Article 31 GDPR
GDPR Article 31 infringements can lead to criminal liability and significant fines.
GDPR Article 31, concerning the right against self-incrimination, is discussed in relation to potential criminal liability and administrative fines. Infringements can result in fines up to €10 million or 2% of global annual turnover, with CJEU case law indicating that administrative fines can be considered criminal if punitive and severe. The right against self-incrimination is generally accepted to take precedence if invoked.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GDPR?
Get an email when a new story names GDPR, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonGDPR Article 31 creates a significant legal tension for organizations: they are obligated to cooperate with supervisory authorities, yet individuals may invoke the right against self-incrimination when facing punitive administrative fines that the CJEU may classify as 'criminal' in nature. This matters because fines reaching €10 million or 2% of global annual turnover can cross the threshold into what is legally considered criminal punishment, triggering additional procedural rights. Organizations that are unprepared for regulatory investigations risk either non-compliance penalties for failing to cooperate or inadvertently self-incriminating key personnel. Having a clear legal and compliance strategy before an investigation begins is essential to navigating this dual obligation safely.