Introduction

Matrix organization

Mergers by absorption

Risks related to the expansion of the scope of criminal liability of legal entities

Validity conditions

Proof of delegation

Exemption from individual liability of delegator

Attribution of offense to legal entity

Delegations of authority

Criminal risk management within business organizations

Complicity in crimes against humanity

Breaches of secrecy

Personal data breaches

Theft

Extortion

Blackmail

Fraud

Misappropriation

Receiving/concealment of unlawfully obtained property (recel)

Attacks on automated data processing systems

Money laundering

Misappropriation by public official (concussion)

Corruption and influence peddling

Unlawful acquisition of an interest

Favoritism

Forgery and use of forgeries

Violation of Criminal Code

Offenses under the Monetary and Financial Code

Offenses under the Commercial Code

Environmental Code violations

Offenses arising from other codes

Types of offenses

Offenses under the Criminal Code, the Commercial Code, or the Environmental Code, Criminal procedure

White Collar Crime (en cours)

Pursuant to Article 226-22-1 of the Criminal Code, the act of carrying out or having carried out a transfer of personal data that is being processed or intended to be processed to a state not belonging to the European Union or to an international organization in violation of Chapter V of the GDPR, or Articles 112 to 114 of the Data Protection Act, is punishable by five years of imprisonment and a  …

Data transfer outside the EU

Pursuant to Article 226-22-1 of the Criminal Code, the act of carrying out or having carried out a transfer of personal data that is being processed or intended to be processed to a state not belonging to the European Union or to an international organization in violation of Chapter V of the GDPR, or Articles 112 to 114 of the Data Protection Act, is punishable by five years of imprisonment and a fine of 300,000 euros.

Article 45 of the GDPR states that a transfer of personal data to a third country or an international organization may take place when the Commission has determined by decision that the third country, a territory or one or more specified sectors within that third country, or the international organization in question ensures an adequate level of protection. Such a transfer does not require any specific authorization. The Commission has drawn up a list of those countries . In a decision of 26 July 2000 , the Commission considered transfers to US organizations participating in the “Safe Harbor” framework as adequate. However, this adequacy decision was invalidated by the Court of Justice , thereby preventing transfers to the United States. On 2 February 2016, the Commission and the United States established a new framework for transatlantic data transfers. The “EU-US Privacy Shield,” which replaces the Safe Harbor framework and takes into account the requirements set out by the Court, led to the adoption by the Commission of a new adequacy decision on 12 July 2016 for transfers to European organizations adhering to this new arrangement.

Article 46 of the GDPR specifies that the data controller or processor may only transfer personal data to a third country or an international organization if appropriate safeguards have been provided and on the condition that data subjects have enforceable rights and effective legal remedies. Furthermore, Article 48 of the GDPR states that any judgment of a court or administrative authority of a third country requiring a data controller or processor to transfer or disclose personal data may only be recognized or made enforceable in any manner if it is based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer under this chapter.

Finally, Article 49 of the GDPR provides for derogations from Articles 45 and 46 when specific conditions are met, such as the explicit consent given by the data subject to the proposed transfer, after being informed of the risks that this transfer could entail for them due to the absence of an adequacy decision and appropriate safeguards, when the transfer is necessary for the conclusion or performance of a contract in the interest of the data subject between the data controller and another natural or legal person, or when the transfer is necessary for the establishment, exercise, or defense of legal claims.

Such as Argentina, Canada (only in commercial matters), the Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, Uruguay, or Andorra.

Decision No 2000/520/EC of the European Commission of 26 July 2000.

CJEU Case C-362/14 Schrems v Data protection Commissioner, Judgment of 6 October 2015, LawLex202500013812JBJ.

White Collar Crime (en cours)

52. Data transfer outside the EU

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Les notions juridiques connexes

52. Data transfer outside the EU

Demandez un accès gratuit au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Les notions juridiques connexes

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise