Recital 130
General Data Protection Regulation · UE 2016/679
| (130) | Where the supervisory authority with which the complaint has been lodged is not the lead supervisory authority, the lead supervisory authority should closely cooperate with the supervisory authority with which the complaint has been lodged in accordance with the provisions on cooperation and consistency laid down in this Regulation. In such cases, the lead supervisory authority should, when taking measures intended to produce legal effects, including the imposition of administrative fines, take utmost account of the view of the supervisory authority with which the complaint has been lodged and which should remain competent to carry out any investigation on the territory of its own Member State in liaison with the competent supervisory authority. |
In Luxembourg, the CNPD very frequently acts as lead authority for groups with their main establishment in the Grand Duchy (holdings, fintechs, digital platforms). The law of 1 August 2018 on the organisation of the CNPD specifies the authority's investigative and European cooperation powers. CNPD decisions are subject to appeal before the administrative tribunal, and litigation around the article 60 mechanism remains rare but growing.
Luxgap practice: for any Luxembourg client with data subjects in more than two Member States, we systematically prepare a one-stop-shop exposure map anticipating which local authorities could engage the CNPD via article 56, and we calibrate the accountability documentation to withstand the strictest standard among concerned authorities, not just the CNPD's.
