The criminal chamber of the French Supreme Court has ruled that criminal sanctions can be imposed on a person for failure to register with the CNIL for the processing of personal data relating to a single data subject. The court held that French data protection law contains no threshold in terms of volume of data or number of data subjects and that it is, therefore, applicable to processing relating to only one person. Criminal sanctions in such a case are up to five years imprisonment and a fine of €300,000.

Decision (in French)