The Court of Justice of the European Union (CJEU) has in case C-383/23 clarified how ‘total worldwide annual turnover’ should be interpreted when calculating the maximum administrative fine under Article 83(4) and (6) GDPR.
A data controller in Denmark was charged with GDPR violations and the Danish prosecutor sought a fine based on the group’s turnover, while the company argued that only its own turnover should be considered. After a lower fine was imposed, the case was appealed, leading to a request for clarification from the CJEU on whether GDPR fines should be calculated based on the entire group’s turnover or just the individual company’s.
The CJEU clarified in its decision that the term “undertaking” in Article 83(4)–(6) GDPR corresponds with the definition under EU competition law (Articles 101 and 102 TFEU). Consequently, when determining the maximum administrative fine under the GDPR, the calculation should be based on the total worldwide annual turnover of the entire economic unit (i.e. the group) rather than solely the turnover of the individual entity responsible for the violation.
This decision could have broader implications for the calculation of fines under other EU legislations, such as the AI Act and NIS2 Directive, which use similar wording.
