# LUXEMBOURG DPA: Non-compliance with general data processing principles

- Type: Enforcement
- Source: National Commission for Data Protection (CNPD)
- Date: 2021-06-11
- Original: https://www.enforcementtracker.com/ETid-749
- Canonical: https://overview.legal/posts/46864
- Topics: Video Surveillance, Monitoring, Employees, IP Address, Accountability, Controllers, Processing Agreement, Processing, Supervisory Authorities, Data Controller

## Summary

The DPA from Luxembourg (CNPD) has imposed a fine of EUR 7,600 on a company. This company had installed a video surveillance system for the purpose of protecting the company's assets, preventing intrusion by unauthorized persons and preventing accidents. However, two of the cameras also covered parts of a public street and six of the cameras covered the workplaces of some employees The DPA states that the recording of the employees and the public street was not necessary to ensure the purposes a

## Full text

The DPA from Luxembourg (CNPD) has imposed a fine of EUR 7,600 on a company. This company had installed a video surveillance system for the purpose of protecting the company's assets, preventing intrusion by unauthorized persons and preventing accidents. However, two of the cameras also covered parts of a public street and six of the cameras covered the workplaces of some employees The DPA states that the recording of the employees and the public street was not necessary to ensure the purposes associated with the video surveillance and was therefore disproportionate. The DPA finds that the controller thus breached the principle of data minimization under Article 5(1)(c) of the GDPR. In addition, the DPA found that the controller had not complied with its information obligations under Article 13 GDPR.

GDPR Articles: Art. 5 (1) c) GDPR, Art. 13 GDPR
Industry: Employment

---
Generated by overview.legal · https://overview.legal/posts/46864 · 2026-08-22