Brussels, 17 August – Following notification to ACCOR SA of the French DPA’s final decision, the EDPB has published its Art. 65(1)(a) binding decision. This binding decision was adopted on June 15th following a dispute between the French DPA as the lead supervisory authority (LSA), and one of the concerned supervisory authorities (CSA), namely the Polish DPA, with regard to the amount of the fine against ACCOR SA, the controller, for their failure to respect the right to object to marketing activities and difficulties encountered in exercising the right of access.
The EDPB decided that the French DPA must take into account the turnover of ACCOR SA of the preceding year, namely 2021. In addition, the EDPB decided that, in view of the turnover of ACCOR SA and of the fact that the case relates to “substantial” infringements, the fine is not dissuasive in accordance with Art. 83(1) GDPR. For this reason, the EDPB instructed the French DPA to reassess the elements it relied upon to calculate the amount of the fine to meet the criterion of dissuasiveness under Art. 83(1) GDPR, taking into account, in particular, the relevant turnover of ACCOR SA.
However, contrary to the request of the Polish DPA, the EDPB noted that there is no need for the French DPA to demonstrate the impact of the fine on ACCOR SA’s economic viability, as the French DPA did not base a reduction of the fine on the controller’s inability to pay it. The EDPB also underlined the fact that the turnover already constitutes a relevant indication of the financial situation of a company. Therefore, there is no need to consider the decrease in turnover as a mitigating factor under Art. 83(2)(k) GDPR. This will ensure that the circumstances taken into account when calculating the fine are not counted twice.
Following its assessment, the EDPB instructed the French DPA to reassess its envisaged administrative fine in accordance with the conclusions reached by the Board.
Further information on the Art. 65 GDPR procedure is available here
