Referral C-807/21 (Deutsche Wohnen, 21 Dec 2021)

1. Is Article 83(4) to (6) of the GDPR to be interpreted as incorporating into national law the functional concept of an undertaking, as defined in Articles 101 and 102 TFEU, and the principle of an economic entity, with the result that proceedings for an administrative fine may be initiated directly against an undertaking by broadening the principle of legal entity forming the basis of Paragraph 30 of the Gesetz über Ordnungswidrigkeiten (Law on administrative offences; ‘the OWiG’) and that the imposition of a fine does not require a finding that a natural and identified person committed an administrative offence, if necessary in satisfaction of the objective and subjective elements of tortious liability?

2. If Question 1 is answered in the affirmative: Is Article 83(4) to (6) of the GDPR to be interpreted as meaning that the undertaking must have intentionally or negligently committed the breach by an employee vicariously (see Article 23 of Council Regulation (EC) No 1/2003 of 16 December 2002 on the implementation of the rules on competition laid down in Articles 81 and 82 of the Treaty), or is the objective fact of breach of obligations caused by it sufficient, in principle, for a fine to be imposed on that undertaking (‘strict liability’)?