Opinion of the Advocate General — ECLI:EU:C:2024:752
Date: 2024-09-12
Language of the case: Danish
Procedure: Reference for a preliminary ruling
Origin: Denmark

Translation C-383/23 – 1 
Case C-383/23 
Request for a preliminary ruling 
Date lodged:  
21 June 2023 
Referring court:  
Vestre Landsret (Denmark) 
Date of the decision to refer:  
3 May 2023 
Appellant: 
Anklagemyndigheden 
Respondent:  
ILVA A/S 
  
… Anklagemyndigheden (Public Prosecutor) v 
ILVA A/S 
… Order: 
By judgment of the Retten i Aarhus (Aarhus District Court) of 12 February 2021, 
ILVA A/S was fined DKK 100 000 for infringement of Article 5(1)(e) and (2) of 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (‘the GDPR’), in conjunction with Articles 4(1) and 6 thereof, by 
having, in a period from May 2018 to January 2019, failed to fulfil its obligations 
as controller in relation to the retention of personal data concerning no less than 
350 000 former customers. 
The judgment of the Retten i Aarhus was appealed by the Public Prosecutor 
before the Vestre Landsret (High Court of Western Denmark), which is now 
hearing the criminal case. In that connection, the Vestre Landsret has decided to 
refer a question to the Court of Justice of the European Union concerning the 
interpretation of Article 83(5) of the GDPR. 
EN 
REQUEST FOR A PRELIMINARY RULING OF 3. 5. 2023 – CASE C-383/23 
 
2  
The Vestre Landsret considers that uncertainty may arise as to whether the term 
‘undertaking’ in Article 83(5) of the GDPR should be understood as meaning that, 
when setting a fine for an undertaking’s infringement of the GDPR, regard must 
be had to the turnover of the group of which the company forms part. 
Since clarification of this issue is necessary before the Vestre Landsret can give a 
ruling in the criminal proceedings, it has decided to stay the criminal proceedings 
pending a preliminary ruling of the Court of Justice of the European Union 
pursuant to Article 267 of the Treaty on the Functioning of the European Union 
(TFEU). 
Facts of the case 
1 ILVA A/S is charged before the Vestre Landsret with infringement of 
Article 83(2) and (5) of the GDPR, in conjunction with Article 83(9), 
Article 5(1)(e) and (2), Article 4(1) and Article 6 thereof, and Paragraph 41(1)(4) 
of lov nr. 502 af 23. maj 2018 om supplerende bestemmelser til forordning om 
beskyttelse af behandling af personoplysninger og om fri udveksling af sådanne 
oplysninger (Law No 502 of 23 May 2018 supplementing the regulation on 
protection with regard to the processing of personal data and on the free 
movement of such data), in conjunction with Paragraph 41(3) and (6) thereof, by 
having, in a period from May 2018 to January 2019, failed to fulfil its obligations 
as controller in relation to the retention of personal data concerning no fewer than 
350 000 former customers. 
2 ILVA A/S is part of the Lars Larsen Group. The group’s total turnover in the 
2016/2017 financial year amounted to [DKK] 6.57 billion. Of that, the turnover of 
the subsidiary ILVA A/S amounted to just under [DKK] 1.8 billion. 
3 If ILVA A/S is found to have infringed Article 5(1)(e) and (2) of the GDPR, in 
conjunction with Articles 4(1) and 6 thereof, the Vestre Landsret must impose a 
fine pursuant to Article 83(5) of the GDPR, in conjunction with Article 83(9) 
thereof. 
Procedure to date 
4 The Retten i Aarhus delivered its judgment at first instance on 12 February 2021. 
That court found ILVA A/S guilty as charged, but ruled that it had acted 
negligently rather than intentionally, contrary to what was alleged by the Public 
Prosecutor. 
5 The Retten i Aarhus imposed a fine of DKK 100 000 on ILVA A/S. As regards 
setting the amount of the fine, the grounds of the Retten i Aarhus are as follows: 
‘Acting on a recommendation by the Datatilsynet (Data Protection 
Commissioner), the Public Prosecutor claimed that a fine of DKK 1.5 
million should be imposed. According to the information provided by the 
Data Protection Commissioner and the Public Prosecutor, the turnover-
ILVA 
 
3 
related framework for estimating the amount of the fine is based not only on 
the turnover of the defendant, but on the total turnover of the entire Lars 
Larsen Group. 
In this case, charges have been brought only against the defendant, which is 
a subsidiary, and the Public Prosecutor stated during the proceedings that 
charges had not also been brought against the parent company, as there was 
no basis for doing so. It follows from the principle of prosecution laid down 
in Paragraph 883(3) of the Lov om rettens pleje (‘Administration of Justice 
Act’) that the court cannot hand down a conviction for any offence not 
covered by the indictment. It would be contrary to the principle laid down in 
that provision to attach significance to circumstances related to another 
person, against whom no charges had been brought, when passing a stricter 
sentence. This applies in particular in a situation such as the present, where 
the defendant runs an independent retail business and where it is therefore 
not the case that the parent company has set up a subsidiary with the sole 
purpose of transferring the group’s data processing to it. Consequently – and 
having regard to the fact that the wording of the offence in Article 83(5) of 
the GDPR refers to ‘an undertaking’ – there is, notwithstanding recital 150 
thereof, no basis for founding the calculation of the fine on the total turnover 
of the group. 
According to the case files, the defendant’s turnover was approximately a 
quarter of the group’s total turnover for the financial year 2016/2017. 
Against that background, and since the defendant, as stated above, has only 
been found guilty of negligently infringing the GDPR, the amount of the 
fine must be significantly lower than the amount sought by the Public 
Prosecutor. 
The court further considers that the Public Prosecutor and the Data 
Protection Commissioner, for the purposes of reducing the severity of the 
penalty, have failed to take due account of the attenuating circumstances 
which follow from Article 83(2) of the GDPR, including the fact it is a first 
infringement of the GDPR, that the information in question was of a general 
and not personal nature, that it was in an older and partly phased-out system 
which was accessed only occasionally, that no data subjects have suffered 
any damage, and that the offence – also in the view of the Data Protection 
Commissioner – was only of a formal nature. In addition, considerable 
weight must also be given in the assessment to the fact that it has been 
proven that the defendant made considerable efforts to ensure that the 
company’s many data systems, both IT and legal, were compliant with the 
rather complicated GDPR rules. 
Against this background, the court has considered whether the offence goes 
beyond the threshold of a statement of criticism – which in this legal context 
would be in the nature of a warning under Paragraph 900 of the 
Administration of Justice Act – or whether it is necessary under the 
REQUEST FOR A PRELIMINARY RULING OF 3. 5. 2023 – CASE C-383/23 
 
4  
circumstances to impose a fine on the defendant. However, in light of the 
general principle of sentencing in the GDPR according to which it must be 
ensured that infringements of the regulation are met with penalties which are 
effective, proportionate and dissuasive, the court finds – especially having 
regard to the significant amount of data which the defendant failed to 
anonymise or delete, and thus the significant number of data subjects 
affected by the infringement – that the defendant is liable to a fine. The 
travaux préparatoires for the Law on data protection (Draft Law No 68 of 
25 October 2017, Paragraph 2.8.3.7) envisages a ‘substantial increase’ in the 
level of fines for infringements of the GDPR compared to previous practice, 
which the travaux préparatoires (Paragraph 2.8.1.4) sets at a level of 
between DKK 2 000 and DKK 25 000, depending on the nature of the 
infringement. 
In the light of the foregoing, and after an overall assessment of all the 
attenuating circumstances set out above, the court finds that the defendant 
must be fined DKK 100 000 under Article 83(2) and (5) of the GDPR, in 
conjunction with Article 83(9), Article 5(1)(e) and (2), Article 4(1) and 
Article 6 thereof, and Paragraph 41(1)(4) of Law No 502 of 23 May 2018 
supplementing the regulation on protection with regard to the processing of 
personal data and on the free movement of such data, in conjunction with 
Paragraph 41(3) and (6) thereof.’ 
European Union law 
6 The case concerns the interpretation of Article 83(5) of Regulation (EU) 2016/679 
of the European Parliament and of the Council of 27 April 2016 on the protection 
of natural persons with regard to the processing of personal data and on the free 
movement of such data, and repealing Directive 95/46/EC (General Data 
Protection Regulation), in conjunction with recital 150 thereof. 
7 In that context, it should be noted that in May 2022 the European Data Protection 
Board (EDPB) adopted new guidelines on the calculation of fines which 
harmonise the methodology to be used by each supervisory authority. 
8 Also of relevance are Articles 101 and 102 of the Treaty on the Functioning of the 
European Union (TFEU), and Article 13 and recital 46 of Directive (EU) 2019/1 
of the European Parliament and of the Council of 11 December 2018 to empower 
the competition authorities of the Member States to be more effective enforcers 
and to ensure the proper functioning of the internal market. 
Issues of EU law and arguments of the parties 
Issues of EU law 
9 Article 83(5) of the GDPR states inter alia as follows: 
ILVA 
 
5 
‘Infringements of the following provisions shall, in accordance with 
paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in 
the case of an undertaking, up to 4% of the total worldwide annual turnover 
of the preceding financial year, whichever is higher: 
(a) the basic principles for processing, including conditions for consent, 
pursuant to Articles 5, 6, 7 and 9 …’ 
10 Article 4 of the GDPR contains a list of definitions of terms used in that 
regulation, but that list does not contain a definition of an ‘undertaking’. However, 
Article 4(18) and (19) contain the following definitions, which must be assumed 
to be related to an ‘undertaking’: 
‘(18) “enterprise” means a natural or legal person engaged in an economic 
activity, irrespective of its legal form, including partnerships or associations 
regularly engaged in an economic activity; 
(19) “group of undertakings” means a controlling undertaking and its 
controlled undertakings.’ 
Recital 150 of the GDPR states, inter alia, as follows: 
‘In order to strengthen and harmonise administrative penalties for 
infringements of this Regulation, each supervisory authority should have the 
power to impose administrative fines. This Regulation should indicate 
infringements and the upper limit and criteria for setting the related 
administrative fines, which should be determined by the competent 
supervisory authority in each individual case, taking into account all relevant 
circumstances of the specific situation, with due regard in particular to the 
nature, gravity and duration of the infringement and of its consequences and 
the measures taken to ensure compliance with the obligations under this 
Regulation and to prevent or mitigate the consequences of the infringement. 
Where administrative fines are imposed on an undertaking, an undertaking 
should be understood to be an undertaking in accordance with Articles 101 
and 102 TFEU for those purposes. Where administrative fines are imposed 
on persons that are not an undertaking, the supervisory authority should take 
account of the general level of income in the Member State as well as the 
economic situation of the person in considering the appropriate amount of 
the fine. The consistency mechanism may also be used to promote a 
consistent application of administrative fines. …’ 
11 In that regard, it should be noted that it follows, inter alia, from Article 83(9) of 
the GDPR that, where the legal system of a Member State does not provide for 
administrative fines – which is the case in Denmark, see recital 151 of the 
GDPR – the rules may be applied in such a manner that the fine is initiated by the 
competent supervisory authority and imposed by competent national courts, while 
ensuring that those legal remedies are effective and have an equivalent effect to 
REQUEST FOR A PRELIMINARY RULING OF 3. 5. 2023 – CASE C-383/23 
 
6  
the administrative fines imposed by supervisory authorities. In any event, the fines 
imposed are to be effective, proportionate and dissuasive. 
12 The reference in recital 150 to Articles 101 and 102 TFEU regarding the 
understanding of an ‘undertaking’ is a reference to the Treaty competition rules. 
13 It should be noted that EU law relating to the Treaty competition rules provides 
that, for the purpose of setting fines for infringements of the competition rules, the 
concept of an undertaking is to be understood as including undertakings in the 
same group. 
The arguments of the Public Prosecutor 
14 The term ‘undertaking’ in Article 83(5) of the GDPR must be understood as 
meaning that, when setting a fine for an infringement of the GDPR by an 
undertaking, regard must be had to the total turnover of the group of which that 
undertaking forms part. 
15 Thus, according to recital 150 of the GDPR the term ‘undertaking’ in 
Article 83(5) is to be understood to be an undertaking in accordance with 
Articles 101 and 102 TFEU (EU competition rules). 
16 Secondary competition law expressly states that, when setting fines, regard must 
be had to the total worldwide turnover of the group. In that connection, reference 
is made to Directive (EU) 2019/1 of the European Parliament and of the Council 
of 11 December 2018 to empower the competition authorities of the Member 
States to be more effective enforcers and to ensure the proper functioning of the 
internal market. 
17 According to recital 46 of that directive the notion of an ‘undertaking’, as 
contained in Articles 101 and 102 TFEU, which should be applied in accordance 
with the case-law of the Court of Justice, designates ‘an economic unit, even if it 
consists of several legal or natural persons’. 
18 Article 13(5) of the directive, which deals with fines on undertakings and 
associations of undertakings, provides that Member States are to ensure that the 
‘notion of undertakings’ (that is to say, the ‘economic unit’) is applied for the 
purpose of imposing fines on parent companies and legal and economic 
successors of undertakings. 
19 Against that background and acting on a recommendation by the Data Protection 
Commissioner, the Public Prosecutor is seeking the imposition of fine of DKK 1.5 
million based on the total turnover of the entire Lars Larsen Group. 
The arguments of ILVA A/S 
20 When setting a fine for an undertaking’s infringement of the GDPR, regard should 
not be had to the total turnover of the group of which the company forms part. 
ILVA 
 
7 
21 In this specific case, charges have only been brought against ILVA A/S, which is 
a subsidiary, and not against the parent company. 
22 Furthermore, the choice of turnover does not appear to be a necessary component 
of the court’s sentencing. Thus, the GDPR has not laid down rules or principles 
for the calculation of fines where the size of the turnover has a direct impact, and 
Article 83(5) of the GDPR only lays down the maximum limits for the amount of 
the fine. 
23 In addition, the wording of Article 83(5) of the GDPR refers to ‘an undertaking’, 
which is why – notwithstanding recital 150 of the Regulation – there is no basis 
for basing the calculation of the fine on the total turnover of the group. 
Background to the Vestre Landsret’s question 
Neither the Danish, French, German or English language versions of the GDPR 
help clarify whether, when setting a fine for an undertaking’s infringement of the 
GDPR, regard should be had to the turnover of the overall group of which the 
company forms part. 
The Court of Justice of the European Union does not appear to have had the 
opportunity to take a position on this matter. 
The Vestre Landsret accordingly finds that a ruling on the interpretation of the 
term ‘undertaking’ in Article 83(5) of the GDPR is necessary in order to allow it 
to rule on the criminal proceedings before it. 
Consequently, the Vestre Landsret has decided to stay the criminal appeal 
proceedings in order to make a reference for a preliminary ruling to the Court of 
Justice, pursuant to Article 267 TFEU. 
It is hereby ordered: 
The Vestre Landsret requests that the Court of Justice of the European Union 
answer the following questions: 
1. Must the term ‘undertaking’ in Article 83(4) to (6) of the General Data 
Protection Regulation be understood as an undertaking within the meaning of 
Articles 101 and 102 TFEU, in conjunction with recital 150 of that regulation, and 
the case-law of the Court of Justice of the European Union concerning EU 
competition law, so that the term ‘undertaking’ covers any entity engaged in an 
economic activity, regardless of that entity’s legal status and the way in which it is 
financed? 
2. If the answer to the Question 1 is in the affirmative, must Article 83(4) to (6) 
of the General Data Protection Regulation be interpreted as meaning that, when 
imposing a fine on an undertaking, regard must be had to the total worldwide 
REQUEST FOR A PRELIMINARY RULING OF 3. 5. 2023 – CASE C-383/23 
 
8  
annual turnover of the economic entity of which the undertaking forms part, or 
only the total worldwide annual turnover of the undertaking itself? 
…