Author: Olivia Tambou
- Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. Such penalties shall be effective, proportionate and dissuasive.
- Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.
A.Preliminary remarks
Art. 84 provides for a general framework for the regulation by the Member States of penalties applicable for infringements of the GDPR. In contrast to the DPD, the regime of administrative fines is now distinguished from that of the penalties. Penalties are left to the discretion of Member States, whereas administrative fines benefit from harmonisation-strategies aiming at imposing equivalent sanctions. Therefore, Member States must organise the articulation of both regimes. Their margin for manoeuvre covers the type and nature of penalties that are to be introduced in national law. Member States should further determine infringements of the GDPR, to which they wish to apply penalties. However, to reinforce the GDPR, Member States need to introduce penalties for such infringements. This could be seen as a specific result from the principle of loyalty provided by Art. 4 para. 3 TEU, which reads: “The Member States shall take any appropriate measure, general or particular, to ensure fulfilment of the obligations arising out of the Treaties or resulting from the acts of the institutions of the Union.” According to case law of the CJEU, it is implied that Member States are required to introduce sanctions for violations of EU law, where the Union legislation does not provide for penalties for breaches or refers to national law. Failure to introduce sanctioning at national level can result in an action for failure to fulfil obligations.
B.Legislative history
The Comm-P contained a specific provision on penalties introduced before the article on administrative sanctions; this was not amended by the EP. The Council-R introduced important changes aimed at offering more discretion to Member States when regulating penalties at domestic level. Therefore, Art. 78 of the Comm-P was deleted by the Council, which added Art. 79b. The wording of Art. 79b was mostly maintained in Art. 84 GDPR.
The main changes introduced by the Council are threefold. First, the title of the new Art. 79a only refers to administrative fines, not sanctions. Thus, penalties seem to include administrative sanctions; they are not limited solely to criminal offences. Second, administrative fines have been prioritised; and penalties appear complementary sanctions that Member States must apply. The explicit mentions of the imposition of penalties in relation to the controller established in third countries have been deleted. The Comm-P provided that Member States should apply penalties when the controller does not comply with the obligation to designate a representative in the EU. Third, the Council-R added the possibility to impose penalties on the representative of the controller. Member States were thus allowed to decide on whether or not such penalties would be adopted at national level.
C.The imposition of national penalties for infringements of the GDPR (Art. 84 para.1)
I.The comprehensive nature of the penalties (para. 1 sentence 1)
The concept of penalties is not defined in Art. 84. In literature, it has been argued that “it seems that Union law does not prefer the term “sanctions” as an umbrella term for labelling the state’s response to unlawful behaviour. More often we find the terms “penalty” … in the English versions of EU rules… when it is translated in several language versions by an equivalent of the word sanction.” In this context, it could be argued that measures of reparatory nature would not fall under the scope of “penalties”; the latter, consisting of measures of a punitive character.
Penalties should cover both criminal and administrative penalties (Art. 84 in conjunction with recital 150). The concept of criminal penalties should be construed in the light of the case law of the CJEU, which has been inspired by the ECtHR’s Engel case. Engel set out three criteria for assessing whether or not a penalty is criminal: the classification of the conduct under domestic law, the very nature of the offence and the degree of severity of the penalty that the person concerned risks incurring.
[…]