Under GDPR Art. 83, what is the maximum fine for an unlawful transfer, and how does 'whichever is higher' apply to a corporate group?

## The two tiers **Art. 83** sets maximum administrative fines in two bands. The GDPR names which provisions fall in each. | Tier | Maximum | Provisions (examples) | |---|---|---| | **Art. 83(4)** | **EUR 10 million**, or for an undertaking **2%** of total worldwide annual turnover of the preceding financial year, **whichever is higher** | controller and processor obligations in Arts. 8, 11, 25-39, 42 and 43, e.g. data protection by design, records, security, breach notification, DPIA, DPO; certification and monitoring body duties | | **Art. 83(5)** | **EUR 20 million**, or **4%**, **whichever is higher** | principles and bases (Arts. 5, 6, 7, 9); data subject rights (Arts. 12-22); **transfers to a third country or international organisation (Arts. 44-49)**; Member State law under Chapter IX; non-compliance with an Art. 58(2) order, a limitation or **a suspension of data flows**, or refusing access under Art. 58(1) | | **Art. 83(6)** | EUR 20 million or 4% | non-compliance with an Art. 58(2) order | So an unlawful transfer sits in the **upper tier**, beside unlawful processing and ignored data subject rights. ## How "whichever is higher" works Each tier has a **static** maximum (EUR 10m or 20m) and, for an undertaking, a **dynamic** one (2% or 4% of turnover). The higher of the two is the legal maximum. EDPB Guidelines 04/2022 on fines point out the crossover. 2% of EUR 500 million is EUR 10 million, and 4% of EUR 500 million is EUR 20 million. So the turnover-based cap only exceeds the fixed one for undertakings with more than **EUR 500 million** total annual turnover in the previous financial year. Worked examples, following the guidelines' own examples: 1. **EUR 3 billion turnover, Art. 83(5) infringement.** Static cap EUR 20m, dynamic cap 4% = **EUR 120m**. The legal maximum is EUR 120m. 2. **EUR 450 million turnover, Art. 83(4) infringement.** Static cap EUR 10m, dynamic cap 2% = EUR 9m. The static **EUR 10m** prevails. 3. **A public body that is not an undertaking**, Art. 83(5) infringement. Only the static EUR 20m applies. Art. 83(7) lets each Member State decide whether and how far its public authorities can be fined at all. ## Whose turnover? The undertaking concept **Recital 150**: *"Where administrative fines are imposed on an undertaking, an undertaking should be understood to be an undertaking in accordance with Articles 101 and 102 TFEU."* That is the **competition-law** concept: - an undertaking is any entity engaged in economic activity, identified as an **economic unit** rather than a legal one; - a parent that exercises **decisive influence** over a subsidiary forms a **single economic unit** with it; - the EDPB guidelines conclude that the **combined turnover** of that undertaking can set the dynamic maximum. So a small EU subsidiary that runs an unlawful transfer is not capped by its own revenue if its parent controls it. The group's worldwide turnover sets the ceiling. ## Ceilings, not tariffs The maxima are limits. The amount in a given case follows **Art. 83(2)**, which lists factors including: - nature, gravity and duration, the number of data subjects and the damage; - **intentional or negligent** character; - mitigation, the degree of responsibility given Arts. 25 and 32 measures, and previous infringements; - **cooperation** with the authority, the categories of data, and how the infringement became known (including whether it was self-notified); - adherence to approved codes or certifications, and financial benefit gained. Two more rules shape the result: - **Art. 83(1)**: every fine must be *effective, proportionate and dissuasive*. - **Art. 83(3)**: for the *same or linked* processing operations infringing several provisions, the total cannot exceed the amount for the **gravest** infringement. A fine may be imposed instead of, or in addition to, corrective measures. For transfers the most disruptive tool is often not the fine but an order under **Art. 58(2)(j)** to **suspend the data flow**. Ignoring that order is itself an upper-tier infringement under Art. 83(5)(e).