Recital 148
General Data Protection Regulation · UE 2016/679
| (148) | In order to strengthen the enforcement of the rules of this Regulation, penalties including administrative fines should be imposed for any infringement of this Regulation, in addition to, or instead of appropriate measures imposed by the supervisory authority pursuant to this Regulation. In a case of a minor infringement or if the fine likely to be imposed would constitute a disproportionate burden to a natural person, a reprimand may be issued instead of a fine. Due regard should however be given to the nature, gravity and duration of the infringement, the intentional character of the infringement, actions taken to mitigate the damage suffered, degree of responsibility or any relevant previous infringements, the manner in which the infringement became known to the supervisory authority, compliance with measures ordered against the controller or processor, adherence to a code of conduct and any other aggravating or mitigating factor. The imposition of penalties including administrative fines should be subject to appropriate procedural safeguards in accordance with the general principles of Union law and the Charter, including effective judicial protection and due process. |
In Luxembourg, the law of 1 August 2018 organising the CNPD specifies the procedural regime for sanctions: the CNPD adopts its decisions through a restricted panel, and any reprimand, warning or administrative fine is subject to appeal before the Administrative Tribunal within three months. A notable local specificity: the CNPD cannot impose fines on Luxembourg public authorities and public bodies (Article 48 of the 2018 law), which radically changes the risk calculation for municipalities, ministries and public institutions.
Luxgap practice: for private entities, we systematically document cooperation with the CNPD from the first exchange (acknowledgment, response schedule, actions taken) because the CNPD strongly values this criterion in its Article 83(2)(f) weighting. For public actors, the leverage shifts to individual liability of executives and civil litigation by data subjects, which the Mitigation Evidence Vault also covers.
