6.2.2 - Determining the turnover

authority has to demonstrate, not only that the parent company has the ability to exercise decisive influence over the subsidiary, but also that it has actually exercised such decisive influence so that it can intervene at any time in the subsidiary's freedom of choice and determine its behavior. The nature or type of instruction is irrelevant when determining the parent company’s influence.

127. The fine is addressed58 to the (joint-) controller(s)/processor(s), and the competent supervisory authority has the option to hold the parent company jointly and severally liable59 for the payment of the fine.

6.2.2 - Determining the turnover

128. Turnover is taken from the annual accounts of an undertaking, which are drawn up with reference to its business year and provide an overview of the past financial year of a company or of a group of companies (consolidated accounts). Turnover is defined as the sum of all goods and services sold. The term turnover within the meaning of Article 83(4)–(5) GDPR is to be understood in terms of the net turnover of Directive 2013/34/EU60 . According to this directive, net turnover means the amount derived from the sale of products and the provision of services after deducting sales rebates and value added tax (VAT) and other taxes directly linked to turnover.

61

129. Turnover is taken from the presentation of the profit and loss account within the meaning of Annexes V or VI to Article 13(1) of Directive 2013/34/EU under the heading "net turnover". Net turnover includes revenue from the sale, rental and leasing of products and revenue from the sale of services less sales deductions (e.g. rebates, discounts) and VAT. Revenue therefore does not include items which are unrelated to the business object/sector of the company such as for example the proceeds from the sale of fixed assets, rental of unused parts of buildings, insurance premiums, commissions and interest income in case of an industrial company.

62

130. If the undertaking is subject to the obligation within the meaning of Article 21 et seq. of Directive 2013/34/EU and has to prepare consolidated annual financial statements, these consolidated financial statements of the parent company heading the group are relevant for reflecting the combined turnover of the undertaking. If such statements do not exist, any other documents shall be obtained and used that are apt to infer the worldwide annual turnover of the undertaking in the relevant business year.

131. Article 83(4)–(6) GDPR state that the total worldwide annual turnover of the preceding financial year is to be used. As to the question of which event the term “preceding” relates to, the CJEU case law in competition law is also to be applied for GDPR fines so that the relevant event is the fining decision issued by the supervisory authority and neither the time of infringement nor the court decision63 . In case of cross-border processing the relevant fining decision is not the draft decision, but rather the final decision issued by the

58 The decision is addressed and delivered to the controller(s)/processor(s) as the offender(s) of the infringement and can additionally be addressed and delivered to other legal entities of the SEU that are jointly and severally liable for the fine. 59 EDPB Binding Decision 1/2021, para. 290. 60 Directive 2013/34/EU of the European Parliament and of the Council of 26 June 2013 on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 788/660/EEC (hereinafter “Directive 2013/34/EU”). 61 Article 2(5) of Directive 2013/34/EU. 62 Conversely, some of these items are relevant and should be included in the revenue in case the company operates for example in the banking sector (commissions and interest income) or in the insurance sector (insurance premiums). 63 Regional Court Bonn, case 29 OWi 1/20, 11 November 2020, para. 102.