Enforcement · National Commission for Data Protection (CNPD) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
Company: Insufficient involvement of data protection officer
How it connects
Related across sources
Case Law Deutsche Wohnen SE v Staatsanwaltschaft Berlin Guidance Guidelines 07/2022 on certification as a tool for transfers News De Autoriteit Persoonsgegevens publiceert een rapport over de risicoanalyse van de AVG (Algemene Verordening Gegevensbescherming). News What Happened to the Risk-Based Approach to Data Transfers? News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Guidance Guidelines 04/2021 on Codes of Conduct as tools for transfers
Full text
The DPA of Luxembourg has imposed a fine of EUR 18,700 on a company. During its investigation, the DPA first found that the controller's public website did not include direct contact details for the DPO. Furthermore, the DPO was not sufficiently involved in all data protection matters. For example, they only participated in internal meetings by invitation. Moreover, there were several hierarchical intermediaries between the DPO and the highest management level of the controller, not granting them sufficient autonomy. Also, in the absence of formalized procedures, the DPO was not able to sufficiently monitor the consistency of data processing practices.
Industry: Not assigned
Original document at the source cnpd.public.lu