Key Facts
- Direct liability of legal persons: ECJ allows fines against legal persons without attribution to natural persons.
- Culpable conduct as a prerequisite: Supervisory authorities must prove culpable conduct before fines are imposed.
- Group turnover as a basis for assessment: Fines are calculated according to the turnover of the entire group, which can lead to higher amounts.
- Liability for infringements by third parties: Legal entities are also liable for infringements committed by third parties in the course of their business activities.
- Joint responsibility: Liability arises through participation in decisions on data processing purposes, without formal agreement.
- Extended liability: ruling lowers hurdles for GDPR fines and requires robust data protection compliance management
- Risk assessment and management: Companies must carry out comprehensive risk assessments and continuously monitor data protection practices.
In an earlier post on my blog itmedialaw.com, I already briefly addressed the important ruling of the ECJ of December 5, 2023. I would now like to undertake a more detailed analysis and expansion.
