liable for an infringement of Article 101 [TFEU] by reason only of the fact that he, she or it is a member of an undertaking responsible as a matter of EU law for the infringement, in circumstances where the person in question neither participated in the infringement nor had decisive influence over the conduct in the relevant market of other member(s) of the undertaking who did participate. … [I]n such circumstances it may well be unlikely that the person in question would in fact be held to be part of that “undertaking”’. ( 32 )

52.

In my view, the above arguments are also relevant when considering which persons fall under the concept of ‘undertaking’ in order to determine the actual fine for the infringement of the GDPR. That is particularly the case when the supervisory authority has explicitly established that the parent company was not involved as controller or processor in the infringement in question, ( 33 ) as is the case in the main proceedings.

53.

Even though the EU legislature has, to a certain limited extent, formed a bridge between the two fields of EU law for the purpose of setting maximum fines, the GDPR rules and EU competition rules clearly pursue different objectives. The regulatory scheme of the GDPR is different from that of EU competition rules and is based on the concept of the responsibility of the controller (and processor) for the lawful processing of personal data. In other words, while EU competition law is directed at ‘undertakings’ (it expresses its prohibition by reference to an ‘undertaking’), the GDPR focuses on ‘controllers’ and ‘processors’. I also recall that, since the doctrine of ‘economic unit’ cannot be detached from the broad logic of EU competition law and its object, the Court has previously refused to extend its application by analogy to other areas of EU law, for example to non-contractual liability based on the second paragraph of Article 340 TFEU. ( 34 )

54.

Bearing in mind those considerations, it becomes apparent why the Court has clearly narrowed down the implications of EU competition law for GDPR enforcement (and GDPR fines, in particular). In the judgment in Deutsche Wohnen (paragraph 53), the Court ruled that the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, ‘has no bearing on whether and under what conditions an administrative fine may be imposed pursuant to Article 83 of the GDPR on a controller who is a legal person, since that question is exhaustively regulated by Article 58(2) and Article 83(1) to (6) of that regulation’. It continued by observing (in paragraph 54) that that concept is ‘relevant only for the purpose of determining the amount of the administrative fine imposed under Article 83(4) to (6) of the GDPR [which deals with the maximum fine] on a controller’ (emphasis added). Moreover, by ruling (in paragraph 53) that the question whether, and under what conditions, an administrative fine may be imposed ‘is exhaustively regulated by Article 58(2) and Article 83(1) to (6) of that regulation’ (emphasis added), the Court has further clarified that, when determining the actual fine, the requirements of Article 83(1) to (6) have to be applied in their entirety and none of those paragraphs is primus inter pares.

55.

Therefore, the ‘turnover’ of the ‘undertaking’ is only one of the multiple elements that must be considered when enforcing the responsibility of a controller (or a processor) and imposing a GDPR fine that is effective, proportionate and dissuasive.

56.

It is true that the Court’s case-law indicates that, in EU competition law, in certain situations, taking account of a company’s turnover may be justified – but only as one relevant element among others – when calculating the amount of the actual fine (for instance, when increasing the basic fine for the purposes of deterrence). ( 35 )

57.

Therefore, to my mind, it should be possible to rely on the concept of ‘undertaking’ within the meaning of Articles 101 and 102 TFEU when fixing the actual fine, but only where this is duly justified for the purposes of the dissuasiveness and effectiveness of the fine. Indeed, in that respect, the use of that concept must be nuanced and individualised in each given case. More specifically, it may be used as an adjustment mechanism when considering the specific circumstances of an individual case once the fine in accordance with Article 83(2) of the GDPR has been established. It is therefore incumbent on the referring court to determine whether, in the present case, circumstances exist which would justify increasing the fine in such a manner, in particular, for the purposes of deterrence.

58.

The issue of the individualisation of GDPR fines ( 36 ) has also been addressed by the European Data Protection Board (EDPB). ( 37 ) In its guidelines on the calculation of GDPR fines, ( 38 ) drawn up pursuant to Article 70(1)(k) of the GDPR, the EDPB seeks to standardise the fining power of the supervisory authorities under the GDPR across the European Union. In particular, the EDPB states that it considers ‘three elements to form the starting point for further calculation: the categorisation of infringements by nature under [Article 83(4) to (6) of the] GDPR, the [gravity] of the infringement … and the turnover of the undertaking as one relevant element to take into consideration with a view to imposing an effective, dissuasive and proportionate fine, pursuant to Article 83(1) [of the] GDPR’. Whilst it is true that they are not binding on the Court, these considerations show that only a comprehensive approach that embraces all the elements relevant to a specific case can ensure that the fine meets the key requirements under Article 83 of that regulation, in particular that the actual fine imposed be effective, proportionate and dissuasive.

59.

Consequently, for the purpose of determining the amount of the actual fine, I invite the Court to consider that the following aspects should be pertinent when applying the concept of ‘undertaking’ in the context of setting the actual fine under Article 83 of the GDPR. First, it should be evaluated whether the parent company has exercised its decision-making power with respect to specific activities of the controller or the processor at issue in the GDPR infringement(s). Second, it needs to be considered whether specific data processing infringing the GDPR relates to the company concerned and/or to the whole group. Third, it is necessary to establish whether more than one company forming part of the group was involved in the GDPR infringement(s).

60.

In that regard, I would point out that the following non-exhaustive list of elements is relevant: (i) in the present case ( 39 ) – contrary to the case which gave rise to the judgment in Deutsche Wohnen – it appears that the Lars Larsen Group and/or its parent company was not involved in the criminal proceedings; (ii) the charges were brought only against ILVA and not against the group; ( 40 ) and (iii) the GDPR infringement in the main proceedings was limited only to ILVA’s customers and their data, and there was no suggestion that the infringement was carried out at the level of the group itself or that ILVA’s processing was linked to the other companies in the group. It should be stressed that in the case which gave rise to the judgment in Deutsche Wohnen, the ‘company concerned’ assumed all responsibility for the data processing, that is, also for the data processing of the other companies in the group. ( 41 )

61.

It is, however, for the referring court – which alone has jurisdiction to rule on the facts – to carry out the necessary verifications in that respect and to consider those elements as well as the relevance and weight that should be given to them in the context of setting the appropriate amount of ILVA’s actual fine.

62.

Although the referring court has not submitted any questions in that regard, I consider that – in order to give that court a complete answer – it is appropriate to address briefly certain specific aspects of the present case.

63.

The interpretation of Article 83(1) to (6) in the case in the main proceedings must be carried out, in particular, in conjunction with Article 83(9) of the GDPR ( 42 ) – a matter that was not addressed by the Court in the judgment in Deutsche Wohnen. ( 43 ) Therefore, the regime for the setting of an appropriate actual fine under Article 83 of the GDPR must, in the present case, be interpreted in a manner which is consistent with the essential guarantees of a criminal law trial.

64.

In the context of analysing the impact of Article 83(9) on the present case, it is necessary also to take account of recital 151 of the GDPR, according to which ‘the legal systems of Denmark and Estonia [ ( 44 )] do not allow for administrative fines as set out in this Regulation’. The recital, further, provides guidance on the compatibility of different procedures with the three key conditions for the actual fine under the GDPR regime, that is, that ‘in any event, the fines imposed should be effective, proportionate and dissuasive’. Therefore, it is relevant to address briefly the impact of EU law on fines imposed in criminal proceedings in order to ensure that those three conditions are met also in a specific case such as this one.

65.

At the hearing, ILVA relied, on the one hand, on Article 41 of the Charter of Fundamental Rights of the European Union (‘the Charter’). That article is entitled ‘Right to good administration’ and, in particular, Article 41(2)(c) points out ‘the obligation of the administration to give reasons for its decisions’, but ILVA has not made any specific arguments in that regard.

66.

On the other hand, ILVA also referred to Article 49 of the Charter. Indeed, I consider that, in interpreting Article 83(1) to (6) of the GDPR, account should be taken of that article of the Charter, which is entitled ‘Principles of legality and proportionality of criminal offences and penalties’ and thus is relevant to the case in the main proceedings. Article 49(3) of the Charter states, in particular, that ‘the severity of penalties must not be disproportionate to the criminal offence’.

67.

Indeed, it follows from the Court’s case-law that the principle of proportionality is one of the general principles of EU law underlying the constitutional traditions common to the Member States which must be observed by national authorities when they are applying or implementing EU law. It requires the Member States to adopt measures that are appropriate for attaining the objectives pursued and do not go beyond what is necessary for attaining them. ( 45 )

68.

The severity of a penalty must thus correspond to the gravity of the offence concerned, that requirement following both from Article 52(1) of the Charter and from the principle of proportionality of penalties in Article 49(3) of the Charter. ( 46 )

69.

It follows from the Explanations relating to the Charter ( 47 ) that, under Article 52(3) of the Charter, in so far as the right guaranteed by Article 49 of the Charter also corresponds to a right guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms signed at Rome on 4 November 1950 (‘the ECHR’), its meaning and scope are the same as those laid down by the ECHR. Consequently, the requirements of the ECtHR concerning the proportionality of penalties apply to a case such as that in the main proceedings by the combined effect of Article 17(1), Article 51(1) and Article 52(1) and (3) of the Charter. ( 48 )

70.

The case-law of the Court makes clear that the principle of proportionality requires, first, that the penalty imposed correspond to the gravity of the offence and, second, that the individual circumstances of the particular case are taken into account in determining the penalty and fixing the amount of the fine. ( 49 ) As regards that second element, the case-law stresses that the referring court is required to take into account objective criteria such as the gravity and duration of the infringement as well as any aggravating and mitigating circumstances, in order to ensure that the fine is effective, proportionate and dissuasive. ( 50 )

71.

Second, the ECtHR case-law in such cases proceeds to weigh up the various interests at stake and takes account of the nature, severity and chilling effect of the applicant’s criminal penalty. It makes clear that the obligation on States to impose criminal law and attribute punishment ( 51 ) in order to protect the public ( 52 ) gives rise to a corresponding obligation to ensure that the punishment imposed is not excessive.

72.

The ECtHR has held that the ‘requisite balance will not be struck where the person concerned bears an individual and excessive burden’; thus ‘a financial liability arising out of a fine may undermine the guarantee afforded by that provision if it places an excessive burden on the person or fundamentally interferes with his or her financial position’. ( 53 )

73.

It follows that the specific procedural aspects of the case in the main proceedings, and EU law and ECtHR case-law in relation to fines imposed in criminal proceedings, require the referring court to take into account all the relevant elements of the case when setting the actual fine for infringements of the GDPR. Procedural guarantees of a person accused as well as the principle of proportionality, as interpreted in the case-law of the Court of Justice and the ECtHR, require penalties to correspond to the gravity of the offence and require that the individual circumstances of the particular case be taken into account.

74.

In the light of those requirements, the referring court must ensure that the principle of proportionality is observed in the setting of the actual fine, whereby a fair balance is struck between the demands of the general interest of the community in protecting personal data and the requirements of the protection of the fundamental rights ( 54 ) of the controller, the processor or the undertaking of which it forms part.

75.

I propose that the Court answer the questions referred for a preliminary ruling by the Vestre Landsret (High Court of Western Denmark, Denmark) as follows:

Article 83(4) to (6) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as meaning that, where fines are imposed on a controller or processor that is (or forms part of) an undertaking, the concept of ‘undertaking’ must be interpreted as meaning that it corresponds to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, for the purpose of setting the maximum amount of the fine. Hence, the total annual worldwide turnover of the undertaking of which the controller or processor forms part is taken into account.

However, when determining the actual fine to be imposed, the concept of ‘undertaking’ must be interpreted in conjunction with Article 83(1) and (2) of Regulation 2016/679 and used as one relevant element among others when considering the specific circumstances of the individual case. In that connection, specific circumstances may relate to the decision-making power of the parent company, the scope of data processing that infringes the rules of that regulation and the number of entities of the undertaking involved in the infringement.

Moreover, where such a fine is imposed, in conjunction with Article 83(9) of Regulation 2016/679, by a national court in the context of criminal proceedings, the actual fine must be assessed in the light of principles which are applicable in criminal law. In that context, the national court must ensure that the principle of proportionality is observed in the setting of the actual fine, whereby a fair balance is struck between the demands of the general interest of the community in protecting personal data and the requirements of the protection of the fundamental rights of the controller, the processor or the undertaking of which it forms part.