Authors: Stefan Drewes and Sebastian Bretthauer
For the purposes of this regulation:
(18) “enterprise” means a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity;
The term “enterprise” has recently been introduced within the GDPR.[1] The term covers any natural or legal person regularly engaged in an economic activity. According to this definition, all legal entities with economic activity that process personal data are qualified as “enterprise”. This definition has certain particularities: All persons or plurality of persons engaged in an economic activity are considered as enterprise within the meaning of the GDPR. The assignment of partnerships to the concept of an enterprise saves the dispute as to whether and to what extent partnerships have their own legal personality under the law of the Member States.[2] Furthermore, the size of the company is insignificant, so that, pursuant to recital 13, micro-sized enterprises are also covered. Accordingly, a craftsman or an economically active association is also an enterprise within the meaning of the GDPR. In addition, legal entities under public law that regularly engage in an economic activity are qualified as “enterprise” as well. However, enterprises that are only temporarily engaged in economic activities are not covered.[3]
The question whether an enterprise is engaged in an economic activity is governed by relevant EU law.[4] According to this, “economic activity” is defined as “any offering of goods and services on a given market”.[5] The term is to be understood in a broad manner.[6] Only non-profit associations or research institutes organized in form of a limited liability company do not engage in an economic activity. Furthermore, there is no economic activity if the so-called household exception in Art. 2 para. 2c and recital 18 applies and the activity has purely personal or family purposes. (→ Art. 2 mn. 54 et seq.).
The enterprise is not to be confused with the controller, which is defined in Art. 4(7) (→ Art. 4(7) mn. 3 et seq.). The term enterprise is used in the GDPR to tier certain obligations. For example, enterprises with fewer than 250 persons are exempt from the obligation to maintain a record of processing activities under Art. 30 para. 5, unless there is a counter-exception (→ Art. 30 mn. 15 et seq.). Moreover, in view of the broadness of the definition, there will hardly be any dispute in the systematics of the GDPR as to whether an enterprise exists. The question (not addressed by Art. 4 para. 18) of micro-, small- and medium-sized enterprises is more significant, because these are being privileged in several places (see Art. 40 para. 1, 42 para. 1 and also recitals 13, 98, 132, 167).[7]
The term “enterprise” is not used consistently in the German version of the GDPR – the same applies to the French, Italian and Spanish versions.[8] For the assessment of administrative fines pursuant to Art. 83 paras. 4 and 5 an expanded concept of an undertaking is used. Thus, under recital 150, the term “undertaking” should be understood as defined in Arts. 101 and 102 TFEU with regard to the sanctioning.[9] Therefore, a competition law concept of the term “undertaking” – the so-called functional approach – is to be applied for the assessment of administrative fines (→ Art. 83 mn. 9 et seq.). According to this approach, any entity engaged in an economic activity is an undertaking, regardless of its legal status and the way in which it is financed. Thus, the parent company and subsidiary form one economic unit. The legislator intended the formal approach of the term for the area of administrative fines but did not include such an approach in the definitions of Art. 4.[10] In substance, the legislative intention in Art. 83 paras. 4 and 5 is more in line with the term “group of undertakings” (Art. 4 para. 19).
However, it is questionable, whether the term “enterprise” can be understood differently within the GDPR. In Art. 4 para. 18, the GDPR explicitly refers to the individual company and does not recognize any group privilege. If the term is to be interpreted differently within the GDPR, there are considerable concerns regarding the principle of legal certainty pursuant to Article 49(1) para. 1 of the CFR. Such an understanding contradicts the limits of the wording and the statutory system, at least in the German version, but also in the French (“entreprise“), Italian (“impresa“) and the Spanish (“empresa“) versions.[11] In the English version, however, the problem is considerably smaller, because it distinguishes between “enterprise” (Art. 4 para. 18) and “undertaking” (Art. 83 paras. 4 – 5). In view of the considerable relevance of the interpretation of the term “enterprise”, a judicial clarification can be expected in the near future. Both terms should be given a European meaning that is independent of national conceptions.[12]
[1]Drewes in Simitis/Hornung/Spiecker gen. Döhmann, Art. 4(18), para. 1 et seq.; Bygrave/Tosoni, ‘Art. 4(18)’, in Kuner/Bygrave/Docksey, 248 et seq.
[2]See Klabunde in Ehmann/Selmayr, Art. 4 para. 56.
[3]Bygrave/Tosoni, ‘Art. 4(18)’, in Kuner/Bygrave/Docksey, 250 et seq; Case T-11/89, 10.03.1992, Shell v Commission, ECLI:EU:T:1992:33, para. 311.
[4]See also Bygrave/Tosoni, ‘Art. 4(18)’, in Kuner/Bygrave/Docksey, 250.
[5]See Schreiber in Plath, DS‑GVO, Art. 4 para. 70 and Gola, K&R 2017, 145.
[6]Also Bygrave/Tosoni, ‘Art. 4(18)’, in Kuner/Bygrave/Docksey, 250.
[7]See Bygrave/Tosoni, ‘Art. 4(18)’, in Kuner/Bygrave/Docksey, 251 et seq.
[8]In detail Cornelius, NZWiSt 2016, 421 (423 et seq.); Gola, K&R 2017, 145.
[9]In detail Faust/Spittka/Wybitul, ZD 2016, 120; Gola, K&R 2017, 145 (146); Durmus, DB 2019, 94 (94 et seq.).
[10]See Drewes, ‘Art. 4(18)’, in Simitis/Hornung/Spiecker gen. Döhmann, para. 4; Schild in BeckOK DatenschutzR, DS‑GVO, Art. 4, para. 158a.
[11]Schröder in Kühling/Buchner, Art. 4(18), para. 2; also Gola, K&R 2017, 145 (146); Neun/Lubitsch, BB 2017, 1538 (1543).
[12]Bygrave/Tosoni, ‘Art. 4(18)’, in Kuner/Bygrave/Docksey, 250.