CJEU Rules Private Entities Cannot Be Exempted from GDPR Fines via National Law
Written by AI from the linked story. Not reviewed by an editor. How this works
The Advocate General's opinion in CJEU C-458/25 clarifies that Article 83(7) of the GDPR allows Member States to exempt only genuine public authorities from administrative fines — not private-law entities, even when those entities perform publicly subsidized or public-interest tasks. This matters because organizations may have incorrectly assumed that performing a public-interest function shields them from regulatory liability under national GDPR exemptions. The Belgian case involving an educational institution illustrates how organizational legal structure — not mission — determines fine applicability. Private entities operating in education, healthcare, or other public-interest sectors must now treat themselves as fully subject to GDPR enforcement and fines. Failing to recognize this distinction exposes organizations to significant financial and reputational risk.
Tactical Insight
Immediate actions
- Conduct a legal classification review to confirm whether your organization qualifies as a 'public authority' under your Member State's national law and GDPR definitions.
- Audit all active data processing activities for GDPR compliance gaps, paying particular attention to lawful basis and data subject rights obligations.
Governance & Policy improvements
- Appoint or verify the competence of a Data Protection Officer (DPO) if your organization processes personal data at scale, regardless of public-interest mission.
- Establish a GDPR compliance program that explicitly accounts for your organization's private-law status, removing any assumption of fine immunity.
- Document and regularly review data processing agreements, consent mechanisms, and breach notification procedures to ensure full regulatory alignment.
Monitoring & Incident Readiness
- Implement ongoing Data Protection Impact Assessments (DPIAs) for high-risk processing activities to proactively identify and remediate compliance risks.
- Set up a structured process for monitoring CJEU and national DPA rulings that may affect your organization's compliance obligations.