CJEU - C-458/25
Advocate General opines private entities providing public services can be fined under GDPR.
The Advocate General has opined that Article 83(7) of the GDPR does not permit national laws to exempt private-law entities from administrative fines, even if they perform public-interest tasks like providing publicly subsidized education. This ruling clarifies that while Member States can exempt public authorities, this exemption does not extend to private entities acting in the public interest. The case involved a Belgian DPA's decision to fine an educational institution, highlighting the distinction between public authorities and private entities for GDPR fine applicability.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GDPR?
Get an email when a new story names GDPR, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Advocate General's opinion in CJEU C-458/25 clarifies that Article 83(7) of the GDPR allows Member States to exempt only genuine public authorities from administrative fines — not private-law entities, even when those entities perform publicly subsidized or public-interest tasks. This matters because organizations may have incorrectly assumed that performing a public-interest function shields them from regulatory liability under national GDPR exemptions. The Belgian case involving an educational institution illustrates how organizational legal structure — not mission — determines fine applicability. Private entities operating in education, healthcare, or other public-interest sectors must now treat themselves as fully subject to GDPR enforcement and fines. Failing to recognize this distinction exposes organizations to significant financial and reputational risk.