Unpacking compliance, security and AI.
Our DPOs and CISOs regularly share their take on regulatory and technical news here: new CNPD guidelines, notable sanctions, incident lessons learned, evolutions on the AI Act, NIS 2 and DORA. To go beyond the press release.
112 articles found · #reglementaire
DORA: TLPT RTS now in force — what the CSSF expects
Delegated Regulation (EU) 2025/1190 sets TLPT under DORA. In Luxembourg, the CSSF is the TLPT authority and aligns TIBER‑LU. Who gets designated, how testing works, and cadence: a practical brief.
NIS 2: ILR frames directors’ accountability
ILR issues NIS 2 Guidelines for governing bodies: approval, oversight and training become verifiable and sanctionable.
Mandatory DPIA: CNPD vs CNIL on HR (GDPR Art. 35)
The CNPD and CNIL apply the same GDPR yet diverge on HR surveillance and analytics: a narrower scope in Luxembourg, broader in France. Result: a DPIA may be mandatory in FR and conditional in LU.
GDPR: CNIL fines EXTIA €300k for erasure failures
CNIL fines EXTIA €300,000 for breaches of GDPR Articles 12 and 17 on the right to erasure and one‑month response obligations.
CJEU 10/02/2026 — GDPR: EDPB binding decisions are challengeable
The CJEU held that an EDPB binding decision (Art. 65 GDPR) is a challengeable act directly concerning the company. The EDPB’s fine methodology can now be contested before EU courts.
GDPR Article 22: Uber fined €825m, automated decisions
The Dutch DPA, with the CNIL, fined Uber nearly €825m for automated driver account deactivations/suspensions without adequate safeguards. Clear message: GDPR Article 22 applies concretely to high‑impact business algorithms.
CJEU C‑526/24 — When a first access request is “abusive” under Art. 12(5)
The CJEU allows, in exceptional cases, refusal of a first access request (Art. 15 GDPR) if the controller proves an abusive intent to manufacture compensable harm. Article 12(5) is interpreted strictly and the burden of proof lies with the controller.
Vehicle geolocation: CNPD vs CNIL on retention and oversight
CNIL sets a 2‑month default retention for vehicle geolocation, while CNPD requires a case‑by‑case proportionality proof with potential L.261‑1 referral. Adapt HR and fleet policies accordingly in Luxembourg.
Legitimate interest vs consent: French Supreme Court, 17 June 2026
On 17 June 2026, the French Supreme Court (commercial chamber) required strict Article 14 GDPR information when relying on legitimate interest for data collected indirectly, including in litigation contexts.
CNPD — Recording meetings: consent rarely valid, legitimate interest under conditions
On 08/07/2026, Luxembourg’s CNPD updated its file on recording private meetings: consent is rarely valid; legitimate interest applies only case by case; deletion is required once the minutes are approved.
Recording calls: the SWDE case and what the CNPD expects in Luxembourg
Belgium’s DPA fined SWDE €86,000 for non-compliant call recordings. In Luxembourg, the CNPD strictly frames recordings: point-of-contact notice, clear legal basis, short retention, and Article 28 DPAs.
US DPF: adequacy adopted, EDPB caution and CNPD guidance
On 10 July 2023, the Commission adopted the EU‑US DPF adequacy decision (GDPR art. 45). The EDPB urges caution and the CNPD sets practical checks: verify certification and scope (incl. HR) and keep a fallback plan.