Response to CCIA Europe concerning EDPB guidelines on calculation of fines

Anu Talus Chair of the European Data Protection Board Claudia Canelles Quaroni Privacy and Safety Lead, CCIA Europe Computer & Communications Industry Association (CCIA) Brussels, 17 September 2025 by e - mail only Subject: Response to your letter regarding a call for revision of the EDPB Guidelines on calculation of administrative fines Dear Ms. Canelles Quaroni , Thank you for your letter of 23 April, in which you provide your views regarding the possible effects of the rec ent CJEU judgment C - 383/23 1 on the EDPB Guidelines 04/2022 on the calculation of administrative fines under the GDPR 2 . The EDPB closely follows decisions of the Court of Justice of the European Union (CJEU), especially when they relate to matters of dat a protection law. In this context, the judgment in case C - 383/23 has been discussed within the subgroups of the EDPB, in particular with a view to assessing whether or not this new decision should lead to any change to existing EDPB guidelines, and in par ticular the Guidelines 4/2022 . In its judgment in case C - 383/23, the CJEU recalls that, in order to comply with the requirements that a fine be effective, proportionate and dissuasive, the GDPR requires data protection authorities to have due regard to th e factors provided for in Article 83(2) GDPR when deciding on the amount of the fine. These factors serve to ensure that each infringement is assessed on the basis of all the relevant individual circumstances. Furthermore, paragraph 29 of the ruling refers to a previous ruling, i.e. the judgment in case C - 807/21 3 , which clarified that a fine can only fulfil the conditions set out in Article 83(1) of the GDPR - to be effective, proportionate, and dissuasive - if it takes into consideration not only the factors characterising the established infringements of the GDP R but also, where appropriate, the actual or 1 CJEU Judgment of 13 February 2025, ILVA, C ‑ 383/23 , EU:C:202 5 : 84 (hereinafter ‘Case C - 383/23’ ) 2 EDPB Guidelines 04/2022 on the calculation of administrative fines under the GDPR, Version 2.1, adopted on 24 Mat 2023 (hereinafter ‘EDPB Guidelines 04/2022’) 3 Judgment of 5 December 2023, Deutsche Wohnen, C ‑ 807/21, EU:C:2023:950, paragraph 58 . material economic capacity of the person on which the fine is imposed. The Court further held that in order to assess those conditions, it is necessary to take account of whether that person forms part of an und ertaking, within the meaning of Articles 101 and 102 TFEU. The Guidelines 4/2022 provide for a step - by - step approach for the calculation of the amount of the fine. It is important to note that the turnover of an undertaking is only one of three elements th e EDPB considers relevant for determining the starting point for the calculation, the others being the categorisation of the infringements by nature under Article 83(4) - (6) GDPR, and the seriousness of the infringement. Furthermore, the Guidelines 4/2022 s tate that the identification of harmonised starting points does not and should not preclude the data protection authorities from assessing each case on its merits. Having carefully analysed the judgment in case C - 383/23, the EDPB considers that the Guidel ines 4/2022, and in particular Section 6.2.1, align with this ruling, and that no change is needed at this stage. As regards your request for stakeholders to be offered the opportunity to comment on the Guidelines and any proposed revisions, I would like to highlight that the EDPB organised a public consultation on these guidelines following the adoption of the first version in 2022. The EDPB will, in accordance with chapter 8 of the Guidelines 4/2022, continue to monitor the application of these guidelin es, in order to evaluate whether they effectively achieve the objectives of consistent application of the GDPR. Please note that, in line with usual practice, the reply to this letter will be published on the EDPB website. Yours sincerely Anu Talus