Enforcement · National Commission for Data Protection (CNPD) EN LLM context

LUXEMBOURG DPA: Non-compliance with general data processing principles

The DPA from Luxembourg (CNPD) has imposed a fine of EUR 7,200 on a company.

€7,200 Fine

Unknown

LUXEMBOURG

Art. 5 GDPR Art. 13 GDPR Art. 32 GDPR

Supervisory Authorities Retention Period Storage Limitation Accountability Controllers

Jun 11, 2021 Source cnpd.public.lu

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline

The DPA from Luxembourg (CNPD) has imposed a fine of EUR 7,200 on a company. The company had installed a video surveillance system to protect the company's assets, prevent intrusion by unauthorized persons and prevent accidents. However, the cameras also captured parts of an employee's work area and the smoking area that employees frequently used. Furthermore, the controller had installed location sensors on the cars in its fleet. This was intended to optimize the company's operations. The DPA finds that the recording of employees was not necessary to ensure the purposes associated with the video surveillance and was therefore disproportionate. The DPA states that the controller thus violated the principle of data minimization under Article 5 (1) c) of the GDPR. The location data collected by the controller was stored for a period of eight months, although this would not have been necessary for the purposes of the processing.

Retention Period Supervisory Authorities Video Surveillance applies Art. 5(1)

The DPA considered this to be a violation of the principle of data retention. Furthermore, the DPA found a violation of the information obligations set out in Art. 13 GDPR. Finally, the DPA found a violation of Art. 32 (1) GDPR. All persons who had authorized access to the software via which the locations could be tracked used the same account and not an individual account. GDPR Articles: Art. 5 (1) c), e) GDPR, Art. 13 GDPR, Art. 32 (1) GDPR Industry: Employment

Supervisory Authorities Storage Limitation applies Art. 5(1)Art. 32(1)Art. 13

How it connects

2 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

Related across sources

10 A 5144/23 VG Hannover: Controller appeals DPA reprimand over unlawful workplace video surveillance The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. Cameras were placed in the… Administrative Court Hannover Aug 7, 2026 Controllers Supervisory Authorities Legitimate Interest

C-231/22 État belge v Autorité de protection des données In Case C-231/22, the Court of Justice of the European Union interpreted Article 4(7) and Article 5(2) of the GDPR in response to a preliminary reference from the Brussels Court… CJEU ·Third Chamber Jan 11, 2024 Controllers Personal Data Public Authority

C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data

C-768/21 TR v Land Hessen In Case C-768/21, the Court of Justice of the European Union (First Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning TR's challenge of… CJEU ·First Chamber Sep 26, 2024 Supervision Data Breaches Integrity and Confidentiality Principle

C-638/23 Amt der Tiroler Landesregierung v Datenschutzbehörde In Case C-638/23, the Court of Justice interpreted Article 4(7) GDPR in response to a preliminary reference from the Austrian Verwaltungsgerichtshof in proceedings between the Amt… CJEU ·Eighth Chamber Feb 27, 2025 Public Authority Controllers Personal Data

C-136/17 GC and Others v CNIL C-136/17 (GC and Others) CJEU Sep 24, 2019 Right to be Forgotten Legitimate Interest Criminal Data