Introduction

Matrix organization

Mergers by absorption

Risks related to the expansion of the scope of criminal liability of legal entities

Validity conditions

Proof of delegation

Exemption from individual liability of delegator

Attribution of offense to legal entity

Delegations of authority

Criminal risk management within business organizations

Complicity in crimes against humanity

Breaches of secrecy

Personal data breaches

Theft

Extortion

Blackmail

Fraud

Misappropriation

Receiving/concealment of unlawfully obtained property (recel)

Attacks on automated data processing systems

Money laundering

Misappropriation by public official (concussion)

Corruption and influence peddling

Unlawful acquisition of an interest

Favoritism

Forgery and use of forgeries

Violation of Criminal Code

Offenses under the Monetary and Financial Code

Offenses under the Commercial Code

Environmental Code violations

Offenses arising from other codes

Types of offenses

Offenses under the Criminal Code, the Commercial Code, or the Environmental Code, Criminal procedure

White Collar Crime (en cours)

Pursuant to Article 226-20 of the Criminal Code, the act of retaining personal data beyond the period provided by law or regulation, by the request for authorization or opinion, or by the prior declaration addressed to the National Commission on Information Technology and Civil Liberties, is punishable by five years of imprisonment and a fine of 300,000 euros, unless such retention is carried out  …

Retention beyond the legal period

Pursuant to Article 226-20 of the Criminal Code, the act of retaining personal data beyond the period provided by law or regulation, by the request for authorization or opinion, or by the prior declaration addressed to the National Commission on Information Technology and Civil Liberties, is punishable by five years of imprisonment and a fine of 300,000 euros, unless such retention is carried out for historical, statistical, or scientific purposes under the conditions provided by law. The same penalties apply to the act, outside the cases provided by law, of processing personal data retained beyond the period mentioned in the first paragraph for purposes other than historical, statistical, or scientific. Thus, the offense of illegal retention is established when an undertaking keeps clients' names, phone numbers, and credit card numbers with expiration dates, as well as cryptograms, whose data can only be used and retained for the strict need and duration of a specific transaction and must not be stored .

When authorized, data retention must be limited in  time  and not exceed the legal or set period. Keeping data for a period longer than that declared to the CNIL constitutes a breach of this obligation . The data controller is required to set a retention period proportionate to the purpose of the processing. In particular, a company cannot retain the data of individuals who have closed their accounts beyond three years after closure, without emptying the closed accounts based on the duration it has defined. This duration exceeds what is necessary for the purposes of data collection . Similarly, an employee's fingerprint can only be retained for the time strictly necessary for the purpose pursued by the system, which aims to secure areas reserved for staff. A shopping center also cannot retain surveillance videos without a time limit . The same applies to geolocation data collected via a tracker within mobile applications, which a company cannot justify retaining for thirteen months on the grounds that some of its partners might need to know the places visited by mobile users during this period .

For cookies, the CNIL adopted deliberation No 2013-378 of 5 December 2013 adopting a recommendation on cookies and other trackers. This recommendation, which is not binding, aims to interpret the aforementioned legislative provisions and to guide data controllers in implementing concrete measures to ensure compliance with these provisions, so that they either implement these measures or implement measures with equivalent effect. It specifies that cookies must have a lifespan limited to thirteen months after their first placement on the user's terminal equipment (following the expression of consent) and their lifespan must not be extended during new visits to the site. It notably considered that the retention in a company's databases of profiles archived for more than three years appears excessive in relation to the purpose of the processing .

Cass. crim., 3 March 2015, LawLex202200003602JBJ.

CNIL, 2 July 2018, LawLex202200003571JBJ.

CNIL, 24 June 2015, LawLex202200003562JBJ.

CNIL, 12 July 2013, LawLex202200003563JBJ.

CNIL, 25 June 2018, LawLex202200003576JBJ.

White Collar Crime (en cours)

49. Retention beyond the legal period

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Les notions juridiques connexes

49. Retention beyond the legal period

Demandez un accès gratuit au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Les notions juridiques connexes

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise