CJEU - C-458/25
CJEU Advocate General rules private entities cannot be exempt from GDPR fines.
The Advocate General of the Court of Justice of the European Union (CJEU) opined that while Article 83(7) of the GDPR permits national laws to exempt public authorities from administrative fines, this exemption does not extend to private-law entities, even if they perform public interest tasks like subsidized education. This clarification arose from a case involving a Belgian educational group fined by the Dutch DPA for GDPR violations.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Dutch DPA?
Get an email when a new story names Dutch DPA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Advocate General's opinion confirms that private-law organizations — including subsidized educational institutions — cannot shield themselves from GDPR administrative fines under Article 83(7), even when performing public interest functions. This matters because many private entities mistakenly assume their public-interest role grants them the same regulatory protections as government bodies. The Belgian educational group's fine by the Dutch DPA illustrates that cross-border GDPR enforcement is active and that organizational legal structure does not determine compliance obligations. Organizations must understand that performing a public task and being a public authority are legally distinct categories under EU law.