Recital 170
General Data Protection Regulation · UE 2016/679
| (170) | Since the objective of this Regulation, namely to ensure an equivalent level of protection of natural persons and the free flow of personal data throughout the Union, cannot be sufficiently achieved by the Member States and can rather, by reason of the scale or effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union (TEU). In accordance with the principle of proportionality as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve that objective. |
In Luxembourg, the national margin is governed by the law of 1 August 2018 on the organisation of the National Commission for Data Protection and the general data protection regime. It notably specifies the regime for scientific and historical research (article 65), journalistic purposes (article 62), and the CNPD's sanction powers. The minor consent age is set at 16 years (maximalist alignment on article 8 GDPR).
Luxgap practice: for any group with main establishment in Luxembourg, the CNPD is the lead authority within the meaning of article 56 GDPR for cross-border processing. Precisely map your data decision centre to secure this status, particularly strategic for financial actors and fintechs.
