Recital 142
General Data Protection Regulation · UE 2016/679
| (142) | Where a data subject considers that his or her rights under this Regulation are infringed, he or she should have the right to mandate a not-for-profit body, organisation or association which is constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest and is active in the field of the protection of personal data to lodge a complaint on his or her behalf with a supervisory authority, exercise the right to a judicial remedy on behalf of data subjects or, if provided for in Member State law, exercise the right to receive compensation on behalf of data subjects. A Member State may provide for such a body, organisation or association to have the right to lodge a complaint in that Member State, independently of a data subject's mandate, and the right to an effective judicial remedy where it has reasons to consider that the rights of a data subject have been infringed as a result of the processing of personal data which infringes this Regulation. That body, organisation or association may not be allowed to claim compensation on a data subject's behalf independently of the data subject's mandate. |
In Luxembourg, article 80(2) GDPR has not been transposed: an association may act before the CNPD only with explicit mandate from a data subject, unlike Germany or Belgium. The law of 1 August 2018 organising the CNPD frames the admissibility of mandated complaints, and the CNPD systematically verifies the reality of the individual mandate before investigation.
Luxgap practice: even without mandate-free action, European NGOs regularly file mandated individual complaints before the CNPD against entities established in Luxembourg (notably fintech, e-commerce and platforms). Anticipate by auditing your cookie banners and article 15 processes quarterly against noyb criteria.
