[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCWzUP1BpB5PH6qUCsXnRUEOheliRMZplbs8zAbizlRI":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"4b6e64e1-facf-4c7a-b165-4fb67b0b7eb6","CJEU - C-458\u002F25","cjeu-c-458-25-3056e6","← Older revision Revision as of 14:14, 22 September 2026 Line 75: Line 75: The complaint concerned a survey on pupils' well-being which was distributed to pupils through a digital platform. According to the complaint, the controller had not informed the parents beforehand, had not obtained their consent, had collected more personal data than necessary and had failed to comply with its obligations regarding the processing of the pupils' personal data. The complaint concerned a survey on pupils' well-being which was distributed to pupils through a digital platform. According to the complaint, the controller had not informed the parents beforehand, had not obtained their consent, had collected more personal data than necessary and had failed to comply with its obligations regarding the processing of the pupils' personal data. On 16 June 2020, the DPA found that the controller infringed [[Article 6 GDPR|Article 6(1) GDPR]], [[Article 8 GDPR|Article 8 GDPR]], the data minimisation principle under [[Article 5 GDPR|Article 5(1)(c) GDPR]] and the transparency principle under [[Article 5 GDPR|Article 5(1)(a) GDPR]] in conjunction with Articles 12(1) and 13 GDPR. The DPA ordered the controller to bring the processing into compliance and imposed a €2,000 administrative fine. On 16 June 2020, the DPA found that the controller infringed [[Article 6 GDPR|Article 6(1) GDPR]], [[Article 8 GDPR]], the data minimisation principle under [[Article 5 GDPR|Article 5(1)(c) GDPR]] and the transparency principle under [[Article 5 GDPR|Article 5(1)(a) GDPR]] in conjunction with Articles 12(1) and 13 GDPR. The DPA ordered the controller to bring the processing into compliance and imposed a €2,000 administrative fine. The controller appealed. A court held that the DPA had not sufficiently justified whether the controller benefited from the exemption from administrative fines provided under Article 221(2) of the Belgian Data Protection Law. The DPA subsequently adopted a new decision and imposed a €1,000 fine, reasoning that, although the controller could qualify as a public authority under national law, it was not a public authority for the purposes of [[Article 83 GDPR|Article 83(7) GDPR]]. The controller appealed. A court held that the DPA had not sufficiently justified whether the controller benefited from the exemption from administrative fines provided under Article 221(2) of the Belgian Data Protection Law. The DPA subsequently adopted a new decision and imposed a €1,000 fine, reasoning that, although the controller could qualify as a public authority under national law, it was not a public authority for the purposes of [[Article 83 GDPR|Article 83(7) GDPR]]. Following further proceedings, a court annulled the fine. After an appeal and remittal, a court again held on 27 February 2024 that the DPA could not impose an administrative fine on the controller. The DPA appealed to the high court, which referred the matter to the CJEU for a preliminary ruling. It essentially asked whether [[Article 83 GDPR|Article 83(7) GDPR]] precludes national legislation under which a private-law entity providing subsidised independent education cannot be subject to administrative fines. Following further proceedings, a court annulled the fine. After an appeal and remittal, a court again held on 27 February 2024 that the DPA could not impose an administrative fine on the controller. The DPA appealed to the high court, which referred the matter to the CJEU for a preliminary ruling. It essentially asked whether [[Article 83 GDPR|Article 83(7) GDPR]] precludes national legislation under which a private-law entity providing subsidised independent education cannot be subject to administrative fines. === Advocate General Opinion === === Advocate General Opinion === The Advocate General (hereinafter, the AG) first considered that the concepts of \"public authorities and bodies\" in [[Article 83 GDPR|Article 83(7) GDPR]] constitute autonomous concepts of EU law. [[Article 83 GDPR|Article 83(7) GDPR]] allows Member States to determine whether and to what extent administrative fines can be imposed on public authorities and bodies, but it does not allow Member States themselves to determine which entities fall within those concepts. The Advocate General (hereinafter, the AG) first considered that the concepts of \"public authorities and bodies\" in [[Article 83 GDPR|Article 83(7) GDPR]] constitute autonomous concepts of EU law. [[Article 83 GDPR|Article 83(7) GDPR]] allows Member States to determine whether and to what extent administrative fines can be imposed on public authorities and bodies, but it does not allow Member States themselves to determine which entities fall within those concepts. Line 97: Line 94: Consequently, the AG proposed that [[Article 83 GDPR|Article 83(7) GDPR]] be interpreted as precluding national legislation under which the DPA cannot impose administrative fines on legal persons governed by private law solely because they provide independent education financed through public subsidies. Consequently, the AG proposed that [[Article 83 GDPR|Article 83(7) GDPR]] be interpreted as precluding national legislation under which the DPA cannot impose administrative fines on legal persons governed by private law solely because they provide independent education financed through public subsidies. === Holding === === Holding === TBD TBD","The Advocate General (AG) in CJEU case C-458\u002F25 provided an opinion on whether national legislation can exempt private-law entities providing subsidized independent education from administrative fines under GDPR. The case originated from a complaint about a digital survey on pupil well-being, where the controller allegedly violated GDPR principles. Belgian DPAs initially imposed fines, but courts repeatedly annulled them, leading to a referral to the CJEU.","CJEU case C-458\u002F25: AG opinion on GDPR fines for private entities providing subsidized education.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-458\u002F25&diff=53154&oldid=53123","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-09-22T14:14:58+00:00","2026-09-22T16:00:38.482678+00:00",7,[17],{"name":18,"type":19},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,30,35,37],{"category":27},{"id":28,"icon":22,"name":18,"slug":29},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":31},{"id":32,"icon":22,"name":33,"slug":34},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":36},{"id":20,"icon":22,"name":23,"slug":24},{"category":38},{"id":39,"icon":22,"name":40,"slug":41},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":45,"vendors":46},[],[],{"slug":48,"title":49,"body":50,"framework_refs":51,"framework_notes":63},"cjeu-case-highlights-gdpr-enforcement-gaps-for-subsidized-private-education-entities","CJEU Case Highlights GDPR Enforcement Gaps for Subsidized Private Education Entities","This case exposes a critical ambiguity in GDPR enforcement: whether private-law entities receiving public subsidies can claim exemptions from administrative fines typically applicable to public authorities under Article 83(7). The violation originated from a digital well-being survey of pupils — a scenario where sensitive data about minors was collected without apparent adherence to GDPR principles such as data minimization, lawful basis, and transparency. The repeated annulment of fines by national courts undermined the deterrent effect of GDPR, signaling that organizational type and funding model can create exploitable enforcement loopholes. This matters because educational institutions routinely handle sensitive data about children, a protected class under GDPR, and inconsistent enforcement erodes trust and data subject rights. Organizations must not assume their legal structure shields them from data protection obligations.",[52,53,54,55,56,57,58,59,60,61,62],"GDPR Article 5 (Principles of data processing)","GDPR Article 6 (Lawful basis for processing)","GDPR Article 35 (Data Protection Impact Assessment)","GDPR Article 37-39 (Data Protection Officer)","GDPR Article 83 (Administrative fines)","GDPR Article 83(7) (Public authority fine exemptions)","NIST Privacy Framework PR.DS-1 (Data-at-rest protection)","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27701 (Privacy Information Management)","ITIL Service Design — Information Security Management",{}]