Recital 150

Recital 150

General Data Protection Regulation · UE 2016/679

(150)

In order to strengthen and harmonise administrative penalties for infringements of this Regulation, each supervisory authority should have the power to impose administrative fines. This Regulation should indicate infringements and the upper limit and criteria for setting the related administrative fines, which should be determined by the competent supervisory authority in each individual case, taking into account all relevant circumstances of the specific situation, with due regard in particular to the nature, gravity and duration of the infringement and of its consequences and the measures taken to ensure compliance with the obligations under this Regulation and to prevent or mitigate the consequences of the infringement. Where administrative fines are imposed on an undertaking, an undertaking should be understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those purposes. Where administrative fines are imposed on persons that are not an undertaking, the supervisory authority should take account of the general level of income in the Member State as well as the economic situation of the person in considering the appropriate amount of the fine. The consistency mechanism may also be used to promote a consistent application of administrative fines. It should be for the Member States to determine whether and to which extent public authorities should be subject to administrative fines. Imposing an administrative fine or giving a warning does not affect the application of other powers of the supervisory authorities or of other penalties under this Regulation.

Luxembourg specificity
loi luxembourgeoise du 1er aout 2018 portant organisation de la Commission nationale pour la protection des donnees

In Luxembourg, the law of 1 August 2018 organising the CNPD specifies that Luxembourg public authorities and bodies are not exempt from GDPR administrative fines (Article 48), unlike France where the CNIL cannot financially sanction the State. A municipality, a public hospital or a Luxembourg public institution can therefore be sanctioned in the same way as a private company, which constitutes a strong specificity of transposed Luxembourg law.

Luxgap practice: for Luxembourg public actors (municipalities, intermunicipal syndicates, public institutions), we systematically integrate the fine scenario into the budgetary risk mapping presented to the college of aldermen or the board of directors.