EDPB Publishes Art.65 GDPR Dispute Resolution Binding Decision Concerning Accor SA (8/17/2022)

UK Version of GDPR

Following notification to ACCOR SA of the French DPA’s final decision, the EDPB has published its Art. 65(1)(a) binding decision. This binding decision was adopted on June 15th following a dispute between the French DPA as the lead supervisory authority (LSA), and one of the concerned supervisory authorities (CSA), namely the Polish DPA, about the amount of the fine against ACCOR SA, the controller, for their failure to respect the right to object to marketing activities and difficulties encountered in exercising the right of access.

The EDPB decided that the French DPA must take into account the turnover of ACCOR SA of the preceding year, namely 2021. In addition, the EDPB decided that, given the turnover of ACCOR SA and the fact that the case relates to “substantial” infringements, the fine is not dissuasive by Art. 83(1) GDPR. For this reason, the EDPB instructed the French DPA to reassess the elements it relied upon to calculate the amount of the fine to meet the criterion of dissuasiveness under Art. 83(1) GDPR, taking into account, in particular, the relevant turnover of ACCOR SA.

However, contrary to the request of the Polish DPA, the EDPB noted that there is no need for the French DPA to demonstrate the impact of the fine on ACCOR SA’s economic viability, as the French DPA did not base a reduction of the fine on the controller’s inability to pay it. The EDPB also underlined the fact that the turnover already constitutes a relevant indication of the financial situation of a company. Therefore, there is no need to consider the decrease in turnover as a mitigating factor under Art. 83(2)(k) GDPR. This will ensure that the circumstances taken into account when calculating the fine are not counted twice.

Following its assessment, the EDPB instructed the French DPA to reassess its envisaged administrative fine by the conclusions reached by the Board.

Source; https://edpb.europa.eu/news/news/2022/edpb-publishes-art65-gdpr-dispute-resolution-binding-decision-concerning-accor-sa_en

Picture of Dposphere

Dposphere

Recent Post

A new regulation adopted on Thursday, February 29th, allows EU citizens to identify and authenticate themselves

Privacy is getting more and more critical in the modern world. Even giant enterprises face challenges

The UK Competition and Markets Authority’s (CMA) latest report on Google’s Privacy Sandbox raises concerns about