In Press Release No. 184/2023 dated 05.12.2023. The Court of Justice of the EU (CJEU) clarifies the conditions relating to the possibility for national supervisory authorities to sanction a breach of the General Data Protection Regulation (GDPR) by imposing a fine on the data controller.
The CJEU ruled that in order for a data controller to be subject to a fine for a breach of the GDPR, there must be unlawful conduct, i.e. the breach must have been committed intentionally or negligently. This is the case, for example, where the data controller could not have been unaware of the infringing nature of its conduct, whether or not he/she was aware of the infringement.
If the administrator is a legal entity, the infringement does not need to have been committed by its governing body, nor does the latter need to have been aware of the infringement. It will be liable both for infringements committed by its agents, directors and managers and for infringements committed by any other person acting within that legal enitiy and on its behalf.
The controller may also be fined for operations carried out by a processor to the extent if the controller can be held liable for those operations.
The joint control of two or more organisations arises from the fact that they have participated in determining the purposes and means of processing the data. The CJEU specifies that for classification as ‘joint controllers’, it is sufficient that there are common or matching decisions and, where there are in fact joint controllers, they must define their respective responsibilities in accordance with an agreement between them.
As regards the calculation of the fine, where the addressee is an enterprise or part of an enterprise, the supervisory authority must regard to the concept of “enterprise” under competition law. The maximum amount of the fine should be calculated on the basis of a percentage of the enterprise’s total worldwide annual turnover, taken as a whole, for the preceding business year.
