FranceCNIL Enforcement, GDPR Article 83 and Code Pénal Articles 226-16 to 226-22-2
Regulation (EU) 2016/679, Art. 83; Code penal, Arts. 226-16 to 226-22-2
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person in France who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Code penal Articles 226-16 to 226-24 (Chapitre VI, Section 5, Des atteintes aux droits de la personne resultant des fichiers ou des traitements informatiques) create a family of criminal offences for personal-data processing, layered on top of, and independent from, the CNIL's GDPR Article 83 administrative fines. The standard maximum, which applies to most offences in this family including Article 226-16 (processing personal data, including by negligence, without complying with the legally required prior formalities), Article 226-19 (unlawfully recording sensitive personal data such as racial or ethnic origin, political, philosophical or religious opinions, trade union membership, health, sexual orientation or gender identity, or offence and conviction data), Article 226-20 (unlawful retention beyond the authorised period), and Article 226-21 (misuse of data outside its declared purpose), is five years' imprisonment and a fine of EUR 300,000. Article 226-22 (unlawfully disclosing personal data whose disclosure would harm the data subject's reputation or privacy) carries the same five-year, EUR 300,000 maximum for an intentional disclosure, reduced to three years and EUR 100,000 where the disclosure was merely reckless or negligent, and is prosecutable only on the victim's own complaint. Article 226-22-2 separately punishes obstructing the CNIL's own investigative action with up to one year's imprisonment and a EUR 15,000 fine. A corporate defendant faces the amende under Code penal Article 131-38 plus the additional penalties listed in Article 131-39(2) to (5) and (7) to (9), per Article 226-24.
Penalty structure
GDPR Article 83(5) sets the higher administrative-fine tier the CNIL applies, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, for the gravest infringement categories (basic processing principles including Articles 5 to 9, the Article 12 to 22 data-subject rights, and the Chapter V transfer rules). The narrower Article 83(4) tier, up to EUR 10,000,000 or 2 percent, applies instead to the Article 25 to 39 controller and processor obligations. France has not been found to narrow or replace this EU-wide ceiling for private-sector processing; Code penal Articles 226-16 to 226-22-2 layer separate CRIMINAL fines on top of, not instead of, the CNIL's administrative fine, and are set out in the criminal exposure note rather than here.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Commission Nationale de l'Informatique et des Libertes (CNIL), France's independent supervisory authority for data protection under the GDPR and Loi n. 78-17 du 6 janvier 1978 (Loi Informatique et Libertes, as amended). The Code penal Articles 226-16 to 226-22-2 criminal offences are prosecuted separately, through the ordinary French criminal courts, rather than by the CNIL directly; several of those offences (Article 226-22-2, and the aggravated form of Article 226-16) are engaged specifically by interference with the CNIL's own supervisory work.
Enforcement record
The CNIL's own review of its 2025 enforcement counts 83 sanctions (16 by the restricted committee, 67 by its president or a member sitting alone under the simplified procedure) and administrative fines totaling EUR 486,839,500 for calendar year 2025; it also counts 143 formal notices. The count covers every sanction the CNIL pronounced, not only GDPR Article 83 fines, and the total is dominated by two cookie decisions of .
- As of
- Currency
- EUR
- Source link
- https://www.cnil.fr/fr/bilan-sanctions-2025
- Fines per year
- 486,839,500
- Actions per year
- 83
Settledness
- As of
- Case link
- https://curia.europa.eu/juris/document/document.jsf?docid=273284&doclang=EN
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of
- Open questions
- Which French rules on the extent of financial compensation fix the amount payable for non-material damage under Article 82 of the GDPR, given that the Court of Justice in Case C-300/21 leaves the extent of compensation to the domestic rules of each Member State?
What it makes you log
Logging duty
Article 83 and Code pénal Articles 226-16 to 226-22-2 set fines and criminal penalties. They state no duty to create, keep or produce a log or record; the record of processing and breach documentation duties sit in Articles 30 and 33(5) of the Regulation.
- Kind
- None
- As of
What this law does
The CNIL is France's supervisory authority, sanctioning through its restricted committee (formation restreinte). Under Article 22-1 of Loi 78-17, the CNIL's president may start a simplified procedure in which the president of the restricted committee, or a member designated for the purpose, decides alone, where the administrative fine incurred does not exceed EUR 20,000 and the penalty payment incurred does not exceed EUR 100 a day.
Article 22-1 also provides that those ceilings become EUR 100,000 and EUR 500 a day where the controller's total worldwide annual turnover for the preceding financial year exceeds EUR 50 million. Article 60 of the loi de simplification de la vie économique of added that rule to Article 22-1.
France separately criminalizes unlawful processing: Code penal Article 226-16 punishes processing carried out, including by negligence, without the prior formalities the law requires with five years' imprisonment and EUR 300,000. Article 226-22-2 punishes obstructing the action of the CNIL with one year's imprisonment and EUR 15,000. General Data Protection Regulation (GDPR) Article 82 arms an individual with a direct private right of action.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .