Recital 152
General Data Protection Regulation · UE 2016/679
| (152) | Where this Regulation does not harmonise administrative penalties or where necessary in other cases, for example in cases of serious infringements of this Regulation, Member States should implement a system which provides for effective, proportionate and dissuasive penalties. The nature of such penalties, criminal or administrative, should be determined by Member State law. |
In Luxembourg, the law of 1 August 2018 organising the Commission nationale pour la protection des donnees made a strong political choice: it excluded public authorities and public bodies from GDPR administrative fines (Art. 48). In return, it kept criminal penalties (Art. 46 and 47) for obstructing CNPD powers and for unlawful processing, targeting individual directors. Recital 152 is fully relevant here: the criminal or administrative nature depends on national law, and in Luxembourg both coexist.
Luxgap practice: for Luxembourg public actors (municipalities, ministries, public bodies), we calibrate the exposure matrix on the personal criminal risk of directors and on reputational risk, rather than on the administrative fine excluded by the 2018 law.
