Recital 169
General Data Protection Regulation · UE 2016/679
| (169) | The Commission should adopt immediately applicable implementing acts where available evidence reveals that a third country, a territory or a specified sector within that third country, or an international organisation does not ensure an adequate level of protection, and imperative grounds of urgency so require. |
In Luxembourg, the CNPD (Commission nationale pour la protection des données, never APDL) is the competent authority to supervise transfers outside the EU and sanction breaches linked to the collapse of an adequacy decision. The law of 1 August 2018 organising the CNPD grants it immediate injunction powers, particularly used during thematic inspections on transfers to the United States since Schrems II.
Luxgap practice: for CSSF-regulated actors (private banks, PFS, funds), we couple the Adequacy Watchtower with CSSF Circular 22/806 on IT outsourcing, so that the fallback plan is also enforceable during a prudential inspection.
