Introduction

Matrix organization

Mergers by absorption

Risks related to the expansion of the scope of criminal liability of legal entities

Validity conditions

Proof of delegation

Exemption from individual liability of delegator

Attribution of offense to legal entity

Delegations of authority

Criminal risk management within business organizations

Complicity in crimes against humanity

Breaches of secrecy

Personal data breaches

Theft

Extortion

Blackmail

Fraud

Misappropriation

Receiving/concealment of unlawfully obtained property (recel)

Attacks on automated data processing systems

Money laundering

Misappropriation by public official (concussion)

Corruption and influence peddling

Unlawful acquisition of an interest

Favoritism

Forgery and use of forgeries

Violation of Criminal Code

Offenses under the Monetary and Financial Code

Offenses under the Commercial Code

Environmental Code violations

Offenses arising from other codes

Types of offenses

Offenses under the Criminal Code, the Commercial Code, or the Environmental Code, Criminal procedure

White Collar Crime (en cours)

Article R. 625-10 of the Criminal Code lists a set of situations which, when subject to automated processing, must be brought to the attention of the individuals concerned by the data controller and penalizes the failure to comply with this obligation to inform. The data controller of personal data is, in principle, the person, public authority, company, or organization that determines the purpose …

Breach of obligation to inform individuals

Article R. 625-10 of the Criminal Code lists a set of situations which, when subject to automated processing, must be brought to the attention of the individuals concerned by the data controller and penalizes the failure to comply with this obligation to inform. The data controller of personal data is, in principle, the person, public authority, company, or organization that determines the purposes and means of this processing, who decides on its creation. In practice, it is generally the legal entity (undertaking, community, etc.) represented by its legal representative (chairperson, mayor, etc.) .

Failure to comply with the obligation to inform data subjects, as provided for and sanctioned by Article R. 625-10, can take various forms:

- The failure to inform the individual from whom personal data concerning them is collected of:

o the identity of the data controller and, where applicable, that of their representative;

o the purpose pursued by the processing for which the data is intended;

o the mandatory or optional nature of replies;

o the potential consequences for them of a failure to respond;

o the recipients or categories of recipients of the data;

o their right to object, inquire, access, and rectify;

- Where applicable, any planned transfers of personal data to a State not belonging to the European Union;

- When data is collected by means of a questionnaire, not to include on the questionnaire information relating to:

o the identity of the data controller and, where applicable, that of its representative;

o the mandatory or optional nature of responses;

o the right to object, inquire, access, and rectify of individuals from whom data is collected;

- The failure to clearly and precisely inform any user of electronic communications networks of:

o the purpose of actions seeking to access, via electronic transmission, information stored in its terminal connection equipment or entering, by the same means, information into its terminal connection equipment;

o The means at her disposal to enforce it;

- The failure to provide the data subject, when personal data has not been collected from them, with the information listed in 1° and 2° as soon as the data is recorded or, if communication of the data to third parties is envisaged, no later than at the time of the first communication of the data.

The same penalty applies to the failure to provide any of the information mentioned in Article 104 (information that the data controller must make available to the data subject) of Law No 78-17 of 6 January 1978 on Information Technology, Data Files, and Civil Liberties or in Articles 13 (Information to be provided where personal data are collected from the data subject) and 14 (Information to be provided where personal data have not been obtained from the data subject) of the GDPR.

In matters of contraventions, it is generally sufficient, for the application of criminal law, that the punishable act be materially established .

The information provided by the company implementing the data processing must enable the user to give their consent to this processing in a specific, informed, and unambiguous manner . The expression of this consent is not valid if they must accept all processing as a whole , as the different purposes of these processes must be presented to them separately in advance .

The information must be provided directly to the data subject, which is not the case when a tracker is integrated into a mobile application during an update, without the new general terms of use in privacy policies being directly brought to the attention of the mobile user .

The information must specify the purposes of the processing, including the installation of cookies, and the rights available to the data subjects. Thus, an account creation form must, to comply with the requirements of Article 32 of the 1978 law, contain this information . When filling out this form, the person concerned by the data collection must be able to understand the scope of their action. The information is incomplete when it is not disclosed that by checking a box related to subscribing to the newsletter, they will receive other newsletters from partners  or when the form only includes a partial mention of the processing . Similarly, cookies cannot be placed on the user's device without informing them beforehand and obtaining their consent for this placement .

Finally, a company that implements a video surveillance system whose purpose goes beyond the security of third parties and individuals fails in its obligation to provide the person from whom personal data is collected with information on the identity of the data controller, its purpose, its recipients, and their rights of access or to object .

It is clear that the purpose of the information provided is paramount: it must be visible, highlighted, and complete to allow for the definition of a specific, explicit, and legitimate purpose of the processing. 

Information available on the CNIL website, section “Who is the “data controller”?”

Cass. crim., 16 November 1976, LawLex202200003600JBJ.

CNIL, 16 December 2011, LawLex202200003566JBJ.

CNIL, 24 June 2015, LawLex202200003562JBJ.

CNIL, 21 January 2019, LawLex201900000259JBJ.

CNIL, 25 June 2018, LawLex202200003576JBJ; Similarly CNIL, 8 February 2018, LawLex202200001716JBJ.

CNIL, 27 November 2017, LawLex202200003569JBJ; 24 June 2015, LawLex202200003570JBJ; 15 January 2014, LawLex202200003573JBJ.

CNIL, 13 October 2014, LawLex202200003568JBJ.

CNIL, 24 June 2015, LawLex202200003570JBJ.

White Collar Crime (en cours)

45. Breach of obligation to inform individuals

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Les notions juridiques connexes

45. Breach of obligation to inform individuals

Demandez un accès gratuit au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Les notions juridiques connexes

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise