Calculation of administrative fines under the GDPR -4

The House of Data Imperiali bulletins are extracts from the articles of the Legal Information Service (SIG) edited by Mr. Rosario Imperiali d’Afflitto.

The SIG is available by subscription only.

For further information, please email: segreteria@imperialida.com

The European Data Protection Board (EDPB) has released Guidelines 04/2022 on the calculation of administrative fines under the GDPR, submitting them for public consultation until June 27, 2022.

The Guidelines divide the logical process of determining administrative fines into steps:

the first, consisting of identifying how many conducts and infringements the fine is based upon. We covered this first step in the bulletin of June 16, 2022.
the second step, concerning the calculation of the theoretical fine, was analyzed in the bulletin of June 30, 2022. This calculation is made:
- by identifying the level of legal penalty level applicable to the specific case (i.e., whether it falls within the lowest level – €10 million or 2% of Total Worldwide Annual Turnover – or the highest level – €20 million or 4% of the Total Worldwide Annual Turnover
- assessing the seriousness of the infringement (nature, severity and duration of the infringement, malicious or negligent character, categories of personal data involved; see Art. 83(2)(a), (b) and (g) GDPR)
- or by determining the Total Worldwide Annual Turnover value of the offending organization.

Once the level of the theoretical penalty has been calculated, adjustments for the specific case can be made to it in succession, which are:

Step 3 – the application of relevant mitigating or aggravating factors. We covered this third step in the bulletin of July 14, 2022.
Step 4 – the determination of the Legal Maximum
Step 5 – the appreciation of the resulting fine with regard to the principle of effectiveness, dissuasiveness, and proportionality of punitive intervention.

In this round we will focus on the calculation of the Total Worldwide Annual Turnover (step 4) and the principle of effectiveness, dissuasiveness and proportionality of the fine (step 5).

Summary

EDPB_GDPR_How_calculate_fines — Figure – EDPB Guidelines 04/2022: steps for determining the amount of administrative fine.

Global turnover in step 2 and 4

According to the administrative fine determination process suggested by EDPB Guidelines 04/2022, the turnover of the organization that committed the infringement is taken into account at two separate steps:

at step 2, in order to adjust the initial theoretical amount of the fine to the level of turnover, to meet the principle that the fine should be effective, dissuasive, and proportionate; in other words, the lower the turnover, the lower the level of penalty applicable, within the legal maximum
at step 4, especially in order to determine the maximum legal level of the fine, also always having as a reference the principle of effectiveness, dissuasiveness and proportionality.

Concept of Total Worldwide Annual Turnover

The variable measure of the administrative fine is calculated based on a percentage (2% or 4%) of the organization’s Annual Total Worldwide Turnover in the preceding financial year.

Concept of “undertaking”

The concept of “undertaking” is borrowed from antitrust discipline and should be understood as an “economic unit” rather than a “legal entity.” Accordingly, the Total Worldwide Annual Turnover to be calculated is not that of the individual offending company but the cumulative Total Worldwide Annual Turnover of all legal entities that may constitute a single economic unit (so-called single economic entity theory).

And so: what is the criteria according to which several legal entities form a single economic entity? According to the EDPB – which in this regard refers to Articles 101 and 102 TFEU and the case law of the CJEU – the criteria is the exercise of decisive influence over other companies, whereby “different companies belonging to the same group can form an economic unit and therefore an undertaking.”

Do all companies of the same group necessarily form an “undertaking”? Not really.

First, taking a cue from the CJEU’s decision in Case C-97/08 Akzo Nobel and Others vs. Commission, there is a rebuttable presumption (i.e., surmountable by objective evidence) that the ownership of 100% or almost 100% of shares, constitutes evidence of decisive influence exercised by the parent company over the subsidiary (so-called Akzo presumption). In such a case, it is sufficient for the supervisory authority to prove direct or indirect control of 100% or almost 100% of the subsidiary’s shares to establish the presence of decisive influence and, consequently, the constitution of a single economic entity between the two companies. It will be the burden of the companies involved, with a reversal of the burden of proof, to demonstrate conversely that despite the controlling shareholding, the owned company possibly benefits from decision-making autonomy, based on the factual circumstances of the individual case.

In the absence of a controlling interest of 100% of the shares or nearly so, according to the EDPB, in order to justify the presence of a single economic entity among several legal entities (undertaking), the supervisory authority has to demonstrate, not only that the parent company has the ability to exercise decisive influence over the subsidiary, but also that it has actually exercised such decisive influence so that it can intervene at any time in the subsidiary’s freedom of choice and determine its behavior (EDPB, cited para. 126).

Thus, Total Worldwide Annual Turnover cumulation will cover those legal entities linked by “economic, legal and organizational links (… considering) for example, the amount of the participation, personnel or organizational ties, instructions and the existence of company contracts” (EDPB, linee guida 04/2022, par. 118 e ss.).

In conclusion, the determination of the Total Worldwide Annual Turnover is not immediate and requires case-by-case evaluation.