# LUXEMBOURG DPA: Non-compliance with general data processing principles

- Type: Enforcement
- Source: National Commission for Data Protection (CNPD)
- Date: 2021-05-12
- Original: https://www.enforcementtracker.com/ETid-711
- Canonical: https://overview.legal/posts/46826
- Topics: Video Surveillance, Accountability, IP Address, Controllers, Monitoring, Processing Agreement, Processing, Supervisory Authorities, Data Controller, Law Enforcement

## Summary

The DPA from Luxembourg (CNPD) has imposed a fine of EUR 1,900 on a company. The controller had installed a video surveillance system to protect the company's assets and prevent entry by unauthorized persons. However, the cameras also excessively captured parts of the public space. The DPA finds that the controller thus violated the principle of data minimization under Article 5 (1) c) GDPR. In addition, the DPA finds that the controller stored the recordings longer than legally permitted and th

## Full text

The DPA from Luxembourg (CNPD) has imposed a fine of EUR 1,900 on a company. The controller had installed a video surveillance system to protect the company's assets and prevent entry by unauthorized persons. However, the cameras also excessively captured parts of the public space. The DPA finds that the controller thus violated the principle of data minimization under Article 5 (1) c) GDPR. In addition, the DPA finds that the controller stored the recordings longer than legally permitted and thus violated Art. 5 (1) e) GDPR.

GDPR Articles: Art. 5 (1) c), e) GDPR
Industry: Not assigned

---
Generated by overview.legal · https://overview.legal/posts/46826 · 2026-08-22