On 5 December 2023, the Court of Justice of the European Union handed down two judgments (C-807/21 Deutsche Wohnen and C-683/21 Nacionalinis[1]) in which it ruled that only a deliberate breach of the General Data Protection Regulation (the “GDPRâ€) can lead to an administrative fine by a national supervisory authority.Â
The German and Lithuanian courts have both requested for a preliminary ruling concerning the interpretation of Article 83 of the GDPR (entitled “General conditions for imposing administrative finesâ€). In particular, the Court of Justice was asked to clarify the conditions under which national supervisory authorities may impose administrative fines for breaches of the GDPR, and whether an objective breach of an obligation (“strict liabilityâ€) is sufficient to impose a fine under Article 83 of the GDPR.
