News
Waiting for Cjeu Ruling in the Matter of “Deutsche Wohnen” (C-807/21)
Since the end of December 2021, the preliminary ruling of the European Court of Justice (CJEU) on the conditions under which an administrative fine may be imposed on a legal entity for violating the GDPR has been pending. Since then, the Austrian Data Protection Authority and the administrative courts have suspended all proceedings against legal persons who have violated the GDPR pending the decision of the CJEU. This decision is now expected to be rendered on December 5, 2023.
1. CASE FACT
Deutsche Wohnen SE ("Deutsche Wohnen") is a listed real estate company based in Berlin that indirectly owns approximately 163,000 residential units and 3,000 commercial units. The operational business and management are carried out by subsidiaries. The subsidiaries process personal data relating to tenants, including copies of IDs, bank statements, salary statements, tax, social security and health insurance data.
In 2017, following an on-site inspection of Deutsche Wohnen, the Berlin Data Protection Authority objected to the fact that the group companies were storing tenants' personal data in an electronic archiving system that was no longer required. As a result, the Berlin Data Protection Commissioner ordered Deutsche Wohnen to delete the data from the archive system – but the data was still there until 2020. As a result, the data protection authority fined Deutsche Wohnen more than 14 million euros for intentionally violating the data processing principles of lawfulness, data minimization, and storage limitation.
The Berlin Regional Court discontinued the proceedings due to the lack of a chargeable administrative offense. Since Deutsche Wohnen, as a legal entity, could not have committed an administrative offense itself, an administrative offense committed by a member of the legal entity's executive body must be established. Direct liability of the corporation, i.e., regardless of any fault attributable to a natural person, would contradict the principle of culpability enshrined in German law. The Berlin Public Prosecutor's Office objected to this decision, and the Berlin Court of Appeal requested a preliminary ruling from the CJEU on the interpretation of Article 83(4) to (6) GDPR.
In its previous case law pursuant to Article 30 of the Austrian Data Protection Act, the Austrian Higher Administrative Court also sees the need to determine the constitutive, unlawful and culpable conduct of a natural person in order to impose a fine on a legal person for a violation of the GDPR. Therefore, since the beginning of 2022, all administrative criminal proceedings in Austria regarding GDPR violations by legal persons have been suspended until the CJEU publishes its decision in the Deutsche Wohnen case.
2. OPINION OF THE ADVOCATE GENERAL
According to the opinion of Advocate General Campos Sánchez-Bordona of April 27, 2023, the CJEU has the rare opportunity to rule on the conditions under which an administrative fine may be imposed on a legal person for a violation of the GDPR. In particular, the CJEU must determine whether a penalty can be imposed on a legal person without establishing the liability of a natural person, and whether the infringement must be committed intentionally or negligently, or whether the mere fact of an infringement is sufficient to impose a penalty.
Advocate General Sánchez-Bordona argues that the GDPR allows for direct liability of companies for data protection violations. He states that this is in line with the objective of the GDPR, which is to create an effective and dissuasive sanctioning mechanism that harmonizes the different national legal systems. He points out that Article 83 of the GDPR must be interpreted in such a way that an administrative fine can be imposed on a legal entity without having to prove the infringement of a natural person acting on behalf of that legal entity. He adds, however, that an administrative fine would require that the causal conduct be intentional or negligent. These two aspects seem somewhat contradictory since any "causal intentional or negligent conduct" can only be committed by a natural person. The Advocate General's opinion leaves open how this shall be handled in practice.
3. CONCLUSION
The Advocate General's opinion is not binding on the CJEU, but it often gives an indication of the direction of the final decision. If the CJEU follows the opinion, it would mean that the mere fact that a company violates the rules of the GDPR would not be enough to justify administrative fines. The CJEU is expected to deliver its judgment on December 5, 2023. The decision could have a significant impact on the practices of data protection authorities in the EU, potentially leading to an increase in fines.
The opinion of the Advocate General can be accessed here in different languages:
https://curia.europa.eu/juris/documents.jsf?nat=or&mat=or&pcs=Oor&jur=C%2CT%2CF&num=C-807%252F21&for=&jge=&dates=&language=de&pro=&cit=none%252CC%252CCJ%252CR%252C2008E%252C%252C%252C%252C%252C%252C%252C%252C%252C%252Ctrue%252Cfalse%252Cfalse&oqp=&td=%3BALL&avg=&lgrec=de&page=1&lg=&cid=3801407
Article provided by INPLP member: Stephan Winklbauer (Aringer Herbst Winklbauer Rechtsanwälte, Austria)
Discover more about the INPLP and the INPLP-Members
Dr. Tobias Höllwarth (Managing Director INPLP)
News Archiv
- Alle zeigen
- April 2024
- März 2024
- Februar 2024
- Jänner 2024
- Dezember 2023
- November 2023
- Oktober 2023
- September 2023
- August 2023
- Juli 2023
- Juni 2023
- Mai 2023
- April 2023
- März 2023
- Februar 2023
- Jänner 2023
- Dezember 2022
- November 2022
- Oktober 2022
- September 2022
- August 2022
- Juli 2022
- Mai 2022
- April 2022
- März 2022
- Februar 2022
- November 2021
- September 2021
- Juli 2021
- Mai 2021
- April 2021
- Dezember 2020
- November 2020
- Oktober 2020
- Juni 2020
- März 2020
- Dezember 2019
- Oktober 2019
- September 2019
- August 2019
- Juli 2019
- Juni 2019
- Mai 2019
- April 2019
- März 2019
- Februar 2019
- Jänner 2019
- Dezember 2018
- November 2018
- Oktober 2018
- September 2018
- August 2018
- Juli 2018
- Juni 2018
- Mai 2018
- April 2018
- März 2018
- Februar 2018
- Dezember 2017
- November 2017
- Oktober 2017
- September 2017
- August 2017
- Juli 2017
- Juni 2017
- Mai 2017
- April 2017
- März 2017
- Februar 2017
- November 2016
- Oktober 2016
- September 2016
- Juli 2016
- Juni 2016
- Mai 2016
- April 2016
- März 2016
- Februar 2016
- Jänner 2016
- Dezember 2015
- November 2015
- Oktober 2015
- September 2015
- August 2015
- Juli 2015
- Juni 2015
- Mai 2015
- April 2015
- März 2015
- Februar 2015
- Jänner 2015
- Dezember 2014
- November 2014
- Oktober 2014
- September 2014
- August 2014
- Juli 2014
- Juni 2014
- Mai 2014
- April 2014
- März 2014
- Februar 2014
- Jänner 2014
- Dezember 2013
- November 2013
- Oktober 2013
- September 2013
- August 2013
- Juli 2013
- Juni 2013
- Mai 2013
- April 2013
- März 2013
- Februar 2013
- Jänner 2013
- Dezember 2012
- November 2012
- Oktober 2012
- September 2012
- August 2012
- Juli 2012
- Juni 2012
- Mai 2012
- April 2012
- März 2012
- Februar 2012
- Jänner 2012
- Dezember 2011
- November 2011
- Oktober 2011
- September 2011
- Juli 2011
- Juni 2011
- Mai 2011
- April 2011
- März 2011
- Februar 2011
- Jänner 2011
- November 2010
- Oktober 2010
- September 2010
- Juli 2010