Judgment;Abstract — ECLI:EU:C:2023:950
Date: 2023-12-05
Language of the case: German
Court formation: Grand Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Germany

Summary C-807/21 – 1 
Case C-807/21 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
21 December 2021 
Referring court: 
Kammergericht (Germany) 
Date of the decision to refer: 
6 December 2021 
Concerned party: 
Deutsche Wohnen SE 
Appellant: 
Staatsanwaltschaft Berlin 
  
Subject matter of the main proceedings 
Proceedings for an administrative fine initiated against the concerned party as an 
undertaking in relation to breaches of data protection legislation 
Subject matter and legal basis of the request 
The preliminary ruling proceedings under Article 267 TFEU concern the 
interpretation of Article 83 of Regulation (EU) 2016/679 of the European 
Parliament and of the Council of 27 April 2016 on the protection of natural 
persons with regard to the processing of personal data and on the free movement 
of such data, and repealing Directive 95/46/EC (General Data Protection 
Regulation – ‘the GDPR’) with regard to the imputability of administrative 
offences to undertakings 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-807/21 
 
2  
Questions referred for a preliminary ruling 
1. Is Article 83(4) to (6) of the GDPR to be interpreted as incorporating into 
national law the functional concept of an undertaking, as defined in Articles 101 
and 102 TFEU, and the principle of an economic entity, with the result that 
proceedings for an administrative fine may be initiated directly against an 
undertaking by broadening the principle of legal entity forming the basis of 
Paragraph 30 of the Gesetz über Ordnungswidrigkeiten (Law on administrative 
offences; ‘the OWiG’) and that the imposition of a fine does not require a finding 
that a natural and identified person committed an administrative offence, if 
necessary in satisfaction of the objective and subjective elements of tortious 
liability? 
2. If Question 1 is answered in the affirmative: Is Article 83(4) to (6) of the 
GDPR to be interpreted as meaning that the undertaking must have intentionally 
or negligently committed the breach by an employee vicariously (see Article 23 of 
Council Regulation (EC) No 1/2003 of 16 December 2002 on the implementation 
of the rules on competition laid down in Articles 81 and 82 of the Treaty), or is the 
objective fact of breach of obligations caused by it sufficient, in principle, for a 
fine to be imposed on that undertaking (‘strict liability’)? 
Provisions of European Union law relied on 
TFEU, Article 26(1), Articles 101, 102, 132 
Regulation 2016/679, recitals 9 to 11, 13, 129, 148 and 150, Article 4(7), 
Article 5(1)(a), (c) and (e), Article 6(1), Article 25(1), Article 83; 
Regulation No 1/2003, Article 23; 
Regulation No 2532/98; 
Directive 95/46/EC, Article 2(d). 
Provisions of national law relied on 
Grundgesetz (German Basic Law; ‘the GG’), Article 1, the third sentence of 
Article 23(1), Article 79(3), Article 103(2); 
Law on administrative offences, Paragraphs 9, 17, 30, 35, 36, 46(1), 56 to 58, 
66(1), 87, 88, 99 and 100; 
Bundesdatenschutzgesetz (Federal Law on data protection; ‘the BDSG’), 
Paragraph 41(1) and (2); 
Strafprozessordnung (Code of Criminal Procedure, ‘the StPO’), Paragraph 206. 
DEUTSCHE WOHNEN 
 
3 
Succinct presentation of the facts and procedure in the main proceedings 
1 The undertaking concerned is a public listed real estate enterprise having its 
registered office in Berlin. It indirectly holds participating interests in 
approximately 163 000 housing units and 3 000 commercial units. The owners of 
these units are subsidiaries of the undertaking concerned and manage the 
operational side of the business in their capacity as ‘holding companies’. The 
business activities of the undertaking concerned are focused on higher 
management. The holding companies lease the housing and commercial units that 
are managed by other group companies, which are known as service companies. 
2 As part of their business activities, the undertaking concerned and its group 
companies also handle personal data relating to the tenants of their housing and 
commercial units, for example when re-letting a property or as part of the day-to-
day management of an existing tenancy arrangement. These data include proof of 
identity, tax, social and health insurance data, and information relating to previous 
tenancies. 
3 On 23 June 2017, the Berlin Commissioner for Data Protection (‘the authority’) 
informed the undertaking concerned during an on-the-spot check that companies 
within its group were storing the personal data of tenants in an electronic archive 
system in relation to which it could not be ascertained whether storage was 
necessary and that did not guarantee the erasure of data that were no longer 
required. The authority then requested the undertaking concerned to delete the 
documents from the electronic archive system before the end of 2017. The 
undertaking concerned refused to do so, stating that deletion was impossible for 
technical and legal reasons. In particular, deleting the documents would first 
require the old archive data to be transferred to a new archive system that is 
compliant with statutory retention obligations under commercial and tax law. The 
undertaking concerned and the authority then entered into an oral and written 
exchange concerning the deletion order. 
4 On 5 March 2020, the authority carried out an inspection at the corporate 
headquarters of the group, during which a total of 16 samples were taken from the 
data pool. The undertaking concerned informed the authority that the archive 
system objected to had already been decommissioned and that the data would be 
migrated to the new system imminently. The administrative penalty order, adopted 
on 30 October 2020, complains that, in the period from 25 May 2018 to 5 March 
2019, the undertaking concerned deliberately omitted to take the necessary 
measures to allow the proper deletion of tenant data that were no longer required 
or were otherwise wrongly stored. It is also alleged to have continued to store 
personal data relating to at least 15 named tenants, even though it was known that 
this was not necessary or was no longer necessary. For the intentional 
infringement of Article 25(1) and Article 5(1)(a), (c) and (e) of the GDPR, the 
authority imposed a pecuniary penalty of EUR 14 385 000, as well as 15 further 
pecuniary penalties each ranging from EUR 3 000 to EUR 17 000 for 
infringements of Article 6(1) of the GDPR. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-807/21 
 
4  
5 Following an objection by the undertaking concerned, the Landgericht Berlin 
(Regional Court, Berlin) discontinued the proceedings pursuant to 
Paragraph 46(1) of the OWiG, read in conjunction with Paragraph 206a of the 
StPO, on the grounds that a legal person could not be the party concerned by 
proceedings for an administrative fine, not even in proceedings pursuant to 
Article 83 of the GDPR. Only a natural person can culpably commit an 
administrative offence. Only acts committed by members of its executive bodies 
or its representatives can be imputed to the legal person. In proceedings for an 
administrative fine, a legal person can therefore be only a participant. The 
imposition of a pecuniary penalty on a legal person is comprehensively governed 
by Paragraph 30 of the OWiG, which also applies, through Paragraph 41(1) of the 
BDSG, to breaches in accordance with Article 83(4) to (6) of the GDPR. 
Accordingly, a pecuniary penalty could be imposed either in unified proceedings 
against the legal person, where proceedings for an administrative fine are initiated 
against its executive body or representatives, i.e. natural persons, or else in stand-
alone proceedings in accordance with Paragraph 30(4) of the OWiG. In the case 
referred to in Paragraph 30(4) of the OWiG, the prerequisite for this is that 
proceedings must not have been initiated against the executive body or 
representatives of the legal person or, if initiated, any such proceedings must be 
discontinued. However, given that a legal person cannot commit an administrative 
offence, an administrative offence culpably committed by a member of the 
executive body of the legal person must also be established in the stand-alone 
proceedings. The direct liability of undertakings, as codified in Article 83 of the 
GDPR, is contrary to the principle of fault enshrined in German law and therefore 
cannot be applied. 
6 The Berlin Public Prosecutor’s Office lodged an immediate appeal against the 
discontinuation of the proceedings, on which appeal the referring court is called 
upon to rule at final instance. 
Succinct presentation of the reasoning in the request for a preliminary ruling 
7 The question as to whether proceedings for an administrative fine may be initiated 
directly against an undertaking or whether the imposition of a pecuniary penalty 
on an undertaking that is ‘party to’ or ‘a participant in’ the proceedings may be 
permitted under Paragraph 30(1) of the OWiG only if a natural person has, in his 
or her capacity as representative, committed the ‘immediate offence’ specifically 
named in the administrative fine order is of decisive importance for the case. 
8 Under Article 66(1) of the OWiG, an administrative fine order must contain ‘a 
description of the offence alleged against the party concerned, the time and place 
where it was committed, the legal characteristics of the administrative offence, 
and the provisions on the administrative penalties applied’. Thus, the 
administrative fine order must state formally and objectively the accusation 
(circumscribing function) and must sufficiently inform the party concerned of the 
accusation made against it (information function). 
DEUTSCHE WOHNEN 
 
5 
9 As the law now stands, association penalties may be imposed on undertakings in 
accordance with Paragraph 30 of the OWiG only if certain administrative offences 
may (only) be imputed to them through managers who have been appointed as 
their representatives. In so doing, the representative must have factually, 
unlawfully and culpably infringed the provision that is subject to an administrative 
fine. 
10 In the case-law of the Landgericht Bonn (Regional Court, Bonn) the view has 
been taken that this restricted system of liability is superseded by Article 83 of the 
GDPR as primary EU law. That view is also largely shared in legal literature. 
11 The prevailing opinion in legal literature infers from the primacy of EU law that 
Article 83 of the GDPR lays down guiding legislative principles for imposing 
penalties on undertakings. Therefore, the imputation of infringements must be 
governed by the criteria of EU law and not by reference to national principles on 
imputation. Therefore, the national rules of the Member States must not, in 
principle, lower the level of data protection established by the GDPR. The 
structure for punishing infringements in EU law, which has evolved historically in 
the presence of undistorted competition and a functioning internal market as per 
Article 26(1) TFEU and is substantiated in EU banking law (Article 132 TEU and 
Regulation (EC) No 2532/98) and EU cartel law (Articles 101 and 102 TFEU and 
Regulation (EC) No 1/2003), is quite different from German law. According to the 
settled case-law of the Court of Justice of the European Union, the EU law 
concept of an undertaking as set out in Articles 101 and 102 TFEU is a functional 
one. This functional concept of an undertaking correlates with the functionary 
principle, which is contrary to the German principle of legal entity (Paragraphs 9 
and 30 of the OWiG). The very essence of the functionary principle is that of 
assigning the ‘material liability for penalties’ to the undertaking (as an economic 
unit largely understood according to practical needs), meaning that the actions of 
all employees authorised to act on behalf of that undertaking can also be imputed 
to the undertaking under the law on administrative penalties. In this regard, it is 
not necessary to specifically identify the employee or the alleged act. 
12 The Regional Court, Bonn and the prevailing view taken in the literature rely on 
the following arguments: 
13 The wording of Article 83(4) to (6) of the GDPR supports the primacy of EU law 
on penalties for cartels over Paragraph 30 of the OWiG. The Court has previously 
ruled that an undertaking such as ‘Facebook Ireland’ is a controller within the 
meaning of Article 4(7) of the GDPR (judgment of 29 July 2019, Fashion ID, 
C-40/17, EU:C:2019:629). Although that decision was adopted in relation to 
Article 2(d) of Directive 95/46, it should be taken into account when interpreting 
Article 4(7) of the GDPR, which is worded almost identically. The opposing view 
relies on the fact that Article 83(4) to (6) of the GDPR governs only the amount of 
the administrative fine, and thus cannot extend the group of addressees of that 
fine. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-807/21 
 
6  
14 The Regional Court, Bonn, and a number of legal commentators also cite 
recital 150 to the GDPR in support of the view that the GDPR borrows from EU 
cartel law. The English version of that regulation uses the concept of an 
‘undertaking’ as per EU cartel law, rather than an ‘enterprise’. It can be inferred 
from this that the functionary principle should be applied as a European model of 
penalties and that the concept of ‘undertakings’ within the meaning of Article 83 
of the GDPR refers not to the legal entity but, from a functional point of view, to 
the economic unit. 
15 Recitals 9 to 11, 13, 129 and 148 to the GDPR follow along the same lines, 
suggesting efforts are being made to harmonise and reinforce EU data protection 
law. 
16 The degree of harmonisation being sought also militates in favour of the primacy 
of EU law over the law of the Member States and their rules restricting the 
imputation of liability in respect of undertakings. If Article 83(4) to (6) of the 
GDPR were linked to national rules on liability and imputation, the result would 
be a highly inconsistent system of penalties for undertakings, both as regards the 
substantive and procedural scope and the effectiveness of proceedings. The 
application of Paragraph 30 of the OWiG and further restrictions on imputation 
laid down by national legislation would make it considerably more difficult to 
enforce the law. In practice, the application of Paragraph 30 of the OWiG often 
prevents pecuniary penalties from being imposed on undertakings, and not just in 
the field of data protection, because the persons acting internally within an 
undertaking cannot be identified or can only be identified with disproportionate 
effort. It is precisely these disadvantages of the principle of legal entity as regards 
the protection of legal rights that additionally aid the unlawful unequal treatment 
of undertakings, prompting the EU legislature to incorporate the fairer, more 
effective and simply more powerful functionary principle model into the GDPR. 
17 It is apparent from a systematic and historical assessment that the degree of 
harmonisation sought by the GDPR is not a minimum level, but rather absolute or 
maximum harmonisation. The Court has already recognised the perfectly 
harmonised effect of Directive 95/46 and its system of penalties (judgment of 
24 November 2011, ASNEF, C-468/10 and C-469/10, EU:C:2011:777). The 
provisions of the GDPR, which are more detailed than those contained in the 
directive, confirm that the EU legislature’s intention was to achieve the greatest 
possible degree of harmonisation. In so doing, it reduced the legislative leeway 
afforded to the Member States, meaning that it is difficult to imagine that 
fundamental conditions of liability, such as questions of imputation, would be left 
to the discretion of the Member States. This would have the effect of changing the 
penalties for material breaches of data protection legislation in several Member 
States, or even removing such penalties completely. 
18 According to the opposing view expressed in the legal literature, an interpretation 
of Article 83 of the GDPR as providing for the direct liability of undertakings with 
reference to EU law on the penalties for cartels is contrary to national law and to 
DEUTSCHE WOHNEN 
 
7 
internationally recognised legal principles. Article 83 of the GDPR does not 
borrow from EU law on the penalties for cartels, but even if this were the case, EU 
law would still not have primacy. This primacy is in fact restricted by the 
principles of the German Constitution, as ‘laid down’ in the third sentence of 
Article 23(1) of the GG, read in conjunction with Article 79(3) of the GG. The 
protected interests of the constitutional identity set out in the present case also 
include the principles set out in Article 1 of the GG, namely the obligation of all 
public authorities to respect and protect human dignity (the second sentence of 
Article 1(1) of the GG) and consequently also the principle of fault enshrined in 
Article 1(1) of the GG. 
19 The first sentence of Paragraph 41(1) of the BDSG prevents proceedings for an 
administrative fine being initiated against legal persons. This states that the 
provisions of the OWiG apply correspondingly to breaches in accordance with 
Article 83(4) to (6) of the GDPR, ‘unless otherwise provided for in this law’. The 
second sentence of Paragraph 41(1) of the BDSG expressly excludes 
Paragraphs 17, 35 and 36 of the OWiG. As regards procedural law, Article 41(2) 
of the BDSG contains a similar rule excluding Paragraphs 56 to 58, 87, 88, 99 and 
100 of the OWiG. 
20 This view in the legal literature therefore infers that proceedings for an 
administrative fine initiated in accordance with Article 83 of the GDPR must 
necessarily comply with the principles of imputation and legal procedure laid 
down in Paragraph 30 of the OWiG. 
21 In this context, the referring court notes that Paragraph 30 of the OWiG was not 
excluded from the reference made in Article 41 of the BDSG, contrary to the 
procedural rule in Paragraph 88 of the OWiG that is necessary for the procedural 
implementation of Paragraph 30 of the OWiG. Paragraph 41 of the BDSG is thus 
described as incoherent, dysfunctional and entirely ‘unsuccessful’. 
22 According to the legal literature, Article 83(8) of the GDPR also militates against 
the direct liability of undertakings. It (also) makes reference to the law of the 
Member States in order to ensure appropriate procedural safeguards, ‘including 
effective judicial remedy and due process’. Contrary to this view, it is argued that 
Paragraph 30 of the OWiG is – at least in terms of the central focus of the present 
case – a rule on imputation and consequently a substantive provision of law. 
23 It is also argued, in particular by the contested order discontinuing proceedings, 
that the direct liability of an undertaking under the law on administrative penalties 
infringes the principle of fault. The Regional Court, Berlin, takes the view that 
public sentencing always requires a link to the culpable act committed by a natural 
person. Fault presupposes the freedom of will and the responsibility of the 
individual to decide on right or wrong. That is not the case with legal persons. In 
the light of the principle of fault, proceedings for an administrative fine initiated in 
accordance with Article 83 of the GDPR also require a connecting act committed 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-807/21 
 
8  
by an individual that could be imputed to the undertaking (only) under 
Paragraph 30 of the OWiG. 
24 Some sections of the literature also argue that an adaptation of EU cartel law by 
the GDPR would also infringe other aspects of the principle of legality, namely 
the principle of legal certainty and the prohibition of analogy (Article 103(2) of 
the GG). EU law on fines is so fragmentary that it cannot be used to derive a 
consistent, universal model of association fines. 
25 If the answer to the first question referred for a preliminary ruling is in the 
affirmative, the criteria for determining ‘corporate fault’ are of crucial importance 
for the further course of the proceedings. Under German law, therefore, pecuniary 
penalties that are not criminal in nature may be imposed on undertakings that 
have – either intentionally or negligently – breached certain obligations. However, 
it is also argued in this respect that intent and negligence are not preconditions for 
a fine, but rather purely imputability criteria. Under the principle of ‘strict 
liability’, a fine requires only the finding of an objective breach of obligations. 
The Court has already ruled that a specific fault is not actually required beyond 
objective participation in the offence (judgment of 7 June 1983, Musique 
Diffusion française v Commission, C-100/80 to C-103/80, EU:C:1983:158).