Cybersecurity Policy Report, Revisions to EU Privacy Fines Unnecessary After Court Ruling, EDPB Says, (Sep 23, 2025)

By Tony Foley

The European Data Protection Board (EDPB) has responded to a letter from the Computer and Communications Industry Association Europe regarding the association’s contention that a recent decision of the Court of Justice of the European Union (CJEU) should lead to revisions to EDPB Guidelines 04/2022 on the calculation of administrative fines under the EU General Data Protection Regulation (GDPR).

The EDPB’s response outlines the CJEU decision (Case C-383/23), in which the court held that, in order to comply with the requirements that a fine be effective, proportionate, and dissuasive, the GDPR requires data protection authorities to have due regard to the factors provided in GDPR article 83(2) in deciding the fine amount to ensure that each infringement is assessed on the basis of all the relevant individual circumstances. In addition, the response points out that the CJEU references a separate case in which it found that a fine could be effective, proportionate, and dissuasive only if it took into account both the factors listed in article 83(2) and, where appropriate, the actual or material economic capacity of the entity on whom the fine was imposed.

The EDPB said the Guidelines 04/2022 provide for a step-by-step approach for the calculation of a fine amount, and the turnover of an undertaking is only one of three elements it would consider in determining the starting point of the calculation. The EDPB added that it considered the nature and seriousness of the infringement. The EDPB concluded that, having carefully analyzed the judgment of the CJEU, Guidelines 04/2022 were aligned with the ruling, and no change was needed. It emphasized that it would continue to monitor the application of the guidelines to evaluate whether they effectively achieve the objectives of consistent application of the GDPR.

News: LitigationEnforcement InternationalLegislation DataPrivacy GDPR