Can an individual member-state citizen be criminalised for not following EU law?

Question

Can an individual member-state citizen be criminalised for not following EU law, or is there a limitation to EU law that means it is not applicable to individuals?

Can the EU be said to be able to pass “criminal law” - or is this specific term reserved for national governments?

Answer 1

There isn't any provision in the treaties excluding it explicitly and completely but criminal law is generally out of the remit of EU law. There is also little in EU law that would apply to individuals directly.

There are however a few areas in which EU law touches upon this indirectly:

• Some cases where the EUCJ looked at criminal prosecution and how to interpret the non bis in idem principle. I do not recall the details but the reasoning is that risking to be prosecuted in another member state for something that the justice system of one member state decided not to pursue was a restriction on freedom of movement.
• Much EU law has to do with standards, norms and regulations on consumer products (that's the underpinning of the single market and a major area of EU law). These are then implemented and enforced at the national level but if you would, say, sell wine with a false label, you could be liable for prosecution. The crime itself (fraud or some such) would be defined in national law but you could in effect be prosecuted for willfully disregarding some EU rules.
• The Schengen regulations are an interesting case: The Visa Code and the Borders Code are regulations (meaning they are directly binding without having to be implemented in national law) and they create many obligations for individuals (unlike most of EU law). But they stop just short of providing for sanctions. Thus, if someone stays longer than allowed in the Schengen area, the regulation just states that they may be expelled and leaves possible criminal prosecution, fines, or bans entirely up to the member states.
• EU rules (say on competition) often provide for “administrative fines”. They are intended for businesses but an individual acting as a self-employed professional could technically be covered by all this. That includes the new GDPR, which explicitly mentions “natural […] persons“ as being subject to these rules.

Answer 2

It's upon EU member states to implement EU law. From the EC website:

Regulations and decisions

National authorities must ensure they are correctly applied.

Directives

Each directive contains a deadline by which EU countries must incorporate its provisions into their national legislation and inform the Commission to that effect.

The Commission assists member countries in correctly implementing all EU laws. It provides online information, implementation plans, guidance documents and organises expert‑group meetings.

When a member state fails to apply EU law, there is an infringement procedure. From the EC website (see that page for more detail):

Infringement procedure

According to the EU treaties, the Commission may take legal action – an infringement procedure – against an EU country that fails to implement EU law. The Commission may refer the issue to the Court of Justice, which in certain cases, can impose financial penalties.

So to answer your question. A citizen violating EU law can be penalised by the EU member state (either for violating a regulation or violating a national law implementing an EU directive). The EU itself doesn't normally do this though it may take action against a member state failing to enforce.

Answer 3

In some limited areas, namely environmental protection, the EU can force via directives the member states to criminalize certain behaviors:

The contention that criminal law is the exclusive business of the sovereign state has, however, been challenged by the latest developments in EU law, both in terms of treaty amendments and in case law of the Court. In the Environmental Crime Case, which concerned legislation in the area of environmental policy, the Court held that, under Article 175 EC (now 192 TFEU), the Community had the power to require Member States to enact criminal law measures if such measures would be ‘essential’ to ensure that the rules on environmental protection are ‘fully effective’.

from Öberg, J. (2011) "Criminal Sanctions in the Field of EU Environmental Law." New Journal of European Criminal Law, (4): 402-425

I'm not sure if this has resulted in any individuals (as opposed to companies) being prosecuted under the directive-implementing national laws. The resulting 2008 PECL (Protection of the Environment through Criminal Law) directive has this text:

2008 PECL Directive The definitive version of the PECL Directive was finally adopted in November 2008 and Member States are required to bring into force the legislative measures necessary for its transposition by 26 December 2010.

Offences Article 3 of the Directive lists and defines common offences and requires that: Member States shall ensure that the following conduct constitutes a criminal offence, when unlawful and committed intentionally or with at least serious negligence:
(a) the discharge, emission or introduction of a quantity of materials or ionising radiation into air, soil or water, which causes or is likely to cause death or serious injury to any person or substantial damage to the quality of air, the quality of soil or the quality of water, or to animals or plants; (b) the collection, transport, recovery or disposal of waste, including the supervision of such operations and the aftercare of disposal sites, and including action taken as a dealer or a broker (waste management), which causes or is likely to cause death or serious injury to any person or substantial damage to the quality of air, the quality of soil or the quality of water, or to animals or plants; (c) the shipment of waste, where this activity falls within the scope of Article 2(35) of Regulation (EC) No. 1013/2006 …on shipments of waste and is undertaken in a non­negligible quantity, whether executed in a single shipment or in several shipments which appear to be linked; (d) the operation of a plant in which a dangerous activity is carried out or in which dangerous substances or preparations are stored or used and which, outside the plant, causes or is likely to cause death or serious injury to any person or substantial damage to the quality of air, the quality of soil or the quality of water, or to animals or plants; (e) the production, processing, handling, use, holding, storage, transport, import, export or disposal of nuclear materials or other hazardous radioactive substances which causes or is likely to cause death or serious injury to any person or substantial damage to the quality of air, the quality of soil or the quality of water, or to animals or plants; (f) the killing, destruction, possession or taking of specimens of protected wild fauna or flora species, except for cases where the conduct concerns a negligible quantity of such specimens and has a negligible impact on the conservation status of the species; (g) trading in specimens of protected wild fauna or flora species or parts or derivatives thereof, except for cases where the conduct concerns a negligible quantity of such specimens and has a negligible impact on the conservation status of the species; (h) any conduct which causes the significant deterioration of a habitat within a protected site; (i) the production, importation, exportation, placing on the market or use of ozone­-depleting substances.

So if poaching protected species somehow was not already a criminal offence in all member countries (or poisoning someone with radioactive materials), that looks like something that could directly affect an individual being criminalized. Most other types of activities criminalized there look like they would mostly apply to companies. In general, the PECL directive was seen as imposing some minimum standards, which are usually exceeded in most member country legislation already.

In theory however, the treaty framework would allow stronger criminal-law environmental protection measures to be pushed through directives; since these normally [meaning if they have the Commision's approval] only require a qualified majority in the Council, they could impose on a country the introduction of criminal sanctions in its national legislation (at least in relation to environmental protection) that a country's legislature [or even its popuplation] doesn't quite approve of.

Answer 4

There don't exist any laws on EU levels applying to individuals.

Regulations and directives are signals from the EU to member states and then it's up to member states how to (if they would) start working according to those.