CNPD (Luxembourg)

Commission Nationale pour la Protection des Données
Name:	Commission Nationale pour la Protection des Données
Abbreviation :	CNPD
Jurisdiction:	Luxembourg
Head:	Tine A. Larsen
Deputy:	n/a
Adress:	15, Boulevard du Jazz L-4370 Belvaux Luxembourg
Webpage:	www.cnpd.lu
Email:	info@cnpd.lu
Phone:	+352 2610 60 1
Twitter:	n/a
Procedural Law:	n/a
Decision Database:	n/a
Translated Decisions:	Category:CNPD (Luxembourg)
Head Count:	n/a
Budget:	n/a

The Commission Nationale pour la Protection des Données (CNPD) is the national Data Protection Authority for Luxembourg, headquartered in Belvaux, municipality of Salem. The CNPD oversees the GDPR in Luxembourg and advises the national parliament, the government and other institutions and bodies on legislative and administrative measures relating to the protection of the rights and freedoms of natural persons with regard to processing of their personal data.

Structure

The CNPD is an independent public institution, financially and administratively autonomous. Although the CNPD operates in the form of a public establishment under the supervision of the Minister whose responsibilities include data protection (currently the Minister for Communications and Media, Mr. Xavier Bettel), it is nevertheless independent in the exercise of its functions.

The CNPD adopted its rules of procedure, including its internal procedures and working methods on 22 January 2020. The rules of procedure was adopted unanimously by the members of the college in plenary session. These internal rules of procedure are published in the Official Gazette of the Grand Duchy of Luxembourg.

The internal regulations determine:

1. operating conditions for the CNPD;
2. the organisation of the services of the CNPD;
3. the procedures for convening the members of the college and holding collegiate meetings.

The CNPD is a collegiate body made up of four members, one of which is a president. Members are called Data Protection Commissioners and are authorised to use the title “Commissioner”, with this title having no impact on their rank or their remuneration. Current Commissioners are: Ms Tine A. Larsen (Chair), Mr Thierry Lallemang (Commissioner), Mr Marc Lemmer (Commissioner) and Mr Alain Herrmann (Commissioner). Four deputy members are also appointed. The deputy members are called to replace members of the college when they are absent or unable to attend.

The CNPD meets regularly for deliberations. The college may validly sit and deliberate only if at least three members of the college are present, and decisions are adopted by majority vote. If the number of votes are equal, the president has the deciding vote. Abstentions are not permitted. The members of the college and the deputy members cannot sit, deliberate or adopt decisions in a matter in which they have a direct or indirect interest.

The CNPD's organizational chart can be found on this page.

Procedural Information

Applicable Procedural Law

The CNPD verifies if personal data is processed in accordance with the following provisions:

• the General Data Protection Regulation (GDPR);
• the Act of 1 August 2018 on the organisation of the National Data Protection Commission and the general data protection framework;
• the Act of 1 August 2018 on the protection of individuals with regard to the processing of personal data in criminal and national security matters;
• the Act of 30 May 2005 regarding the specific rules for the protection of privacy in the sector of electronic communications;
• other legal texts containing specific provisions on the protection of personal data, as listed at the end of the page here.

The CNPD is not competent to supervise the processing of personal data carried out by courts of the judicial order, including the public prosecutor (ministère public), or the administrative order acting in their judicial capacities.

Complaints Procedure under Art 77 GDPR

The GDPR was adopted pursuant to article 40 of the Act of 1 August 2018 on the organisation of the National Data Protection Commission and the general data protection framework. It determines the procedure for investigations before the CNPD.

In the course of the procedure of complaint, the CNPD first examines whether a complaint is justified, i.e. it checks whether the facts alleged by the claimant relating to the processing of personal data are likely or not to constitute a violation of the applicable data protection legislation. Where the CNPD considers that the challenged processing of data would indeed be contrary to applicable law, it will use its best endeavours to remedy the situation without making use of the binding measures entrusted within the framework of its powers conferred by law.

Ex Officio Procedures under Art 57 GDPR

The CNPD may launch Ex Officio procedures, for example following information seen in the media. They also launch own audit campaigns, for example the 2018 audit of controllers' appointment of a Data Protection Officer (which lead to several decisions, many which are found in the GDPRhub, for example Délibération n° 42FR/2021).

Appeals

A decision made by the CNPD can be challenged within 3 months. If it is, it will go to a general, administrative tribunal for review. A tribunal decision may also be challenged and the case will then move forward in the Luxembourg court system.

Practical Information

Filing with the DPA

Complaints can be filed online via this form: https://cnpd.public.lu/en/particuliers/faire-valoir/formulaire-plainte.html or sent by post to the following address:

Commission nationale pour la protection des données

Service des réclamations

15, Boulevard du Jazz

L-4370 Belvaux

Known Problems

Make sure to download your complaint as PDF after submission. You are left with no trace of what you submitted if you fail to download the complaint.

Filing an Appeal

You can help us by filling in this section!

Decision Database

Decision and Opinions can be found on the CNPD's website here : https://cnpd.public.lu/en/decisions-avis.html. Decisions summarized on the GDPRhub are listed here.

Statistics

Funding

You can help us filling this section!

Personal

You can help us filling this section!

Caseload

• Number of complaints received by the DPA: 526
• Number of proceedings initiated on the own initiative of the DPA: 31
• Number of data breach notifications: 299
• Number of proceedings terminated by a decision: 0

Fines

• Number of imposed fines : 0
• Amount of these fines: 0

Annual Reports

The CNPD has published annual reports since 2022, all of which can be found on their website here: https://cnpd.public.lu/en/publications/rapports.html

Annual reports are usually published in September/October.