With a judgment dated February 13, 2025[1], the Court of Justice of the European Union (CJEU) has further tightened the EU’s requirements for corporate fines. The decision concerns the calculation of fines under the General Data Protection Regulation (GDPR) and clarifies that not only the turnover of the individual responsible group company, but also the worldwide group turnover can be used as the basis for determining corporate fines. This case law has far-reaching consequences. It also raises the question of the extent to which these principles can be transferred to other legal areas, such as the Digital Services Act (DSA). At the same time, the German Federal Court of Justice (BGH) has referred a question to the CJEU regarding whether companies can seek recourse against responsible managers after paying corporate fines. [2] The winds are once again growing stronger for companies and their managers. On our blog, we therefore examine the CJEU decision, its potential application to other legal fields, and the significance of the BGH’s referral.
A. The CJEU Decision C-383/23: Fines Under the GDPR and Group Turnover
In the case at issue, a Danish furniture company allegedly failed to handle its customers’ personal data with sufficient care. The Danish data protection authority initially imposed a fine of 1.5 million DKK. However, the competent court reduced this amount to 100,000 DKK, as it only considered the turnover of the relevant subsidiary as the basis for calculation. The data protection authority appealed this decision, and in the course of the appeal, the case was referred to the CJEU for a preliminary judgment.
The CJEU ruled that for the imposition of fines under the GDPR, the worldwide group turnover is the reference basis for the determination of corporate fines. However, the Court emphasized that the group turnover does not automatically determine the actual amount of the fine, but merely serves as the maximum limit. The specific amount of the fine must still be determined based on the severity of the infringement, the circumstances of the individual case, and the economic capacity of the responsible company. This distinction is of great importance, as it prevents fines from being imposed up to the upper limit as a matter of course, without taking into account the specificities of each case.
With this decision, the CJEU transferred the logic of the “economic unit” established in competition law to data protection law. In competition law, the CJEU has long set aside the principles of legal personality and, for the purpose of determining fines, has focused on the entire group turnover as the yardstick. According to the CJEU (para. 36), the term “undertaking” in the GDPR is the same as in competition law (Articles 101, 102 TFEU), so that the maximum amount of a fine “imposed on a controller … who is an undertaking or belongs to an undertaking” is determined on the basis of the worldwide group turnover. In particular, the capacity of the group is relevant “in order to assess the actual or material capacity of the addressee of the fine and thus to verify whether the fine is both effective and proportionate as well as dissuasive.” This significantly increases liability. [3]
B. Transfer of CJEU Case Law to Other Legal Fields
There is much to suggest that the CJEU will also set aside the boundaries of legal personality in other legal fields, for example in the Digital Services Act (DSA), which imposes new obligations on platform operators and also provides for fines of up to a certain percentage of worldwide turnover in the event of violations. The DSA stipulates that for serious violations of its provisions, fines of up to six percent of the worldwide group turnover may be imposed. The structure of the DSA is similar to that of the GDPR.
Furthermore, it is to be expected that the CJEU’s case law will also be applied to other new European regulations such as the Digital Markets Act (DMA) or the AI Act. The DMA provides for fines of up to ten percent of worldwide turnover for violations by so-called “gatekeepers.” Here, too, group turnover is used as the yardstick to ensure that the fines are dissuasive and constitute an appropriate sanction. The same applies to the AI Act, which provides for fines of up to seven percent of worldwide turnover for certain violations of the rules on artificial intelligence.
The transfer of the CJEU’s case law to these areas is a logical step.
C. The BGH’s Referral to the CJEU: Recourse Against Managers for Corporate Fines
However, the winds are not only getting rougher for companies, but also for responsible managers. The German Federal Court of Justice (BGH), in its referral KZR 74/23 dated February 11, 2025, has submitted a fundamental question to the CJEU: Is a company that has had to pay a fine for a competition law infringement allowed to seek recourse against responsible managers? In the specific case, the issue concerned a price-fixing cartel, which led to fines being imposed both against the company and against the chairman of the board himself. The company paid its fine and subsequently sought to recover the amount from the chairman.
The BGH has referred this question to the CJEU for clarification, as it has implications under EU law. In particular, the question arises as to whether national claims for recourse against managers are compatible with the purpose of EU competition law. The aim of competition law is to prevent and sanction anti-competitive behavior. The imposition of fines on companies is intended to be both dissuasive and preventive. If a company were to seek recourse against responsible managers after paying a fine, there would be a risk that the sanctioning character of the fines would be undermined. Ultimately, the penalty would then be borne not by the company, but by the responsible managers.
In its referral, the BGH also drew parallels to tax law, where claims for recourse against managers are regularly excluded in order to preserve the sanctioning character of tax liability. It is therefore to be expected that the CJEU will take a similar approach. However, it is conceivable that the CJEU will limit the liability of managers to cases in which they have acted intentionally or with gross negligence. A blanket statement on the admissibility of claims for recourse is not to be expected, as the CJEU’s case law in comparable cases has always emphasized the preventive and dissuasive character of corporate fines.
D. Resumé
The CJEU’s expected decision on the BGH’s referral is likely to be handed down in mid-2026. „Enthaftungsstrategien“ konzernweit organisieren. Regardless of the outcome, the referral demonstrates that the extension of group liability to the DSA, DMA, and AI Act from 2026 onwards will lead to significantly higher sanction risks for companies. The distinction between legal independence and economic unity is increasingly being eroded, with consequences for governance and risk management. Companies must prepare for these developments and organize their “liability mitigation strategies” across the entire group.
A critical note from an more general perspective should be added: Economically, it is the shareholders who foot the bill, even though they bear no responsibility for the violations. This is not only unfair but also violates EU fundamental rights. [4] Undoubtedly, compliance with the law is not negotiable for companies. However, compliance management obligations that apply across the entire company and must be continually tightened, increases systemic risk awareness and risk aversion within companies, without correspondingly fueling the pursuit of opportunities. This shifts personnel from production and quest for opportunities to risk mitigation, resulting in high costs at both the corporate and macroeconomic levels. The CJEU, through its case law, contributes to this development.
[1] Case C-383/23 (Vorabentscheidungsverfahren).
[2] Decree dated 11.02.2025 - KZR 74/23.
[3] Critical in respect of this development Reuter, Der Bußgeldregress gegen Manager aus verfassungs- und EU-rechtlicher Sicht, CCZ, 2023, 289 ff.
[4] Reuter, Der Bußgeldregress gegen Manager aus verfassungs- und EU-rechtlicher Sicht, CCZ, 2023, 289 ff.
