Enforcement · National Commission for Data Protection (CNPD) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

LUXEMBOURG DPA: Non-compliance with general data processing principles

The DPA from Luxembourg (CNPD) has imposed a fine of EUR 6,800 on a company.

€6,800 Fine
Unknown
LUXEMBOURG
Art. 5 GDPR Art. 13 GDPR
Supervisory Authorities Retention Period Controllers Processing Employees
Dec 1, 2021 Source cnpd.public.lu

Full text

The DPA from Luxembourg (CNPD) has imposed a fine of EUR 6,800 on a company. The company had installed a video surveillance system to protect the company's assets, prevent intrusion by unauthorized persons and prevent accidents. However, the cameras also captured parts of an employee's work area, the smoking area that employees frequently used and parts of the public space. The DPA states that the controller thus violated the principle of data minimization under Art. 5 (1) c) of the GDPR. Furthermore, the DPA found a violation of the information obligations set out in Art. 13 GDPR, by not properly informing its employees and third parties about the video surveillance.

Industry: Employment

How it connects

References

Related across sources

10 A 5144/23 VG Hannover: Controller appeals DPA reprimand over unlawful workplace video surveillance The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. Cameras were placed in the… Administrative Court Hannover Aug 7, 2026 Controllers Supervisory Authorities Legitimate Interest
C-422/24 Case C-422/24 - AB Storstockholms Lokaltrafik. A new page has been created with the following information: "" CJEU Jan 7, 2026 Personal Data Fairness & Transparency Controllers
Guidelines 3/2019 processing of personal data through video devices Guidelines ·EDPB Jan 30, 2020 Personal Data Processing Material scope (GDPR)
42 K 51.25 VG Berlin: DPA correctly found residential video surveillance for property protection The property management company of a high-rise building (the controller) had a video surveillance system installed at the entrances of the building in 2021. The installation was… Administrative Court Berlin Apr 20, 2026 Legitimate Interest Supervisory Authorities Retention Period
2018 Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) Guidelines on transparency EDPB Apr 11, 2018 Transparency Information Provision Modalities and Communication Methods Fairness & Transparency
2 A 165/24 OVG Saarlouis - 2 A 165/24 The data subject was an employee, the controller was the employer. On 14 January 2022, the data subject requested access to personal data from the controller under Article 15… May 13, 2025 Right of Access Personal Data Right to Restriction
Related documents