ECJ judgement on the calculation of GDPR fines:More clarity for companies

Author: Dr. Arnt Glienke, Chief Governance Officer, Head of Compliance & Data Protection, Attorney at Law

The calculation of fines under the General Data Protection Regulation (GDPR) has been the subject of debate for years. A key question is whether the amount of a fine should be based on the turnover of the direct legal entity or the total turnover of a group of companies. This uncertainty has now been addressed by the European Court of Justice (ECJ) in its ruling of 13 February 2025 (C-383/23).

The judgement makes a decisive distinction: while the total turnover of a group can be used to determine the maximum amount of a fine, it may not serve as the sole basis for calculating the specific fine. The ECJ thus clarifies that sanctions must be dissuasive, but should also remain proportionate.

The case: GDPR fine against Danish furniture store chain ILVA

The ECJ’s decision was based on a case from Denmark. The case concerned the furniture store chain ILVA, which belongs to the Lars Larsen Group. In 2021, the Danish Data Protection Agency (Datatilsynet) proposed a fine of DKK 1.5 million (approx. EUR 200,000) for data protection violations in connection with the data of over 350,000 former customers. This calculation was based on the turnover of the entire group of companies, not just that of ILVA itself.

However, the competent Danish court took a different view and drastically reduced the fine. It categorised ILVA as an independent retail company and argued that there was no evidence that the parent company had founded the subsidiary specifically to process data. The fine was therefore reduced to DKK 100,000 (approx. EUR 13,400).

The legal basis:How the GDPR assesses fines

According to Art. 83 GDPR, the amount of fines is calculated on the basis of the ‘worldwide annual turnover of an undertaking in the preceding business year’. The key question here is: Which parts of the company are to be included in this calculation?

Recital 150 of the GDPR refers to the concept of an undertaking in Art. 101 and 102 TFEU, according to which an ‘undertaking’ is any economic entity, regardless of its legal form. This means that groups of companies, parent companies and subsidiaries or groups of companies can also be regarded as an economic entity.

However, it had previously only been clarified that the total turnover of a group may be used to determine the maximum amount of a fine. However, whether this can also be decisive for the actual calculation of a fine was previously unclear – until the ECJ’s recent decision.

The decision of the ECJ: Differentiated consideration required

The ECJ has now made a clear distinction between two aspects:

Maximum amount of the fine:

The total turnover of a group of companies may be taken into account when determining the maximum possible penalty.

Calculation of the specific fine:

The actual assessment of the fine must be based on the economic performance of the unit concerned, not on the turnover of the entire group.

The court emphasised that fines must be effective, proportionate and dissuasive. The economic reality of the company is a decisive factor in ensuring that the penalties have their intended effect without being disproportionate.

What does the judgement mean for companies?

With this decision, the ECJ creates more legal certainty in the calculation of fines under the GDPR. While large corporations must continue to expect high maximum fines, a differentiated approach is necessary when calculating the actual fine.

For internationally active companies, this means that data protection compliance must not be limited to individual companies. A group-wide data protection strategy remains essential in order to minimise risks and avoid potential fines.

If you have any questions about GDPR compliance or the assessment of fines, we will be happy to advise you as an experienced law firm.