[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fC0GwsYEdhhW5pwuPbJkOefHq_ThI_Grwe-zf8z8qzMI":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":24},"75a47d4c-0c25-4876-b48f-c839c086a7fe","Article 31 GDPR","article-31-gdpr-feb027","← Older revision Revision as of 15:45, 30 September 2026 Line 248: Line 248: Infringements of the GDPR and the sanctions issued in response to any such infringements often have the capacity to be criminal in nature. Thus, in certain circumstances, GDPR infringements may give rise to the applicability of this right, as Member States are permitted to legislate criminal sanctions for infringements of the GDPR (Recital 149). Consequently, in certain jurisdictions infringements of the GDPR may give rise to criminal liability. Moreover, the imposition of a significant fine (or the threat of such a fine) may equally give rise to the right against self-incrimination. Infringements of the GDPR and the sanctions issued in response to any such infringements often have the capacity to be criminal in nature. Thus, in certain circumstances, GDPR infringements may give rise to the applicability of this right, as Member States are permitted to legislate criminal sanctions for infringements of the GDPR (Recital 149). Consequently, in certain jurisdictions infringements of the GDPR may give rise to criminal liability. Moreover, the imposition of a significant fine (or the threat of such a fine) may equally give rise to the right against self-incrimination. Article 31 GDPR gains an independent significance as it is included in the GDPR’s sanctions framework through [[Article 83 GDPR|Article 83(4) GDPR.]] ''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 31 GDPR, margin number 5 (Beck 2024, 4th edition); ''Klug'' in Gola, Heckmann, DS-GVO, Article 31, margin number 3 (Beck 2022, 3rd edition). [[Article 83 GDPR|Article 83(4) GDPR]] provides that the infringement of Article 31 GDPR may be subject to administrative fines up to €10 million, or in the case of an undertaking, up to 2% of the total worldwide annual turnover. CJEU case law demonstrates that administrative fines may be considered criminal if they serve a punitive purpose and have a high degree of severity, regardless of the fine’s classification as administrative under national legislation. Case C-27\u002F22, ''Volkswagen Group Italia and Volkswagen Aktiengesellschaft'', 14 September 2023, para 55 (available [[CJEU - C‑27\u002F22 - Volkswagen Group Italia and Volkswagen Aktiengesellschaft|here]]); Case C-97\u002F21, ''MV – 98'', 4 May 2023 (available [https:\u002F\u002Fcuria.europa.eu\u002Fjuris\u002Fdocument\u002Fdocument.jsf?text=&docid=273282&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=15630530 here]). Therefore, if a request made under Article 31 GDPR gives rise to circumstances which invoke the right against self-incrimination, it is widely accepted by commentators that the right against self-incrimination takes precedence. ''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 31 GDPR, margin number 14 (Beck 2020, 3rd edition); ''Kotschy'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 31 GDPR, p. 628 (Oxford University Press 2020); ''Zierbarth'' in Sydow, Marsch, DS-GVO BDSG, Article 31 GDPR, margin number 10 (Beck 2022, 3rd edition). Article 31 GDPR gains an independent significance as it is included in the GDPR’s sanctions framework through [[Article 83 GDPR|Article 83(4) GDPR.]] ''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 31 GDPR, margin number 5 (Beck 2024, 4th edition); ''Klug, Rost'' in Gola, Heckmann, Rost, DS-GVO, Article 31, margin number 3 (Beck 2026, 4th edition). [[Article 83 GDPR|Article 83(4) GDPR]] provides that the infringement of Article 31 GDPR may be subject to administrative fines up to €10 million, or in the case of an undertaking, up to 2% of the total worldwide annual turnover. CJEU case law demonstrates that administrative fines may be considered criminal if they serve a punitive purpose and have a high degree of severity, regardless of the fine’s classification as administrative under national legislation. Case C-27\u002F22, ''Volkswagen Group Italia and Volkswagen Aktiengesellschaft'', 14 September 2023, para 55 (available [[CJEU - C‑27\u002F22 - Volkswagen Group Italia and Volkswagen Aktiengesellschaft|here]]); Case C-97\u002F21, ''MV – 98'', 4 May 2023 (available [https:\u002F\u002Fcuria.europa.eu\u002Fjuris\u002Fdocument\u002Fdocument.jsf?text=&docid=273282&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=15630530 here]). Therefore, if a request made under Article 31 GDPR gives rise to circumstances which invoke the right against self-incrimination, it is widely accepted by commentators that the right against self-incrimination takes precedence. ''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 31 GDPR, margin number 14 (Beck 2020, 3rd edition); ''Kotschy'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 31 GDPR, p. 628 (Oxford University Press 2020); ''Zierbarth'' in Sydow, Marsch, DS-GVO BDSG, Article 31 GDPR, margin number 10 (Beck 2022, 3rd edition). Commentators have suggested that the practical application of this reading would mean that Article 31 GDPR cannot be invoked by a ''SA'' to induce a controller or processor to make an admission which would give rise to criminal liability, instead a supervisory authority must use its own investigative powers to establish facts which are incumbent on itself to prove. ''Zierbarth'' in Sydow, Marsch, DS-GVO BDSG, Article 31 GDPR, margin number 10 (Beck 2022, 3rd edition). Commentators have suggested that the practical application of this reading would mean that Article 31 GDPR cannot be invoked by a ''SA'' to induce a controller or processor to make an admission which would give rise to criminal liability, instead a supervisory authority must use its own investigative powers to establish facts which are incumbent on itself to prove. ''Zierbarth'' in Sydow, Marsch, DS-GVO BDSG, Article 31 GDPR, margin number 10 (Beck 2022, 3rd edition). Line 272: Line 272: [[Category:GDPR Articles]] [[index.php?title=Category:GDPR Articles]]","GDPR Article 31, concerning the right against self-incrimination, is discussed in relation to potential criminal liability and administrative fines. Infringements can result in fines up to €10 million or 2% of global annual turnover, with CJEU case law indicating that administrative fines can be considered criminal if punitive and severe. The right against self-incrimination is generally accepted to take precedence if invoked.","GDPR Article 31 infringements can lead to criminal liability and significant fines.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Article_31_GDPR&diff=53256&oldid=51303",null,"2026-09-30T15:45:11+00:00","2026-09-30T16:00:20.062986+00:00",7,[17],{"name":18,"type":19},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":12,"name":22,"slug":23},"Policy","policy",[25,29,34,36],{"category":26},{"id":27,"icon":12,"name":18,"slug":28},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":30},{"id":31,"icon":12,"name":32,"slug":33},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":35},{"id":20,"icon":12,"name":22,"slug":23},{"category":37},{"id":38,"icon":12,"name":39,"slug":40},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":44,"vendors":45},[],[],{"slug":47,"title":48,"body":49,"framework_refs":50,"framework_notes":60},"gdpr-article-31-self-incrimination-rights-vs-regulatory-cooperation-obligations","GDPR Article 31: Self-Incrimination Rights vs. Regulatory Cooperation Obligations","GDPR Article 31 creates a significant legal tension for organizations: they are obligated to cooperate with supervisory authorities, yet individuals may invoke the right against self-incrimination when facing punitive administrative fines that the CJEU may classify as 'criminal' in nature. This matters because fines reaching €10 million or 2% of global annual turnover can cross the threshold into what is legally considered criminal punishment, triggering additional procedural rights. Organizations that are unprepared for regulatory investigations risk either non-compliance penalties for failing to cooperate or inadvertently self-incriminating key personnel. Having a clear legal and compliance strategy before an investigation begins is essential to navigating this dual obligation safely.",[51,52,53,54,55,56,57,58,59],"GDPR Article 31 (Cooperation with the supervisory authority)","GDPR Article 83 (General conditions for imposing administrative fines)","ECHR Article 6 (Right to a fair trial \u002F self-incrimination protections)","CJEU Case law on punitive administrative sanctions","NIST SP 800-53 IR-1 (Incident Response Policy and Procedures)","NIST SP 800-53 AU-9 (Protection of Audit Information)","CIS Control 17 (Incident Response Management)","CIS Control 3 (Data Protection)","ITIL Service Management – Legal and Compliance Risk Management",{}]