Introduction

Matrix organization

Mergers by absorption

Risks related to the expansion of the scope of criminal liability of legal entities

Validity conditions

Proof of delegation

Exemption from individual liability of delegator

Attribution of offense to legal entity

Delegations of authority

Criminal risk management within business organizations

Complicity in crimes against humanity

Breaches of secrecy

Personal data breaches

Theft

Extortion

Blackmail

Fraud

Misappropriation

Receiving/concealment of unlawfully obtained property (recel)

Attacks on automated data processing systems

Money laundering

Misappropriation by public official (concussion)

Corruption and influence peddling

Unlawful acquisition of an interest

Favoritism

Forgery and use of forgeries

Violation of Criminal Code

Offenses under the Monetary and Financial Code

Offenses under the Commercial Code

Environmental Code violations

Offenses arising from other codes

Types of offenses

Offenses under the Criminal Code, the Commercial Code, or the Environmental Code, Criminal procedure

White Collar Crime (en cours)

The preliminary formalities refer to a set of declarative formalities to be carried out with the CNIL before implementing a personal data processing operation. Depending on the processing, it will be a declaration or an authorization request. They are listed in Articles 31 to 36 of the Data Protection Act. They have been simplified by the GDPR, which in return requires the data controller to be ab …

Scope of reporting obligation

The preliminary formalities refer to a set of declarative formalities to be carried out with the CNIL before implementing a personal data processing operation. Depending on the processing, it will be a declaration or an authorization request. They are listed in Articles 31 to 36 of the Data Protection Act. They have been simplified by the GDPR, which in return requires the data controller to be able to establish compliance with GDPR rules at any time, particularly regarding the traceability of procedures (principle of accountability).

The act, including by negligence, of processing personal data without complying with the prior formalities provided by the Law of 6 January 1978 is criminally sanctioned, without requiring a threshold of data or files to be exceeded. Indeed, a directory containing two nominative notes can constitute a personal data file . Automated processing can take different forms. Thus, posting a person's name within the editorial content of a website constitutes automated processing of nominative data within the meaning of the data protection law . Similarly, implementing an automated processing system of nominative information without making a prior declaration to the CNIL and without taking all necessary precautions to prevent the disclosure of medical records to administrative staff, unauthorized third parties, constitutes the offenses sanctioned by Articles 226-16 and 226-17 of the Criminal Code . However, this is not the case for setting up a system allowing each of the user doctors and their secretaries to access the medical information contained in the files created by other doctors, as long as the latter, bound by professional secrecy, cannot be considered unauthorized third parties . Nor can an employee be reproached for refusing to comply with an employer's requirement involving the implementation of automated processing of nominative information concerning them, if this processing has not been declared to the CNIL .

Article 226-16 of the Criminal Code does not condition the preliminary formalities for the implementation of personal data processing on the execution of operations with specific technicality. Indeed, even when the operations consist solely of using simple functionalities, limited to classification and archiving, without implementing any particular automation or technical rules for extraction or dissemination, a prior declaration obligation may arise. It is up to the courts to determine whether such data processing, given its purpose of personnel management, corresponds to the declaration obligation .

An automated processing likely to exclude individuals from the benefit of a contract or service falls under the authorization regime. Therefore, the company that has not made any authorization request to the Commission regarding such processing is in breach of the provisions of 4° of Article 25-I of the Law of 6 January 1978, which states that automated processing likely, due to its nature, scope, or purposes, to exclude individuals from the benefit of a right, service, or contract in the absence of any legislative or regulatory provision, is implemented after authorization from the CNIL . Similarly, the fact that a company has not made any declaration to the CNIL regarding a video surveillance system installed in the premises of a shopping center constitutes a failure to comply with the obligation to complete prior formalities with the CNIL before implementing automated processing of personal data .

Cass. crim., 8 September 2015, LawLex202200002465JBJ.

CA Lyon, 24 February 2004, LawLex202200005082JBJ, which specifies that in this case it is necessary to declare the website concerned to the CNIL prior to implementing any processing of personal data on this site, failing which the person responsible for such a site incurs the penalties provided for by Article 226-16 of the Criminal Code.

Cass. crim., 30 October 2001, LawLex202200002493JBJ.

Cass. soc., 6 April 2004, LawLex202200002488JBJ.

Cass. Crim., 23 May 2018, LawLex202200003591JBJ.

CNIL, 24 June 2015, LawLex202200003560JBJ.

CNIL, 12 July 2013, LawLex202200003563JBJ.

Pursuant to Article 226-16, para. 1, of the Criminal Code, the act, including by negligence, of carrying out or having carried out processing of personal data without complying with the formalities required by law for their implementation is punishable by five years' imprisonment and a fine of EUR 300,000. Paragraph 2 imposes the same penalties, including by negligence, of carrying out or having carried out processing that has been subject to one of the measures provided for in 3° of III of Article 20 of Law No 78-17. Furthermore, Article 20 of Law No 78-17 authorizes the president of the CNIL - when the data controller or its processor fails to comply with the obligations arising from the GDPR or the law, if necessary after issuing a warning or imposing one or more corrective measures - to refer the matter to the restricted panel of the commission for the purpose of imposing, after an adversarial procedure, the temporary or permanent limitation of the processing, its prohibition, or the withdrawal of an authorization granted under the regulation or the law. The offense of implementing an automated processing of personal information without prior declaration constitutes a material offense, the incriminated act involving a fault from which the defendant can only exonerate themselves by force majeure .

Cass. crim., 3 November 1987, LawLex202200002489JBJ.

White Collar Crime (en cours)

39. Scope of reporting obligation

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Les notions juridiques connexes

39. Scope of reporting obligation

Demandez un accès gratuit au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Les notions juridiques connexes

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise