# Company: Non-compliance with general data processing principles

- Type: Enforcement
- Source: National Commission for Data Protection (CNPD)
- Date: 2022-07-22
- Original: https://www.enforcementtracker.com/ETid-1657
- Canonical: https://overview.legal/posts/47772
- Topics: Video Surveillance, IP Address, Monitoring, Controllers, Processing Agreement, Personal Data, Processing, Supervisory Authorities, Data Controller, Law Enforcement

## Summary

The DPA of Luxembourg (CNPD) has imposed a fine of EUR 10,000 on a company. The company had installed a video surveillance system for the purpose of protecting company property and staff. However, the cameras also constantly captured parts of employee's work areas, a break room, a meeting room and a neighbor property. The DPA states that the controller violated the principle of data minimization under Art. 5 (1) c) GDPR due to the excessive CCTV. Furthermore, the DPA found a violation of the inf

## Full text

The DPA of Luxembourg (CNPD) has imposed a fine of EUR 10,000 on a company. The company had installed a video surveillance system for the purpose of protecting company property and staff. However, the cameras also constantly captured parts of employee's work areas, a break room, a meeting room and a neighbor property. The DPA states that the controller violated the principle of data minimization under Art. 5 (1) c) GDPR due to the excessive CCTV. Furthermore, the DPA found a violation of the information obligations set out in Art. 13 GDPR, by not properly informing data subjects about the video surveillance.

GDPR Articles: Art. 5 (1) c) GDPR, Art. 13 GDPR
Industry: Not assigned

---
Generated by overview.legal · https://overview.legal/posts/47772 · 2026-08-22