EU Court of Justice ruling: concept of 'undertaking' and implications for calculation of fines for AVG violations

This judgment concerns criminal proceedings initiated by the Public Prosecutor's Office against the company ILVA A/S, which had failed to comply with AVG obligations regarding personal data of former customers. Relevant to mention, this company is part of a larger group called Lars Larsen Group.

The reader will note that the proceedings to which the preliminary reference relates are not administrative but criminal in nature. Indeed, the Danish legal system does not allow administrative fines for violations of the AVG. According to recital 151 of the AVG, such a system is permitted, provided that the criminal sanction imposed has the same deterrent effect as the more common administrative fine imposed by supervisory authorities.

According to the referring court (second instance court for the West of Denmark), the way in which the maximum fines should be calculated for AVG violations was unclear. The legal basis for determining the maximum fines for privacy violations, Article 83 AVG, uses the term "undertaking." The referring court considers the coloring of this term decisive for the calculation of the fines, and thus relevant to the above question. The questions at issue (paraphrased): should the "undertaking" within the meaning of Article 83(4)-(6) AVG be interpreted within the meaning of European competition law, and should the calculation of the maximum fine be based on the worldwide annual turnover of the entire group (Lars Larsen Group), and not only of the AVG-violating undertaking (ILVA A/S)?

The Court answers both questions in the affirmative, referring to recital 150 of the AVG and an earlier Deutsche Wohnen judgment (C-807/21). In doing so, the Court nuanced that the competition law interpretation of "undertaking" in the AVG has no direct effect on answering or and under what conditions the fine can be imposed, but for the determination of the height of the fine amount.

Under competition law, an "undertaking" refers to an economic unit, regardless of whether it legally consists of several natural or legal persons. The determination of the maximum fine is therefore based on the turnover of the entire concern. Violations of the AVG can thus result in fines of up to 2% or 4% of revenue.

The above is relevant to the determination of the maximumamount of the fine. According to the AVG, the amount of the actual fine imposed must be effective, proportionate and dissuasive - and can therefore be much lower than the ceilings set out in the AVG. According to the Court, this requires taking into account the actual or material economic capacity of the undertaking concerned and other relevant factors. These factors include the nature, severity and duration of the breach, the number of data subjects affected, and the intentional or negligent nature of the AVG breach.

That an imposed fine relates to the global annual turnover of entire complex corporate structures, and not just the companies within those structures that have failed to comply with AVG obligations, requires special attention to monitoring AVG compliance within large-scale and complex concerns.

Moreover, the relevance of this judgment extends beyond the enforcement of the AVG. Similar penalty regimes are also included in other Union laws and regulations, such as in the Artificial Intelligence Act (AI Act), the Digital Services Act (DSA) and the Digital Markets Act (DMA).The AI Act introduces a tiered penalty system in which the level of fines depends on the nature and severity of the violation. Violations may be punishable by fines of up to 1%, 3% or 7% of the affected company's annual global turnover. However, fines of DMA violations are expressly based on companies' global annual turnover, up to 10% of this global annual turnover, increasing to 20% for repeated violations. The DSA thereby regulates fines of up to 6% of global annual turnover for non-compliance, with additional periodic fines for continuing violations of up to 5% of average daily turnover. The present judgment may therefore have far-reaching implications for the interpretation of fine calculations, which have a basis in other Union law laws and regulations, be they of the entire group or of the offending company itself.

Moreover, the European regulator EDPB has already made it explicit in its policy rules that the term "undertaking" in the administrative fine provision should be interpreted in terms of competition law. Indeed, according to the EDPB, Articles 83(4) through 83(6) AVG should be read in light of Recital 150 AVG and in accordance with Articles 101 and 102 TFEU. With this, the policy rules of the European supervisor seem to be in line with the CJEU's opinion. However, the Dutch regulator AP does not devote any words to this topic in its guidelines. The present judgment will therefore certainly affect national law.