Introduction

Matrix organization

Mergers by absorption

Risks related to the expansion of the scope of criminal liability of legal entities

Validity conditions

Proof of delegation

Exemption from individual liability of delegator

Attribution of offense to legal entity

Delegations of authority

Criminal risk management within business organizations

Complicity in crimes against humanity

Breaches of secrecy

Personal data breaches

Theft

Extortion

Blackmail

Fraud

Misappropriation

Receiving/concealment of unlawfully obtained property (recel)

Attacks on automated data processing systems

Money laundering

Misappropriation by public official (concussion)

Corruption and influence peddling

Unlawful acquisition of an interest

Favoritism

Forgery and use of forgeries

Violation of Criminal Code

Offenses under the Monetary and Financial Code

Offenses under the Commercial Code

Environmental Code violations

Offenses arising from other codes

Types of offenses

Offenses under the Criminal Code, the Commercial Code, or the Environmental Code, Criminal procedure

White Collar Crime (en cours)

Articles 323-1 et following of the Criminal Code punish attacks on automated data processing systems. The regime has evolved over time towards increased repression to address the dangers faced by authorities and undertakings increasingly exposed to cybercrime. Attacks on automated data processing systems were first formalized by Law No 88-19 on computer fraud  which was transposed into the 1992 Criminal Code, in Articles 321-1 and following. The four behaviors initially punished by these articles  were supplemented by Law No 2004-575 for confidence in the digital economy  which, in Article 323-3-1, established the offense of trafficking means intended to commit computer-related offenses. Several laws subsequently introduced aggravating circumstances for these various offenses . In particular, Article 323-3 now punishes the act of extracting, possessing, reproducing, or transmitting data contained in the computer system. The penalties incurred were increased by Law No 2015-912 on intelligence .

The concept of an automated data processing system is not specified by the texts. It was defined during the preparatory work for Law No 88-19 by the Senate rapporteur as “any set composed of one or more processing units, memory, software, data, input and output devices, and connections that contribute to a determined result, with the set being protected by security devices.” The reference to protection by a security device was not retained in the text, as the offense under Article 323-1 is constituted as soon as an unauthorized person enters a computer system, whether or not it is protected . However, even if the Senate report's definition was not adopted by the law, it serves as an analytical guide for the courts when applying these rules. Thus, the Paris Court of Appeal, by reference to this definition, held that the concept of a system implies that these elements are united for the purpose of producing a determined result: the automated processing of data , with the concept of data to be understood broadly as the representation of information, namely the form and not the substance of any element of knowledge .

Law No 88-19 of 5 January 1988, OJ 6 January 1988.

Access and maintenance in an automated data processing system (Art. 321-1), act of obstructing or distorting automated data processing (Art. 323-2), introduction, modification, or deletion of data (Art. 323-3), participation in a group or agreement for the preparation of one or more offenses under the preceding articles (Art. 323-4).

Law No 2004-575 of 21 June 2004, OJ 22 June 2004.

Law No 2012-410 of 27 March 2012, concerning the protection of identity; Law No 2014-1353 of 13 November 2014, strengthening provisions related to the fight against terrorism.

Law No 2015-912 of 24 July 2015, OJ 26 July 2015, which excluded from the scope of Articles 323-1 and following the measures implemented by the State's authorized intelligence services.

Judicial Court of Paris, 18 September 2008 LawLex202200010031JBJ.

See notably CA Paris, 24 October 2012, No 11/00404, which recalls that the definition of an automated data processing system was established during parliamentary proceedings by the Senate rapporteur and clarified by doctrine, upheld by Cass. crim., 19 March 2014, LawLex202200003025JBJ.

Cass. crim., 19 March 2014, LawLex202200003025JBJ.

95. Concept