CJEU - C-458/25
CJEU case C-458/25: AG opinion on GDPR fines for private entities providing subsidized education.
The Advocate General (AG) in CJEU case C-458/25 provided an opinion on whether national legislation can exempt private-law entities providing subsidized independent education from administrative fines under GDPR. The case originated from a complaint about a digital survey on pupil well-being, where the controller allegedly violated GDPR principles. Belgian DPAs initially imposed fines, but courts repeatedly annulled them, leading to a referral to the CJEU.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GDPR?
Get an email when a new story names GDPR, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThis case exposes a critical ambiguity in GDPR enforcement: whether private-law entities receiving public subsidies can claim exemptions from administrative fines typically applicable to public authorities under Article 83(7). The violation originated from a digital well-being survey of pupils — a scenario where sensitive data about minors was collected without apparent adherence to GDPR principles such as data minimization, lawful basis, and transparency. The repeated annulment of fines by national courts undermined the deterrent effect of GDPR, signaling that organizational type and funding model can create exploitable enforcement loopholes. This matters because educational institutions routinely handle sensitive data about children, a protected class under GDPR, and inconsistent enforcement erodes trust and data subject rights. Organizations must not assume their legal structure shields them from data protection obligations.