ECJ rules: Corporate fault sufficient for GDPR fine