# LUXEMBOURG DPA: Non-compliance with general data processing principles

- Type: Enforcement
- Source: National Commission for Data Protection (CNPD)
- Date: 2021-05-12
- Original: https://www.enforcementtracker.com/ETid-714
- Canonical: https://overview.legal/posts/46829
- Topics: Video Surveillance, IP Address, Accountability, Controllers, Monitoring, Processing Agreement, Processing, Personal Data, Supervisory Authorities, Data Controller

## Summary

The DPA from Luxembourg (CNPD) has imposed a fine of EUR 1,000 on a company. The controller had installed a video surveillance system with the purposes of the protection of property, securing access to private and risky places, as well as the safety of users and the prevention of accidents. However, the cameras also excessively captured parts of the public space. The DPA finds that the controller thus violated the principle of data minimization under Article 5 (1) c) GDPR. In addition, the contr

## Full text

The DPA from Luxembourg (CNPD) has imposed a fine of EUR 1,000 on a company. The controller had installed a video surveillance system with the purposes of the protection of property, securing access to private and risky places, as well as the safety of users and the prevention of accidents. However, the cameras also excessively captured parts of the public space. The DPA finds that the controller thus violated the principle of data minimization under Article 5 (1) c) GDPR. In addition, the controller had not properly informed the data subjects about the processing of the data by the video surveillance and thus violated its duty to inform.

GDPR Articles: Art. 5 (1) c) GDPR, Art. 13 GDPR
Industry: Not assigned

---
Generated by overview.legal · https://overview.legal/posts/46829 · 2026-08-22