Skip to main content
Praxikon

Ruling

Deutsche Wohnen: a fine on a legal person needs no identified natural person, but does require fault

Date
Status
final
Body
Hof van Justitie van de EU (Grote kamer), Deutsche Wohnen SE tegen Staatsanwaltschaft Berlin
Reference
C-807/21, ECLI:EU:C:2023:950

What it is about

Question: may a Member State allow a GDPR fine on a company only where the infringement has first been attributed to a specific manager or employee, and is a fine possible without intent or negligence? Ruling: national rules making a fine on a legal person conditional on attribution to an identified natural person are contrary to Article 58(2)(i) and Article 83 GDPR. A fine may however be imposed only where it is established that the controller committed the infringement intentionally or negligently. That is the case where the controller could not be unaware of the infringing nature of its conduct, whether or not it was aware that it was infringing the GDPR. For the maximum fine the total worldwide annual turnover of the undertaking in the competition law sense (Articles 101 and 102 TFEU) counts.

What this means in practice

Your organisation can be fined directly as a legal person; the defence that no employee is personally responsible does not work. The authority must however establish intent or negligence, but ignorance of the GDPR is no defence where you could not have been unaware that your conduct was infringing. A well documented compliance programme and demonstrable diligence strengthen your position. For corporate groups the maximum fine is set by reference to the turnover of the whole economic unit, not just that of the subsidiary that made the error.

The GDPR articles concerned

Source: EUR-Lex, arrest C-807/21checked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

The counterpart in the other law

Case law8 of 14

Guidelines8 of 9

Enforcement and fines

Legislation in motion6 of 9