In a recent ruling, the European Court of Justice (ECJ) addressed the conditions for imposing GDPR fines on legal entities. In its decision in the “Deutsche Wohnen” case, the ECJ specified the conditions under which fines can be imposed on companies in connection with data protection violations (ECJ, Case C-807/21, judgment of 5 December 2023).