[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBkA0TSGC0AmAeHQCDpyLWvzmboNkE_LZuea32Z68x5E":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"087413b5-a380-4bab-aa68-1915de3f961e","CJEU - C-458\u002F25","cjeu-c-458-25-b1aae1","← Older revision Revision as of 10:44, 23 September 2026 Line 66: Line 66: }} }} The Advocate General opined that while [[Article 83 GDPR|Article 83(7) GDPR]] allows national law to exempt public authorities from administrative fines, national law may not exempt private-law entities from fines – even if they provide tasks in the public interest such as publicly subsidised education. The Advocate General opined that while [[Article 83 GDPR|Article 83(7) GDPR]] allows national law to exempt public authorities from administrative fines. However, national law may not exempt private-law entities from fines – even if they provide tasks in the public interest such as publicly subsidised education. ==English Summary== ==English Summary==","The Advocate General of the Court of Justice of the European Union (CJEU) opined that while Article 83(7) of the GDPR permits national laws to exempt public authorities from administrative fines, this exemption does not extend to private-law entities, even if they perform public interest tasks like subsidized education. This clarification arose from a case involving a Belgian educational group fined by the Dutch DPA for GDPR violations.","CJEU Advocate General rules private entities cannot be exempt from GDPR fines.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-458\u002F25&diff=53184&oldid=53181","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-09-23T10:44:12+00:00","2026-09-23T12:00:20.884731+00:00",7,[17,20,23],{"name":18,"type":19},"GDPR","product",{"name":21,"type":22},"Dutch DPA","vendor",{"name":24,"type":19},"Article 83(7) GDPR","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,35,40],{"category":32},{"id":33,"icon":27,"name":18,"slug":34},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":36},{"id":37,"icon":27,"name":38,"slug":39},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":41},{"id":42,"icon":27,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[21,18,24],{"controls":48,"vendors":49},[],[],{"slug":51,"title":52,"body":53,"framework_refs":54,"framework_notes":63},"cjeu-clarifies-gdpr-fines-apply-to-private-entities-performing-public-tasks","CJEU Clarifies GDPR Fines Apply to Private Entities Performing Public Tasks","The Advocate General's opinion confirms that private-law organizations — including subsidized educational institutions — cannot shield themselves from GDPR administrative fines under Article 83(7), even when performing public interest functions. This matters because many private entities mistakenly assume their public-interest role grants them the same regulatory protections as government bodies. The Belgian educational group's fine by the Dutch DPA illustrates that cross-border GDPR enforcement is active and that organizational legal structure does not determine compliance obligations. Organizations must understand that performing a public task and being a public authority are legally distinct categories under EU law.",[55,56,57,58,59,60,61,62],"GDPR Article 83(7) — Member State discretion on fines for public authorities","GDPR Article 83(1)-(6) — General conditions for imposing administrative fines","GDPR Article 37 — Designation of the Data Protection Officer","GDPR Article 30 — Records of processing activities","NIST SP 800-53 PT-1 (Privacy Policy and Procedures)","NIST SP 800-53 PM-19 (Privacy Program Leadership)","CIS Control 18 — Penetration Testing (awareness of organizational risk posture)","ISO\u002FIEC 27701 — Privacy Information Management System (PIMS)",{}]