62021CJ0807_RES
Case C‑807/21
Deutsche Wohnen SE
v
Staatsanwaltschaft Berlin
(Request for a preliminary ruling from the Kammergericht Berlin)
Judgment of the Court (Grand Chamber) of 5 December 2023
(Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Article 58(2) – Powers of supervisory authorities to apply corrective measures – Article 83 – Imposition of administrative fines on a legal person – Conditions – Discretion of the Member States – Requirement that the infringement be intentional or negligent)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Imposition of administrative fines – Conditions – No discretion of the Member States to lay down the substantive conditions concerning the imposition of an administrative fine on a controller – Relevance of the concept of an undertaking within the meaning of Articles 101 and 102 TFEU limited to the calculation of a fine – National legislation making the possibility of imposing a fine on a legal person in its capacity as controller subject to the condition that the infringement in question has previously been attributed to an identified natural person – Not permissible
(Arts 101, 102, 288, second para., TFEU; European Parliament and Council Regulation 2016/679, recitals 10, 11, 74, 129 and 150 and Arts 4(7), 58(2) and (4), and 83)
(see paragraphs 38, 43-60, operative part 1)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Concept of controller – Legal persons – Included – Condition – Actual participation in the determination of the purposes and means of processing
(European Parliament and Council Regulation 2016/679, Art. 4(7))
(see paragraphs 39-42)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Imposition of administrative fines – Conditions – No discretion of the Member States to lay down the substantive conditions concerning the imposition of an administrative fine on a controller – Requirement that the controller committed the infringement intentionally or negligently
(European Parliament and Council Directive 2016/679, recitals 9, 13 and 148 and Arts 58(2) and 83)
(see paragraphs 65-78, 86, operative part 2)
Résumé
Deutsche Wohnen SE (‘DW’) is a real estate company which holds, indirectly via participating interests in various companies, a large number of commercial and housing units. As part of its business activities, it processes personal data of tenants of those units.
Following two inspections carried out in 2017 and in 2019, le Berliner Beauftragte für den Datenschutz (Berlin Data Protection Authority, Germany) found that DW had committed a series of infringements of the GDPR. (
1
) By decision of 30 October 2019, that supervisory authority imposed administrative fines in respect of such infringements.
DW brought an action against that decision before the Landgericht Berlin (Regional Court, Berlin, Germany), which closed the proceedings without taking further action. That court observed that, under German law, (
2
) a finding of an administrative infringement can be made only against a natural person and not against a legal person. In addition, in a situation involving a legal person incurring liability, only the actions of representatives of the legal person or of members of bodies thereof can be attributed to that legal person. The Staatsanwaltschaft Berlin (Berlin Public Prosecutor’s Office) brought an appeal against that decision before the Kammergericht Berlin (Higher Regional Court, Berlin, Germany). In that context, that court made a reference to the Court of Justice for a preliminary ruling on the interpretation of the GDPR. (
3
)
In its judgment, the Grand Chamber of the Court rules on the conditions for imposing administrative fines under the GDPR. In the first place, it examines the question whether the Member States may make the imposition of an administrative fine on a legal person subject to the condition that the infringement of that regulation must first be attributed to an identified natural person. In the second place, it addresses the question whether the infringement of the provisions of the GDPR in relation to which a penalty was imposed must be committed intentionally or negligently. (
4
)
Findings of the Court
As regards the imposition of an administrative fine under the GDPR on a legal person, the Court states, first of all, that the principles, prohibitions and obligations laid down by the GDPR are directed, in particular, at ‘controllers’, whose responsibility extends to any processing of personal data which they carry out themselves or which is carried out on their behalf. It is that liability which forms, in the event of infringement of the provisions of the GDPR, the basis for the imposition of an administrative fine on the controller pursuant to Article 83 of that regulation. However, the EU legislature did not distinguish, for the purposes of determining such liability, between natural persons and legal persons, that liability being subject to the sole condition that those persons, alone or jointly with others, determine the purposes and means of processing of personal data. (
5
) Consequently, as a rule, any person meeting that condition is responsible, inter alia, for any infringement of the GDPR which is committed by that person or on behalf of that person. That implies, first, that legal persons are liable not only for infringements committed by their representatives, directors or managers, but also by any other person acting in the course of the business of those legal persons and on their behalf. Second, the administrative fines provided for by the GDPR in respect of such infringements must be capable of being imposed directly on legal persons where they may be classified as controllers.
Next, the Court observes that no provision of the GDPR permits the inference that the imposition of an administrative fine on a legal person as a controller is subject to a previous finding that that infringement was committed by an identified natural person. In addition, the EU legislature did not provide the Member States with a margin of discretion in that regard. The fact that the GDPR provides them with the possibility to lay down requirements concerning the procedure to be followed by the supervisory authorities in order to impose an administrative fine (
6
) in no way means that they are also authorised to lay down substantive conditions over and above those set by the GDPR.
In that context, the Court clarifies that to allow Member States to make it a requirement, unilaterally and as a necessary condition for the imposition of an administrative fine pursuant to Article 83 of the GDPR on a controller who is a legal person, that the infringement in question is first attributed or attributable to an identified natural person, would be contrary to the purpose of the GDPR. In addition, such an additional requirement would, ultimately, risk weakening the effectiveness and deterrent effect of administrative fines imposed on legal persons as controllers.
Lastly, the Court points out that the concept of an ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, (
7
) has no bearing on whether and under what conditions an administrative fine may be imposed pursuant to the GDPR on a controller who is a legal person and is relevant only for the purpose of determining the amount of such a fine.
Accordingly, the Court concludes that the GDPR (
8
) precludes national legislation under which an administrative fine may be imposed on a legal person in its capacity as controller in respect of an infringement of that regulation (
9
) only in so far as that infringement has previously been attributed to an identified natural person.
As regards the question whether the Member States may provide for an administrative fine to be imposed even where the infringement in respect of which a penalty has been imposed has not been committed intentionally or negligently, the Court recalls, first of all, that the substantive conditions which a supervisory authority must satisfy when it imposes such a fine on a controller are governed solely by EU law and that the Member States have no discretion in that regard.
As regards those conditions, the Court notes that the factors listed in the GDPR to which the supervisory authority is to have regard when imposing such a fine include ‘the intentional or negligent character of the infringement’. (
10
) By contrast, none of those factors mention any possibility that the controller will incur liability in the absence of wrongful conduct on its part. Accordingly, only infringements of the provisions of the GDPR committed by the controller intentionally or negligently can result in a fine being imposed on the controller pursuant to Article 83 of that regulation.
The Court adds that that interpretation is supported by the general scheme and purpose of the GDPR. In that context, it states that the existence of a system of penalties under the GDPR making it possible to impose, where justified by the specific circumstances of each individual case, an administrative fine creates an incentive for controllers and processors to comply with that regulation and that, through their deterrent effect, administrative fines contribute to strengthening the protection of data subjects. However, the EU legislature did not consider it necessary to provide for administrative fines to be imposed in the absence of wrongdoing. In view of the fact that the GDPR aims for a level of protection which is both equivalent and homogeneous, and that it must, to that end, be applied consistently throughout the European Union, it would be contrary to that purpose to allow Member States to provide such a system for the imposition of a fine.
Therefore, the Court finds that, under Article 83 of the GDPR, an administrative fine may be imposed only where it is established that the controller, which is both a legal person and an undertaking, intentionally or negligently, committed an infringement of the rules contained in that regulation.
(
1
)	Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’).
(
2
)	Gesetz über Ordnungswidrigkeiten (Law on administrative offences) of 24 May 1968 (BGBl. 1968 I, p. 481), in the version in the Communication of 19 February 1987 (BGBl. 1987 I, p. 602), as amended by the Law of 19 June 2020 (BGBl. 2020 I, p. 1350).
(
3
)	Article 58(2) and Article 83 of the GDPR.
(
4
)	In that regard, see also judgment of 5 December 2023, Nacionalinis visuomenės sveikatos centras (C‑683/21, EU:C:2023:949), delivered on the same day.
(
5
)	In accordance with Article 4(7) of the GDPR.
(
6
)	As is apparent from Article 58(4) and Article 83(8) of the GDPR, read in the light of recital 129 thereof.
(
7
)	To which reference is made in recital 150 of the GDPR.
(
8
)	See Article 58(2)(i) and Article 83(1) to (6) of the GDPR.
(
9
)	Referred to in Article 83(4) to (6) of the GDPR.
(
10
)	Article 83(2)(b) of the GDPR.