Unpacking compliance, security and AI.
Our DPOs and CISOs regularly share their take on regulatory and technical news here: new CNPD guidelines, notable sanctions, incident lessons learned, evolutions on the AI Act, NIS 2 and DORA. To go beyond the press release.
69 articles found · #cnpd
Mandatory DPIA: CNPD vs CNIL on HR (GDPR Art. 35)
The CNPD and CNIL apply the same GDPR yet diverge on HR surveillance and analytics: a narrower scope in Luxembourg, broader in France. Result: a DPIA may be mandatory in FR and conditional in LU.
GDPR: CNIL fines EXTIA €300k for erasure failures
CNIL fines EXTIA €300,000 for breaches of GDPR Articles 12 and 17 on the right to erasure and one‑month response obligations.
EDPB harmonizes GDPR fines: a unified EU methodology
On 21 September 2026, the EDPB adopted guidelines aligning how GDPR fines are decided and calculated. Luxembourg companies gain predictability—alongside stricter enforcement.
CJEU C‑526/24 — When a first access request is “abusive” under Art. 12(5)
The CJEU allows, in exceptional cases, refusal of a first access request (Art. 15 GDPR) if the controller proves an abusive intent to manufacture compensable harm. Article 12(5) is interpreted strictly and the burden of proof lies with the controller.
Vehicle geolocation: CNPD vs CNIL on retention and oversight
CNIL sets a 2‑month default retention for vehicle geolocation, while CNPD requires a case‑by‑case proportionality proof with potential L.261‑1 referral. Adapt HR and fleet policies accordingly in Luxembourg.
CNPD — Recording meetings: consent rarely valid, legitimate interest under conditions
On 08/07/2026, Luxembourg’s CNPD updated its file on recording private meetings: consent is rarely valid; legitimate interest applies only case by case; deletion is required once the minutes are approved.
Recording calls: the SWDE case and what the CNPD expects in Luxembourg
Belgium’s DPA fined SWDE €86,000 for non-compliant call recordings. In Luxembourg, the CNPD strictly frames recordings: point-of-contact notice, clear legal basis, short retention, and Article 28 DPAs.
US DPF: adequacy adopted, EDPB caution and CNPD guidance
On 10 July 2023, the Commission adopted the EU‑US DPF adequacy decision (GDPR art. 45). The EDPB urges caution and the CNPD sets practical checks: verify certification and scope (incl. HR) and keep a fallback plan.
French Supreme Court (Mar 18, 2026) — Geolocation and working time
The French Supreme Court allows geolocation to measure working time if no other objective, reliable and accessible means exists and employees lack freedom to organize their time. Luxembourg focus: legal basis, necessity, DPIA.
GDPR: CJEU C‑199/24 and the “journalism” derogation
The CJEU holds that paywalled publication of criminal judgments is not, in principle, a journalistic purpose under Article 85 GDPR. Where the journalism derogation does not apply, GDPR rights and remedies remain available.
CNPD vs CNIL: 8 days or 1 month to retain workplace CCTV footage?
Facts: CNPD sets 8 days in principle (30 days exceptionally), while CNIL tolerates up to one month. Key point: align video retention with GDPR Art. 5(1)(e) and Luxembourg Labor Code L. 261‑1.
CJEU C‑414/24 (18 June 2026): parallel GDPR remedies are not exclusive
The CJEU confirms that GDPR complaints to the authority (Art. 77) and judicial actions (Art. 79) are parallel and not mutually exclusive. An authority may not dismiss a complaint solely because a court action is pending.