[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgpQ0lQjY062SqV5Y8VGWGj42LRXjy3lct2N3RC1OXDw":3},{"article":4,"iocs":41},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":11,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":29},"3d04c789-0f76-4abf-8d8c-1384f5dd7819","CJEU - C-458\u002F25","cjeu-c-458-25-f6fca7","Created page with \"{{CJEUdecisionBOX |Case_Number_Name=C-458\u002F25 |ECLI= |Opinion_Link=https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fdocument\u002FC\u002F2025\u002FC-0458-25-00000000RP-01-P-01\u002FCONCL\u002F326396-EN-1-html |Judgement_Link=https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fjurisprudence?lang=en&sort=DOC_DATE-DESC&searchTerm=2016%252F679 |Date_Decided=10.09.2026 |Year=2026 |GDPR_Article_1=Article 83(7) GDPR |GDPR_Article_Link_1=Article 83 GDPR#7 |GDPR_Article_2= |GDPR_Article_Link_2= |GDPR_Article_3= |GDPR...\" New page {{CJEUdecisionBOX |Case_Number_Name=C-458\u002F25 |ECLI= |Opinion_Link=https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fdocument\u002FC\u002F2025\u002FC-0458-25-00000000RP-01-P-01\u002FCONCL\u002F326396-EN-1-html |Judgement_Link=https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fjurisprudence?lang=en&sort=DOC_DATE-DESC&searchTerm=2016%252F679 |Date_Decided=10.09.2026 |Year=2026 |GDPR_Article_1=Article 83(7) GDPR |GDPR_Article_Link_1=Article 83 GDPR#7 |GDPR_Article_2= |GDPR_Article_Link_2= |GDPR_Article_3= |GDPR_Article_Link_3= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |Party_Name_1=Onderwijsgroep Zusters der Christelijke Scholen Zuid-Kempen VZW |Party_Link_1=https:\u002F\u002Fdata-onderwijs.vlaanderen.be\u002Fonderwijsaanbod\u002Finstelling.aspx?sn=117911 |Party_Name_2=Gegevensbeschermingsautoriteit |Party_Link_2=https:\u002F\u002Fwww.gegevensbeschermingsautoriteit.be\u002Fburger |Party_Name_3= |Party_Link_3= |Party_Name_4= |Party_Link_4= |Reference_Body=Hof van Cassatie (Court of Cassation) |Reference_Case_Number_Name= |Initial_Contributor=bms | }} The Advocate General opined that [[Article 83 GDPR|Article 83(7) GDPR]] precludes exempting a private-law entity providing publicly subsidised education from administrative fines merely because it performs a public-interest task. ==English Summary== === Facts === In July 2019, the father of a pupil filed a complaint with the Dutch DPA, against Onderwijsgroep Zusters der Christelijke Scholen Zuid-Kempen VZW (OZCS), the controller, a non-profit organisation operating a subsidised independent educational establishment. The complaint concerned a survey on pupils' well-being which was distributed to pupils through a digital platform. According to the complaint, the controller had not informed the parents beforehand, had not obtained their consent, had collected more personal data than necessary and had failed to comply with its obligations regarding the processing of the pupils' personal data. On 16 June 2020, the DPA found that the controller infringed [[Article 6 GDPR|Article 6(1) GDPR]], [[Article 8 GDPR|Article 8 GDPR]], the data minimisation principle under [[Article 5 GDPR|Article 5(1)(c) GDPR]] and the transparency principle under [[Article 5 GDPR|Article 5(1)(a) GDPR]] in conjunction with Articles 12(1) and 13 GDPR. The DPA ordered the controller to bring the processing into compliance and imposed a €2,000 administrative fine. The controller appealed. A court held that the DPA had not sufficiently justified whether the controller benefited from the exemption from administrative fines provided under Article 221(2) of the Belgian Data Protection Law. The DPA subsequently adopted a new decision and imposed a €1,000 fine, reasoning that, although the controller could qualify as a public authority under national law, it was not a public authority for the purposes of [[Article 83 GDPR|Article 83(7) GDPR]]. Following further proceedings, a court annulled the fine. After an appeal and remittal, a court again held on 27 February 2024 that the DPA could not impose an administrative fine on the controller. The DPA appealed to the high court, which referred the matter to the CJEU for a preliminary ruling. It essentially asked whether [[Article 83 GDPR|Article 83(7) GDPR]] precludes national legislation under which a private-law entity providing subsidised independent education cannot be subject to administrative fines. === Advocate General Opinion === The Advocate General (hereinafter, the AG) first considered that the concepts of \"public authorities and bodies\" in [[Article 83 GDPR|Article 83(7) GDPR]] constitute autonomous concepts of EU law. [[Article 83 GDPR|Article 83(7) GDPR]] allows Member States to determine whether and to what extent administrative fines can be imposed on public authorities and bodies, but it does not allow Member States themselves to determine which entities fall within those concepts. The AG reasoned that a uniform interpretation was necessary in light of the GDPR's objective of ensuring consistent and homogeneous protection throughout the EU and its harmonised system of administrative fines. Allowing each Member State to independently define \"public authorities and bodies\" could substantially alter the scope of the GDPR's sanctioning regime between Member States. The AG further considered that [[Article 83 GDPR|Article 83(7) GDPR]] must be interpreted restrictively because it constitutes an exception to the general system of administrative fines. In his view, the concept covers authorities or bodies governed by public law which exercise public authority or special powers conferred by public law. The mere performance of a task in the public interest is not sufficient to qualify an entity as a public authority or body under [[Article 83 GDPR|Article 83(7) GDPR]]. Applying these considerations to the controller, the AG considered that the fact that it provided education in the public interest and received public subsidies did not, in itself, make it a public authority. The controller was a legal person governed by private law, did not form part of the State and had not been entrusted with special powers amounting to the exercise of public authority. Similarly, the fact that it was subject to public supervision and could issue educational certificates was insufficient to establish that it exercised prerogatives of public power. The AG also rejected the argument that an exemption was necessary to protect public funds or guarantee continuity of the educational service. Such circumstances could instead be taken into consideration when determining the amount of an administrative fine under [[Article 83 GDPR|Article 83(2) GDPR]]. In this case, the controller's non-profit status and its performance of a task in the general interest had already contributed to the relatively low €1,000 fine. Moreover, categorically excluding private entities performing publicly funded tasks from administrative fines could significantly limit the DPA's ability to enforce the GDPR. This was particularly relevant because activities in areas such as education, health and social services often involve personal data concerning vulnerable data subjects, including children. Consequently, the AG proposed that [[Article 83 GDPR|Article 83(7) GDPR]] be interpreted as precluding national legislation under which the DPA cannot impose administrative fines on legal persons governed by private law solely because they provide independent education financed through public subsidies. === Holding === TBD == Comment == The Opinion itself did not impose a fine or other corrective measure. The €1,000 administrative fine arose from the underlying proceedings before the DPA, and the final interpretation of [[Article 83 GDPR|Article 83(7) GDPR]] remains for the CJEU to determine in its judgment. == Further Resources == ''Share blogs or news articles here!''","The CJEU Advocate General opined that Article 83(7) of the GDPR does not preclude exempting private-law entities providing publicly subsidized education from administrative fines solely because they perform a public-interest task. The opinion clarifies that \"public authorities and bodies\" are autonomous EU law concepts, and national legislation cannot unilaterally define which entities fall under this exemption. The case involves a dispute over a fine imposed on an educational organization for GDPR violations.","CJEU Advocate General: Private entities providing public education can be fined under GDPR.",null,"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-458\u002F25&diff=53123&oldid=0","2026-09-21T15:21:37+00:00","2026-09-21T16:00:33.014561+00:00",7,[17,20,23],{"name":18,"type":19},"GDPR","product",{"name":21,"type":22},"Onderwijsgroep Zusters der Christelijke Scholen Zuid-Kempen VZW","vendor",{"name":24,"type":22},"Gegevensbeschermingsautoriteit","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":11,"name":27,"slug":28},"Policy","policy",[30,34,39],{"category":31},{"id":32,"icon":11,"name":18,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":35},{"id":36,"icon":11,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":25,"icon":11,"name":27,"slug":28},[]]