Unpacking compliance, security and AI.
Our DPOs and CISOs regularly share their take on regulatory and technical news here: new CNPD guidelines, notable sanctions, incident lessons learned, evolutions on the AI Act, NIS 2 and DORA. To go beyond the press release.
23 articles found · #cnil · Expertise Luxgap
Mandatory DPIA: CNPD vs CNIL on HR (GDPR Art. 35)
The CNPD and CNIL apply the same GDPR yet diverge on HR surveillance and analytics: a narrower scope in Luxembourg, broader in France. Result: a DPIA may be mandatory in FR and conditional in LU.
GDPR: CNIL fines EXTIA €300k for erasure failures
CNIL fines EXTIA €300,000 for breaches of GDPR Articles 12 and 17 on the right to erasure and one‑month response obligations.
GDPR Article 22: Uber fined €825m, automated decisions
The Dutch DPA, with the CNIL, fined Uber nearly €825m for automated driver account deactivations/suspensions without adequate safeguards. Clear message: GDPR Article 22 applies concretely to high‑impact business algorithms.
Vehicle geolocation: CNPD vs CNIL on retention and oversight
CNIL sets a 2‑month default retention for vehicle geolocation, while CNPD requires a case‑by‑case proportionality proof with potential L.261‑1 referral. Adapt HR and fleet policies accordingly in Luxembourg.
CNIL fines IQVIA €5M: health data warehouses under high scrutiny
On May 26, 2026, the CNIL fined IQVIA €5M for breaching authorizations and Articles 14 and 25 GDPR across two health data warehouses. Clear message: effective notice, operational opt-out, and privacy by design are non-negotiable.
CNPD vs CNIL: 8 days or 1 month to retain workplace CCTV footage?
Facts: CNPD sets 8 days in principle (30 days exceptionally), while CNIL tolerates up to one month. Key point: align video retention with GDPR Art. 5(1)(e) and Luxembourg Labor Code L. 261‑1.
IQVIA: €5m fine and health data — Article 9 GDPR under strain
CNIL fines IQVIA France €5m for failings in health data warehouses. Key takeaway for Luxembourg: “pseudonymised” data remains health data (Art. 9 GDPR) and requires a strict legal basis and effective safeguards.
GDPR Art. 32: France Travail, €5M for weak security
On 22 January 2026, the CNIL fined France Travail €5M for breaches of GDPR Article 32. Key takeaway: prove the proportionality and effectiveness of security measures, with clear documentation, including in Luxembourg.
Workplace video surveillance: CNPD (8 days) vs CNIL (1 month)
The CNPD sets an 8‑day retention period “in principle,” while the CNIL allows up to one month. A concrete divergence affecting retention, DPIAs and employee information.
Workplace video surveillance: CNIL fine of 2 April 2026
On 02/04/2026, the CNIL imposed a €7,500 fine for CCTV non-compliance. In Luxembourg, the CNPD likewise requires proportionality, frequent DPIAs and two-layer information.
Recording meetings and calls: €250,000 fine — CNPD framework 2026
On 16/10/2025, the CNIL fined a call center €250,000 for poorly governed recordings. Since April 2026, the CNPD has issued a dedicated framework for meeting recordings: legal basis, transparency, retention, security, and DPIA.
Mandatory DPIA: CNPD vs CNIL — geolocation, two thresholds
In Luxembourg, the CNPD requires a DPIA for any systematic tracking of location. In France, the CNIL only mandates it for large-scale processing of location data.