In brief: The CJEU ruled that GDPR fines are based on the total turnover of the economic entity (group), not on the individual company’s turnover. This applies to the maximum penalty; the actual fine-setting remains the task of supervisory authorities.
The Court of Justice of the European Union has decided: When determining GDPR fines, the total turnover of the economic entity is decisive – not merely the turnover of the individual company. A fundamental decision with far-reaching implications for corporate groups.
The Court of Justice of the European Union (CJEU) issued an important clarification on the calculation of data protection fines in its judgment of 13 February 2025 (C-383/23). The central question was whether the turnover of the individual company or that of the entire corporate group should be used in calculating GDPR fines.
The case concerned the Danish company ILVA A/S, a company within the Lars Larsen Group. The Danish authority imposed a fine of 1.5 million Danish kroner (approximately 201,000 euros) for alleged GDPR violations. The calculation was based on the worldwide turnover of the entire Larsen Group. However, the competent court reduced the fine to 100,000 Danish kroner (approximately 13,400 euros), since only the individual company ILVA A/S was prosecuted.
The CJEU now confirms a fundamental principle: The term “enterprise” in Articles 83(4) to (6) of the GDPR must be interpreted in the sense of Articles 101 and 102 TFEU. This means that an enterprise constitutes an economic entity which – even if it consists of several natural or legal persons – has permanent common personnel, material and immaterial resources at its disposal for the pursuit of a single economic purpose.
For fine calculation, this has a clear consequence: The maximum penalty of a GDPR fine must be calculated on the basis of the total turnover of the entire economic entity in the preceding financial year.
The CJEU emphasizes an important distinction: a distinction must be made between the maximum limit of the fine – which is generally based on the total turnover of the group – and the concrete fine calculation in the individual case. The actual determination of the fine is carried out by the competent supervisory authority taking into account all circumstances of the case.
Source: www.activemind.legal