[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQucgu2AnGv3d-z9anJ2wcWTS4x1AQhXQLh7okY4tux4":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"e9c7a734-126d-4446-89c3-57270672efcc","CJEU - C-458\u002F25","cjeu-c-458-25-cd116e","← Older revision Revision as of 09:23, 23 September 2026 (One intermediate revision by the same user not shown) Line 5: Line 5: |Opinion_Link=https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fdocument\u002FC\u002F2025\u002FC-0458-25-00000000RP-01-P-01\u002FCONCL\u002F326396-EN-1-html |Opinion_Link=https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fdocument\u002FC\u002F2025\u002FC-0458-25-00000000RP-01-P-01\u002FCONCL\u002F326396-EN-1-html |Judgement_Link=https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fjurisprudence?lang=en&sort=DOC_DATE-DESC&searchTerm=2016%252F679 |Judgement_Link= |Date_Decided=10.09.2026 |Date_Decided=10.09.2026 Line 66: Line 66: }} }} The Advocate General opined that [[Article 83 GDPR|Article 83(7) GDPR]] precludes exempting a private-law entity providing publicly subsidised education from administrative fines merely because it performs a public-interest task. The Advocate General opined that while [[Article 83 GDPR|Article 83(7) GDPR]] allows national law to exempt public authorities from administrative fines, national law may not exempt private-law entities from fines – even if they provide tasks in the public interest such as publicly subsidised education. ==English Summary== ==English Summary== Line 76: Line 76: On 16 June 2020, the DPA found that the controller infringed [[Article 6 GDPR|Article 6(1) GDPR]], [[Article 8 GDPR]], the data minimisation principle under [[Article 5 GDPR|Article 5(1)(c) GDPR]] and the transparency principle under [[Article 5 GDPR|Article 5(1)(a) GDPR]] in conjunction with [[Article 12 GDPR|Articles 12(1)]] and [[Article 13 GDPR|13 GDPR]]. The DPA ordered the controller to bring the processing into compliance and imposed a €2,000 administrative fine. On 16 June 2020, the DPA found that the controller infringed [[Article 6 GDPR|Article 6(1) GDPR]], [[Article 8 GDPR]], the data minimisation principle under [[Article 5 GDPR|Article 5(1)(c) GDPR]] and the transparency principle under [[Article 5 GDPR|Article 5(1)(a) GDPR]] in conjunction with [[Article 12 GDPR|Articles 12(1)]] and [[Article 13 GDPR|13 GDPR]]. The DPA ordered the controller to bring the processing into compliance and imposed a €2,000 administrative fine. [[Article 83 GDPR|Article 83(7) GDPR]] allows Member States to determine whether and to what extent administrative fines may be imposed on public authorities and bodies established in that Member State. Belgium made use of this possibility in [https:\u002F\u002Fwww.belgium.be\u002Fen\u002Fpersonal_data Article 221(2) of its Data Protection Law], which excludes the application of [[Article 83 GDPR]] to public authorities and their employees or agents, except for legal persons governed by public law that offer goods or services on a market. The dispute therefore concerned whether the controller, despite being a legal person governed by private law, could fall within that exemption because it provided publicly subsidised education. The controller appealed. A court held that the DPA had not sufficiently justified whether the controller benefited from the exemption from administrative fines provided under [https:\u002F\u002Fwww.belgium.be\u002Fen\u002Fpersonal_data Article 221(2) of the Belgian Data Protection Law]. The DPA subsequently adopted a new decision and imposed a €1,000 fine, reasoning that, although the controller could qualify as a public authority under national law, it was not a public authority for the purposes of [[Article 83 GDPR|Article 83(7) GDPR]]. The controller appealed. A court held that the DPA had not sufficiently justified whether the controller benefited from the exemption from administrative fines provided under [https:\u002F\u002Fwww.belgium.be\u002Fen\u002Fpersonal_data Article 221(2) of the Belgian Data Protection Law]. The DPA subsequently adopted a new decision and imposed a €1,000 fine, reasoning that, although the controller could qualify as a public authority under national law, it was not a public authority for the purposes of [[Article 83 GDPR|Article 83(7) GDPR]].","The Advocate General has opined that Article 83(7) of the GDPR does not permit national laws to exempt private-law entities from administrative fines, even if they perform public-interest tasks like providing publicly subsidized education. This ruling clarifies that while Member States can exempt public authorities, this exemption does not extend to private entities acting in the public interest. The case involved a Belgian DPA's decision to fine an educational institution, highlighting the distinction between public authorities and private entities for GDPR fine applicability.","Advocate General opines private entities providing public services can be fined under GDPR.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-458\u002F25&diff=53181&oldid=53156","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-09-23T09:23:27+00:00","2026-09-23T10:00:28.225131+00:00",7,[17],{"name":18,"type":19},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,30,35,37],{"category":27},{"id":28,"icon":22,"name":18,"slug":29},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":31},{"id":32,"icon":22,"name":33,"slug":34},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":36},{"id":20,"icon":22,"name":23,"slug":24},{"category":38},{"id":39,"icon":22,"name":40,"slug":41},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":45,"vendors":46},[],[],{"slug":48,"title":49,"body":50,"framework_refs":51,"framework_notes":61},"cjeu-rules-private-entities-cannot-be-exempted-from-gdpr-fines-via-national-law","CJEU Rules Private Entities Cannot Be Exempted from GDPR Fines via National Law","The Advocate General's opinion in CJEU C-458\u002F25 clarifies that Article 83(7) of the GDPR allows Member States to exempt only genuine public authorities from administrative fines — not private-law entities, even when those entities perform publicly subsidized or public-interest tasks. This matters because organizations may have incorrectly assumed that performing a public-interest function shields them from regulatory liability under national GDPR exemptions. The Belgian case involving an educational institution illustrates how organizational legal structure — not mission — determines fine applicability. Private entities operating in education, healthcare, or other public-interest sectors must now treat themselves as fully subject to GDPR enforcement and fines. Failing to recognize this distinction exposes organizations to significant financial and reputational risk.",[52,53,54,55,56,57,58,59,60],"GDPR Article 83(7) — Member State discretion on fines for public authorities","GDPR Article 37 — Designation of the Data Protection Officer","GDPR Article 35 — Data Protection Impact Assessment","GDPR Article 5 — Principles relating to processing of personal data","NIST Privacy Framework PR.PO-P1 — Policies, processes, and procedures for managing data","NIST SP 800-53 PT-1 — Personally Identifiable Information Processing and Transparency Policy","CIS Control 18 — Penetration Testing (adapted: regular compliance audits)","ISO\u002FIEC 27701:2019 — Privacy Information Management System","ITIL Service Management — Compliance and Risk Management practices",{}]