View source for CNPD (Luxembourg) - Délibération n° 11FR/2021

{{DPAdecisionBOX

|Jurisdiction=Luxembourg
|DPA-BG-Color=
|DPAlogo=LogoLU.png
|DPA_Abbrevation=CNPD (Luxembourg)
|DPA_With_Country=CNPD (Luxembourg)

|Case_Number_Name=Délibération n° 11FR/2021
|ECLI=

|Original_Source_Name_1=CNPD
|Original_Source_Link_1=https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-11FR-2021-sous-forme-anonymisee.pdf
|Original_Source_Language_1=French
|Original_Source_Language__Code_1=FR

|Type=Investigation
|Outcome=Violation Found
|Date_Decided=08.04.2021
|Date_Published=07.06.2021
|Year=2021
|Fine=2800
|Currency=EUR

|GDPR_Article_1=Article 5(1)(e) GDPR
|GDPR_Article_Link_1=Article 5 GDPR#1e
|GDPR_Article_2=Article 13 GDPR
|GDPR_Article_Link_2=Article 13 GDPR
|GDPR_Article_3=Article 32(1) GDPR
|GDPR_Article_Link_3=Article 32 GDPR#1



|Party_Name_1=
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=
|Party_Name_4=
|Party_Link_4=
|Party_Name_5=
|Party_Link_5=

|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=
|Appeal_To_Link=

|Initial_Contributor=n/a
|
}}

The Luxembourg DPA fined a controller €2800 for processing geolocation data from their fleet of vehicles without an adequate retention period and without providing all the necessary information to their employees.  

== English Summary ==

=== Facts ===
The Luxembourg DPA (CNPD) launched an investigation on a company that was using a geolocation system in their fleet of vehicles. Such vehicles were used by their employees for home to office transport and to travel with clients. 

According to the controller, the geolocation purposes were geographic identification, protection of company assets, tracking of transported goods, optimal fleet management, optimisation of the work process, responding to customer complaints, proof of service customer complaints, the provision of proof of services, invoicing of services,and the monitoring of the working time of employees on the move.

The DPA also found that the geolocation data had been stored for a period of 2 years and 4 months. 
=== Holding ===
According to the CNPD, the retention period exceeded what was necessary for the purposes of the processing. Because of this, the CNPD considered that the controller had violated Article 5(1)(e) GDPR. 

The DPA also noted that the storage period should not only be adequate in sight of the purposes of the processing, but should also be individualised per each purpose. 

The authority also found that the controller had not properly informed their employees about the processing of geolocation data. The only information provided to the employees consisted on a sticker on the vehicles and a plastic sheet attached to the vehicle documentation. There was also not enough information about the system on their privacy note. 

The CNPD therefore considered that the controller had infringed Article 13.

For these violations, the DPA fined the controller €2800, and ordered them to implement a policy for providing the necessary information to the employees, as well as to implement adequate retention periods. Additionally, the DPA ordered the controller to implement, in accordance with Article 32(1) GDPR, access measures to the geolocation data, with a system that allows the data subject to authenticate themselves in order to access it. 

== Comment ==
''Share your comments here!''

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the French original. Please refer to the French original for more details.

<pre>
Decision of the National Commission sitting in restricted formation

    on the outcome of survey No. [...] conducted with "Company A"



                       Deliberation n ° 11FR / 2021 of April 8, 2021






The National Commission for Data Protection sitting in a restricted body
composed of Ms Tine A. Larsen, president, and Messrs Thierry Lallemang and Marc

Lemmer, commissioners;



Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016
relating to the protection of individuals with regard to the processing of personal data

personal character and on the free movement of such data, and repealing the Directive

95/46 / EC;


Having regard to the law of 1 August 2018 on the organization of the National Commission for

data protection and the general data protection regime, in particular

its article 41;


Having regard to the internal regulations of the National Commission for the Protection of

data adopted by decision n ° 3AD / 2020 dated 22 January 2020, in particular its

article 10 point 2;


Having regard to the regulation of the National Commission for Data Protection relating to

investigation procedure adopted by decision n ° 4AD / 2020 dated 22 January 2020,

in particular Article 9;



Considering the following:







   _____________________________________________________________

             Decision of the National Commission sitting in restricted formation on the outcome of
                             the survey n ° [...] conducted with "Company A"


                                                                                                  1 / 26I. Facts and procedure



      During its deliberation session of February 14, 2019, the National Commission for

data protection sitting in plenary session (hereinafter: "Plenary session

") Had decided to open an investigation with the ABC group on the basis of Article 37 of the

Law of 1 August 2018 on the organization of the National Commission for the Protection

data and the general data protection regime (hereinafter "Law of 1 August

2018 ") and to appoint Mr. Christophe Buschmann as head of the investigation.



      According to the decision of the Plenary Panel, the investigation carried out by the

National Commission for Data Protection (hereafter: "CNPD") had as

purpose of verifying compliance with the provisions of the regulation on the protection of
natural persons with regard to the processing of personal data and the

free movement of such data, and repealing Directive 95/46 / EC (hereinafter "GDPR")

and the law of August 1, 2018, in particular through the establishment of

video surveillance and geolocation, where applicable, installed by the three companies of the

ABC group.



      On February 20, 2019, CNPD agents visited the

ABC group premises. Since the report no. […] Relating to the said mission

on-site investigation only mentions that, among the three ABC group companies, as
                                                               2
responsible for the controlled processing company "Company A", the decision of the Commission

national body for data protection sitting in a restricted group on the outcome of

the investigation (hereinafter: "Restricted Training") will be limited to controlled treatments
by CNPD agents and carried out by the company "Company A".



       "Company A" is a […] registered in the Trade and Companies Register of

Luxembourg under number […], with registered office at L- […] (hereinafter “the controlled”). The




1 And more specifically with companies: Company A, registered in the Trade and
Luxembourg companies under number […], with registered office at L- […]; Company B, registered at
Luxembourg Trade and Companies Register under number […], with registered office at L-
[…] And Company C, registered in the Luxembourg Trade and Companies Register under number

[…], With registered office at L- […].
2 See in particular report no. […] Relating to the on-site fact-finding mission carried out to date
of February 20, 2019 with the company Company A.
   _____________________________________________________________

              Decision of the National Commission sitting in restricted formation on the outcome of
                               the survey n ° [...] conducted with "Company A"


                                                                                                         2 / 26contrôlé's activity is to provide consultancy, installation and
                                     3
maintenance in technology […].



      During the aforementioned visit of February 20, 2019 by CNPD agents in the

controlled premises, Mr X, Director of Human Resources for the controlled,

confirmed to CNPD officers that a geolocation device is installed in a

part of the vehicles in the controlled fleet, but that the latter does not use
                                    4
a video surveillance system.



      According to the explanations provided to the CNPD agents, the persons concerned

by geolocation are employees of the company who use the vehicles for their

travel to customers and on their business trip between their home and head office

social control. Mr. X also confirmed to the CNPD agents that each

vehicle is assigned to a specific employee and that part of the vehicles that can be

used by employees for private purposes is not equipped with a
                 5
geolocation.


      At the end of his investigation, the head of investigation notified the inspectorate on 9

August 2019 a statement of objections detailing the shortcomings he considered

constituted in this case, and more specifically a non-compliance with the prescribed requirements

by Article 13 of the GDPR with regard to employees, a non-compliance with

measures prescribed by Article 32.1 of the GDPR, as well as non-compliance with the requirements

prescribed by Article 5.1.e) of the GDPR.



      The request for a meeting by the controlled of August 13, 2019 was accepted by the chief

of inquiry and the meeting was held on August 20, 2019. 6







3
 According to the information provided on its own website: […].
4See report no. […] Relating to the on-site fact-finding mission carried out on February 20
2019 from Company A; see also the email from Company A of March 1, 2019 and

the letter of March 29, 2019.
5See finding 1 of report no. […] Relating to the on-site fact-finding mission carried out to date
of February 20, 2019 with the company Company A.
6
 See the report of the meeting of August 20, 2019 with the company Société A.
   _____________________________________________________________
               Decision of the National Commission sitting in restricted formation on the outcome of

                                the survey n ° [...] conducted with "Company A"


                                                                                                           3/26 On October 7, 2019, the inspected produced written observations on the
statement of objections.



      A letter additional to the statement of objections was sent to the inspectorate

dated August 17, 2020. In this letter, the head of the investigation proposed to the Formation
Restricted from taking three different corrective measures, as well as inflicting the controlled

an administrative fine in the amount of EUR 4,000.



      By letter of September 24, 2020, the inspected produced written observations
on the additional letter to the statement of objections.



      The president of the Restricted Training informed the control by letter of 9

October 2020 that his case would be registered for the Restricted Training session of 17
November 2020. The inspected confirmed their presence at the said meeting on October 20

2020.


      During the Restricted Training session on November 17, 2020, the chef

investigation and the inspector reiterated their written observations orally and responded to

questions asked by the Restricted Training. The controlled had the floor last.




II. Place



II. 1. As to the grounds for the decision


A. On the breach linked to the principle of limitation of retention



1. On the principles


      In accordance with Article 5.1.e) of the GDPR, personal data

must be kept "in a form permitting the identification of persons
concerned for a period not exceeding that necessary for the purposes

for which they are processed […] ”.


   _____________________________________________________________

              Decision of the National Commission sitting in restricted formation on the outcome of
                             the survey n ° [...] conducted with "Company A"


                                                                                                  4/26 According to recital (39) of the GDPR "personal data should

be adequate, relevant and limited to what is necessary for the purposes for

which they are processed. This requires, in particular, to ensure that the duration of

data retention is limited to the strict minimum. Personal data

personnel should only be processed if the purpose of the processing cannot be

reasonably achieved by other means. In order to ensure that the data is not
not kept longer than necessary, time limits should be set by the

controller for their erasure or for periodic review […]. "



2. In this case



      During the on-site investigation, it was explained to CNPD officials that the purposes

of geolocation are as follows: "geographical identification, protection of

company assets, monitoring of transported goods, optimal fleet management,
optimizing the work process, providing responses to complaints from

customers, the provision of proof of services, invoicing of services as well as the

monitoring of the working time of employees on the move ”. 7



      Regarding the retention period of data from the

geolocation, it appears from the findings of CNPD agents that the oldest

data dated October 14, 2016, i.e. the retention period of
                                   8
data was 2 years and 4 months.


      According to the head of the investigation, the said retention period for

geolocation of 2 years and 4 months exceeded that which was necessary for the realization of

the aforementioned purposes and for which the geolocation system had been implemented

square. For this reason, he was of the opinion that a non-compliance with the requirements of Article 5.1.e)

of the GDPR is to be retained (see statement of objections, Ad.A.3).







7See finding 5 of report no. […] Relating to the on-site fact-finding mission carried out to date
of February 20, 2019 with the company Company A.
8See finding 4 of report no. […] Relating to the on-site fact-finding mission carried out to date

of February 20, 2019 with the company Company A.
   _____________________________________________________________
              Decision of the National Commission sitting in restricted formation on the outcome of
                               the survey n ° [...] conducted with "Company A"


                                                                                                        5/26 By letter of March 29, 2019, the inspected for his part reiterated the comments contained

in his email of March 1, 2019, specifying that the retention period

data from the “[…]” geolocation system had been adapted to 12 months,

limit that was already in place for the "historical" component but not yet for the
"General reports". 9



      During the hearing of the Restricted Training on November 17, 2020, the inspector

clarified that the retention period of 12 months was justified, among other things, by the fact that

location data is used for billing customers for services

carried out by its employees.


      Restricted Training reminds that it is the responsibility of the data controller

determine, depending on each specific purpose, a retention period

appropriate and necessary in order to achieve said purpose. Thus, as the system of

geolocation set up by the controlled pursues several purposes, the durations of
conservation are to be individualized for each specific purpose.



      The Restricted Training considers that the control should in particular have differentiated

between the retention period of location data for the purpose of

geographical identification, monitoring of goods transported and optimal management of its fleet,

on the one hand, and the data relating to the working time of employees having precisely
the purpose of monitoring the working time of employees on the move, on the other hand.

As mentioned above, during the hearing of the Restricted Panel, the inspector has by

elsewhere specified that the geolocation data is also intended for invoicing

to customers of services provided by its employees. As a result, the Restricted Formation

believes that an appropriate retention period should have been determined in order to achieve

said purpose.


      With regard to the geolocation of employee vehicles, the Training

Restricted considers that the personal data obtained by the

geolocation can in principle only be kept for a period

maximum of two months under the aforementioned principle of Article 5.1.e) of the GDPR.

9
 Regarding the different functionalities of “[…]”, see the explanations of the inspected in
his letter of October 7, 2019.
   _____________________________________________________________
              Decision of the National Commission sitting in restricted formation on the outcome of
                               the survey n ° [...] conducted with "Company A"


                                                                                                      However, it considers that if the said data is used by the person in charge of the

processing for the purposes of proof for invoicing the services provided for its

customers, the data necessary for such invoicing may be kept for a
duration of one year, provided that it is not possible to provide proof of benefits

by other means. 10



      In the event that the geolocation device is installed for the purpose of verifying the

working time (when this is the only possible means), the Restricted Training considers
that the personal data obtained by geolocation which allows to

check the working time can nevertheless be kept for a period of time

maximum of three years in accordance with the limitation period set out in Article 2277 paragraph

1st of the Civil Code in matters of action for the payment of employee compensation.


      In the event of an incident, the Restricted Training is of the opinion that the data may

however, be kept beyond the pre-mentioned deadlines within the framework of the

transmission of data to the competent judicial authorities and authorities

law enforcement agencies competent to ascertain or prosecute criminal offenses.


      It also wishes to point out that the data obtained by geolocation

may also be kept beyond the aforementioned periods, if these have

previously made anonymous, that is to say that it is no longer possible to make a link

- direct or indirect - between these data and a specific employee.


      In its former authorization no. […], On which the inspected, among others, is based

to justify that employees were already informed of the implementation of the

geolocation, the CNPD had already imposed as a condition that the data of

geolocation could not be kept beyond two months, respectively three

years for data relating to working time.


      Based on all of these elements, the Restricted Training concludes that

Article 5.1.e) of the GDPR was not complied with by the inspectorate.



10See in this context the article of the National Commission for Computing and Liberties
(CNIL): “The geolocation of employee vehicles”, available at: https://www.cnil.fr/fr/la-
geolocation-of-employee-vehicles. "
   _____________________________________________________________
              Decision of the National Commission sitting in restricted formation on the outcome of
                              the survey n ° [...] conducted with "Company A"



                                                                                                      7 / 26B. On the breach related to the obligation to inform the persons concerned



1. On the principles


      Pursuant to paragraph 1 of Article 12 of the GDPR, the "controller

take appropriate measures to provide any information referred to in Articles 13 and 14

as well as to make any communication under Articles 15 to 22 and Article
34 with regard to the processing to the data subject in a concise manner,

transparent, understandable and easily accessible, in clear and simple terms […]. "



      Article 13 of the GDPR provides the following:


"1. When personal data relating to a data subject are

collected from this person, the controller provides them, at the time
where the data in question is obtained, all of the following information:



a) the identity and contact details of the controller and, where applicable, of the

representative of the controller;


b) where applicable, the contact details of the data protection officer;



c) the purposes of the processing for which the personal data are intended as well
as the legal basis for the processing;



d) where the processing is based on Article 6 (1) (f), the legitimate interests

pursued by the controller or by a third party;


e) the recipients or the categories of recipients of the personal data,

if they exist; and


f) where applicable, the fact that the controller intends to carry out a

transfer of personal data to a third country or to an organization
   _____________________________________________________________

              Decision of the National Commission sitting in restricted formation on the outcome of
                              the survey n ° [...] conducted with "Company A"


                                                                                                      8/26 international, and the existence or absence of an adequacy decision issued by the
Commission or, in the case of transfers referred to in Article 46 or 47, or in Article 49,

paragraph 1, second subparagraph, the reference to appropriate or adapted guarantees and the

how to obtain a copy or where it was made available;


2. In addition to the information referred to in paragraph 1, the controller shall provide

to the data subject, when the personal data are

obtained, the following additional information which is necessary to guarantee

fair and transparent treatment:


a) the retention period of personal data or, when this is not

possible, the criteria used to determine this duration;


b) the existence of the right to request from the controller access to data at

personal character, rectification or erasure thereof, or a limitation of the

processing relating to the data subject, or the right to object to the processing and
right to data portability;



c) where the processing is based on Article 6 (1) (a) or on Article 9,

paragraph 2 (a), the existence of the right to withdraw consent at any time,
without affecting the lawfulness of the processing based on consent made before the

withdrawal of it;



d) the right to lodge a complaint with a supervisory authority;


e) information on whether the requirement to provide data to

personal character has a regulatory or contractual character or if it conditions the

conclusion of a contract and whether the data subject is obliged to provide the data to
personal character, as well as the possible consequences of the non-provision of

those data;


f) the existence of automated decision-making, including profiling, referred to in Article

22, paragraphs 1 and 4, and, at least in such cases, useful information concerning the


   _____________________________________________________________

              Decision of the National Commission sitting in restricted formation on the outcome of
                              the survey n ° [...] conducted with "Company A"


                                                                                                      Underlying logic, as well as the significance and expected consequences of this processing

for the person concerned.



3. When he intends to carry out further processing of personal data

personal for a purpose other than that for which the personal data

have been collected, the data controller provides the person with
concerned information about this other purpose and any other information

relevant referred to in paragraph 2.



4. Paragraphs 1, 2 and 3 do not apply when and to the extent that the person

concerned already has this information. "



      Communication to data subjects of information relating to the processing

of their data is an essential element in the context of compliance with obligations
general transparency within the meaning of the GDPR. 11 These obligations have been explained

by the Article 29 Working Group in its guidelines on transparency in the sense

of Regulation (EU) 2016/679, the revised version of which was adopted on April 11, 2018 (here-

after: "WP 260 rev.01").



      Note that the European Data Protection Board (hereafter: "EDPS

»), Which replaced the Article 29 Working Group on May 25, 2018, took over and

re-approved the documents adopted by the said Group between May 25, 2016 and May 25
2018, as precisely the aforementioned guidelines on transparency. 12



2. In this case



      According to the head of the investigation, the employees of the inspected were not validly informed

on the precise elements of articles 13.1 and 2 of the GDPR (see statement of objections,

page 2, Ad.A.1.).






11See in particular articles 5,1, a) and 12 of the GDPR, see also recital (39) of the GDPR.
12 See EDPS Endorsement 1/2018 decision of 25 May 2018, available at:

https://edpb.europa.eu/sites/edpb/files/files/news/endorsement_of_wp29_documents_en_0.pdf.
   _____________________________________________________________
              Decision of the National Commission sitting in restricted formation on the outcome of
                              the survey n ° [...] conducted with "Company A"


                                                                                                    10/26 By letter of March 29, 2019, the inspected for his part reiterated the comments contained

in his email of March 1, 2019, specifying that already before the visit on

CNPD site, a plastic sheet was added to the vehicle documents

equipped with a geolocation system specifying that the vehicle is equipped with such
system, on the one hand, and that said vehicles had a label on the rear door

informing the driver of the presence of said system, on the other hand.



      The inspected attached to the aforementioned letter of March 29, 2019 a declaration from the

staff delegation dated March 27, 2019 and certifying that it was informed of

the implementation of a geolocation system in certain vehicles of the ABC group.


      By letter of October 7, 2019, the inspector also sent the head of the investigation

a copy of the information note intended for all staff on the

geolocation and which has been displayed since October 4, 2019 on the controlled site, as well

than a photo of its display.


      Finally, in his letter of September 24, 2020, the inspected added that in [...],

a geolocation authorization had been issued by the CNPD and that already

at that time, the employees had been informed of the implementation of the

geolocation, in particular via staff delegation. The controlled specified having

asked the ABC group staff delegations to certify that
the information to the staff was actually given in 2009.



      The Restricted Training first of all wishes to point out that Article 13 of the GDPR makes

reference to the obligation imposed on the controller to "provide" all

the information mentioned therein. The word "provide" is crucial here and it "means

that the controller must take concrete measures to provide the
information in question to the data subject or to actively direct the person

concerned to the location of said information (for example by means of a link

direct, a QR code, etc.). ”(WP260 rev. 01. paragraph 33).







13See deliberation no. […].
   _____________________________________________________________
              Decision of the National Commission sitting in restricted formation on the outcome of
                               the survey n ° [...] conducted with "Company A"


                                                                                                       11/26 The declaration of the staff delegations of Company A and Company B of the

March 27, 2019 certifies in this context that they were informed of the establishment of a

geolocation system in certain vehicles of the ABC group, while

the joint statement of September 14, 2020 from said delegations indicates that they were

"Duly informed by the controller of the establishment of a
geolocation in company vehicles. It should be noted that the delegations of

staff have been informed of this since it was set up in 2009. […]. "



      Nevertheless, the Restricted Training considers that a simple declaration,

respectively a certificate by the delegation of inspected personnel indicating that they have

been informed of the presence of the geolocation device does not ensure that employees
of the company have been validly informed in accordance with Articles 13.1 and 2 of the GDPR,

Especially since the said documents are dated after the on-site visit by the agents of the

CNPD.



      Moreover, as mentioned above, the inspected indicates in its position paper of 24

September 2020 that, as he had an authorization from the CNPD of [...], the

employees had already been informed at that time of the implementation of the
geolocation, in particular via staff delegation.



      The only possible derogation from the information obligations referred to in Article 13 of

GDPR of a controller is in effect "when and to the extent that the
                                                           14
data subject already has this information ”. The principle of responsibility

however requires controllers to demonstrate (by documenting)

what information was already in the possession of the data subject, how and
when it has received them and no changes have been made to this information

likely to make them obsolete. 15



      The Restricted Training however notes that no documentation submitted by

the control does not contain proof that the information of employees has in fact taken place





14According to article 13.4 of the GDPR.
15
  See WP260 rev. 01, paragraph 56.
   _____________________________________________________________
              Decision of the National Commission sitting in restricted formation on the outcome of
                              the survey n ° [...] conducted with "Company A"


                                                                                                    12/26 in 2009, at least in relation to the requirements provided for by the legislation in force in

the time .6



      Then, the Restricted Training would like to note that there is in the GDPR a

"Inherent conflict between, on the one hand, the requirement to communicate to the persons concerned
the complete information that is required under the GDPR and, on the other hand, the requirement

to do so in a concise, transparent, understandable and easily accessible manner. "

(WP260 rev. 01, para. 34) Prioritize the information to be provided to individuals

concerned and determine what levels of detail and methods are appropriate for the

communication of information is not always easy.


      It is for this reason that a multi-level approach to communicating

information on transparency to data subjects can be used in a

offline or non-digital context, that is to say in a real environment such as

for example personal data processed by means of a

geolocation. The first level of information should generally include

the most important information, namely details of the purpose of processing, identity

of the controller and the existence of the rights of the data subjects, as well
that the information having the greatest impact on the treatment or any treatment

likely to surprise those concerned. The second level of information,

That is to say the other information required under Article 13 of the GDPR, could

be provided later and by other means, such as a copy
                                                     17
of the privacy policy sent by e-mail.



      Finally, the joint attestation of the delegations of company personnel
Company A and Company B of September 14, 2020 indicates that said delegations have to

were again informed during the publication of the information note on the

geolocation intended for all staff as of October 4, 2019. Exhibit

appended to the audit observations of September 24, 2020 contains the said note

information and a photo of its display.




16 In accordance with article 26 of the repealed law of 2 August 2002 on the protection of
people with regard to the processing of personal data.
17
  See WP260 rev. 01 (point 38).
   _____________________________________________________________
              Decision of the National Commission sitting in restricted formation on the outcome of
                              the survey n ° [...] conducted with "Company A"


                                                                                                    13/26 The Restricted Training nonetheless notes that the plastic sheet added to the

vehicle documents indicating only that the vehicle "is equipped with a

geolocation ", as well as the label affixed to the rear door of the vehicle
mentioning "Monitored by GPS with […]" do not even meet the requirements of the

mandatory content of the first level of information. In addition, the control failed

to its obligation to put in place a confidentiality policy which contains all

information required in accordance with Articles 13.1 and 13.2 of the GDPR.


      In view of the above, the Restricted Training concludes that Article 13 of the GDPR

was not respected by the controlled.



C. The breach linked to the obligation to guarantee appropriate safety


1. On the principles



      Under Article 32.1 of the GDPR and "given the state of knowledge,

implementation costs and the nature, scope, context and purposes of the

treatment as well as risks, which vary in likelihood and severity, for
rights and freedoms of natural persons, the controller and the processor

implement the appropriate technical and organizational measures in order to

guarantee a level of security adapted to the risk including, among other things, according to the needs:



a) pseudonymization and encryption of personal data;


b) the means to guarantee the confidentiality, integrity, availability and

continued resilience of treatment systems and services;



c) the means to restore the availability of personal data
and access to them within an appropriate timeframe in the event of a physical or technical incident;



d) a procedure for regularly testing, analyzing and evaluating the effectiveness of

technical and organizational measures to ensure the security of the processing. "



18Y is also a link to the website of the developer of said software….
   _____________________________________________________________
              Decision of the National Commission sitting in restricted formation on the outcome of
                               the survey n ° [...] conducted with "Company A"



                                                                                                     14/262. In this case


      The head of the investigation examined the security aspect of data access

appearing in the geolocation system. As access to the operating software of the

geolocation device was only secured by means of identification

unique, i.e. a unique username and password, which is used by

all persons authorized to access the software, it held against the controlled
non-compliance with the measures prescribed by Article 32.1 of the GDPR (see

statement of objections, Ad.A.2).



       The inspected defends himself based on his written observations of October 7, 2019

relating to the email he sent in this context on August 21, 2019 to the
person who manages access to user accounts of the geolocation system.

In said letter, the inspected asks the person who manages access to the accounts

users to create custom logins and passwords for
                                    19
people who have access to "[...]" and to delete existing logins, on the one hand, and on

ensure that passwords are regularly updated and not shared with
third parties, on the other hand. In addition, it is specified that the "perimeter to which they have access

remains unchanged (so only the vans of the service for which these people

working) ".



      The Restricted Training noted that on the day of the visit by CNPD agents
in the premises of the controlled, the policies of access to the geolocation software do not

did not meet the minimum necessary security requirements, i.e.

have individual accounts in place by means of a username and password

for people authorized to access it as part of the performance of their

missions.


      In view of the above, the Restricted Training concludes that Article 32.1 of the GDPR

was not respected by the controlled.





19This is the name of the geolocation software developed by […].
   _____________________________________________________________
              Decision of the National Commission sitting in restricted formation on the outcome of
                              the survey n ° [...] conducted with "Company A"



                                                                                                    15/26 II. 2. On corrective measures and fines


1. The principles



      In accordance with article 12 of the law of August 1, 2018, the CNPD has the power

to adopt all the corrective measures provided for in Article 58.2 of the GDPR:


"(A) notify a controller or processor that data processing operations

treatment envisaged are likely to violate the provisions of these regulations;



b) call to order a controller or a processor when the
processing operations have resulted in a violation of the provisions of this Regulation

;



c) order the controller or processor to comply with the requests

presented by the data subject in order to exercise their rights under the
this regulation;



d) order the controller or processor to put the data processing operations

processing in accordance with the provisions of this Regulation, where applicable, of
in a specific way and within a specific timeframe;



e) order the controller to communicate to the data subject a

personal data breach;


f) impose a temporary or permanent restriction, including a ban, of processing;



g) order the rectification or erasure of personal data or the

restriction of processing in application of Articles 16, 17 and 18 and the notification of these

measures to the recipients to whom the personal data have been disclosed
in accordance with Article 17, paragraph 2, and Article 19;



h) withdraw a certification or order the certification body to withdraw a

certification issued in application of Articles 42 and 43, or order the
   _____________________________________________________________
              Decision of the National Commission sitting in restricted formation on the outcome of

                               the survey n ° [...] conducted with "Company A"


                                                                                                      16/26 certification not to issue certification if the requirements applicable to the certification

are not or no longer satisfied;


i) impose an administrative fine in application of Article 83, in addition to or

the place of the measures referred to in this paragraph, depending on the characteristics

specific to each case;


j) order the suspension of data flows addressed to a recipient located in a

third country or to an international organization. "


                                                er
      In accordance with article 48 of the law of August 1, 2018, the CNPD may additionally impose
administrative fines as provided for in Article 83 of the GDPR, except against

state or municipalities.



      Article 83 of the GDPR provides that each supervisory authority ensures that

administrative fines imposed are, in each case, effective, proportionate and
dissuasive, before specifying the elements that must be taken into account in deciding

whether to impose an administrative fine and to decide on the amount of this

fine:


"(A) the nature, gravity and duration of the breach, taking into account the nature, extent

or the purpose of the processing concerned, as well as the number of data subjects

affected and the level of damage they suffered;



(b) whether the violation was committed willfully or negligently;


c) any measures taken by the controller or processor to mitigate the

damage suffered by the persons concerned;



d) the degree of responsibility of the controller or processor, account
taking into account the technical and organizational measures that they have implemented by virtue of

Articles 25 and 32;




   _____________________________________________________________
              Decision of the National Commission sitting in restricted formation on the outcome of

                              the survey n ° [...] conducted with "Company A"


                                                                                                    17/26 e) any relevant breach previously committed by the controller or
the subcontractor ;



f) the degree of cooperation established with the supervisory authority in order to remedy the violation

and mitigate any negative effects;


g) the categories of personal data affected by the breach;



h) the manner in which the supervisory authority became aware of the breach, in particular whether,
and to what extent the controller or processor has notified the breach;



(i) where measures referred to in Article 58 (2) have previously been

ordered against the controller or the processor concerned for the
same object, compliance with these measures;



j) the application of codes of conduct approved in accordance with Article 40 or
certification mechanisms approved under Article 42; and



k) any other aggravating or mitigating circumstance applicable to the circumstances of

the species, such as financial benefits obtained or losses avoided, directly or
indirectly, as a result of the violation ”.



      The Restricted Training would like to point out that the facts taken into account in the

of this decision are those noted at the start of the investigation. Any
changes relating to the processing of data subject to the investigation

later, even if they make it possible to fully or partially establish the

compliance, do not retroactively cancel a breach found.


      However, the steps taken by the inspected to comply

with the GDPR during the investigation procedure or to remedy breaches

noted by the head of investigation in the statement of objections, are taken into account by
Restricted Training as part of any corrective measures to be taken

and / or fixing the amount of a possible administrative fine.


   _____________________________________________________________

              Decision of the National Commission sitting in restricted formation on the outcome of
                              the survey n ° [...] conducted with "Company A"


                                                                                                    18/262. In this case


2.1. As for the imposition of an administrative fine



      In its additional letter to the statement of objections of August 17, 2020,
the head of the investigation proposed to the Restricted Formation to impose an administrative fine

to the control relating to the amount of 4,000 euros, taking into account the elements

following:



     "The fact that clear and complete information to the people concerned about the

       processing (s) carried out by the controller constitutes a

       essential condition for these data subjects to know

       the existence of said treatment, but also grasp its scope. Do not provide these
       information or providing it in an incomplete manner will not only prevent

       data subjects to understand what will happen to their data at

       personal character, but will effectively deprive them of exercising all

       remedies granted by the GDPR.


     The fact that partial information of the persons concerned has actually been
       performed.


     The scale of the geolocation system, installed in at least 191 vehicles.


     The good cooperation of the company throughout the investigation as well as its willingness

       to comply with the law as soon as possible. "


      In its response to the additional letter of September 24, 2020, the inspected

maintained in particular that the concrete criteria taken into account by the head of the investigation

resulted in the quantum determination were unclear and he did not understand on which
objective elements the proposal for the fine would have been made.



      In order to decide whether to impose an administrative fine and to decide, the

if applicable, of the amount of this fine, the Restricted Training analyzes the criteria
posed by Article 83.2 of the GDPR:

   _____________________________________________________________

             Decision of the National Commission sitting in restricted formation on the outcome of
                             the survey n ° [...] conducted with "Company A"


                                                                                                19/26  As to the nature and seriousness of the violation (article 83.2.a) of the GDPR), the
     Restricted Training notes that with regard to the breach of Article 5.1.e)

     of the GDPR, it constitutes a breach of one of the fundamental principles of

     GDPR (and data protection law in general), namely in principle

     of the limitation of data retention devoted to Chapter II "Principles
     Of the GDPR.




  As for the failure to inform people in accordance with

     Article 13 of the GDPR, the Restricted Training recalls that the information and
     transparency relating to the processing of personal data are

     essential obligations incumbent on data controllers so that

     people are fully aware of the use that will be made of their

     personal data, once collected. A breach of
     Article 13 of the GDPR thus constitutes an infringement of the rights of individuals

     concerned. This right to information has also been strengthened under the terms of

     GDPR, which testifies to their particular importance.



  As for the duration criterion (article 83.2.a) of the GDPR), the Restricted Training

     notes that these shortcomings have lasted over time, at least since

     May 25, 2018. The Restricted Formation recalls here that two years have separated the entrance

     of the GDPR when it comes into effect to allow
     data controllers to comply with their obligations and

     this even if a comparable information obligation existed in application of

     Article 26 of the repealed law of August 2, 2002 relating to the protection of persons

     with regard to the processing of personal data.


     Regarding the retention period of data, the Restricted Training

     would like to recall that already in its authorization n ° […], the CNPD had imposed

     as a condition that personal data cannot be
     kept beyond two months, respectively three years for data

     relating to working time.
_____________________________________________________________

           Decision of the National Commission sitting in restricted formation on the outcome of
                          the survey n ° [...] conducted with "Company A"


                                                                                            20/26  As for the number of data subjects (article 83.2.a) of the GDPR), such as the
     controlled specified that each vehicle is allocated to a specific employee, the

     number of persons concerned corresponds to the number of vehicles equipped with a

     geolocation system.


     During the hearing of the Restricted Training of November 17, 2020, the inspected

     confirmed that the "ABC" group has a total of 191 vehicles equipped with

     geolocation system, as the head of the investigation also retained in his

     additional letter to the statement of objections of August 17, 2020.
     Nevertheless, he clarified that the company "Company A" only has 92

     vehicles equipped with a geolocation system.



     As the head of the investigation limited the scope of the investigation to one of the three companies
     of the “ABC” group and more specifically of the “Company A” company, Formation

     Restricted only retains 92 vehicles, unlike 191 vehicles

     mentioned by the head of the survey, corresponding to 92 people who are

     concerned by the processing implemented by the geolocation system.



  As to the question of whether the breaches were deliberately committed

     or not (by negligence) (article 83.2.b) of the GDPR), the Restricted Training recalls

     that "not willfully" means that there was no intention to commit the
     violation, although the controller or processor has not

     complied with its duty of care under the law.



     In this case, the Restricted Training is of the opinion that the facts and the breaches
     observed do not reflect a deliberate intention to violate the GDPR in the chief

     of the controlled.




  As for the degree of cooperation established with the supervisory authority (Article 83.2.f) of
     RGPD), the Restricted Training takes into account the statement of the head of the investigation

     that the cooperation of the controlled throughout the investigation was good, thus

     that of its desire to comply with the law as soon as possible.

_____________________________________________________________

           Decision of the National Commission sitting in restricted formation on the outcome of
                           the survey n ° [...] conducted with "Company A"


                                                                                              21/26  As to the mitigating circumstances applicable to the circumstances in the present case
       (article 83.2.k) of the GDPR), the Restricted Training takes into account the elements

       following:




           o partial information has been provided to the persons concerned,

              in particular by the plastic sheet added to the on-board documents indicating
              that the vehicle "is equipped with a geolocation system", as well as

              the label affixed to the rear door of the vehicle mentioning "

              Monitored by GPS with […] ”;



           o taking measures to comply with Articles 12 and 13 of the

              RGPD, in particular by the development and posting on its site of a note

              information on the geolocation system for the entire

              staff ;



           o reducing the retention periods for data contained in the

              2-year and 4-month to 12-month geolocation system.


      The Restricted Training notes that the other criteria of Article 83.2 of the GDPR

are neither relevant nor likely to influence his decision to impose a

administrative fine and its amount.


      Regarding the breach of the obligation to ensure data security, in

application of Article 32 of the GDPR, the Restricted Training considers that in view of the

measures taken by the company, in particular the efforts made to create logins and
personalized passwords for people who have access to "[…]" and

remove existing logins and ensure that passwords are regularly

updated and not communicated to third parties, it has shown good faith in connection with

of the procedure. Consequently, the Restricted Training considers that with regard to
circumstances of the case, there is no need to base his fine on the basis of this

breach, although it is characterized.


   _____________________________________________________________

             Decision of the National Commission sitting in restricted formation on the outcome of
                            the survey n ° [...] conducted with "Company A"


                                                                                              22/26 The Restricted Training also notes that although several measures have been implemented
placed by the inspected in order to remedy in whole or in part certain shortcomings,

these were only adopted following the control of CNPD agents on

February 20, 2019.


      Therefore, the Restricted Panel considers that the imposition of a fine

administrative procedure is justified with regard to the criteria set out in Article 83.2 of the GDPR for

breach of Articles 5 and 13 of the GDPR.


      Regarding the amount of the administrative fine, the Restricted Training recalls

that paragraph 3 of Article 83 of the GDPR provides that in the event of multiple violations,

as is the case here, the total amount of the fine cannot exceed the amount

set for the most serious violation. Insofar as a breach of Articles 5 and
13 of the GDPR is criticized for the inspectorate, the maximum amount of the fine that may be

retained amounts to 20 million euros or 4% of global annual turnover, the amount

the highest is retained.


      In view of the relevant criteria of Article 83.2 of the GDPR mentioned above, the

Restricted Training considers that the pronouncement of a fine of 2,800 euros appears

both effective, proportionate and dissuasive, in accordance with the requirements of Article 83.1
of the GDPR.





2.2. Regarding the taking of corrective measures


      The adoption of the following corrective measures was proposed by the head of the investigation

to the Restricted Training in its additional letter to the communication of

grievances:


"A) Order the controller to put in place information measures

intended for people affected by geolocation, in accordance with
provisions of Article 13, paragraphs (1) and (2) of the GDPR, in particular by providing

the identity and contact details of the controller, where applicable,

contact details of the data protection officer, the purposes of the processing and its basis
   _____________________________________________________________

             Decision of the National Commission sitting in restricted formation on the outcome of
                             the survey n ° [...] conducted with "Company A"


                                                                                                 Legal, the categories of data processed, the legitimate interests pursued by the
controlled, the recipients, the retention period of the data as well as the

the data subject and how to exercise them, and the right to introduce a

complaint to a supervisory authority;


b) Order the controller to take all security measures in the

framework of the use of the operating software of the geolocation device, in particular

(i) define authorizations to access the geolocation operating software at

only persons for whom it is strictly necessary for the accomplishment of
their missions and (ii) to create individual accounts using a username and a

password for the persons authorized above;



c) Order the data controller to implement a duration policy
retention of personal data in accordance with the provisions of e) of

Article 5 of the GDPR, not exceeding the time necessary for the purposes for which they

are collected, and in particular by not keeping location data for more than
two months and data relating to working time for a maximum of

three years. "



      As for the establishment of a data retention period policy
personal character in accordance with the provisions of article 5.2.e) of the GDPR, the inspector has

adapted after the on-site visit of CNPD agents the retention period of

data from the geolocation system from 2 years and 4 months to 12 months.


      The Restricted Training considers, however, that the retention periods for

data from the geolocation system must be adapted according to the

different purposes pursued.


      As for information intended for people concerned by geolocation,

in accordance with the provisions of article 13.1 and 13.2 of the GDPR, the inspected maintains that they have

developed and posted since October 4, 2019 on its website an information note on the
geolocation system for all staff.




   _____________________________________________________________

              Decision of the National Commission sitting in restricted formation on the outcome of
                              the survey n ° [...] conducted with "Company A"


                                                                                                   24/26 The Restricted Training considers, however, that the information note does not include
not all of the rights enjoyed by data subjects under the

GDPR. Thus, the right of objection (Article 21 of the GDPR) is not mentioned. Otherwise,

Information on the retention period of data must be updated.


      As for the obligation to put in place policies for access to

geolocation under article 32.1 of the GDPR, the Restricted Training considers that

despite the efforts made by the inspectorate, the latter must, by virtue of the principle of

accountability implement mechanisms and
internal procedures to demonstrate compliance with Article 32.1 of the GDPR.




In view of the foregoing developments, the National Commission sitting

in restricted formation and deliberating unanimously decides:



- to pronounce against Company A an administrative fine of one
amount of two thousand and eight hundred euros (2,800 euros), in view of the breaches

constituted in Articles 5.1.e) and 13 of the GDPR;



- to issue an injunction against Company A to bring into compliance
processing with the provisions of Articles 5.1.e), 13 and 32.1 of the GDPR, within a

two months following the notification of the decision of the Restricted Panel, the supporting documents

the compliance must be sent to the Restricted Training, at the latest,

within this period;


and especially :



1.with regard to the breach of the obligation to implement a term policy
retention of personal data in accordance with the provisions of article

5.1.e) of the GDPR: adapt the retention periods for personal data

obtained by geolocation according to the different purposes pursued, and
in particular by not keeping the personal data obtained by the

geolocation beyond two months, the personal data obtained by the

geolocation used for proof purposes for invoicing the services provided
   _____________________________________________________________

              Decision of the National Commission sitting in restricted formation on the outcome of
                              the survey n ° [...] conducted with "Company A"


                                                                                                  25/26 for customers beyond one year and personal data obtained by the
geolocation which makes it possible to check working time beyond three years;



2. with regard to the failure to inform the persons concerned of the

processing of their personal data in accordance with Article 13 of the GDPR: inform
the persons concerned in a clear and complete manner, in accordance with the provisions

of Article 13 of the GDPR, in particular by providing information relating to the duration of

data retention according to the purposes pursued and to all rights

people ;


3.with regard to the failure to take any appropriate security measures in the

framework of the use of the operating software of the geolocation device under

Article 32 of the GDPR, create individual accounts using a username and a word
password only for people for whom access to the

geolocation is strictly necessary for the accomplishment of their missions.


So decided in Belvaux on April 8, 2021.



For the National Commission for Data Protection sitting in formation

restraint






Tine A. Larsen Thierry Lallemang Marc Lemmer
  President Commissioner Commissioner





                            Indication of remedies


This administrative decision may be the subject of an appeal for reformation in the

three months following its notification. This appeal is to be brought before the administrative court.
and must be introduced through a lawyer at the Court of one of the Orders of

lawyers.


   _____________________________________________________________

             Decision of the National Commission sitting in restricted formation on the outcome of
                             the survey n ° [...] conducted with "Company A"


                                                                                                 26/26
</pre>