Note: The CJEU is made up of two courts: the Court of Justice and the General Court. References to ‘the Court’ in this section should be read as the Court of Justice (the higher court) unless otherwise stated.

Calculating GDPR fines for companies in group structures

Under the GDPR, certain infringements are subject to fines based on a percentage of an undertaking’s worldwide annual turnover. In the case of ILVA (Case C-383/23), a Danish company (ILVA A/S) was fined for data breaches relating to customer data. ILVA sought to challenge how the fine was calculated, which turned on the interpretation of “undertaking” to be applied when calculating fines under the GDPR. In calculating ILVA’s fine, the Danish regulatory authority based the amount of the fine not only on the turnover of ILVA, but also on the overall turnover of the group to which it belongs. The key issue in the case was whether the regulator was correct to do so.

As it did in the Deutsche Wohnen case in December 2023, the Court applied the competition law understanding of 'undertaking' as an economic unit. The Court held that the group’s turnover is therefore relevant in establishing the maximum amount of a fine under the GDPR. When determining the actual fine, the Court held that this concept of undertaking “must also be taken into account in order to assess the actual or material economic capacity of the recipient of the fine and thus to ascertain whether the fine is at the same time effective, proportionate and dissuasive”.

This decision is broadly in line with the approach to calculating fines being taken to-date, but there is still some ambiguity around how precisely national authorities are approaching the calculation of GDPR fines for individual group companies.

Entitlement to rationale for an automated decision on creditworthiness

In Dun & Bradstreet Austria (Case C-203/22), a customer asked for “meaningful information” (under article 15(1)(h) GDPR) after her application was rejected following an automated credit assessment. Dun & Bradstreet refused to provide some of this information, claiming it was a trade secret.

The Court found that, in order to provide sufficiently meaningful information, the data controller must describe the decision-making procedure in a way that allows data subjects to understand which of their personal data have been used and how. In the context of profiling (such as credit scoring), it may be sufficient to explain how “a variation in the personal data taken into account would have led to a different result”. However, the Court held, the mere communication of an algorithm or a “detailed description of all the steps in automated decision making” will not, by itself, be sufficient.

The Court further found that controllers cannot rely on the defence of trade secrets to refuse all data subject information requests. If a controller believes information forms part of a trade secret, they must present it to the competent court or supervisory authority, and it is for that body to determine the scope of information to be provided.

This decision emphasises that the controller’s obligation to provide “meaningful information” to data subjects in respect of processing operations will be carefully scrutinised, and overly broad, blanket refusals on the basis of intellectual property rights will not be accepted.

What constitutes personal data in cases of pseudonymisation?

In September 2025, the Court delivered its decision in EDPS v SRB (Case C‑413/23 P), a case concerning whether pseudonymised data are to be considered "personal data" within the meaning of Regulation (EU) 2018/1725 (the GDPR-equivalent regulation governing data protection within EU institutions and bodies).

The background to this case was the collection, by the EU’s Single Resolution Board (the SRB), of the comments of shareholders from a Spanish bank undergoing a resolution. The SRB developed a pseudonymisation process to aggregate the comments. Some of these comments were later sent to Deloitte in its capacity as an independent valuer. The SRB retained the capacity to link the pseudonymised comments to separate, identifying data, but the identifying data set was not provided to Deloitte.

Five shareholders subsequently lodged a complaint with the European Data Protection Supervisor (the EDPS), alleging that the transfer of comments to Deloitte was a violation of their rights under Regulation 2018/1725, as they believed they had not been appropriately informed about the transfer of their personal data. The SRB claimed that the data were not personal data and therefore the notification obligations under Regulation 2018/1725 did not apply.

In its judgment, the Court confirmed the position that pseudonymised data may not be personal data in all cases - it will depend on the measures used to pseudonymise the data and whether natural persons can be linked to the resulting data.

The decision emphasises the importance of context in respect of pseudonymised data. The Court found that, where pseudonymised information is transferred to a third party, such information may not constitute “personal data” from the third party’s perspective, if that third party does not have “means that are reasonably likely” to reverse the pseudonymisation process and re-identify the relevant data subjects. The key question is whether the third party has a realistic means of accessing that information and re-identifying the data subjects.

However, the Court held, if the controller who transferred the pseudonymised information retains the capacity to re-identify the data subjects, such information is personal data from that controller’s perspective. Accordingly, the controller must comply with its general obligation to inform data subjects of relevant third party transfers.