This case study examines ILVA A/S v. Danish Public Prosecutor, a CJEU ruling that clarifies whether GDPR fines should be based on the revenue of an individual company or its entire corporate group. The case is significant because it aligns GDPR enforcement with EU competition law principles and could increase the financial penalties for subsidiaries of multinational groups.
CJEU Case C-383/23 – Interpretation of “undertaking” in GDPR Article 83
Background
ILVA A/S, a Danish furniture retailer and a subsidiary of Lars Larsen Group, was investigated by the Danish Data Protection Agency (Datatilsynet) for failing to comply with GDPR’s data retention rules. The company retained personal data of at least 350,000 former customers beyond the legally permitted period.
The Danish Public Prosecutor’s Office sought a fine of DKK 1.5 million (~€201,000), arguing that the penalty should be based on the total revenue of the Lars Larsen Group, not just ILVA. This calculation was based on the interpretation that under Article 83 of GDPR, the fine for an infringement should be a percentage of the total worldwide annual turnover of the “undertaking.”
ILVA, however, contested this approach, arguing that:
- It was a separate legal entity from the parent company.
- Its own revenue should determine the fine, not that of the entire Lars Larsen Group.
The Aarhus District Court sided with ILVA, imposing a significantly reduced fine of DKK 100,000 (~€13,400), reasoning that ILVA operated independently and that only ILVA’s revenue should be used to determine the fine.
The Danish Public Prosecutor appealed, and the High Court of Western Denmark referred the case to the Court of Justice of the European Union (CJEU) for clarification.
The Legal Question Before the CJEU
The CJEU was asked to clarify whether, under Article 83(4)–(6) of GDPR, the term “undertaking” should be interpreted:
- Narrowly – meaning only the entity directly committing the violation is considered for fine calculation.
- Broadly (competition law approach) – meaning the entire corporate group’s turnover is considered when calculating the fine.
This interpretation was crucial because it could dramatically increase GDPR fines for companies that are part of large multinational groups.
The CJEU’s Judgment
On February 13, 2025, the CJEU ruled in favor of the broader interpretation, concluding that:
- The term “undertaking” in GDPR Article 83 should be interpreted consistently with EU competition law (Articles 101 and 102 TFEU).
- The total worldwide turnover of the entire economic entity (including the parent company and subsidiaries) can be considered when calculating fines.
- The fine must still adhere to GDPR principles of proportionality, effectiveness, and deterrence but may take into account the economic reality of the corporate group.
Key Legal Reasoning:
- The CJEU emphasized that in EU antitrust cases, companies within the same economic group cannot escape liability by claiming corporate separation. The same logic should apply in GDPR enforcement to ensure that fines are not circumvented by corporate structuring.
- A subsidiary with low revenue but part of a wealthy parent group should not receive disproportionately low fines, as it could undermine the dissuasive effect of GDPR penalties.
- While the overall group turnover may be considered, fines must still be proportionate to the specific infringement.
Conclusion
- GDPR fines can be based on the revenue of an entire corporate group, not just the subsidiary that committed the violation. If a company is part of a larger economic entity, the parent company’s financial strength matters in fine calculations.
- Corporate structuring won’t shield businesses from higher GDPR penalties. Simply operating as a legally separate entity does not prevent authorities from considering the financial power of the parent group.
- Multinational companies must ensure GDPR compliance at all levels. A compliance failure at a small subsidiary could lead to a fine based on global revenue, making group-wide privacy policies even more critical.
