CNPD (Luxembourg) - Délibération n° 41FR/2021

CNPD (Luxembourg) - Decision 41FR/2021
Authority:	CNPD (Luxembourg)
Jurisdiction:	Luxembourg
Relevant Law:	Article 37(7) GDPR Article 38(1) GDPR Article 38(3) GDPR Article 39(1)(b) GDPR Article 58(2) GDPR Article 83 GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	27.10.2021
Published:	29.11.2021
Fine:	18700 EUR
Parties:	n/a
National Case Number/Name:	Decision 41FR/2021
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	French
Original Source:	Luxembourg DPA (in FR)
Initial Contributor:	Florence D'Ath

Following an audit, the Luxembourg DPA (CNPD) imposed a fine of €18,700 on a company because of four breaches relating to the role and position of its Data Protection Officer (DPO), and issued an injunction against that company to bring its practices into compliance with the GDPR within four months.

English Summary

Facts

In 2018, the Luxembourg DPA (the CNPD) initiated 25 different audit proceedings both in the private and public sector with regard to the role of the Data Protection Officer (DPO) under Section 4 of Chapter 4 of the GDPR (see in particular Article 37 GDPR to Article 39 GDPR).

One of these audit proceedings concerned a Luxembourg private company (hereafter, the controller). During the audit, it was found by the head of investigation of the DPA that :

1. the controller had failed to publish the contact details of its DPO in breach of Article 37(7) GDPR;
2. the controller had failed to ensure that the DPO was involved, properly and in a timely manner, in all issues which relate to the protection of personal data, in breach of Article 38(1) GDPR;
3. the controller had failed to ensure that the DPO could fulfill their mission with a sufficient degree of autonomy, in breach of Article 38(3) GDPR;
4. the controller had failed to ensure that the DPO could properly monitor the compliance of the controller's data processing practices with the GDPR, in breach of Article 39(1)(b) GDPR.

In their audit report, the head of investigation therefore recommended the DPA to impose a fine of €18,700 on the controller, and to issue an injunction against the controller to bring its practices in compliance with the GDPR.

Holding

Following the audit and the report from the head of investigation, the DPA found that the controller had been in breach of four distinct obligations relating to the DPO under the GDPR, as specified below.

Regarding the breach of Article 37(7) GDPR, the DPA noted that it had been found that the public website of the controller did not provide the direct contact details of the DPO. In case of questions or requests from data subjects, the website only provided a general online contact form, a postal address, or a telephone number. Based on these facts, the DPA found that data subjects were not able to directly contact the DPO (but only indirectly, via an other services within the controller). In the course of the proceedings, the controller remedied that breach by adding the contact details of the DPO in its online data protection notice (and in particular, in the section on the rights of data subjects). The DPA nevertheless found that, at the time of the audit, there had been a breach of Article 37(7) GDPR.

Regarding the breach of Article 38(1) GDPR, the DPA considered that the DPO had not been sufficiently involved in all issues relating to data protection law. In particular, the audit report pointed to the fact that the DPO was only being involved in various internal meetings or committees upon invitation or on an ad hoc basis, but there was no defined rule or frequency as to the involvement of the DPO in these committees. In the course of the investigation, the controller implemented new procedures according to which the DPO would become a permanent member of, or would be regularly involved in various committees meetings. Although welcoming these new measures, the DPA nevertheless concluded that the controller had been in breach of Article 38(1) GDPR prior to these changes.

Regarding the breach of Article 38(3) GDPR, the audit report pointed to the existence of several hierarchical intermediaries between the DPO and the highest level of management within the controller. Based on these facts, the DPA found that the DPO could not directly report to the highest management level of the controller, and did not have a sufficient degree of autonomy and independence, as normally required by Article 38(3) GDPR.

Regarding the breach of Article 39(1)(b) GDPR, the audit report pointed to the absence of any monitoring plan or procedures that would formalize and ensure that the DPO is able to duly monitor the compliance of the controller's data processing practices with the GDPR. Although the controller explained that monitoring procedures had been developed and finalised in December 2019, to be implemented in 2020. Because such control plan or monitoring procedures had not been put in place at the time the investigation was initiated, the DPA concluded that the controller had breached Article 39(1)(b) GDPR.

For all these reasons, the DPA issued an injunction against the controller to bring its practices in compliance with the GDPR for the remaining breaches (with a deadline of 4 months as from the date of the decision), and also imposed an administrative fine of €18,700 EUR on the controller.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

 Decision of the National Commission sitting in restricted formation on

            the outcome of survey No. [...] conducted with Company A

                         Deliberation n ° 41FR / 2021 of October 27, 2021



The National Commission for Data Protection sitting in a restricted body,

composed of Mrs Tine A. Larsen, president, and Messrs Thierry Lallemang and Marc

Lemmer, commissioners;



Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on
the protection of individuals with regard to the processing of personal data

personnel and the free movement of such data, and repealing Directive 95/46 / EC;



Having regard to the law of 1 August 2018 on the organization of the National Commission for the Protection

data and the general data protection regime, in particular Article 41 thereof;


Having regard to the internal regulations of the National Commission for Data Protection

adopted by decision n ° 3AD / 2020 dated 22 January 2020, in particular Article 10, point

2;



Having regard to the regulation of the National Commission for Data Protection relating to

investigation procedure adopted by decision n ° 4AD / 2020 dated 22 January 2020, in particular
its article 9;



Considering the following:



    I. Facts and procedure


1. Given the impact of the role of the data protection officer (hereinafter: the "DPO") and
the importance of its integration into the body, and considering that the guidelines

concerning DPOs have been available since December 2016, i.e. 17 months before entry into

application of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016

on the protection of natural persons with regard to the processing of personal data

personal data and the free movement of such data, and repealing Directive 95/46 / EC


1The guidelines concerning DPOs were adopted by the “Article 29” working group on 13
December 2016. The revised version (WP 243 rev. 01) was adopted on April 5, 2017.
________________________________________________________________________

              Decision of the National Commission sitting in restricted formation on the outcome of
                                survey no. [...] conducted with Company A
                                                                                                       1/21 (General Data Protection Regulation) (hereafter: the "GDPR"), the Commission

National Data Protection Authority (hereinafter: the “National Commission” or the

"CNPD") has decided to launch a thematic survey campaign on the function of the DPO.
Thus, 25 audit procedures were opened in 2018, concerning both the private sector and the

public sector.


2. In particular, the National Commission decided by decision no. […] Of 14

September 2018 to initiate an investigation in the form of a data protection audit
with Company A located at […], […] and registered in the Trade and

Luxembourg companies under number […] (hereinafter: the “controlled”) and to designate Mr. Christophe

Buschmann as the head of the investigation. The said deliberation specifies that the investigation relates to the

compliance of the inspected with section 4 of chapter 4 of the GDPR.


3. […] the purpose of the control is all activities relating to banks or establishments

credit […].


4. By letter of September 17, 2018, the head of the survey sent a questionnaire

preliminary to the control to which the latter replied by letter of September 28, 2018.

on-site visit took place on January 29, 2019. Following these discussions, the head of the investigation established
the audit report no. […] (hereinafter: the "audit report").



5. It emerges from the audit report that in order to verify the compliance of the organization with the

section 4 of chapter 4 of the GDPR, the head of the investigation defined eleven control objectives,
know :


    1) Ensure that the body subject to the obligation to appoint a DPO has done so;

    2) Make sure that the organization has published the contact details of its DPO;

    3) Ensure that the organization has communicated the contact details of its DPO to the CNPD;

    4) Ensure that the DPO has sufficient expertise and skills to
        carry out its missions effectively;

    5) Ensure that the missions and tasks of the DPO do not give rise to a conflict of interest;

    6) Ensure that the DPO has sufficient resources to perform effectively
        of its missions;

    7) Ensure that the DPO is able to carry out his missions to a sufficient degree

        autonomy within their organization;


________________________________________________________________________


              Decision of the National Commission sitting in restricted formation on the outcome of
                               survey no. [...] conducted with Company A 2/21 8) Ensure that the organization has put in place measures so that the DPO is associated with

        all matters relating to data protection;

    9) Ensure that the DPO fulfills his mission of information and advice to the

        data controller and employees;
    10) Ensure that the DPO exercises adequate control over data processing within

        of his body;

    11) Ensure that the DPO assists the data controller in carrying out the

        impact analyzes in the event of new data processing.


6. By letter of 21 October 2019 (hereinafter: the “statement of objections”), the Chief

investigation informed the inspector of breaches of obligations under the GDPR that it

noted during its investigation. The audit report was attached to this letter.



7. In particular, the head of the investigation noted in the statement of objections

failures to
                                                          2
      the obligation to publish the contact details of the DPO;

      the obligation to involve the DPO in all matters relating to the protection of
                  3
         data;
      the obligation to guarantee the autonomy of the DPO; 4

      the DPD's control mission. 5



8. By letter of November 15, 2019, the inspector sent the head of the investigation

position on the shortcomings identified in the statement of objections.



9. On August 3, 2020, the head of the investigation sent the inspector an additional letter to

the statement of objections by which he informs the inspectorate of the corrective measures he

proposes to the National Commission sitting in a restricted formation (hereinafter: the "formation

restricted ") to adopt. In this letter, the head of the investigation proposed to the restricted group
to adopt 4 different corrective measures as well as to impose a fine on the controlled person

administrative costs in the amount of 18,700 euros.







2Objective 2
3Objective 8
4Objective n ° 7
5Objective n ° 10

________________________________________________________________________

              Decision of the National Commission sitting in restricted formation on the outcome of
                                survey no. [...] conducted with Company A
                                                                                                        3/2110. By letter of September 8, 2020, the inspector sent the head of the investigation his

observations on the additional letter to the statement of objections.


11. The case was on the agenda for the restricted committee session on May 31, 2021.

In accordance with article 10.2. b) the rules of procedure of the National Commission,

the head of investigation and the controlled made oral observations on the case and replied

to the questions asked by the restricted formation. The controlled had the floor last.


    II. Place

    A. On the failure to publish the contact details of the DPO


        1. On the principles



12. Article 37.7 of the GDPR provides for the obligation for the audited body to publish the

contact details of the DPD. Indeed, it follows from Article 38.4 of the GDPR that people

concerned must be able to contact the DPO about all the

questions relating to the processing of their personal data and the exercise of

rights conferred on them by the GDPR.


13. The DPO guidelines explain in this regard that this requirement

aims to ensure that "the persons concerned (both inside and outside

the organization) can easily and directly contact the DPO without having to
contact another department of the organization ". The guidelines also state that

"The contact details of the DPO must contain information enabling people to

concerned to reach it easily (a postal address, a telephone number
                                                                      6
specific and / or specific e-mail address) ”.


14. In addition, Article 12.1 of the GDPR provides that the controller must take

appropriate measures to provide any information referred to in Articles 13 and 14 of the GDPR

with regard to the processing to the data subject in a concise, transparent manner,

understandable and easily accessible, in clear and simple terms. From
information that must be transmitted to the person concerned is the relative information

contact details of the DPD, in accordance with Articles 13.1.b) and 14.1.b) of the GDPR.




6WP 243 v.01, version revised and adopted on April 5, 2017, p.15
________________________________________________________________________

              Decision of the National Commission sitting in restricted formation on the outcome of

                               the survey no. […] carried out with Company A 4/21 2. In the present case


15. It emerges from the audit report that, in order for the head of the investigation to consider objective 2

as completed by the inspected as part of this audit campaign, he expects
the organization publishes the contact details of its DPO internally within the organization and in

external to the public. The DPO must be able to be contacted easily and directly via a

communication channel adapted to the people concerned. As part of this campaign

audit, active internal communication is expected, particularly via emails,
newsletters, dedicated spaces on the intranet. Externally, it is at least expected that

DPD contact details are easily accessible on the organization's website.



16. According to the statement of objections, page 2: "The investigation showed that the website
public of Company A does not provide the direct contact details of the DPO. In case of questions

or requests from the persons concerned, the website provides a form to

complete and return to a generic email address ([…]) or by post to the address of the

hotline […] or via the secure messaging of […]. "


17. The head of the investigation concludes that "the data subjects external to Company A

cannot contact the DPO directly without having to contact another
agency service. "



18. In its position paper of November 15, 2019, the inspected does not call into question the

findings made by the head of the investigation and indicates that following the breach noted,
a dedicated e-mail address has been created "so that

data subjects can contact the Data Protection Officer directly

("DPD"). »The inspector then specified where the DPD's contact details were published, namely

on its website as well as in its data processing policy
personal.



19. During the meeting of May 31, 2021, the restricted committee noted that the contact details

of the DPD were not mentioned in the section of the controlled website relating to
the exercise of the rights of the persons concerned or in the form below this

section and asked the auditee for further information in this regard. By email from 4

June 2021, the inspected informed the restricted committee of the mention of the DPD's contact details

in this section as well as in the said form.

________________________________________________________________________


             Decision of the National Commission sitting in restricted formation on the outcome of
                              survey no. […] conducted with Company A 5/2120. If measures have been taken by the inspector to comply with the obligation to

publication of the contact details of his DPO, it should be noted that these were decided

only under investigation. The restricted training recognizes that at the start of the investigation, the

controlled had not published the contact details of his DPO.


21. In view of the above, the restricted panel concludes that Article 37.7 of the GDPR has no

not respected by the inspected.


    B. On the breach of the obligation to involve the DPO in all matters relating to
        the protection of personal data



    1. On the principles


22. According to article 38.1 of the GDPR, the organization must ensure that the DPO is involved,

in an appropriate and timely manner, in all matters relating to the protection of

personal data.



23. The DPO guidelines state that “[i] t is essential that the DPO,
or his team, is involved from the earliest possible stage in all questions

relating to data protection. [...] Information and consultation of the DPO from the start

will facilitate compliance with the GDPR and encourage an approach based on

data protection by design; it should therefore be the usual procedure in
within the governance of the organization. In addition, it is important that the DPO is considered as

an interlocutor within the organization and that he or she is a member of the dedicated working groups

to data processing activities within the organization ". 7



24. The DPO guidelines provide examples on how to
to ensure this association of the DPO, such as:

       invite the DPO to participate regularly in management meetings

            upper and intermediate;

       to recommend the presence of the DPO when decisions having implications

            in terms of data protection are taken;

       always take due account of the opinion of the DPO;




7 WP 243 v.01, version revised and adopted on April 5, 2017, p. 16
________________________________________________________________________

              Decision of the National Commission sitting in restricted formation on the outcome of

                               investigation no. [...] conducted with Company A 6/21  to immediately consult the DPO in the event of a data breach or other

            incident occurs.


25. According to the guidelines for DPOs, the body could, where appropriate,

develop data protection guidelines or programs

indicating the cases in which the DPO must be consulted.


    2. In this case



26. It emerges from the audit report that, in order for the investigator to consider objective 8

as completed by the inspected as part of this audit campaign, it expects the
DPD participates in a formalized manner and on the basis of a defined frequency in the

Management, project coordination committees, new product committees,

security committees or any other committee deemed useful in the context of data protection.


27. According to the statement of objections, page 3, “[t] he investigation shows that the DPO

intervenes on invitation or on an ad hoc basis at various internal meetings or committees

which discuss issues or projects with impacts in terms of
data protection, but there is no defined rule or frequency as to the

participation of the DPO in these committees. "The head of the investigation then notes that" [t] he fact that the

DPD participated in two Internal Control Committees (January 2019 and August 2018),

Management Board of November 2017, that he be a permanent guest of the Safety Committee and
that he is involved if a Data Protection aspect concerns a new product is not sufficient to

demonstrate the formal, permanent and regular nature of the DPO's involvement. "



28. In his position paper of 15 November 2019, the inspected indicates that the DPO is
intervened on an ad hoc basis in September 2019 to the “Internal Control Committee” and to the

" Executive Committee ". He then indicates that a "quarterly intervention to the Control Committee

Internal will be implemented and formalized ”in its“ Data protection policy

personal ”.


29. The restricted formation notes that it is rightly specified on page 2 of the

statement of objections (under "preliminary remarks") that "[t] he requirements of the GDPR
are not always strictly defined. In such a situation, it is up to the authorities to

control to verify the proportionality of the measures put in place by those responsible for

________________________________________________________________________


              Decision of the National Commission sitting in restricted formation on the outcome of
                              survey no. [...] conducted with Company A 7/21 processing with regard to the sensitivity of the data processed and the risks incurred by the

persons concerned. "


30. However, the restricted committee notes that it is also specified on page 2 of the

statement of objections that the audited has approximately […] employees and […] customers. Leader

investigation concludes that the inspected process a significant amount of personal data. The

restricted formation shares this assessment and therefore considers that the participation
formalized and systematic of the DPO at the relevant meetings, as expected by the

investigation lead, constitutes a proportionate measure in order to ensure the association of the DPO with

all questions relating to the protection of personal data.


31. The restricted committee takes note of the fact that in its response of September 8, 2020

to the letter supplementing the statement of objections, the inspector provided "elements

additional information (...) in order to respond to the corrective measures proposed by
the head of investigation ", concerning in particular the involvement of the DPO in all questions

relating to data protection. The inspected provided a list of 6 committees (concerning

the areas of IT, risk management and subcontracting) of which the DPD is a member

permanent as well as indications on the interventions / participations of the DPD in other
committees and meetings (namely the “[…]” Committee, the “[…]” meetings and the Control Committee

internal "in order to present the quarterly activity report or any other subject that it deems

necessary ").


32. While these measures should facilitate the involvement of the DPO in all matters relating to

data protection, it should nevertheless be noted that these have been decided

under investigation. The restricted committee therefore considers that, at the start of the investigation, the

controller has not been able to demonstrate that the DPO was associated with
in an appropriate manner to all matters relating to the protection of personal data.



33. In view of the above, the restricted panel concludes that Article 38.1 of the GDPR has no
not respected by the inspected.



    C. On the breach of the obligation to guarantee the autonomy of the DPO


    1. On the principles



________________________________________________________________________


              Decision of the National Commission sitting in restricted formation on the outcome of
                               survey no. […] carried out with Company A 8/2134. According to Article 38.3 of the GDPR, the body must ensure that the DPO "does not

receive no instructions with regard to the exercise of the missions ”. In addition, the DPD

"Reports directly to the highest level of management" of the organization.


35. Recital (97) of the GDPR further states that DPOs “should be able to

to exercise their functions and missions in complete independence ”.


                                                            8
36. According to the guidelines on DPOs, Article 38.3 of the GDPR "provides for

certain basic guarantees intended to ensure that DPOs are able to exercise
their missions with a sufficient degree of autonomy within their organization. […] That

means that, in carrying out their duties under Article 39, DPOs must not

receive instructions on how to handle a case, for example, what the outcome should be

obtained, how to investigate a complaint or whether to consult the supervisory authority.
In addition, they cannot be required to take a certain point of view on any issue related to

data protection legislation, for example, a particular interpretation

law. […] If the controller or processor takes decisions that are

incompatible with the GDPR and the opinion of the DPO, the latter should be able to indicate

clearly his opinion diverges at the highest level of management and at decision-makers. In this
In this regard, Article 38 (3) provides that the DPO "shall report directly to the level

higher of the management of the controller or the processor ”. Such surrender

direct account ensures that senior management (e.g. board of directors) has

knowledge of the opinions and recommendations of the DPO which fall within the framework of

task of the latter consisting in informing and advising the controller or the
subcontracting. The preparation of an annual report on the activities of the DPO for the level

higher management is another example of direct accountability. "



    2. In this case


37. It emerges from the audit report that, in order for the investigator to consider objective 7

as completed by the inspected as part of this audit campaign, it expects the

DPD is "attached to the highest level of management in order to guarantee as much as possible

autonomy ”.





8WP 243 v.01, version revised and adopted on April 5, 2017, p. 17 and 18
________________________________________________________________________

              Decision of the National Commission sitting in restricted formation on the outcome of

                                survey no. […] carried out with Company A 9/2138. According to the Statement of Objections, page 4, "During the investigation, the officers of the

CNPD noted the existence of several hierarchical intermediaries between the DPO and the

Direction. In fact, the DPO is attached to a person from the “[…]” department who is

even attached to a person from the “[…]” department who is himself attached to the Chief
Compliance Officer. Although the DPO can intervene on an ad hoc basis in the Executive Committee

and to the Internal Control Committee at its request and at any time, the reporting line

management and therefore access to the latter are not direct and permanent. "


39. In his letter of September 8, 2020, the inspected indicated that in order to guarantee
the autonomy of the DPD: "i. the DPD function was hierarchically attached to the Chief

Group Compliance Officer (CCO) As of January 15, 2020. ii. CCO is invited

of the Executive Committee of Company A since October 1, 2018 (no intermediary

hierarchical between the DPO and the highest level of Management) and reports directly to the
Chief Executive Officer, as well as to the Chairman of the Board of Directors. iii. A report

quarterly activity on data protection is presented by the DPO to […] composed

part of the Executive Committee). The inspected also indicates that meetings

weekly are organized between the DPD and the CCO.


40. If it does not follow from the provisions of the GDPR that the DPO must necessarily be
attached to the highest level of management in order to guarantee its autonomy, training

restricted however recalls that it noted in point 29 of this decision that it is

rightly specified on page 2 of the statement of objections (under "preliminary remarks

") That" [t] he requirements of the GDPR are not always strictly defined. In such
situation, it is up to the supervisory authorities to verify the proportionality of the measures

in place by data controllers with regard to the sensitivity of the data processed

and the risks incurred by the persons concerned. "


41. However, as mentioned in point 30 of this decision, the formation

restricted shares the assessment of the head of the investigation, mentioned on page 2 of the
statement of objections, according to which the inspected processes a significant amount of data

personal. The restricted committee therefore considers that, in the absence of other measures

which would make it possible to demonstrate that direct accountability to the highest level

management is formalized, the hierarchical reporting of the DPO to the highest level of
direction, as expected by the head of the investigation, is a proportionate measure to

guarantee its autonomy.



________________________________________________________________________


              Decision of the National Commission sitting in restricted formation on the outcome of
                               survey no. […] carried out with Company A 10/2142. In this regard, the restricted committee notes that at the time of the opening of the investigation,

the DPO was not attached to the highest level of management and it has not been demonstrated

by the controlled as direct reporting to the highest level of management

was formalized.


43. In view of the above, the restricted panel concludes that Article 38.3 of the GDPR has no
not respected by the inspected.


    D. On the breach relating to the DPO's control mission


    1. On the principles


44. According to section 39.1. b) of the GDPR, the DPO has, among other things, the task of "controlling the

compliance with this Regulation, other provisions of Union or State law

members in terms of data protection and internal rules of the controller
processing or subcontractor with regard to the protection of personal data, including

including with regard to the division of responsibilities, awareness raising and training

personnel participating in processing operations, and the related audits ”. the

recital (97) specifies that the DPO should help the body to verify compliance, at the level

internal, of the GDPR.

45. It follows from the guidelines on DPOs that the DPO can, within the framework

of these control tasks, in particular:


     collect information to identify processing activities;

     analyze and verify the compliance of processing activities;

     inform and advise the controller or the processor and formulate

        recommendations to him.


    2. In this case


46. It emerges from the audit report that, in order for it to be able to consider objective 10 as fulfilled

by the control as part of this audit campaign, the head of the investigation expects that

"The organization has a formalized data protection control plan

(even if it is not yet executed) ”.




9WP 243 v.01, version revised and adopted on April 5, 2017, p. 20
________________________________________________________________________

              Decision of the National Commission sitting in restricted formation on the outcome of

                               survey no. […] carried out with Company A 11/2147. According to the statement of objections, p. 5, “[i] t emerges from the investigation that the organization does not
has no control plan. Although the organization informed the CNPD that controls

relating to data protection are under construction, that they will be integrated into

the Compliance Monitoring program and that recourse to external assistance is envisaged

to build this monitoring program, the organization did not carry out the

control at the time of the survey. "


48. In his letter of September 8, 2020, the inspected indicated that he “asked for help from
consultants for the development of a control plan […] ”and that“ [this] [plan] was finalized in

[d] December 2019 and is applicable in 2020 ”. The inspected further indicates that in "April 2019

Internal Audit [of the controlled] (3rd line of defense) carried out a mission on the implementation

of Regulation (EU) 2016/679 which gave rise to recommendations. »The precise control

also that "controls have been carried out or are in the process of being carried out by the DPO",

in particular the review of the processing register and the review of the contractual clauses relating to
data protection. The inspected finally indicates that “in accordance with article 25 of

regulation, the principles of "data protection by design and protection of

default data ”have been set up as a priori control for the implementation of

new processing of personal data. "


49. The restricted committee notes that article 39.1 of the GDPR lists the missions that

the DPO must at least be entrusted with the task of monitoring compliance with the GDPR, without

however, require the body to put in place specific measures to ensure that the

DPD can accomplish its control mission. Guidelines for DPOs
indicate in particular that the keeping of the register of processing activities referred to in Article 30 of the

GDPR can be entrusted to the DPD and that "[this] register should be considered as one of the

tools enabling the DPO to carry out his duties of monitoring compliance with the GDPR as well as
                                                                                10
information and advice from the controller or processor. "


50. It emerges from the respondent's responses to the preliminary questionnaire that, from the start of

the investigation, the DPD's task was to "coordinate the documentation of the treatments in the
register ”. The restricted committee nevertheless notes that this element taken in isolation is not sufficient

not to demonstrate that the task of monitoring compliance with the GDPR could have been carried out

adequately.





10WP 243 v.01, version revised and adopted on April 5, 2017, p. 22
11Response of the inspected on 09/28/2018 to the preliminary questionnaire (question 5.d).
________________________________________________________________________

              Decision of the National Commission sitting in restricted formation on the outcome of
                                survey no. [...] conducted with Company A
                                                                                                      12/2151. The restricted committee recalls that it noted in point 29 of this decision

that it is rightly specified on page 2 of the statement of objections (under "remarks

preliminary ”) that“ [t] he requirements of the GDPR are not always strictly defined.

In such a situation, it is up to the supervisory authorities to verify the proportionality of the
measures put in place by data controllers with regard to the sensitivity of

data processed and the risks incurred by the data subjects. "


52. However, as mentioned in point 30 of this decision, the formation

restricted shares the assessment of the head of the investigation, mentioned on page 2 of the
statement of objections, according to which the inspected processes a significant amount of data

personal.


53. The restricted committee therefore considers that the control mission carried out

by the DPO to the inspected should be sufficiently formalized, for example by a plan

data protection control, in order to be able to demonstrate that the DPO
can perform its task of monitoring compliance with the GDPR in an adequate manner.


54. The restricted committee takes note of the elements communicated by the inspected in

his letter of September 8, 2020 concerning the development of a control plan finalized in

December 2019 and its application in 2020.


55. Nevertheless, the restricted committee notes that this control plan was established after
the start of the investigation and therefore considers that at the start of the investigation, the control was not

able to demonstrate that the DPO carries out his duties of monitoring compliance with the GDPR

in a manner suited to their needs.


56. In view of the foregoing, the Select Committee concludes that Article 39.1. b) of the GDPR
was not respected by the controlled.


    III. On corrective measures and the fine



           A. Principles


57. In accordance with article 12 of the law of 1 August 2018 on the organization of

National Commission for Data Protection and General Protection Regime

data, the National Commission has the powers provided for in Article 58.2 of the GDPR:



________________________________________________________________________


              Decision of the National Commission sitting in restricted formation on the outcome of
                               investigation no. [...] carried out with Company A 13/21 a) notify a data controller or a subcontractor of the fact that the

       planned treatment are likely to violate the provisions of this

       regulation;

    b) call to order a controller or a processor when the

       processing operations have resulted in a violation of the provisions of this

       regulation;


    c) order the controller or processor to comply with the requests
       presented by the data subject in order to exercise their rights under the

       this regulation;


    d) order the controller or processor to put the data processing operations

       processing in accordance with the provisions of these regulations, if applicable,

       in a specific manner and within a specified timeframe;

    e) order the controller to communicate to the data subject a

       personal data breach;


    f) impose a temporary or permanent limitation, including a ban, on the

       processing;

    g) order the rectification or erasure of personal data or the

       restriction of processing in application of Articles 16, 17 and 18 and the notification of these

       measures to the recipients to whom the personal data have been

       disclosed in accordance with Article 17, paragraph 2, and Article 19;


    h) withdraw a certification or order the certification body to withdraw a
       certification issued in application of Articles 42 and 43, or order the

       certification not to issue certification if the requirements applicable to the

       certification are not or no longer satisfied;


    i) impose an administrative fine in application of Article 83, in addition to or
       the place of the measures referred to in this paragraph, depending on the characteristics

       specific to each case;


    j) order the suspension of data flows addressed to a recipient located in a

       third country or to an international organization. "

________________________________________________________________________


              Decision of the National Commission sitting in restricted formation on the outcome of
                               survey no. […] conducted with Company A 14/2158. Article 83 of the GDPR provides that each supervisory authority ensures that

administrative fines imposed are, in each case, effective, proportionate and

dissuasive, before specifying the elements that must be taken into account in deciding whether there
to impose an administrative fine and to decide on the amount of this fine:


    (a) the nature, gravity and duration of the breach, taking into account the nature, extent or

    the purpose of the processing concerned, as well as the number of data subjects

    affected and the level of damage they suffered;

    (b) whether the violation was committed willfully or negligently;


    c) any measures taken by the controller or processor to mitigate the

    damage suffered by the persons concerned;


    d) the degree of responsibility of the controller or processor, account

    taking into account the technical and organizational measures they have implemented in accordance with the
    Articles 25 and 32;


    e) any relevant breach previously committed by the controller or

    the subcontractor ;


    f) the degree of cooperation established with the supervisory authority in order to remedy the violation
    and mitigate any negative effects;


    g) the categories of personal data affected by the breach;


    h) the manner in which the supervisory authority became aware of the breach, in particular whether,

    and to what extent the controller or processor has notified the

    violation;

    (i) where measures referred to in Article 58 (2) have previously been

    ordered against the controller or the processor concerned for the

    same object, compliance with these measures;


    j) the application of codes of conduct approved in accordance with Article 40 or
    certification mechanisms approved under Article 42; and






________________________________________________________________________


              Decision of the National Commission sitting in restricted formation on the outcome of
                               investigation no. [...] carried out with Company A 15/21 k) any other aggravating or mitigating circumstance applicable to the circumstances of

    the species, such as financial benefits obtained or losses avoided, directly or

    indirectly, as a result of the violation ”.

59. The restricted panel would like to point out that the facts taken into account in the context of the

this decision are those noted at the start of the investigation. Any modifications

relating to the subject of the investigation carried out subsequently, even if they make it possible to establish

fully or partially compliance, do not allow retroactive cancellation of a
breach noted.


60. Nevertheless, the steps taken by the inspected to bring themselves into compliance

with the GDPR during the investigation procedure or to remedy breaches

noted by the head of investigation in the statement of objections are taken into account by the
limited training in the context of any corrective measures to be taken.


           B. In this case



    1. As to the imposition of an administrative fine


61. In his additional letter to the statement of objections of 3 August 2020, the

investigator proposes to the restricted formation to pronounce against the controlled a

administrative fine relating to the amount of 18,700 euros.


62. In order to decide whether to impose an administrative fine and to decide, if
of the amount of this fine, the restricted committee analyzes the criteria set by

Article 83.2 of the GDPR:


- As to the nature and seriousness of the violation [article 83.2 a) of the GDPR], with regard to

breaches of articles 37.7, 38.1, 38.3, and 39.1.b) of the GDPR, restricted training
notes that the appointment of a DPO by an organization cannot be efficient and effective,

know how to facilitate compliance with the GDPR by the organization, only in the case where people

concerned have the possibility of easily finding the contact details of the DPO in order to be able to
contact the DPO on all questions relating to the processing of their

personal data and the exercise of their rights, where the DPO is involved from the

as early as possible in all data protection matters,

be able to exercise their functions and missions in complete independence, and be able to exercise
effective its missions, in particular the task of monitoring compliance with the GDPR.

________________________________________________________________________


              Decision of the National Commission sitting in restricted formation on the outcome of
                               the survey no. [...] carried out with Company A 16 / 21- As for the duration criterion [article 83.2.a) of the GDPR], the restricted training falls under:


       (1) That the controlled indicated in its position paper of November 15, 2019 that a

       dedicated e-mail address has been created "so that data subjects can
       contact the Data Protection Officer directly ”and that the contact details

       of the DPD have been published on its website as well as in its policy on

       processing of personal data. The breach of Article 37.7 of the GDPR therefore

       lasted over time, at least between May 25, 2018 and November 2019.

       (2) That it was decided by the inspectorate to take appropriate measures to facilitate

       the involvement of the DPO in all matters relating to data protection,

       which are described in his letter of September 8, 2020. The failure to

       Article 38.1 of the GDPR therefore lasted over time, at least between May 25, 2018
       and September 2020;


       (3) That the elements communicated by the inspected during the investigation, and in particular

       by email of June 4, 2021 following the meeting of May 31, 2021, do not allow

       demonstrate that the DPO would be able to report directly to the highest
       management level in a formalized manner. Breach of Article 38.3 of the GDPR

       therefore lasted over time, from 25 May 2018, it being specified that the training

       Restricted could not find that the breach has ended;


       (4) That a control plan was finalized in December 2019 and applied in 2020. The

       breach of Article 39.1.b) of the GDPR therefore lasted over time, at the very least
       between May 25, 2018 and December 2019.


63. The restricted committee notes that the other criteria of Article 83.2 of the GDPR do not

are neither relevant nor likely to influence his decision on whether to impose a fine

administrative and its amount.

64. The restricted committee notes that if several measures have been decided by the inspected

in order to remedy the shortcomings, they were not decided until after the launch of

the investigation by CNPD agents on September 17, 2018 (see also point 59 of

this decision).

65. Therefore, the restricted panel considers that the imposition of a fine

administrative procedure is justified with regard to the criteria set out in Article 83.2 of the GDPR for

breach of Articles 37.7, 38.1, 38.3 and 39.1.b) of the GDPR.
________________________________________________________________________


              Decision of the National Commission sitting in restricted formation on the outcome of
                               survey no. […] carried out with Company A 17/2166. Regarding the amount of the administrative fine, the restricted panel recalls that

Article 83.3 of the GDPR provides that in the event of multiple violations, as is the case in

the case, the total amount of the fine may not exceed the amount set for the most serious violation
serious. Insofar as a breach of Articles 37.7, 38.1, 38.3, and 39.1.b) of the GDPR

is accused of the inspected, the maximum amount of the fine that can be withheld is 10

million euros or 2% of annual worldwide turnover, whichever is greater

retained.

67. In view of the relevant criteria of Article 83.2 of the GDPR mentioned above, the

restricted committee considers that the pronouncement of a fine of 18,700 euros appears in the

both effective, proportionate and dissuasive, in accordance with the requirements of Article 83.1 of the GDPR.



    2. Regarding the taking of corrective measures



68. In his additional letter to the statement of objections of 3 August 2020, the

survey leader suggests that the restricted group take corrective measures
following:


        "A) Order the publication of the contact details of the data protection officer

        in accordance with the requirements of article 37 paragraph 7 of the GDPR and the lines

        DPD guidelines of the Article 29 working group on the protection of
        data which indicates that data subjects should be able to easily and

        contact the DPO directly without having to contact another

        the body. Thus, one of the ways to achieve this result would be to publish the

        contact details of the DPO on the public website of [Company A] insofar as this does not
        would not already be.



        b) Order the implementation of measures ensuring an association of the DPO to all

        data protection issues, in accordance with the requirements of
        Article 38 paragraph 1 of the GDPR. Although several ways can be

        envisaged to achieve this result, one of the possibilities could be to analyze,

        with the DPO, all relevant committees / working groups with regard to protection
        data and formalize the modalities of its intervention (previous information

        with the agenda of meetings, invitation, frequency, permanent member status,

        etc ....).

________________________________________________________________________


              Decision of the National Commission sitting in restricted formation on the outcome of
                               survey no. [...] conducted with Company A 18/21 c) Order the establishment of a mechanism guaranteeing the DPO's autonomy

       in accordance with the requirements of Art.38 para.3 GDPR. Several

       measures can be considered to achieve this result, such as
       attachment of the DPO to the highest level of management in order to guarantee as much as possible

       its autonomy or the creation of a formal and regular direct reporting line,

       as well as an emergency escalation mechanism to the management to bypass

       the intermediate hierarchical level (s).


       d) Order the deployment of the control mission, in accordance with article 39

       paragraph 1 b) of the GDPR. The DPO should therefore document his controls relating to
       the application of internal data protection rules and procedures

       (second line of defense). This documentation could take the form of a plan

       control insofar as this has not already been done. "


69. As for the corrective measures proposed by the head of the investigation and by reference to the

point 60 of this decision, the restricted committee takes into account the procedures
carried out by the inspected in order to comply with the provisions of articles 37.7, 38.1, 38.3,

and 39.1.b) of the GDPR, in particular the measures described in his letter of November 15, 2019

and in its letter of September 8, 2020. More particularly, it takes note of the facts
following:


    - With regard to the violation of article 37.7 of the GDPR, the restricted committee notes

    that a dedicated e-mail address has been created and that the DPO's contact details have been published

    on the website of the inspected as well as in its policy on handling

    personal data. The restricted formation therefore considers that there is no need to
    pronounce the corrective measure proposed by the head of investigation under a) of point 68 of the

    this decision.


    - With regard to the violation of article 38.1 of the GDPR, the restricted committee notes

    that it was decided by the inspectorate to take appropriate measures to facilitate
    involving the DPO in all matters relating to data protection. The

    restricted party therefore considers that there is no need to pronounce the measure

    corrective measure proposed by the head of investigation under b) of point 68 of this decision.


    - With regard to the violation of article 38.3 of the GDPR, the restricted committee notes
    that the elements communicated by the inspected during the investigation, and in particular by

    email of June 4, 2021 following the meeting of May 31, 2021, do not allow to demonstrate
________________________________________________________________________


              Decision of the National Commission sitting in restricted formation on the outcome of
                               the survey no. [...] conducted with Company A 19/21 that the DPD would be able to report directly to the highest level of the

    direction in a formalized manner. The restricted formation therefore considers that it is necessary to

    pronounce the corrective measure proposed by the head of investigation under c) of point 68 of the

    this decision.

    - With regard to the violation of Article 39.1.b) of the GDPR, the restricted committee falls under

    that a control plan was finalized in December 2019 and applied in 2020. The training

    therefore considers that there is no need to take the corrective measure

    proposed by the head of investigation under d) of point 68 of this decision.



In view of the foregoing developments, the National Commission sitting

in restricted formation and deliberating unanimously decides:



- to retain the breaches of articles 37.7, 38.1, 38.3 and 39.1.b) of the GDPR;


- to pronounce against Company A an administrative fine in the amount of ten-

eight thousand seven hundred euros (18,700 euros) with regard to the violation of articles 37.7, 38.1, 38.3

and 39.1.b) of the GDPR;


- to issue an injunction against Company A to comply with

Article 38.3 of the GDPR within four months of the notification of the decision of the

limited training, in particular:


ensure the establishment and maintenance of a formal mechanism guaranteeing autonomy

of the DPD.


















________________________________________________________________________


              Decision of the National Commission sitting in restricted formation on the outcome of
                               survey no. [...] conducted with Company A 20/21 As decided in Belvaux on October 27, 2021.



The National Commission for Data Protection sitting in a restricted body






Tine A. Larsen Thierry Lallemang Marc Lemmer
  President Commissioner Commissioner



                             Indication of remedies



This administrative decision may be the subject of an appeal for reformation within three

months following its notification. This appeal is to be brought before the administrative tribunal and must
must be introduced through a lawyer at the Court of one of the Bar Associations.




































________________________________________________________________________


             Decision of the National Commission sitting in restricted formation on the outcome of
                              survey no. [...] conducted with Company A 21/21