proposed for the Article 14 infringement (in the range of between €30 and €50 million) was effective, proportionate and dissuasive in the circumstances of the inquiry, “taking into account all infringements.” b. WhatsApp has further submitted that, rather than reassessing the fine originally proposed in respect of the Article 14 infringement, the Commission has simply reverted to the fine previously proposed without having any regard to WhatsApp’s previous submissions, made in response to the fine originally proposed. 857. In response to the above, WhatsApp appears to be suggesting that the fine proposed by the Composite Draft reflected all of the (then) three infringements that were found to have occurred. To be absolutely clear about the position, this is absolutely not the case and it is difficult to understand how WhatsApp could have formed this view, given the clear explanation, set out in the Composite Draft, as to the manner in which the Commission interpreted and applied Article 83(3). 858. As regards the Commission’s reinstatement of the fine originally proposed by the Supplemental Draft in respect of the Article 14 infringement, the manner in which the Commission has taken account of WhatsApp’s various submissions is clearly set out in Part 5 of this Decision, including within the individual Article 83(2) assessments as well as my assessments of the Submissions on Recurring Themes. It is therefore incorrect to suggest that the Commission failed to have regard to WhatsApp’s submissions. I further question why it might have been inappropriate for the Commission to have reinstated the fine that it originally proposed in circumstances where the impact, from the perspective of the Article 83(2) assessment, of the Board’s determination on the lossy hashing objections is materially identical to that originally outlined in the Preliminary Draft and Supplemental Draft decisions. 859. On the basis of the above, I am not inclined to make a downward adjustment to the fines proposed above to take account of WhatsApp’s Final Submissions.
Article 83(5) and the applicable fining “cap” 860. Turning, finally, to Article 83(5), I note that this provision operates to limit the maximum amount of any fine that may be imposed in respect of certain types of infringement, as follows: “Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher: … (b) the data subjects’ rights pursuant to Articles 12 to 22; …” 861. In order to determine the applicable fining “cap”, it is firstly necessary to consider whether or not the fine is to be imposed on “an undertaking”. Recital 150 clarifies, in this regard, that: “Where administrative fines are imposed on an undertaking, an undertaking should be understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those purposes.”
248
