<!-- wp:paragraph -->
<p>Non compliance with the GDPR has three series of legal consequences : We've extensively heard of the administrative enforcement by national Data Protection Authorities. We have less heard of Criminal liabilities for non compliance, especially for the absence of measures of security. The third level is civil liability as set by the <a rel="noreferrer noopener" href="https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/" target="_blank">Article 82 GDPR</a>. This article establishes a right to compensation and liability to 'Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.' Action can be taken individually or in a class action. This is a serious threat while we are witnessing high rise of data breach incidents with increase cyber attacks and ransomware. When a controller has neglected to take appropriate security measures, it has to be liable for compensation. The difficulty here is that often the damage caused is not measurable or not imminent.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>In its recent enforcement against an online payment company Slimpay, the French Data Protection CNIL clearly states that non compliance with the obligations of security in <a href="https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/" target="_blank" rel="noreferrer noopener">Article 32 GDPR</a> is sufficient without the need to prove access to the data.</p>
<!-- /wp:paragraph -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>"<em>La formation restreinte considère que l’absence de preuve d’une utilisation frauduleuse des données est sans incidence sur la caractérisation du manquement à l’obligation de sécurité. En effet, le risque d’utilisation frauduleuse des données à caractère personnel était réel, indépendamment des cas de fraude, dans la mesure où les données de nombreuses personnes ont été rendues accessibles à des tiers non autorisés. L’absence de dommage avéré pour les personnes concernées n’a pas d’incidence sur l’existence du défaut de sécurité, qui constitue le manquement à l’article 32 du RGPD.</em>"</p><p>The restricted panel considers that the absence of evidence of fraudulent use of the data has no bearing on the characterisation of the breach of the security obligation. <strong>The risk of fraudulent use of personal data was real, irrespective of the cases of fraud, in so far as the data of many persons were made accessible to unauthorised third parties. The absence of proven damage to the data subjects does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.</strong></p></blockquote>
<!-- /wp:quote -->

<!-- wp:paragraph -->
<p>Several recent data breaches, British Airways, EASYJET, MARRIOTT, TICKET MASTER, ETC... have been hurt by <a rel="noreferrer noopener" href="https://www.pearltrees.com/clarinettecaselaw/class-actions/id43827607" target="_blank">class actions</a>. In The UK, the case raised by <a rel="noreferrer noopener" href="https://www.pearltrees.com/clarinettecaselaw/richard-lloyd-v-google-copy/id50888527" target="_blank">Mr Lloyd against unlawful data access by Google</a> was ultimately rejected by the Supreme Court base to the fact that not all class members had suffers identical harm. When could that ever be the case? </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Loss of control and distress have been the criteria in civil compensation following a data breach. Several German and Austrian courts have recognised the liability for non-material damages caused by data subjects. Three referrals for clarification have been made to the <a href="https://www.pearltrees.com/clarinettecaselaw/ecj/id43825447" target="_blank" rel="noreferrer noopener">EUROPEAN COURT OF JUSTICE</a>. If interested by this important subject, you can have a deeper read on all relevant cases we could curate <a href="https://www.linkedin.com/posts/taubmanbassirian_gdpr-non-material-damage-liability-ugcPost-6893517983616950272-zPr5" target="_blank" rel="noreferrer noopener">here</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>As for the Criminal liabilities, EU National legislations have introduced into their criminal laws specific incriminations. We know about the offense of <a rel="noreferrer noopener" href="https://www.legislation.gov.uk/ukpga/1990/18/section/1" target="_blank">Computer Misuse Act</a> 1990 in the UK. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The chart below shows some of the main criminal offences introduced in the French legal system related to data protection.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":2343,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://www.datarainbow.eu/wp-content/uploads/2022/02/Screenshot-2022-01-03-at-21.58.36-1024x654.png" alt="" class="wp-image-2343"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p><strong>Art. 226-16 </strong>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years' imprisonment and a fine of 300,000 euros. The same penalties shall be imposed on the act, including negligently, of carrying out or having carried out a processing which has been the subject of one of the measures provided for in 3 ° of III of Article 20 of Law No. 78-17 of 6 January 1978 relating to data processing, files and freedoms.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Art. 226-16-1</strong> The fact, except in cases where the processing has been authorized under the conditions provided for by Law No. 78-17 of 6 January 1978 cited above, of carrying out or having carried out a processing of personal data including among the data on which it relates the registration number of persons in the national register of identification of natural persons is punishable by five years' imprisonment and a fine of 300,000 euros.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Art. 226-17</strong> The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years' imprisonment and a fine of 300,000 euros.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Art. 226-17-1</strong> The fact that a provider of electronic communications services or a controller does not notify a personal data breach to the Commission nationale de l'informatique et des libertés or to the interested party, in breach of Articles 33 and 34 of Regulation (EU) 2016/679 of 27 April 2016 or the provisions of II of Article 83 and Article 102 of Law No. 78-17 of 6 January 1978, is punishable by five years' imprisonment and a fine of €300,000. The same penalties shall apply to a processor failing to notify the controller of this breach in breach of Article 33 of Regulation (EU) 2016/679 of 27 April 2016 or Article 102 of The aforementioned Law No 78-17 of 6 January 1978.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Art. 226-18</strong> Collecting personal data by fraudulent, unfair or unlawful means is punishable by five years' imprisonment and a fine of €300,000.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Art. 226-18-1</strong> The fact of processing personal data concerning a natural person despite the opposition of this person, when this processing meets prospecting purposes, in particular commercial, or when this opposition is based on legitimate reasons, is punishable by five years' imprisonment and a fine of 300,000 euros.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Art. 226-19</strong> The fact, except in the cases provided for by law, of placing or storing in computerized memory, without the express consent of the person concerned, personal data which, directly or indirectly, reveal the racial or ethnic origins, political, philosophical or religious opinions, or trade union memberships of the persons, or which relate to their health or sexual orientation or gender identity, is punishable by five years' imprisonment and a fine of €300,000. The same penalties shall apply, except in the cases provided for by law, to placing or storing in computerized memory personal data concerning offences, convictions or security measures. The provisions of this Article shall apply to non-automated processing of personal data the implementation of which is not limited to the exercise of exclusively personal activities.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Art. 226-19-1 </strong>In the event of the processing of personal data for the purpose of research in the field of health, the following is punishable by five years' imprisonment and a fine of 300,000 euros: 1 ° Without having previously informed individually the persons on whose account personal data are collected or transmitted of their right of access, rectification and opposition, the nature of the data transmitted and the recipients thereof; (2) Despite the objection of the person concerned or, where provided for by law, in the absence of the informed and express consent of the person, or in the case of a deceased person, despite the refusal expressed by the latter during his lifetime.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Art. 226-20</strong> The fact of keeping personal data beyond the period provided for by law or regulation, by the request for authorisation or opinion, or by the prior declaration addressed to the National Commission for Informatics and Freedoms, is punishable by five years' imprisonment and a fine of 300,000 euros, unless this retention is carried out for historical purposes, statistical or scientific under the conditions provided for by law. The same penalties shall apply to the fact, except in the cases provided for by law, of processing personal data stored beyond the period mentioned in the first paragraph for purposes other than historical, statistical or scientific purposes.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Art. 226-21</strong> The fact, by any person holding personal data on the occasion of their registration, classification, transmission or any other form of processing, of diverting this information from its purpose as defined by the legislative provision, the regulatory act or the decision of the National Commission for Informatics and Freedoms authorising automated processing, or by the declarations prior to the implementation of this treatment, is punishable by five years' imprisonment and a fine of 300,000 euros.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Art. 226-22</strong> The fact, by any person who has collected, on the occasion of their registration, classification, transmission or other form of processing, personal data the disclosure of which would have the effect of undermining the consideration of the interested party or the intimacy of his private life, to carry, without authorisation of the interested party, these data to the knowledge of a third party who does not have standing to receive them is punishable by five years' imprisonment and a fine of 300,000 euros. The disclosure provided for in the preceding paragraph is punishable by three years' imprisonment and a fine of 100,000 euros when committed by recklessness or negligence. In the cases provided for in the two preceding paragraphs, prosecution may be brought only on the basis of a complaint by the victim, his legal representative or his successors in title.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Art. 226-22-1</strong> Carrying out or causing to be transferred personal data which is or is intended to be processed to a State not belonging to the European Union or to an international organisation in breach of Chapter V of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, or Articles 112 to 114 of Law No 78-17 of 6 January 1978 cited above, shall be punishable by five years' imprisonment and a fine of EUR 300 000.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Art. 226-22-2</strong> The following are punishable by one year's imprisonment and a fine of €15,000 for hindering the action of the National Commission for Informatics and Liberties: 1 ° Either by opposing the exercise of the missions entrusted to its members or authorised agents pursuant to the last paragraph of Article 10 of Law No. 78-17 of 6 January 1978 aforementioned when the visit has been authorised by the judge; 2 ° Either by refusing to communicate to its members or to the agents authorised pursuant to the last paragraph of Article 10 of the same law, or to the agents of a supervisory authority of a Member State of the European Union pursuant to Article 62 of Regulation (EU) 2016/679 of 27 April 2016 cited above, the information and documents useful for their mission, or by concealing such documents or information, or by removing them; 3 ° Either by communicating information that does not conform to the content of the recordings as it was at the time when the request was made or that does not present this content in a directly accessible form. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Art. 226-23</strong> In the cases provided for in Articles 226-16 to 226-22-2, the erasure of all or part of the personal data subject to the processing that gave rise to the offence may be ordered. The members and agents of the National Commission for Informatics and Liberties are entitled to note the erasure of this data.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Art. 226-24</strong> Legal persons declared criminally liable, under the conditions provided for in Article 121-2, for the offences defined in this section shall incur, in addition to the fine in accordance with the procedures laid down in Article 131-38, the penalties provided for in 2 ° to 5 ° and 7 ° to 9 ° of Article 131-39. The prohibition mentioned in 2 ° of article 131-39 relates to the activity in the exercise or in the course of the exercise of which the offence was committed.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>These are few of the French incriminations making liable the data controller or the person unlawfully accessing personal data.</p>
<!-- /wp:paragraph -->

<!-- wp:embed /-->