Article 84 of the GDPR: Criminal sanctions

Article 84 of the GDPR allows Member States to establish criminal sanctions applicable in the event of violation of the provisions of the regulation, in addition to the administrative fines provided for in article 83.

Article 84 of the GDPR explained

This item:

Authorizes each Member State to set criminal sanctions for GDPR violations;
Specifies that these sanctions must be effective, proportionate and dissuasive;
Implies that States notify these provisions to the European Commission;
Allows national personalization of the repressive GDPR regime, beyond the common administrative framework.

Why is this article important for your GDPR compliance?

He reminds that violations of the GDPR may also fall under criminal law, depending on severity and national legislation. In some countries, this can lead to individual prosecutions or criminal sanctions for managers.

How to comply with Article 84 of the GDPR?

Consult the national legislation in force in your country on GDPR criminal sanctions;
Train your management teams on the criminal risks associated with non-compliance;
Provide strict internal procedures to regulate sensitive processing;
Update your processing records and security measures to prevent serious violations.

Examples of application of Article 84 of the GDPR

In France, the Penal Code penalizes the misuse of purpose or the illicit collection of personal data;
An officer is criminally prosecuted for deliberately retaining prohibited data;
A company is convicted of disseminating health data without consent.