menu MENU
arrow_back Tilbake til alle artikler
Endre land (Nåværende : Norway) language
Kontakt vårt medlem i Norway mail_outline
Besøk nettstedet til Advokatfirmaet Bull account_balance

arrow_backTidligere artikkel
Artikkel 84
Neste artikkelarrow_forward

Penalties

Offisielle tekster Retningslinjer Beslutninger Vurderinger
EU-regulering Vurderinger
nasj. regulering
Vis nøkkelord og artikler relatert til art. 84 i forordningen keyboard_arrow_down Skjul nøkkelord og artikler relatert til art. 84 keyboard_arrow_up

Nøkkelord relatert til art. 84

Vis forordningens fortaletekst relatert til art. 84 keyboard_arrow_down Skjul forordningens fortaletekst relatert til art. 84 keyboard_arrow_up

(148) In order to strengthen the enforcement of the rules of this Regulation, penalties including administrative fines should be imposed for any infringement of this Regulation, in addition to, or instead of appropriate measures imposed by the supervisory authority pursuant to this Regulation. In a case of a minor infringement or if the fine likely to be imposed would constitute a disproportionate burden to a natural person, a reprimand may be issued instead of a fine. Due regard should however be given to the nature, gravity and duration of the infringement, the intentional character of the infringement, actions taken to mitigate the damage suffered, degree of responsibility or any relevant previous infringements, the manner in which the infringement became known to the supervisory authority, compliance with measures ordered against the controller or processor, adherence to a code of conduct and any other aggravating or mitigating factor. The imposition of penalties including administrative fines should be subject to appropriate procedural safeguards in accordance with the general principles of Union law and the Charter, including effective judicial protection and due process.

(149) Member States should be able to lay down the rules on criminal penalties for infringements of this Regulation, including for infringements of national rules adopted pursuant to and within the limits of this Regulation. Those criminal penalties may also allow for the deprivation of the profits obtained through infringements of this Regulation. However, the imposition of criminal penalties for infringements of such national rules and of administrative penalties should not lead to a breach of the principle of ne bis in idem, as interpreted by the Court of Justice.

(150) In order to strengthen and harmonise administrative penalties for infringements of this Regulation, each supervisory authority should have the power to impose administrative fines. This Regulation should indicate infringements and the upper limit and criteria for setting the related administrative fines, which should be determined by the competent supervisory authority in each individual case, taking into account all relevant circumstances of the specific situation, with due regard in particular to the nature, gravity and duration of the infringement and of its consequences and the measures taken to ensure compliance with the obligations under this Regulation and to prevent or mitigate the consequences of the infringement. Where administrative fines are imposed on an undertaking, an undertaking should be understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those purposes. Where administrative fines are imposed on persons that are not an undertaking, the supervisory authority should take account of the general level of income in the Member State as well as the economic situation of the person in considering the appropriate amount of the fine. The consistency mechanism may also be used to promote a consistent application of administrative fines. It should be for the Member States to determine whether and to which extent public authorities should be subject to administrative fines. Imposing an administrative fine or giving a warning does not affect the application of other powers of the supervisory authorities or of other penalties under this Regulation.

(151) The legal systems of Denmark and Estonia do not allow for administrative fines as set out in this Regulation. The rules on administrative fines may be applied in such a manner that in Denmark the fine is imposed by competent national courts as a criminal penalty and in Estonia the fine is imposed by the supervisory authority in the framework of a misdemeanour procedure, provided that such an application of the rules in those Member States has an equivalent effect to administrative fines imposed by supervisory authorities. Therefore the competent national courts should take into account the recommendation by the supervisory authority initiating the fine. In any event, the fines imposed should be effective, proportionate and dissuasive.

Vis direktivets fortaletekst relatert til art. 84 keyboard_arrow_down Skjul direktivets fortaletekst relatert til art. 84 keyboard_arrow_up

(55) Whereas, if the controller fails to respect the rights of data subjects, national legislation must provide for a judicial remedy; whereas any damage which a person may suffer as a result of unlawful processing must be compensated for by the controller, who may be exempted from liability if he proves that he is not responsible for the damage, in particular in cases where he establishes fault on the part of the data subject or in case of force majeure; whereas sanctions must be imposed on any person, whether governed by private of public law, who fails to comply with the national measures taken under this Directive;

GDPR

Article 84 of the Regulation does not bring anything new. It takes the principles already present in the Directive: Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. These penalties must be effective, proportionate and dissuasive.

The only real novelty is that each Member State shall notify the Commission of the measures it adopts under paragraph 1, no later than 2 years after the publication of the Regulation, and without delay of any subsequent amendment affecting them.

Direktivet

The Directive contained only a general provision (Art. 24) requiring the states to take appropriate measures to ensure full implementation of its provisions and specify penalties in cases of infringement of the provisions adopted pursuant to this Directive.

Utfordringer

The divergences with respect to penalties between the Member States could be damaging to a harmonized protection but the imposition of the system of administrative penalty provided for in Article 83 in each Member State should limit these consequences.

arrow_back Tidligere artikkel • Artikkel 84 • Neste artikkel arrow_forward
arrow_back Tidligere artikkel • Artikkel 84 Neste artikkel arrow_forward

Summary

European Union

European Union

Retour au sommaire

Art. 29-arbeidsgruppen

Guidelines on the application and setting of administrative fines for the purposes of the Regulation 2016/679 (3 October 2017)

(Endorsed by the EDPB)

The EU has completed a comprehensive reform of data protection regulation in Europe. The reform rests on several pillars (key components): coherent rules, simplified procedures, coordinated actions, user involvement, more effective information and stronger enforcement powers.

Data controllers and data processors have increased responsibilities to ensure that personal data of the individuals is protected effectively. Supervisory authorities have powers to ensure that the principles of the General Data Protection Regulation (hereafter ‘the Regulation’) as well as the rights of the individuals concerned are upheld according to the wording and the spirit of the Regulation.

Consistent enforcement of the data protection rules is central to a harmonized data protection regime. Administrative fines are a central element in the new enforcement regime introduced by the Regulation, being a powerful part of the enforcement toolbox of the supervisory authorities together with the other measures provided by article 58.

This document is intended for use by the supervisory authorities to ensure better application and enforcement of the Regulation and expresses their common understanding of the provisions of article 83 of the Regulation as well as its interplay with articles 58 and 70 and their corresponding recitals.

In particular, according to article 70, (1) (e), the European Data Protection Board (hereafter ‘EDPB’) is empowered to issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation and article 70, (1), (k) specifies the provision for guidelines concerning the setting of administrative fines.

These guidelines are not exhaustive, neither will they provide explanations about the differences between administrative, civil or criminal law systems when imposing administrative sanctions in general.

In order to achieve a consistent approach to the imposition of the administrative fines, which adequately reflects all of the principles in these guidelines, the EDPB has agreed on a common understanding of the assessment criteria in article 83 (2) of the Regulation and therefore the EDPB and individual supervisory authorities agree on using this Guideline as a common approach.

Link

Retour au sommaire
arrow_back Tidligere artikkel • Artikkel 84 Neste artikkel arrow_forward
Retour au sommaire
arrow_back Tidligere artikkel • Artikkel 84 Neste artikkel arrow_forward
Forordning
1e 2e

Art. 84

1.   Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. Such penalties shall be effective, proportionate and dissuasive.

2.   Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.
1. forslag close

Art. 78

1. Member States shall lay down the rules on penalties, applicable to infringements of the provisions of this Regulation and shall take all measures necessary to ensure that they are implemented, including where the controller did not comply with the obligation to designate a representative. The penalties provided for must be effective, proportionate and dissuasive.

2. Where the controller has established a representative, any penalties shall be applied to the representative, without prejudice to any penalties which could be initiated against the controller.

3. Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by the date specified in Article 91(2) at the latest and, without delay, any subsequent amendment affecting them.
2. forslag close

Art. 79b

 1. For infringements (…)of this Regulation in particular for infringements which are not subject to administrative fines pursuant to (…) Article 79a Member States shall lay down the rules on penalties applicable to such infringements and shall take all measures necessary to ensure that they are implemented (…). Such penalties shall be effective, proportionate and dissuasive.

2. (…).

3. Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by the date specified in Article 91(2) at the latest and, without delay, any subsequent amendment affecting them.
Direktiv close

Art. 24

The Member States shall adopt suitable measures to ensure the full implementation of the provisions of this Directive and shall in particular lay down the sanctions to be imposed in case of infringement of the provisions adopted pursuant to this Directive.
Norway
compare_arrows
visibility Gamle loven

Alt. 84

Sanksjoner

1. Medlemsstatene skal fastsette regler om andre sanksjoner for overtredelser av denne forordning, særlig for overtredelser som ikke omfattes av overtredelsesgebyrer i henhold til artikkel 83, og skal treffe alle nødvendige tiltak for å sikre at de gjennomføres. Sanksjonene skal være virkningsfulle, stå i rimelig forhold til overtredelsen og virke avskrekkende.

2. Medlemsstatene skal senest 25. mai 2018 underrette Kommisjonen om de lovbestemmelser de vedtar i henhold til nr. 1, og uten opphold om eventuelle senere endringer som påvirker dem.
Gamle loven close

Pol. § 46 Overtredelsesgebyr. Pålegg om endring eller opphør av ulovlige behandlinger

Datatilsynet kan pålegge den som har overtrådt denne loven eller forskrifter i medhold av den, å betale et pengebeløp til statskassen (overtredelsesgebyr) på inntil 10 ganger grunnbeløpet i folketrygden. Fysiske personer kan bare ilegges overtredelsesgebyr for forsettlige eller uaktsomme overtredelser. Et foretak kan ikke ilegges overtredelsesgebyr dersom overtredelsen skyldes forhold utenfor foretakets kontroll.

Ved vurderingen av om overtredelsesgebyr skal ilegges, og ved utmålingen, skal det særlig legges vekt på

a) hvor alvorlig overtredelsen har krenket de interesser loven verner,

b) graden av skyld,

c) om overtrederen ved retningslinjer, instruksjon, opplæring, kontroll eller andre tiltak kunne ha forebygget overtredelsen,

d) om overtredelsen er begått for å fremme overtrederens interesser,

e) om overtrederen har hatt eller kunne ha oppnådd noen fordel ved overtredelsen,

f) om det foreligger gjentakelse,

g) om andre reaksjoner som følge av overtredelsen blir ilagt overtrederen eller noen som har handlet på vegne av denne, blant annet om noen enkeltperson blir ilagt straff og

h) overtrederens økonomiske evne.

Oppfyllelsesfristen er 4 uker etter at vedtaket om overtredelsesgebyr er endelig. Dersom et vedtak om overtredelsesgebyr bringes inn for en domstol, kan den prøve alle sider av saken.

Datatilsynet kan gi pålegg om at behandling av personopplysninger3 i strid med bestemmelser i eller i medhold av denne loven skal opphøre, eller stille vilkår som må være oppfylt for at behandlingen skal være i samsvar med loven.

Pol. § 47 Tvangsmulkt

Ved pålegg etter § 12, § 27, § 28 og § 46 kan Datatilsynet3 fastsette en tvangsmulkt som løper for hver dag som går etter utløpet av den fristen som er satt for oppfylling av pålegget, inntil pålegget er oppfylt.

Tvangsmulkten løper ikke før klagefristen er ute. Hvis vedtaket påklages, løper ikke tvangsmulkt før Personvernnemnda4 har bestemt det.

Pol. § 47 a. Innkreving av refusjonskrav, overtredelsesgebyr og tvangsmulkt

Refusjonskrav som nevnt i § 44, overtredelsesgebyr etter § 46 og tvangsmulkt etter § 47 er tvangsgrunnlag for utlegg.

Pol. § 48 Straff

Med bøter eller fengsel inntil ett år eller begge deler straffes den som forsettlig eller grovt uaktsomt

a) unnlater å sende melding etter § 31,

b) behandler personopplysninger2 uten nødvendig konsesjon etter § 33,

c) overtrer vilkår fastsatt etter § 35 eller § 46,

d) unnlater å etterkomme pålegg fra Datatilsynet etter § 12, § 27, § 28 eller § 46,

e) behandler personopplysninger i strid med § 13, § 15, § 26 eller § 39, eller

f) unnlater å gi opplysninger etter § 19, § 20, § 21, § 40 eller § 44.

Ved særdeles skjerpende omstendigheter kan fengsel inntil tre år idømmes. Ved avgjørelsen av om det foreligger særdeles skjerpende omstendigheter skal det blant annet legges vekt på faren for stor skade eller ulempe for den registrerte, den tilsiktede vinningen ved overtredelsen, overtredelsens varighet og omfang, utvist skyld, og om den behandlingsansvarlige4 tidligere er straffet for å ha overtrådt tilsvarende bestemmelser.

I forskrift som gis i medhold av loven, kan det fastsettes at den som forsettlig eller grovt uaktsomt overtrer forskriften skal straffes med bøter eller fengsel inntil ett år eller begge deler.
Serbia close

Article 95

Monetary Fines

A monetary fine from 50,000 to 2,000,000 dinars shall be imposed for a misdemeanor on a controller or processor having the status of a legal person if it:

1.         processes personal data contrary to the processing principles referred to in Article 5, paragraph 1 of this Law;

2.         processes personal data for other purposes, contrary to Articles 6 and 7 of this Law;

3.         does not clearly separate personal data based on facts from personal data based on personal assessment (Article 10);

4.         by using reasonable measures does not ensure that inaccurate, incomplete and outdated personal data are not transferred or made available (Article 11, paragraph 1);

5.         processes personal data without the consent of the data subject and is not able to demonstrate that the data subject has consented to the processing of his or her data (Article 15, paragraph 1);

6.         processes special categories of personal data contrary to Articles 17 and 18 of this Law;

7.         processes personal data relating to criminal convictions, offences and security measures contrary to Article 19, paragraph 1 of this Law;

8.         does not provide the data subject with the information referred to in Article 23, paragraphs 1 to 3 and Article 24, paragraphs 1 to 4 of this Law;

9.         does not make available to the data subject, or does not provide, the information referred to in Article 25, paragraphs 1 and 2 of this Law;

10.       does not provide the requested information, does not enable access to data, or does not deliver a copy of the data being processed (Article 26, paragraphs 1 and 2 and Article 27);

11.       partially or fully restricts the right of access to data of the data subject contrary to Article 28, paragraph 1 of this Law;

12.       does not rectify inaccurate data or complete incomplete data contrary to Article 29 of this Law;

13.       does not erase the data of the data subject without delay in the cases referred to in Article 30, paragraph 2 of this Law;

14.       does not restrict the processing of personal data in the cases referred to in Article 31 of this Law;

15.       does not erase personal data (Article 32);

16.       does not notify the recipient in relation to rectification, erasure and restriction of processing (Article 33, paragraph 1);

17.       does not inform the data subject of the decision to refuse rectification, erasure or restriction of processing, and of the reason for refusal (Article 34, paragraph 1);

18.       does not cease processing after the data subject has lodged an objection (Article 37, paragraph 1);

19.       a decision producing legal effects for the data subject is made solely on the basis of automated processing contrary to Articles 38 and 39 of this Law;

20.       when determining the means of processing and during processing does not take appropriate technical, organisational and personnel measures contrary to Article 42 of this Law;

21.       does not regulate the relationship between joint controllers in the manner prescribed by Article 43, paragraphs 2 to 4 of this Law;

22.       entrusts the processing of personal data to a processor contrary to Article 45 of this Law;

23.       processes data without the controller’s instructions or contrary to the controller’s instructions (Article 46);

24.       does not notify the Commissioner of a personal data breach contrary to Article 52 of this Law;

25.       does not notify the data subject of a personal data breach contrary to Article 53 of this Law;

26.       does not carry out a data protection impact assessment in the manner provided for in Article 54 of this Law;

27.       does not notify the Commissioner or does not request the Commissioner’s opinion prior to commencing processing (Article 55, paragraphs 1 and 3);

28.       does not designate a data protection officer in the cases referred to in Article 56, paragraph 2 of this Law;

29.       does not fulfil its obligations towards the data protection officer referred to in Article 57, paragraphs 1 to 3 of this Law;

30.       transfers personal data to other countries and international organisations contrary to Articles 63 to 71 of this Law;

31.       does not ensure the application of effective mechanisms for confidential reporting of cases of infringement of this Law (Article 80);

32.       processes personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes contrary to Article 92 of this Law.

A monetary fine in the amount of 100,000 dinars shall be imposed for a misdemeanour on a controller or processor having the status of a legal person if it:

1.         does not inform the recipient of special conditions for processing personal data prescribed by law and of its obligation to fulfil those conditions (Article 11, paragraph 5);

2.         does not deliver to the data subject a reasoned decision or does not notify the data subject within the time limit referred to in Article 28, paragraphs 3 and 5 of this Law;

3.         continues processing for direct marketing purposes after the data subject has lodged an objection to such processing (Article 37, paragraph 3);

4.         does not designate its representative in the Republic of Serbia contrary to Article 44 of this Law;

5.         does not keep the prescribed records of processing (Article 47), or does not record processing operations (Article 48);

6.         does not publish the contact details of the data protection officer and does not provide them to the Commissioner (Article 56, paragraph 11).

A monetary fine from 5,000 to 150,000 dinars shall be imposed for a misdemeanour on a natural person who does not keep, as a professional secret, personal data that he or she learned during the performance of duties (Article 57, paragraph 7 and Article 76).

For the misdemeanour referred to in paragraph 1 of this Article, an entrepreneur shall be fined from 20,000 to 500,000 dinars.

For the misdemeanour referred to in paragraph 1 of this Article, a natural person, that is, a responsible person in a legal person, a state authority, an authority of territorial autonomy or a unit of local self-government, as well as a responsible person in a representative office or business unit of a foreign legal person, shall be fined from 5,000 to 150,000 dinars.

For the misdemeanour referred to in paragraph 2 of this Article, an entrepreneur shall be fined in the amount of 50,000 dinars.

For the misdemeanour referred to in paragraph 2 of this Article, a natural person, that is, a responsible person in a legal person, a state authority, an authority of territorial autonomy or a unit of local self-government, as well as a responsible person in a representative office or business unit of a foreign legal person, shall be fined in the amount of 20,000 dinars.

 

 

 

 
arrow_back Tidligere artikkel • Artikkel 84 Neste artikkel arrow_forward
close

2016 - www.itiplaw.eu.