LUXEMBOURG DPA: Non-compliance with general data processing principles

The DPA from Luxembourg (CNPD) has imposed a fine of EUR 1,500 on a company. The company had installed a video surveillance system to ensure that their customers would not have to wait when their front desk staff was not present. However, the cameras also constantly captured parts of two employee's work areas. The DPA states that the controller thus violated the principle of data minimization under Art. 5 (1) c) of the GDPR. Furthermore, the DPA found a violation of the information obligations set out in Art. 13 GDPR, by not properly informing its employees and third parties about the video surveillance.

GDPR Articles: Art. 5 (1) c) GDPR, Art. 13 GDPR
Industry: Employment