The Art.-29-Data Protection Group has the Draft guidance on fines under the GDPR (“Guidelines on the application and setting of administrative fines for the purposes of the Regulation 2016/679”). The draft is dated October 3, 2017; interested parties may submit comments until November 27, 2017.
The draft explains the criteria to be taken into account when assessing penalties, but also states that the concept of “undertaking”, whose turnover is relevant in determining the maximum amount of a fine, is defined in accordance with the understanding of the Treaty on the Functioning of the European Union (TFEU) is to be interpreted, i.e. the corresponds to the definition of an enterprise under antitrust law. The upper limit of fines would therefore not be assessed according to the turnover of the legal entity in question, but according to that of the “economically active unit”. The consequence of this is not only that mothers have to answer for violations committed by their daughters, but also that a Group is treated as a single entity to the extent that an economic unity exists, i.e. to the extent that a parent company can exercise a decisive influence over subordinate companies. In this case, the total Group sales are decisive for determining the upper limit of a fine (2% or 4% of the annual sales generated worldwide).
This corresponds to Recital 150, but it contradicts the legal definition of “undertaking” in Art. 4 No. 15. However, the term “undertaking” in Art. 4 No. 15 and Recital 150 only coincides in the German version of the GDPR. In the English wording, Art. 4 No. 15 speaks of “enterprise”, while Recital 150 uses the term “undertaking”.In this respect, the interpretation result of the Art. 29 Group is not surprising.