CJEU ruling on calculating GDPR fines: greater clarity for companies

The calculation of fines under the General Data Protection Regulation (GDPR) has been debated for years. A central question is whether a fine should be based on the turnover of the legal entity directly concerned or the total turnover of a group of companies. The Court of Justice of the European Union (CJEU) has now addressed this uncertainty in its judgment of 13 February 2025 (C-383/23).

The judgment makes a crucial distinction: while the total turnover of a group may be used to determine the maximum amount of a fine, it must not serve as the sole basis for calculating the specific fine. The CJEU therefore clarifies that sanctions must be deterrent, but must also remain proportionate.

The case: GDPR fine against Danish furniture chain ILVA

The CJEU’s decision arose from a case in Denmark. It concerned the furniture chain ILVA, which belongs to the Lars Larsen Group. In 2021, the Danish Data Protection Agency (Datatilsynet) proposed a fine of DKK 1.5 million (approximately EUR 200,000) for data protection infringements involving the data of more than 350,000 former customers. The calculation was based on the turnover of the entire group, not merely that of ILVA itself.

The competent Danish court took a different view, however, and drastically reduced the penalty. It regarded ILVA as a separate retail company and argued that there was no evidence that the parent company had established the subsidiary specifically to process data. The fine was therefore reduced to DKK 100,000 (approximately EUR 13,400).

The legal basis: how the GDPR assesses fines

Under Article 83 GDPR, fines are assessed by reference to the “total worldwide annual turnover of the preceding financial year of an undertaking”. The central question is: which parts of a business must be included in this calculation?

Recital 150 GDPR refers to the concept of an undertaking under Articles 101 and 102 TFEU, according to which an “undertaking” is any economic unit, irrespective of its legal form. This means that corporate groups, parent companies and subsidiaries, or groups of companies, may also be regarded as a single economic unit.

Until now, it had only been established that the total turnover of a group may be used to set the maximum amount of a fine. Whether it could also be decisive when calculating the actual sanction remained unresolved — until the CJEU’s latest decision.

The CJEU’s decision: a differentiated assessment is required

The CJEU has now drawn a clear distinction between two aspects:

Maximum amount of the fine:

The total turnover of a group of companies may be taken into account when determining the maximum possible penalty.

Calculation of the specific fine:

The actual assessment of the fine must reflect the economic capacity of the entity concerned and must not be based indiscriminately on the turnover of the entire group.

The Court emphasised that fines must be effective, proportionate and dissuasive. The economic reality of the undertaking is a decisive factor in ensuring that penalties achieve their intended effect without being disproportionate.

What does the judgment mean for companies?

With this decision, the CJEU provides greater legal certainty for the calculation of fines under the GDPR. While large groups must continue to expect high maximum fines, the actual calculation of a penalty requires a differentiated assessment.

For companies operating internationally, this means that data protection compliance must not be confined to individual group entities. A group-wide data protection strategy remains essential to minimise risks and avoid potential fines.

If you have any questions about GDPR compliance or the assessment of fines, our experienced law firm will be glad to advise you.

Find out more