Introduction

Matrix organization

Mergers by absorption

Risks related to the expansion of the scope of criminal liability of legal entities

Validity conditions

Proof of delegation

Exemption from individual liability of delegator

Attribution of offense to legal entity

Delegations of authority

Criminal risk management within business organizations

Complicity in crimes against humanity

Breaches of secrecy

Personal data breaches

Theft

Extortion

Blackmail

Fraud

Misappropriation

Receiving/concealment of unlawfully obtained property (recel)

Attacks on automated data processing systems

Money laundering

Misappropriation by public official (concussion)

Corruption and influence peddling

Unlawful acquisition of an interest

Favoritism

Forgery and use of forgeries

Violation of Criminal Code

Offenses under the Monetary and Financial Code

Offenses under the Commercial Code

Environmental Code violations

Offenses arising from other codes

Types of offenses

Offenses under the Criminal Code, the Commercial Code, or the Environmental Code, Criminal procedure

White Collar Crime (en cours)

Article 226-17 of the Criminal Code punishes the act of processing or having processed personal data without implementing the measures prescribed in Articles 24, 25, 30, and 32 of the GDPR or in Article 4, para. 6 and Articles 99 to 101 of the loi Informatique et Libertés (data protection law) with five years of imprisonment and a fine of EUR 300,000. Article 4, para. 6 of the data protection law  …

Material breach

Article 226-17 of the Criminal Code punishes the act of processing or having processed personal data without implementing the measures prescribed in Articles 24, 25, 30, and 32 of the GDPR or in Article 4, para. 6 and Articles 99 to 101 of the loi Informatique et Libertés (data protection law) with five years of imprisonment and a fine of EUR 300,000. Article 4, para. 6 of the data protection law states that personal data must be processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, or access by unauthorized persons, using appropriate technical or organizational measures.

Article 226-17-1 punishes with five years of imprisonment and a fine of EUR 300,000 a provider of electronic communications services or a data controller failing to notify a personal data breach to the CNIL or the data subject, in breach of Articles 33 and 34 of the GDPR or the provisions of II of Article 83 and Article 102 of the French data protection law, according to which in the event of a personal data breach, the provider of publicly accessible electronic communications services must notify the CNIL without delay. When this breach may affect the personal data or privacy of a subscriber or another natural person, the provider must also notify the data subject without delay. However, notification of a personal data breach to the data subject is not necessary if the CNIL has determined that appropriate protective measures have been implemented by the provider to render the data incomprehensible to any person not authorized to access it and have been applied to the data concerned by the said breach. Failing this, the CNIL may, after examining the severity of the breach, order the provider to also inform the data subjects. The same penalties apply to a processor who fails to notify this breach to the data controller in violation of Article 33 of the regulation or Article 102 of the data protection law.

The non-compliance with these provisions characterizing a material offense, the negligence that allowed administrative staff members to access certain protected medical information constitutes the offense punished by Article 226-17 of the Criminal Code . The absence of proof of fraudulent use of the data and of actual harm to the individuals concerned has no impact on the characterization of the breach of the security obligation, which constitutes the breach of Article 32 of the GDPR .

Cass. crim., 30 October 2001, LawLex202200002493JBJ.

CNIL, 28 December 2021, LawLex202200002500JBJ.

White Collar Crime (en cours)

41. Material breach

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Sous parties

Les notions juridiques connexes

41. Material breach

Demandez un accès gratuit au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Sous parties

Les notions juridiques connexes

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise