LUXEMBOURG DPA: Non-compliance with general data processing principles

The DPA from Luxembourg (CNPD) has imposed a fine of EUR 7,600 on a company. This company had installed a video surveillance system for the purpose of protecting the company's assets, preventing intrusion by unauthorized persons and preventing accidents. However, two of the cameras also covered parts of a public street and six of the cameras covered the workplaces of some employees The DPA states that the recording of the employees and the public street was not necessary to ensure the purposes associated with the video surveillance and was therefore disproportionate. The DPA finds that the controller thus breached the principle of data minimization under Article 5(1)(c) of the GDPR. In addition, the DPA found that the controller had not complied with its information obligations under Article 13 GDPR.

GDPR Articles: Art. 5 (1) c) GDPR, Art. 13 GDPR
Industry: Employment