Recital 11
General Data Protection Regulation · UE 2016/679
| (11) | Effective protection of personal data throughout the Union requires the strengthening and setting out in detail of the rights of data subjects and the obligations of those who process and determine the processing of personal data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data and equivalent sanctions for infringements in the Member States. |
In Luxembourg, the law of 1 August 2018 organising the CNPD grants the national authority the equivalent investigation, supervision and sanction powers required by recital 11. The CNPD may impose administrative fines up to the Article 83 GDPR caps but cannot fine the State or municipalities (Article 47 of the law of 1 August 2018), a Luxembourg specificity that does not exempt the public sector from compliance but limits the financial lever.
Luxgap practice: for Luxembourg public sector entities, we focus the accountability narrative on reputational risk and on CNPD public corrective measures, which remain fully applicable even without monetary sanctions.
