Sanction RGPD National Commission for Data Protection (CNPD) — Company : 19 k€ (2021)
- Autorité de contrôle
- National Commission for Data Protection (CNPD)
- Pays
- Luxembourg
- Entreprise / secteur
- Company
- Montant de l'amende
- 19 k€
- Date de la décision
- 27 octobre 2021
- Fondement juridique
- Art. 37 (7), Art. 38 (1), (3), Art. 39 (1) b)
- Manquement
- Implication insuffisante du DPO
Résumé des faits
The DPA of Luxembourg has imposed a fine of EUR 18,700 on a company. During its investigation, the DPA first found that the controller's public website did not include direct contact details for the DPO. Furthermore, the DPO was not sufficiently involved in all data protection matters. For example, they only participated in internal meetings by invitation. Moreover, there were several hierarchical intermediaries between the DPO and the highest management level of the controller, not granting them sufficient autonomy. Also, in the absence of formalized procedures, the DPO was not able to sufficiently monitor the consistency of data processing practices.