Decision 01/2022 on the dispute arisen on the draft decision
of the French Supervisory Authority regarding Accor SA
under Article 65(1)(a) GDPR
Adopted on 15 June 2022
adopted 1
Table of contents
1 Summary of THE DISPUTE ............................................................................................................... 4
2 Conditions for adopting a binding decision..................................................................................... 7
2.1 Objection expressed by a CSA in relation to a draft decision ................................................. 7
2.2 The LSA does not follow the relevant and reasoned objection to the draft decision............. 8
2.3 Conclusions on the competence of the EDPB ......................................................................... 8
3 The Right to good administration.................................................................................................... 8
4 Structure of the binding decision .................................................................................................... 9
5 On the corrective measures - in particular, the calculation of the administrative fine .................. 9
5.1 Analysis by the LSA in the Draft Decision ................................................................................ 9
5.2 Summary of the objection raised by the PL SA ..................................................................... 11
5.3 Position of the LSA on the objection ..................................................................................... 12
5.4 Analysis of the EDPB.............................................................................................................. 12
5.4.1 Assessment of whether the objection is relevant and reasoned.................................. 13
5.4.2 Assessment on the merits ............................................................................................. 14
6 Binding Decision ............................................................................................................................ 20
7 Final remarks ................................................................................................................................. 20
adopted 2
The European Data Protection Board
Having regard to Article 63 and Article 65(1)(a) of the Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC
(hereinafter “GDPR”)1,
Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended
by the Decision of the EEA joint Committee No 154/2018 of 6 July 20182,
Having regard to Article 11 and Article 22 of its Rules of Procedure3,
Whereas:
(1) The main role of the European Data Protection Board (hereinafter the “EDPB”) is to ensure the
consistent application of the GDPR throughout the European Economic Area (hereinafter the ‘’EEA’’).
To that effect, it follows from Article 60 GDPR that the lead supervisory authority (hereinafter the
“LSA”) shall cooperate with the other supervisory authorities concerned (hereinafter the “CSAs”) in an
endeavour to reach consensus, that the LSA and CSAs shall exchange all relevant information with each
other, and that the LSA shall, without delay, communicate the relevant information on the matter to
the other supervisory authorities concerned. The LSA shall without delay submit a draft decision to the
other CSAs for their opinion and take due account of their views.
(2) Where any of the CSAs expressed a reasoned and relevant objection (“RRO”) on the draft decision
in accordance with Article 4(24) GDPR and Article 60(4) GDPR and the LSA does not intend to follow
the RRO or considers that the objection is not reasoned and relevant, the LSA shall submit this matter
to the consistency mechanism referred to in Article 63 GDPR.
(3) Pursuant to Article 65(1)(a) GDPR, the EDPB shall issue a binding decision concerning all the matters
which are the subject of RROs, in particular whether there is an infringement of the GDPR.
(4) The binding decision of the EDPB shall be adopted by a two-thirds majority of the members of the
EDPB, pursuant to Article 65(2) GDPR in conjunction with Article 11(4) of the EDPB Rules of Procedure,
within one month after the Chair and the competent supervisory authority have decided that the file
is complete. The deadline may be extended by a further month, taking into account the complexity of
the subject-matter upon decision of the Chair on its own initiative or at the request of at least one
third of the members of the EDPB.
(5) In accordance with Article 65(3) GDPR, if, in spite of such an extension, the EDPB has not been able
to adopt a decision within the timeframe, it shall do so within two weeks following the expiration of
the extension by a simple majority of its members.
(6) In accordance with Article 11(6) of the EDPB Rules of Procedure, only the English text of the binding
decision of the EDPB is authentic as it is the language of the EDPB adoption procedure.
1
OJ L 119, 4.5.2016, page 1.
2
References to “Member States” made throughout this decision should be understood as references to “EEA
Member States”.
3
EDPB Rules of Procedure, adopted on 25 May 2018, as last modified and adopted on 6 April 2022.
adopted 3
HAS ADOPTED THE FOLLOWING BINDING DECISION
1 SUMMARY OF THE DISPUTE
1. This document contains a binding decision adopted by the EDPB in accordance with
Article 65(1)(a) GDPR. The decision concerns the dispute arisen following a draft decision (hereinafter
“Draft Decision”) issued by the French supervisory authority (“Commission Nationale de l'Informatique
et des Libertés", hereinafter the “FR SA”, also referred to in this document as the “LSA”) and the
subsequent objection expressed by one supervisory authority concerned or “CSA”, namely the Polish
supervisory authority (“Urząd Ochrony Danych Osobowych”, hereinafter the “PL SA”). The Draft
Decision at issue relates to a complaint-based inquiry commenced by the FR SA (hereinafter, the
‘’Inquiry’’), concerning whether ACCOR SA (hereinafter, “ACCOR”), a company operating in the
hospitality sector, complies with its obligations under the GDPR. This Inquiry followed several
complaints that had been lodged against ACCOR with the FR SA, as well as with the following
complaint-receiving supervisory authorities: the PL SA, the Spanish supervisory authority (‘’Agencia
Española de Protección de Datos’’, hereinafter the “ES SA”), the Lower Saxony supervisory authority
(‘’Landesbeauftragte für den Datenschutz Niedersachen’’, hereinafter ‘’DE-NI SA’’), the Saarland
supervisory authority (‘’Unabhängiges Datenschutzzentrum Saarland’’, hereinafter the ‘’DE-SL SA’’)
and the United Kingdom supervisory authority (‘Information Commissioner’s Office’’, hereinafter the
‘’UK SA’’)4.
2. Between November 2018 and December 2019, the FR SA received 11 complaints against ACCOR. These
complaints concerned a failure to take into account the right to object to the receipt of marketing
messages by mail and/or difficulties encountered in exercising the right of access5.
3. Upon receipt of these complaints, the FR SA qualified the activities falling within the scope of the
above-mentioned complaints as cross-border processing in accordance with Article 4(23) GDPR. As the
main establishment of ACCOR (as defined in Article 4(16) GDPR) was found to be in France, the FR SA
was identified as being the LSA, within the meaning of the GDPR, in respect of the cross-border
processing carried out by ACCOR6 ,7.
4
Note: Paragraph 5 of the Draft Decision mistakenly refers to this complaint as having been lodged with the Irish
supervisory authority.
5
Draft Decision, paragraphs 3 and 5.
6
Draft decision, paragraph 3.
7
The following supervisory authorities were identified as CSAs: the Austrian supervisory authority,
(“Österreichische Datenschutzbehörde“), the Belgian supervisory authority, (“Autorité de la protection des
données - Gegevensbeschermingsautoriteit (APD-GBA)”), the Bulgarian supervisory authority (“Commission for
Personal Data Protection“), the Croatian supervisory authority (“Croatian Personal Data Protection Agency“), the
Czech supervisory authority (“Office for Personal Data Protection“), the Danish supervisory authority
(“Datatilsynet“), the Estonian supervisory authority (“Estonian Data Protection Inspectorate (Andmekaitse
Inspektsioon)), the Greek supervisory authority (“Hellenic Data Protection Authority”), the Irish supervisory
authority (“Data Protection Commission“), the Italian supervisory authority (“Garante per la protezione dei dati
personali”), the Latvian supervisory authority (“Data State Inspectorate”), the Lithuanian supervisory authority
(“State Data Protection Inspectorate”), the Luxembourgish supervisory authority (“Commission Nationale pour
la Protection des Données”), the Dutch supervisory authority (“Autoriteit Persoonsgegevens”), the Polish
supervisory authority (“Urząd Ochrony Danych Osobowych”), the Portuguese supervisory authority (“Comissão
Nacional de Proteção de Dados”), the Romanian supervisory authority (“The National Supervisory Authority for
Personal Data Processing”), the Slovakian supervisory authority (“Office for Personal Data Protection of the
adopted 4
4. The following table presents a summary of the timeline of the events leading to the submission of the
matter to the consistency mechanism:
November 2018 - The FR SA received eleven complaints, against ACCOR, a company
December 2019 established in France. Five of these complaints were transmitted to
the FR SA from the following complaint-receiving SAs: DE-NI SA, DE-
SL SA, ES SA, UK SA and PL SA.
23 December 2019 After the investigation, the FR SA submitted a first draft decision
pursuant to Article 60(3) GDPR to the CSAs, to which several of them
raised objections. Following this, the FR SA decided to halt the Article
60 procedure in question in order to further investigate the matter8.
11 and 24 February To further investigate the matter, the FR SA made an inspection at
2020 ACCOR’s premises on 11 February 2020 and an online inspection was
carried out on 24 February 20209.
February - August 2020 On various dates, ACCOR sent additional information to the FR SA by
letters10.
24 November 2020 The rapporteur appointed by the FR SA delivered her report11, which
was sent to ACCOR12.
Slovak Republic“), the Slovenian supervisory authority (“Information Commissioner of the Republic of Slovenia”),
the Spanish supervisory authority (“Agencia Española de Protección de Datos’’), the Swedish supervisory
authority (“Integritetsskyddsmyndigheten”), supervisory authority of Baden-Württemberg (“Der
Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg“), supervisory
authority of Bavaria (non-public sector) (“Bayerisches Landesamt für Datenschutzaufsicht”), supervisory
authority of Berlin (“Berliner Beauftragte für Datenschutz und Informationsfreiheit), supervisory authority of
Brandenburg (“Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg“),
supervisory authority of Bremen (“Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien
Hansestadt Bremen“), supervisory authority of Hamburg (“Der Hamburgische Beauftragte für Datenschutz und
Informationsfreiheit“), supervisory authority of Hesse (“Der Hessische Beauftragte für Datenschutz und
Informationsfreiheit“), supervisory authority of Lower Saxony (“Die Landesbeauftragte für den Datenschutz
Niedersachsen), supervisory authority of Mecklenburg-Western Pomerania (“Der Landesbeauftragte für
Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern“), supervisory authority of North Rhine-
Westphalia (“Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen“), supervisory
authority of Rhineland-Palatinate (“Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit
Rheinland-Pfalz”), supervisory authority of Saarland (“Unabhängiges Datenschutzzentrum Saarland
Landesbeauftragte für Datenschutz und Informationsfreiheit“), supervisory authority of Saxony (“Die Sächsische
Datenschutzbeauftragte“), supervisory authority of Saxony-Anhalt (“Landesbeauftragter für den Datenschutz
Sachsen-Anhalt“), supervisory authority of Schleswig-Holstein (“Unabhängiges Landeszentrum für Datenschutz
Schleswig-Holstein“) and supervisory authority of Thuringia (“Thüringer Landesbeauftragter für den Datenschutz
und die Informationsfreiheit“).
8
Draft Decision, paragraphs 6-8.
9
Draft Decision, paragraph 9.
10
Ibid.
11
Report proposing the imposition of a sanction on the company ACCOR, (hereinafter, the “Report’’).
12
Draft Decision, paragraph 11-12.
adopted 5
22 December 2020 ACCOR sent the FR SA its written comments on the report of the
rapporteur of the FR SA13.
28 January 2021 ACCOR presented oral observations on the report of the rapporteur
before the FR SA14.
30 April 2021 The FR SA shared a new Draft Decision with the CSAs in accordance
with Article 60(3) GDPR.
28 May 2021 The PL SA raised three objections in accordance with
Article 60(4) GDPR (hereinafter, the “PL SA objections”).
21 October 2021 The rapporteur appointed by the FR SA delivered an addendum15 to
her report following the submission of the PL SA objections.
22 October 2021 The FR SA communicated both the PL SA objections and the
Addendum of the rapporteur to ACCOR.
27 October 2021 At the request of ACCOR, the FR SA shared the Draft Decision with
ACCOR.
29 November 2021 ACCOR sent the FR SA its written observations16 on the PL SA
objections.
13 January 2022 The FR SA adopted the “Deliberation of the Restricted Committee n°
SAN-2022-001” regarding ACCOR in which it provides its views on the
PL SA objections and explains why it decided not to follow them17.
5. On 18 February 2022, the FR SA triggered the dispute resolution process via the information and
communication system mentioned in Article 17 of the EDPB Rules of Procedure, namely the Internal
Market Information System (IMI). Following the submission by the LSA of the matter at hand to the
EDPB in accordance with Article 60(4) GDPR, the EDPB Secretariat assessed the completeness of the
file on behalf of the Chair in line with Article 11(2) of the EDPB Rules of Procedure. On 22 February
2022 the EDPB Secretariat confirmed to the FR SA the reception of the file.
6. On the same date, 22 February 2022, the PL SA informed the FR SA of the withdrawal of one of its
three objections. The FR SA communicated this information to the EDPB Secretariat on 23 March 2022.
13
Draft Decision, paragraph 13; The company ACCOR SA's written comments, 22 December 2020, (hereinafter,
‘’ACCOR’s December 2020 observations”).
14
Draft Decision, paragraph 14; The company ACCOR SA’s hearing transcript during the session of the CNIL’s
restricted committee of 28 January 2021 (hereinafter “ACCOR’s January 2021 observations”).
15
Addendum of 21 October 2021 to the report proposing a sanction against ACCOR (hereinafter, the
“Addendum’’).
16
ACCOR SA's written observations, 29 November 2021, (hereinafter, “ACCOR’s November 2021 observations’’).
17
Deliberation of the Restricted Committee n° SAN-2022-001 regarding the company ACCOR SA, 13 January
2022, (hereinafter, the ‘’Deliberation on the PL SA objections’’).
adopted 6
7. On 15 March 2022, the EDPB Secretariat contacted the FR SA to request additional documents and
information. Following this request, the FR SA submitted additional information to the EDPB
Secretariat on 22 and 23 March 2022 and underlined that more information would follow.
8. On 25 March 2022, the PL SA confirmed to the EDPB Secretariat that there was no longer a dispute
with regard to one of the two remaining objections.
9. On 11 April 2022, the FR SA submitted 17 additional documents on IMI.
10. On 22 April 2022, the EDPB Secretariat contacted the FR SA to ask some follow up questions regarding
the completeness of the file to which the FR SA replied on 26 April 2022.
11. On 27 April 2022, after the FR SA and the Chair of the EDPB confirmed the completeness of the file,
the EDPB Secretariat, on behalf of the Chair, circulated the file to all the Members of the EDPB.
12. A matter that was specifically scrutinised by the EDPB Secretariat concerned the right to be heard, as
required by Article 41(2)(a) of the Charter of Fundamental Rights. On 15 March 2022, the EDPB
Secretariat contacted the FR SA in order to confirm, inter alia, whether ACCOR had been given the
opportunity to exercise its right to be heard regarding documents that were submitted to the EDPB for
making its decision. Additionally, on 29 April 2022, the Chair of the EDPB contacted ACCOR in order to
offer it the opportunity to exercise its right to be heard with respect to the dispute before the EDPB.
ACCOR provided its views on 13 May 202218. Further details on this matter are provided in Section 3
below.
13. The Chair decided, in compliance with Article 65(3) GDPR in conjunction with Article 11(4) of the EDPB
Rules of Procedure, to extend the default timeline for adoption of one month by a further month on
account of the complexity of the subject-matter of the present dispute.
2 CONDITIONS FOR ADOPTING A BINDING DECISION
14. The general conditions for the adoption of a binding decision by the EDPB are set forth in Article 60(4)
and Article 65(1)(a) GDPR19.
2.1 Objection expressed by a CSA in relation to a draft decision
15. The EDPB notes that the PL SA raised, and submitted through the IMI, an objection to the Draft Decision
concerning the amount of the fine that the FR SA proposed to impose against ACCOR. The objection
was raised pursuant to Article 60(4) GDPR and within the deadline provided therein.
16. The Portuguese supervisory authority (“Comissão Nacional de Proteção de Dados”), provided
comments on the Draft Decision. As these comments are not per se objections within the meaning of
Article 4(24) GDPR, they cannot trigger the dispute resolution mechanism of Article 65(1)(a) GDPR and
therefore, are not part of the scope of the present binding decision of the EDPB20.
18
Observations of ACCOR SA, 13 May 2022, (hereinafter, “ACCOR’s May 2022 observations’’).
19
According to Article 65(1)(a) of the GDPR, the EDPB shall issue a binding decision when a supervisory authority
concerned has raised a relevant and reasoned objection to a draft decision of the LSA and the LSA has not
followed the objection or the LSA has rejected such an objection as being not relevant or reasoned.
20
See EDPB Guidelines 3/2021 on the application of Article 65(1)(a) GDPR, (hereinafter, “Guidelines on Art.
65(1)(a)”), paragraph 17.
adopted 7
2.2 The LSA does not follow the relevant and reasoned objection to the draft decision
17. In its Deliberation on the PL SA objections21, the FR SA decided not to follow the objection raised by
the PL SA and to refer the matter to the dispute resolution mechanism in accordance with Article
65(1)(a) GDPR.
2.3 Conclusions on the competence of the EDPB
18. The case at issue fulfils the requirements set out in Article 65(1)(a) GDPR, since the CSA raised an
objection to the Draft Decision of the LSA within the deadline provided by Article 60(4) GDPR, and the
LSA did not follow this objection.
19. The EDPB notes that the Draft Decision concerns not only matters in the scope of the GDPR, but also
matters in the scope of Directive 2002/58/EC (hereinafter, “ePrivacy Directive”) and the relevant
national transposition thereof. More specifically, the Draft Decision envisages the imposition of a fine
for breaches of the GDPR and the imposition of a fine for a breach of the French Code on Post and
Electronic Communications, transposing the ePrivacy Directive in France. The EDPB is not competent
to issue a binding decision on matters that fall exclusively within the scope of the ePrivacy Directive.
The present binding decision does not address the parts of the Draft Decision concerning the national
transposition of the ePrivacy Directive.
20. Therefore, the EDPB is competent to adopt a binding decision on all the matters within the scope of
the GDPR which are the subject of the relevant and reasoned objection of the PL SA, in particular
whether there is an infringement of the GDPR or whether an envisaged action in relation to the
controller or processor complies with the GDPR.
21. All findings in this decision are without prejudice to any assessment or binding decision made in other
cases by the EDPB, including with respect to the same parties, depending on further and/or new
findings.
3 THE RIGHT TO GOOD ADMINISTRATION
22. The EDPB is subject to Article 41 of the EU Charter of Fundamental Rights (right to good
administration). This is also reflected in Article 11 of the EDPB Rules of Procedure.
23. According to Article 65(2) GDPR, the EDPB decision “shall be reasoned and addressed to the lead
supervisory authority and all the supervisory authorities concerned and binding on them”. Article 65(2)
GDPR reflects the fact that the binding decision of the EDPB aims to resolve a dispute emerged among
two or more national supervisory authorities22. It is not aiming to address directly any third party.
However, as the decision adopted by the EDPB shall be binding on the concerned SAs, including the
LSA, and can be decisive for the outcome of the procedures at national level, it is necessary to assess
whether it can affect the interests of persons who were part of the procedure that gave rise to the
Draft Decision, such as the controller who will be addressed by the final decision of the LSA23.
24. First of all, in order to address the possible right to be heard of ACCOR, the EDPB assessed whether
ACCOR had already been offered the opportunity to exercise its right to be heard in relation to the
21
Deliberation on the PL SA objections, paragraph 18.
22
Guidelines on Art. 65(1)(a), paragraph 97.
23
Guidelines on Art. 65(1)(a), paragraphs 98-99.
adopted 8
subject matter of the dispute to be resolved by the EDPB at national level on the documents received
in this procedure and used by the EDPB to take its binding decision24.
25. On 29 April 2022, the Chair of the EDPB contacted ACCOR informing it of the referral of the case to the
Article 65(1)(a) GDPR dispute resolution mechanism. In the same letter, the Chair of the EDPB drew
ACCOR’s attention to the fact that the PL SA no longer considered that there was a dispute in relation
to two of the three objections it had initially submitted and that therefore the subject matter of the
binding decision of the EDPB would be the remaining objection on the level of the fine. The purpose
of this letter was also to grant ACCOR the right to be heard on the documents of the file which it had
not yet had the opportunity to share its views on. The Chair of the EDPB offered ACCOR an opportunity
to provide any observation on these documents by 13 May 2022. On 13 May 2022, ACCOR sent its
observations (ACCOR’s May 2022 observations) and the French original version of ACCOR’s November
2021 observations. Following this submission, the EDPB considered that ACCOR was given the
opportunity to make its views effectively known in relation to the subject matter of the dispute to be
resolved by the EDPB.
26. In light of the scope of the dispute submitted to the EDPB and of the circumstances of the case, the
Chair of the EDPB decided not to grant the complainants a right to be heard before the issuance of this
binding decision as the EDPB decision addressing an objection on the level of the fine is not likely to
affect their legal situation.
4 STRUCTURE OF THE BINDING DECISION
27. With regard to the objection raised by the CSA, the EDPB should first assess whether it is to be
considered as “relevant and reasoned” within the meaning of Article 4(24) GDPR as clarified in the
Guidelines on relevant and reasoned objection25.
28. Where the EDPB finds that an objection (or a part thereof) does not meet the requirements of Article
4(24) GDPR, the EDPB does not take any position on the merits of any substantial issues raised by that
(part of the) objection in the case at issue. The merits of the substantial issues raised by an objection
should be addressed by the EDPB only if the objection is deemed to be relevant and reasoned26.
5 ON THE CORRECTIVE MEASURES - IN PARTICULAR, THE
CALCULATION OF THE ADMINISTRATIVE FINE
5.1 Analysis by the LSA in the Draft Decision
29. The Draft Decision lists the criteria that the FR SA considered when deciding whether to impose an
administrative fine and on the amount of the fine27.
24
Guidelines on Art. 65(1)(a), paragraphs 105-106.
25
EDPB Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679, version 2, adopted
on 9 March 2021, (hereinafter, “Guidelines on RRO”).
26
See Guidelines on Art. 65(1)(a)”, paragraph 63 (stating: “The EDPB will assess, in relation to each objection
raised, whether the objection meets the requirements of Article 4(24) GDPR and, if so, address the merits of the
objection in the binding decision.”)
27
Draft Decision, paragraphs 78-88.
adopted 9
30. In the Draft Decision the FR SA indicated that “[i]n 2019, the Company [ACCOR]) generated a revenue
of €1.2 billion and a net profit of €208 million. This revenue decreased by 54% between 2019 and
2020”28.
31. With regard to the nature and seriousness of the infringement, the FR SA in its Draft Decision first took
note of the number of infringements by ACCOR, namely: “[...] lack of easily accessible and complete
information on the processing carried out, difficulties encountered in the exercise of their rights by
complainants and data security defects’’29. In this regard, the Draft Decision stressed that these failures
to comply with the GDPR concerned several fundamental principles of the applicable legislation on the
protection of personal data and that they constituted a ‘’substantial infringement’’ of data subjects’
rights30. The Draft Decision also considered the ‘’particularly large number of people affected by these
breaches since in 2019, million people received at least one of the ACCOR group's newsletters at
a valid e-mail address” .
31
32. Finally, the Draft Decision went on to recall that the violations in question “had direct consequences
for the data subjects, as evidenced by the fact that the CNIL received eleven complaints relating in
particular to the right to object to marketing messages”32.
33. Based on the above reasoning, the FR SA concluded in its Draft Decision that a fine should be imposed
on ACCOR33.
34. In relation to the determination of the maximum amount of the fine, the FR SA indicated that, ”Article
83(3) of the Regulation provides that in the event of multiple breaches [...] the total amount of the fine
may not exceed the amount set for the most serious breach”34. The FR SA found ACCOR to have
breached Articles 12(1), 12(3), 13, 15(1), 21(2) and 32 GDPR, and provided in its Draft Decision that
“the maximum fine that can be imposed is €20 million or 4% of annual worldwide turnover, whichever
is higher“35.
35. In assessing the proportionality of the fine, the FR SA considered that ACCOR had remedied all of the
breaches identified in the Draft Decision and that, “some of them, in relation to the exercise of
individuals' rights, were not of a structural nature’’36. In addition, the Draft Decision pointed out that
ACCOR fully cooperated with the FR SA37. Additionally, the FR SA considered the financial situation of
ACCOR, which reported “a 54% drop in turnover between 2019 and 2020’’38.
36. The FR SA concluded in its Draft Decision that considering the ‘’economic context caused by the Covid-
19 health crisis, its consequences on [ACCOR’s] financial situation’’, as well as “the relevant criteria of
28
Draft Decision, paragraph 2. During the assessment of the completeness of the file, the FR SA clarified that the
reference to the “revenue’’ of ACCOR in the Draft Decision should be understood as a reference to its turnover.
29
Draft Decision, paragraph 80.
30
Ibid.
31
Draft Decision, paragraph 81.
32
Draft Decision, paragraph 82.
33
Draft Decision, paragraph 83.
34
Draft Decision, paragraph 84.
35
Ibid.
36
Draft Decision, paragraph 86.
37
Ibid.
38
Draft Decision, paragraph 87.
adopted 10
Article 83(2) mentioned above”, the FR SA decided to impose a fine of EUR 100,000 for the identified
infringements of the GDPR39.
5.2 Summary of the objection raised by the PL SA
37. The objection raised by the PL SA concerns the amount of the fine set out in the Draft Decision.
38. The PL SA argues in its objection that the amount the LSA proposed for the administrative fine is too
low for a controller like ACCOR and that the fine would not be effective, proportionate and dissuasive
as required in Article 83(1) GDPR. Therefore, the PL SA concludes that “the draft decision should be
revised accordingly and a higher financial penalty should be proposed for the infringements found in
the present case, so that the penalty meets the conditions of a proportionate, effective and dissuasive
measure”40.
39. With regard to the seriousness of the violations, the PL SA makes reference to the following factors of
Article 83(2)(a) GDPR that should be considered when assessing the severity: “the nature, scope or
purpose of processing, as well as the number of data subjects and the level of damage suffered by
them’’41. In this respect, the PL SA states that the provisions that have been infringed and the cross-
border nature of the processing indicate that the breach is of high gravity and that therefore the
proposed fine should have been higher42.
40. With regard to the assessment of the fine under 83(1) GDPR relating to the duty to impose fines which
in each individual case are effective, proportionate and dissuasive, the PL SA raises the following
concerns.
41. Firstly, the PL SA points out that further information should be included in the Draft Decision
concerning the turnover of ACCOR. In this respect, the PL SA argues that as the turnover of the
company is not provided in the Draft Decision, the information in the Draft Decision “is insufficient to
calculate the amount of the proposed fine”, since the controller’s annual turnover “may constitute the
basis for the calculation of the fine”43.
42. In addition, with regard to proportionality, the PL SA indicates that the Draft Decision does not provide
evidence that a higher fine could irretrievably jeopardise the viability of ACCOR. According to the PL
SA, the proportionality of the fine “applies to the solvency of the sanctioned entity. However, in order
to reduce the amount of the fine for this reason, there must be objective evidence that the imposition
of the fine would irretrievably expose the viability of the company concerned and would result in the
loss of all the value of its assets’’44. Therefore, the PL SA concludes that “taking into account [ACCOR’s]
revenue amounting to EUR 1,621,000,000 in 2020, [...], it is very unlikely that [ACCOR’s] solvency would
be threatened with a penalty even several times higher, despite the losses recorded during the Covid-
19 pandemic”45.
43. With respect to the dissuasiveness of the fine, the PL SA considers that the amount of the fine is too
low for a company with a turnover as high as the turnover of ACCOR to effectively deter it from
39
Draft Decision, paragraphs 88 and 92.
40
PL SA objections, page 4.
41
PL SA objections, page 2.
42
PL SA objections, page 2.
43
PL SA objections, page 2.
44
PL SA objections, pages 2.
45
PL SA objections, pages 2-3.
adopted 11
committing similar infringements in the future. Furthermore, the PL SA is of the opinion that the
suggested fine would not be a sufficient deterrent for other companies with a turnover similar to that
of ACCOR. In that respect, the PL SA states that the level of fine proposed by the LSA would send a
clear signal to other companies that they may refrain from investing much on data protection
compliance, as complying with data protection rules may require a financial investment higher than a
possible fine46.
44. The PL SA is of the opinion that unless changes are made to the Draft Decision, this will entail a risk for
the fundamental rights and freedoms of data subjects, and in particular a risk of violation of Article 8
of the Charter of Fundamental Rights. In that respect, the PL SA explained that the purpose of
corrective measures is to discourage infringements of the legislation in force and that for this reason,
imposing a remedy which is not proportionate, dissuasive and effective will not fulfil this purpose
“which indicates the importance of the risk of violating the rights or freedoms of data subjects
including the protection of their personal data, which is a fundamental right under Art. 8 of the Charter
of Fundamental Rights of the European Union”47.
5.3 Position of the LSA on the objection
45. In its Deliberation on the PL SA objections, the FR SA took the view that the objection of the PL SA is
expressed in broad terms and it does not propose a range of amounts that it would deem appropriate
for a fine nor does it make reference to any relevant precedent. In the opinion of the FR SA, the PL SA
essentially refers to the solvency and the turnover of ACCOR to justify the need to increase the amount
of the fine. However, the FR SA is of the opinion that even though the turnover is a significant element
to consider when determining the level of the fine, the other criteria provided for in Article 83(2) GDPR,
among which the seriousness of the infringements committed, have to be considered, too48.
46. The FR SA further explained that to determine the level of the fine against ACCOR, it had considered
that the infringements in question had not been of structural nature, and that following the
investigation of the FR SA, ACCOR had taken measures to correct the breaches in question49. In
addition, the FR SA clarified having taken into account the significant drop in the turnover of ACCOR
between 2019-2020 as a mitigating factor under Article 83(2)(k) GDPR, due to the serious impact of
the Covid-19 health crisis to the hotel sector50.
47. Therefore, based on the above reasoning, the FR SA concluded that in its opinion the fine was effective,
proportionate and dissuasive51.
5.4 Analysis of the EDPB
46
PL SA objections, page 3.
47
PL SA objections, pages 3-4.
48
Deliberation on the PL SA objections, paragraph 13.
49
Deliberation on the PL SA objections, paragraphs 14-15. It is to be noted that the Guidelines on the application
and setting of administrative fines for the purposes of the Regulation 2016/679, WP 253, specifically indicate
that it would not be appropriate to give additional regard to cooperation that is already required by law (page
14). In this regard see also Article 31 GDPR.
50
Deliberation on the PL SA objections, paragraph 16.
51
Deliberation on the PL SA objections, paragraph 17.
adopted 12
5.4.1 Assessment of whether the objection is relevant and reasoned
48. Firstly, the EDPB takes note that the LSA does not challenge whether the objection is relevant and
reasoned52.
49. With respect to the relevance of the objection, the objection of the PL SA concerns the amount of the
fine set out in the Draft Decision53. There is, therefore, a direct connection between the objection and
the Draft Decision. It is, however, to be noted that even though the PL SA refers in its objection to the
amount of the fine as a whole, i.e. including the fine that the FR SA had established for breaches
relating to the ePrivacy Directive, for the purposes of the present binding decision, as explained in the
paragraphs 18-21 above, in this decision, the EDPB does not address the parts of the Draft Decision
concerning the national transposition of the ePrivacy Directive.
50. Moreover, in its objection, the PL SA considers that the fine proposed in the Draft Decision may be
ineffective, disproportionate and non-dissuasive in the context of the present case. Furthermore, the
PL SA requests that the turnover of the company in the previous year be specified and argues that a
higher fine ought to be imposed to ensure that the fine is proportionate, effective and dissuasive in
accordance with Article 83(1) GDPR, thereby indicating how following the objection would lead to a
change in the Draft Decision. Therefore, the objection in question concerns “whether the action
envisaged in the Draft Decision complies with the GDPR”. If followed, the objection would result in a
different outcome in the Draft Decision, i.e. increasing the amount of the fine. For these reasons, the
EDPB considers the objection to be relevant.
51. ACCOR argued that the objection is not reasoned, as the PL SA “[...] only expresses its objection in the
form of abstract and general remarks without basing itself on the facts of the case nor taking into
account the justifications provided by the Draft Decision”54. In ACCOR’s view, the objection further fails
to justify a conclusion different from that of the FR SA55.
52. The EDPB partially shares the views of ACCOR. In particular, as to the assessment of the proportionality
of the fine in relation to the seriousness of the violations (Article 83(2)(a) GDPR), the EDPB considers
that the PL SA does not put forward any substantiated reasoning in support of this claim. In particular,
the objection does not explain how “the provisions that have been infringed and the cross-border
nature of the processing”56 should have been assessed and balanced differently by the LSA for the
purpose of evaluating the seriousness of the violations. More specifically, considering that the LSA had
already found the infringements to be “substantial”57, the PL SA fails to explain how the level of the
gravity in the Draft Decision would change if the factors the PL SA is proposing were assessed
differently by the LSA. Therefore, the EDPB does not find this part of the objection to be sufficiently
reasoned.
53. However, the EDPB notes that the remaining part of the PL SA objection is sufficiently reasoned with
regard to how the Draft Decision fails to adequately assess and apply the criteria set out in Article 83(1)
GDPR. Concerning the argument of the PL SA on the lack of information in the Draft Decision on the
turnover, the PL SA provides factual elements based on the Draft Decision and publicly available
information on ACCOR’s turnover. According to the PL SA, the alleged lack of information on the
52
Deliberation on the PL SA objections, paragraphs 11-18.
53
PL SA objections, pages 1-3.
54
ACCOR’s November 2021 observations, section 2.1, page 2.
55
ACCOR’s November 2021 observations, section 2.1, page 3.
56
PL SA objections, page 2.
57
Draft Decision, paragraph 80.
adopted 13
turnover of ACCOR may have led to an incorrect assessment of the fine in the Draft Decision. In
addition, with regard to the proportionality of the fine, the PL SA provides legal arguments as to why,
in its view, the Draft Decision incorrectly reduces the amount of the fine due to the Covid-19 pandemic
and therefore a higher fine should be imposed. More specifically, the PL SA considers that ‘’in order to
reduce the amount of the fine [on the ground of the solvency of the company], there must be objective
evidence that the imposition of the fine would irretrievably expose the viability of the company
concerned and would result in the loss of all the value of its assets’’58. Finally, the PL SA provides legal
arguments justifying the imposition of a higher administrative fine in the Draft Decision in order to
ensure its dissuasiveness in accordance with Article 83(1) GDPR, stating that such a level of fine may
prevent ACCOR and other organisations from being deterred from committing similar infringements in
the future. For these reasons, according to the PL SA, “the unchanged draft decision entails a risk for
the fundamental rights and freedoms of data subjects, and in particular the risk of violation of Art. 8
of the Charter of Fundamental Rights.”59
54. In light of the above, the EDPB notes that the PL SA articulates why it proposes amending the Draft
Decision and explains its views on the significance of the risks posed by the Draft Decision for the data
subjects. The EDPB thus considers the part of objection relating to Article 83(1) GDPR to be reasoned.
55. As a result, the EDPB considers that the objection raised by the PL SA is partially relevant and reasoned
pursuant to Article 4(24) GDPR (for the part relating to the application of Art. 83(1) GDPR). Accordingly,
only the merits of the substantial issues raised by the PL SA in the parts of the objection that were
found to be relevant and reasoned should be assessed.
5.4.2 Assessment on the merits
56. The EDPB considers that the part of the objection found to be relevant and reasoned with regard to
Article 83(1) GDPR requires an assessment of its merits as to whether in the case at hand, the Draft
Decision: (i) is missing information on the relevant turnover for setting the amount of the fine; (ii) in
terms of proportionality of the fine, should not grant a reduction of the fine to ACCOR despite the
losses it recorded during the Covid-19 pandemic; and (iii) proposes a fine that does not meet the
dissuasiveness requirement set out in Article 83(1) GDPR.
57. In this regard, the EDPB recalls that the consistency mechanism may also be used to promote a
consistent application of administrative fines60.
Preliminary matter: the relevant turnover for setting the amount of the fine
58. The PL SA stated in its objection that the Draft Decision does not provide the amount of ACCOR’s
annual turnover in 2020 that, in accordance with the provisions of the GDPR on administrative fines,
may constitute the basis for calculating the amount of the fine61. The PL SA further explained that the
annual turnover of ACCOR in 2020 to be taken into account as the basis for the calculation of the
maximum amount of the fine is of EUR 1,621,000,00062.
58
Ibid.
59
PL SA objections, pages 2-3.
60
See GDPR, Recital 150; Guidelines on RRO, paragraph 34 and Guidelines on Article 65(1)(a) GDPR, paragraph
91.
61
PL SA objections, page 2.
62
According to the PL SA, this figure derived from publicly available sources
(https://group.accor.com/en/finance/events-and-announcements/annual-and-half-yearly-information), PL SA’s
Objection, page 2.
adopted 14
59. ACCOR expressed the view that the amount of the fine indicated by the PL SA in its objection is factually
inaccurate. In this regard, ACCOR pointed out that its 2020 turnover was of EUR 531,000,000 and not
of 1,621,000,000,63 as indicated by the PL SA.
60. The EDPB notes that the objection of the PL SA refers to the consolidated turnover of the entire ACCOR
Group of 2020, while the Draft Decision refers only to the turnover of the controller, i.e. ACCOR SA in
2019. As the undertaking to be considered for the determination of the relevant turnover was not
questioned by the PL SA in its objection, the EDPB finds that it should not issue a decision on whether
the LSA should amend its Draft Decision in this respect.
61. Furthermore, the EDPB has previously decided that the turnover of an undertaking is not relevant
exclusively for the determination of the maximum amount of the fine in accordance with Article 83(4)-
(6) GDPR, but should also be considered for the actual calculation of the fine, too64. Therefore, the
EDPB considers that the turnover figure is an important element to be referred to in the Draft Decision.
In addition, the EDPB recalls that the date of the final decision taken by the LSA pursuant to Article
65(6) GDPR is the event from which the preceding financial year should be considered65. Nonetheless,
in the context where a draft decision is circulated by an LSA to the CSAs pursuant to Article 60(3) GDPR,
the EDPB agrees with the approach that this draft decision include a provisional figure based on the
most up to date financial information available at that time66.
62. The EDPB further notes that the Draft Decision was issued on 30 April 2021. During the dispute
resolution procedure, the FR SA clarified that, at that point in time, only the financial statement for
2019 was available, whereas the financial statement for 2020 had yet to be filed. As a result, in its Draft
Decision67, the FR SA expressly referred only to the turnover generated by ACCOR in 2019, by indicating
that ACCOR's turnover fell by 54% between 2019 and 2020, based on a provisional calculation that
ACCOR had provided to the FR SA. Thus, even though the turnover from 2020 is not expressly
mentioned in the Draft Decision, the Draft Decision includes what was the latest available information
on the financial results of ACCOR, and allows the identification of an estimate of the turnover of 2020
by calculating the 46% of the turnover from 2019, which was provided in the Draft Decision. Therefore,
contrary to the contention of the PL SA, the Draft Decision did provide information on ACCOR’s
turnover from 2020, albeit indirectly and based on provisional data.
63. Therefore, the EDPB agrees with the approach taken by the FR SA in the present case to include the
provisional turnover figure based on the most up to date financial information available when it
circulated its Draft Decision to the CSAs pursuant to Article 60(3) GDPR. However, the EDPB recalls that
when issuing its final decision in accordance with Article 65(6) GDPR, the FR SA shall take into account
the undertaking’s annual turnover corresponding to the financial year preceding the date of its final
decision, i.e. the turnover of ACCOR in 2021.
63
ACCOR’s November 2021 observations, section 2.2.1, pages 3-4.
64
EDPB, Binding Decision 1/2021 on the the dispute arisen on the draft decision of the Irish Supervisory Authority
regarding WhatsApp Ireland under Article 65(1)(a) GDPR, adopted on 28 July 2021, paragraphs 405-412.
65
EDPB, Binding Decision 1/2021, paragraphs 297-298.
66
EDPB, Binding Decision 1/2021, paragraph 298 which also refers to the fact that Article 60(6) GDPR, providing
that the LSA and CSA are bound by the draft decision on which they (are deemed to) agree, in any case does not
apply to the present situation.
67
Draft Decision, paragraph 2.
adopted 15
Reduction of the amount of the fine by the LSA
64. The EDPB notes that to calculate the fine the FR SA has taken into account ‘’the economic context
caused by the Covid-19 health crisis’’ and ‘’its consequences on [ACCOR’s] financial situation’’68, which,
as referred to in the Draft Decision, reported a 54% drop in its turnover between 2019 and 2020 due
to the health crisis linked to the Covid-19 pandemic 69.
65. In its objection, the PL SA claims that, in order to ensure proportionality of the fine, the FR SA should
not grant a reduction of the fine to ACCOR. In this respect, the PL SA argues that in order to reduce the
amount of the fine on account of its impact on the solvency of the sanctioned entity, it should be
objectively demonstrated that the imposition of this fine "would irretrievably expose the viability of
the company concerned and would result in the loss of all the value of its assets"70. Accordingly, the
PL SA underlines that, as the turnover of ACCOR amounts to 1.6 billion euros in 202071, "it is very
unlikely’’ that the solvency of the ACCOR would be threatened by a fine, even several times higher,
despite the loss of turnover incurred by ACCOR during the Covid-19 pandemic72.
66. In response to this objection, the FR SA expresses the view that “even though the turnover of the
controller is a significant element when determining the amount of the fine, it should go together with
all the other criteria provided for by Article 83(2) of the GDPR’’73. With regard to the calculation of the
fine, the FR SA further clarified having taken into account the significant impact of the covid-19 health
crisis on the hotel sector as a mitigating factor under Article 83(2)(k) GDPR.74
67. In its observations communicated to the EDPB, ACCOR states that the risk of damage to the solvency
of the company is not a necessary element to be proven by a supervisory authority, in order to be able
to reduce the amount of the fine75. On this specific point, ACCOR refers to the EDPB binding decision
1/2021 in which the EDPB indicates that the turnover of a company can be taken into account, among
other elements, for the calculation of the fine. Moreover, ACCOR underlines that the initial amount of
the fine proposed by the Rapporteur (EUR 1,000,000) was calculated by reference to the turnover of
the company in 2019, before the Covid-19 crisis. According to ACCOR, considering that the EDPB held
that the turnover to be taken into account for the calculation of the fine must correspond to that of
the year preceding the decision, it is logical that the FR SA considered the significant decrease in
ACCOR's revenues between 2019 and 202076.
68. Firstly, the EDPB acknowledges that, in the context of the assessment of the proportionality of the fine
under Article 83(1) GDPR, an LSA, according to its national law, may reduce the fine on the basis of the
inability to pay principle but only in very exceptional circumstances. Indeed, similarly to the practice
observed in the field of competition law77, in order for an LSA to consider such a reduction on the
grounds of the inability to pay the fine, the requesting undertaking shall demonstrate an
insurmountable difficulty in paying the proposed amount of the fine. In particular, the undertaking
68
Draft Decision, paragraph 87.
69
Draft Decision, paragraphs 87-88.
70
PL SA objections, page 2.
71
See clarifications provided in this regard in paragraph 60 above.
72
PL SA objections, pages 2-3.
73
Deliberation on the PL SA objections, paragraph 13.
74
Deliberation on the PL SA objections, paragraph 16.
75
ACCOR November 2021 Observations, section 2.2.b, page 6.
76
Ibid.
77
See on this principle, for instance, the Commission Guidelines on the method of setting fines imposed pursuant
to Article 23(2)(a) of Regulation No 1/2003 (2006/C 210/02).
adopted 16
concerned shall provide objective evidence that the proposed amount of the fine would irretrievably
jeopardise its economic viability and cause its assets to lose all or most of their value78. In addition,
these risks need only to be assessed where a specific ‘’social and economic context’’ exists79.
69. In the present case, the EDPB observes that, contrary to what is claimed by the PL SA, the reduction of
the amount of the fine by the LSA was not decided on the ground of the inability to pay of ACCOR, but
rather on the basis of the drop in the turnover directly resulting from the difficult economic context in
which the company was operating80. Considering that the ground of the inability to pay was not
invoked in the course of the proceeding, the EDPB considers that the LSA is not required to amend its
Draft Decision in order to assess the company's inability to pay when assessing the proportionality of
the fine under Article 83(1) GDPR.
70. With regard to the justification provided by the LSA for the reduction of the fine, the EDPB recalls that
the turnover of the company concerned, as it provides a relevant indication of the size of the company,
already constitutes one of the elements to be taken into account by the LSA to ensure the fine is
effective, proportionate and dissuasive in each individual case81. Furthermore, the EDPB draws
attention to the fact that, given the overarching nature of Article 83(1) GDPR, the LSA must ensure that
the circumstances taken into account when calculating the fine are not counted twice. Therefore, as
the turnover is already to be considered within the assessment under Article 83(1) GDPR, the EDPB
considers that the LSA should not take into account the drop in the turnover of ACCOR as a mitigating
factor under Article 83(2)(k) GDPR too. Without prejudice to the above, the EDPB notes, however, the
deliberately open-ended wording of Article 83(1) GDPR, which leaves a certain degree of flexibility to
the LSA in the choice of the elements to be taken into account in order to ensure that the final amount
of the fine complies with the principles of effectiveness, proportionality and dissuasiveness82. On this
basis, the EDPB considers that the LSA may reduce the fine on the basis of the poor financial conditions
of a sector of the undertaking concerned, insofar as it demonstrates that the relevant turnover for the
calculation of the fine83 does not, on its own, adequately reflect its financial capacity due to exceptional
and recent84 sectoral economic circumstances which directly and substantially affect its activities. In
any event, the EDPB considers that the mere finding that an undertaking is in an adverse or loss-making
financial situation does not automatically warrant a reduction of the amount of the fine85. Therefore,
the final decision on whether or not to consider, in the calculation of the fine, the turnover in the light
of recent developments of the sectoral economic circumstances leading to the poor financial situation
78
See Tokai Carbon and Others v Commission, (Joined cases T-236/01, T-239/01, T-244/01 to T-246/01, T-251/01
and T-252/01, judgment delivered on 29 April 2004), ECLI:EU:T:2004:118, §372; Westfälische Drahtindustrie and
Others v Commission (Case T-393/10, judgment delivered on 15 July 2015), ECLI:EU:T:2015:515, §§292-294.
79
See SGL Carbon v Commission, (Case C-308/04 P, judgment delivered on 29 June2006), ECLI:EU:C:2006:433,
§106.
80
Deliberation on the PL SA objections, paragraphs 13-16.
81
Binding Decision 1/2021, paragraphs 405-412.
82
According to Article 83(1) ‘’ Each supervisory authority shall ensure that the imposition of administrative fines
pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in
each individual case be effective, proportionate and dissuasive’’ (emphasis added).
83
i.e. the turnover of the year preceding the decision. See paragraph 63 above.
84
For example, the term "recent" may capture situations where the exceptional sectoral economic circumstances
arise after the year of reference for the relevant turnover or soon before this year of reference comes to an end,
so that the turnover of the undertaking no longer reflects accurately the company's financial capacity.
85
see Dansk Rørindustri and Others v Commission (joined cases C-189/02 P, C-202/02 P, C-205/02 P to C-208/02
P and C-213/02 P, judgment delivered on 28 June 2005), ECLI:EU:C:2005:408, §327 and the case law cited therein.
adopted 17
of the undertaking not reflected in the relevant turnover belongs to the LSA, in accordance with its
own national fining practices.
71. In light of the above, the EDPB notes that nothing in the present case indicates that the turnover of
ACCOR of 2020 did not appropriately reflect the financial situation of this undertaking at the time the
Draft Decision was issued86.
72. The EDPB therefore instructs the LSA, in order to ensure proportionality of the fine in accordance with
Article 83(1) GDPR, to take into account the financial situation of ACCOR on the basis of the 2021
turnover figure of this undertaking, without considering the reduction of the turnover due to the Covid-
19 pandemic as a mitigating factor under Article 83(2)(k) GDPR.
Dissuasiveness of the fine under Article 83(1) GDPR
73. In the part of its objection that was deemed to be relevant and reasoned by the EDPB, the PL SA
contends that the amount of the fine set by the LSA does not fulfill the dissuasiveness requirement set
out in Article 83(1) GDPR, which provides that “Each supervisory authority shall ensure that the
imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation
referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and
dissuasive.” In particular, the PL SA argues that the proposed amount of the fine is not high enough to
deter ACCOR itself or other entities from committing similar infringements in the future87.
74. In its observations submitted to the EDPB, ACCOR stated that it agreed with the reasoning developed
by the FR SA, which concluded that the administrative fine was sufficiently dissuasive88.
75. It should first be noted that the setting of a fine is not an arithmetically precise exercise,89 and
supervisory authorities have a certain margin of discretion in this respect90. Nonetheless, the EDPB
considers that even though an LSA is not required, under its duty to state reasons, to provide detailed
figures on the method it used for calculating the fine, the LSA should indicate the factors that
influenced the exercise of its discretion when setting fines, in particular with regard to the deterrent
effect of the proposed fine.
76. In addition, the EDPB recalls that to ensure that a fine is dissuasive, it must be set at a level which
ensures that it has a genuinely deterrent effect.91 In order to ensure deterrence, the fine must be set
at a level that discourages both the controller or processor concerned as well as other controllers or
processors carrying out similar processing operations from repeating the same or a similar unlawful
86
In this respect, the EDPB recalls that, when issuing its final decision in accordance with Article 65(6) GDPR, the
FR SA shall use the updated turnover of ACCOR of 2021. See paragraph 63 above.
87
PL SA objections, page 2.
88
ACCOR’s May 2022 observations, page 1, referring to: Deliberation on the PL SA objections, paragraphs 11-18.
89
See, inter alia, Altice Europe NV v Commission (Case T-425/18, judgment delivered on 22 September 2021),
ECLI:EU:T:2021:607, §362; Romana Tabacchi v Commission (Case T‑11/06, judgment delivered on 5 October
2011), ECLI:EU:T:2011:560, §266.
90
See, inter alia, Caffaro Srl v Commission (Case T-192/06, judgment delivered on 16 June 2011),
ECLI:EU:T:2011:278, §38.
91
EDPB, Decision 01/2020 on the dispute arisen on the draft decision of the Irish Supervisory Authority regarding
Twitter International Company under Article 65(1)(a) GDPR, Adopted on 9 November 2020), paragraph 196;
EDPB, Decision 1/2021, paragraph 415.
adopted 18
conduct,92 while not going beyond what is necessary to attain that objective93. Moreover, the size of
the undertaking concerned is one of the elements that should be taken into account in the calculation
of the amount of the fine in order to ensure its dissuasive nature94. Taking into consideration the
resources of the undertaking in question is indeed justified by the impact sought on the undertaking
concerned, in order to ensure that the fine has sufficient deterrent effect, given that the fine must not
be negligible in the light, particularly, of its financial capacity95.
77. In light of the above, the EDPB considers that the fine in the present case relating to “substantial”
infringements96 must be set at a level that is not negligible relative to ACCOR’s turnover, and that
would deter not only ACCOR but also other organisations from committing similar infringements in the
future. In this respect, the EDPB notes that although the resources of ACCOR decreased significantly
between 2019 and 2020 due to the Covid-19 pandemic, the fine amount proposed by the LSA would
represent only 0,02% of the 2020 estimated turnover of ACCOR. The EDPB considers that this amount
would qualify as negligible in the circumstances of the present case, in particular in view of the fact
that it was imposed for infringements that the LSA considered to be “substantial”97. Hence, the EDPB
is of the view that such an amount would not discourage ACCOR and other companies from committing
similar “substantial” infringements, and even less from committing less “substantial” infringements,
as the risk they would face for such infringements would be a minimal retribution relative to their
economic size.
78. Therefore, the EDPB finds the fine provided for in the Draft Decision is not sufficiently dissuasive. On
this basis, the EDPB instructs the LSA to reassess the elements it relied upon to calculate the amount
of the fine in order to ensure that it meets the criterion of dissuasiveness under Article 83(1) GDPR,
taking account, in particular, of the relevant turnover of ACCOR98.
CONCLUSIONS
The EDPB instructs the FR SA to re-assess its envisaged corrective measure in terms of administrative
fine in accordance with the conclusions reached by the EDPB, namely:
- the relevant turnover is the turnover corresponding to the financial year preceding the date of the
final decision taken by the LSA pursuant to Article 65(6) GDPR (paragraphs 58-63).
- to ensure that the fine is proportionate under Article 83(1) GDPR taking into account, as described in
the binding decision, the relevant turnover of ACCOR (paragraphs 64-72).
92
See, inter alia, Versalis Spa v European Commission (Case C-511/11, judgment delivered on 13 June 2013),
ECLI:EU:C:2013:386, §94.
93
MT v Landespolizeidirektion Steiermark (Case C‑231/20, judgment delivered 22 September 2021),
ECLI:EU:T:2021:60, § 45 (stating: “the severity of the penalties imposed must … be commensurate with the
seriousness of the infringements for which they are imposed, in particular by ensuring a genuinely deterrent
effect, while not going beyond what is necessary to attain that objective”).
94
EDPB, Decision 1/2021, paragraphs 405-412.
95
YKK and Others v Commission (Case C‑408/12 P, judgment delivered on 4 September 2014),
ECLI:EU:C:2014:2153, § 85; Lafarge v European Commission, (Case C-413/08 P, judgment delivered on 17 June
2010), ECLI:EU:C:2010:346, § 104 and the case law cited therein.
96
Draft Decision, paragraph 80.
97
Ibid.
98
In this respect, the EDPB recalls that, when issuing its final decision in accordance with Article 65(6) GDPR, the
FR SA shall use the updated turnover of ACCOR of 2021. See paragraph 63 above.
adopted 19
- to reassess the elements it relied upon to calculate the amount of the fine in order to ensure it meets
the criterion of dissuasiveness under Article 83(1) GDPR, taking account, in particular, the relevant
turnover of ACCOR (paragraphs 73-78).
6 BINDING DECISION
79. In light of the above, and in accordance with the task of the EDPB under Article 70(1)(t) GDPR to issue
binding decisions pursuant to Article 65 GDPR, the EDPB issues the following binding decision in
accordance with Article 65(1)(a) GDPR:
The EDPB decides that the objection of the PL SA which questions the level of the fine imposed by the
FR SA in its Draft Decision meets the requirements of Article 4(24) GDPR with regard to the claims of
the PL SA that the Draft Decision (i) is missing information on the relevant turnover for setting the
amount of the fine; (ii) in terms of proportionality of the fine, it should not grant a reduction of the
fine to ACCOR despite the losses it recorded during the Covid-19 pandemic; and (iii) proposes a fine
that does not meet the dissuasiveness requirement set out in Article 83(1) GDPR.
In that respect the EDPB decides that (i) in its final decision the FR SA must take into account the
turnover of ACCOR of the preceding year namely of 2021; (ii) although the FR SA is not required to
verify the solvency of ACCOR, it should, in order to ensure proportionality of the fine, take into account
the financial situation of ACCOR on the basis of the relevant turnover figure of this undertaking,
without considering this reduction of the turnover as a mitigating factor under Article 83(2)(k) GDPR;
and (iii) the fine does not fulfil the requirement of being dissuasive in accordance with Article 83(1)
GDPR and for this reason, instructs the FR SA to reassess the elements it relied upon to calculate the
amount of the fine in order to ensure it meets the criterion of dissuasiveness under Article 83(1) GDPR,
taking account, in particular, of the relevant turnover of ACCOR.
The EDPB decides that the FR SA is not required to amend its Draft Decision on the basis of the part of
the objection on the principle of proportionality in relation to the gravity of the infringement (Article
83 (2)(a) GDPR), as it does not meet the requirements of Article 4(24) GDPR.
7 FINAL REMARKS
80. This binding decision is addressed to the FR SA and the CSAs. The FR SA shall adopt its final decision on
the basis of this binding decision pursuant to Article 65(6) GDPR.
81. Regarding the part of the objection deemed not to meet the requirements stipulated by Article 4(24)
GDPR, the EDPB does not take any position on the merit of any substantial issues raised therein. The
EDPB reiterates that its current decision is without prejudice to any assessments the EDPB may be
called upon to make in other cases, including with the same parties, taking into account the contents
of the relevant draft decision and the objections raised by the CSAs.
82. According to Article 65(6) GDPR, the FR SA shall communicate its final decision to the Chair within one
month after receiving the binding decision.
83. Once such communication is done by the FR SA, the binding decision will be made public pursuant to
Article 65(5) GDPR.
84. Pursuant to Article 70(1)(y) GDPR, the FR SA’s final decision communicated to the EDPB will be included
in the register of decisions which have been subject to the consistency mechanism.
adopted 20
For the European Data Protection Board
The Chair
(Andrea Jelinek)
adopted 21