CNPD (Luxembourg) - Délibération n° 20FR/2021

CNPD (Luxembourg) - 20FR/2021

Authority:	CNPD (Luxembourg)
Jurisdiction:	Luxembourg
Relevant Law:	Article 38(1) GDPR Article 38(3) GDPR Article 39(1)(a) GDPR Article 39(1)(b) GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	11.06.2021
Published:	01.07.2021
Fine:	15.000 EUR
Parties:	Luxembourg data protection authority Logistics company (anonymized)
National Case Number/Name:	20FR/2021
European Case Law Identifier:	na
Appeal:	Unknown
Original Language(s):	French
Original Source:	Official website of the Luxembourgish DPA (CNPD) (in FR)
Initial Contributor:	Maïlys Lemaître

The Luxembourg DPA fined a logistics company €15,000 for failing to ensure that its DPO could exercise the tasks outlined in Articles 38(1), 38(3), 39(1)(a) and 39(1)(b) GDPR, including because the DPO was not invited to all relevant meetings, and did not report directly to the highest level of management.

English Summary

Facts

The Luxembourgish Data Protection Authority (CNPD) conducted an investigation at a logistics company within the framework of a global investigation campaign on the function of Data Protection Officer (DPO) in both private and public sectors.

Dispute

Did the logistics company meet the legal requirements regarding the function of DPO?

Holding

Following their investigation at the company, the CNPD found:

that the company's DPO did not seem to be invited to all relevant meetings for them and that it therefore could not be considered that they were involved properly and in a timely manner in all issues which relate to the protection of personal data as required by Article 38(1) GDPR;
that the DPO did not report directly to the highest level of management at the company, thus not ensuring that the DPO could act without receiving any instructions regarding the exercise of their tasks pursuant to Art. 38(3) GDPR;
that, though it could reasonably be expected that the DPO did a formal and frequent reporting on their activities to the management, such a reporting had not been set up and that the company therefore did not meet the requirements of Article 39(1)(a) GDPR which states that the DPO should inform and advise the controller;
that the company had not been able to demonstrate that they had an audit plan for the year, thus violating Article 39(1)(b) GDPR regarding the DPO's duties to monitor compliance with GDPR.

In view of those violations, the CNPD:

imposed an administrative fine of fifteen thousand euros (€15,000) on the company;
ordered them to comply with Articles 38(1), 38(3), 39(1)(a) and 39(1)(b) GDPR within four months of the notification of the decision.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

Decision of the National Commission sitting in restricted formation on

the outcome of survey No. [...] conducted with Company A

Deliberation n ° 20FR / 2021 of June 11, 2021

The National Commission for Data Protection sitting in a restricted body,

composed of Mrs Tine A. Larsen, president, and Messrs Thierry Lallemang and Marc
Lemmer, commissioners;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on

the protection of individuals with regard to the processing of personal data

personnel and the free movement of such data, and repealing Directive 95/46 / EC;

Having regard to the law of 1 August 2018 on the organization of the National Commission for the Protection

data and the general data protection regime, in particular Article 41 thereof;

Having regard to the internal regulations of the National Commission for Data Protection

adopted by decision n ° 3AD / 2020 dated 22 January 2020, in particular Article 10, point 2;

Having regard to the regulation of the National Commission for Data Protection relating to

investigation procedure adopted by decision n ° 4AD / 2020 dated 22 January 2020, in particular
its article 9;

Considering the following:

________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. […] conducted with Company A 1/25 I. Facts and procedure

1. Given the impact of the role of the data protection officer (hereinafter: the "DPO") and

the importance of its integration into the body, and considering that the guidelines
1
concerning DPOs have been available since December 2016, i.e. 17 months before entry
in application of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27

April 2016 on the protection of individuals with regard to the processing of

personal data and the free movement of such data, and repealing the

Directive 95/46 / EC (General Data Protection Regulation) (hereinafter: the "

RGPD ”), the National Data Protection Commission (hereinafter: the
"National Commission" or "CNPD") has decided to launch an investigation campaign

thematic on the function of the DPO. Thus, 25 audit procedures were opened in 2018,

concerning both the private and public sectors.

2. In particular, the National Commission decided by deliberation n ° […] of September 14
2018 to initiate an investigation in the form of a data protection audit of

Company A established at […] L- […] and registered in the trade and companies register

under the number […] (hereafter: the “controlled”) and to designate Mr. Christophe

Buschmann as the head of the investigation. The said deliberation specifies that the investigation relates to the

compliance of the inspected with section 4 of chapter 4 of the GDPR.

3. […] the inspectorate [is active in the field of transport] […].

4. The controlled has approximately […] collaborators and in terms of its activities […].

5. By letter of September 17, 2018, the head of the survey sent a questionnaire

preliminary to the control to which the latter replied by letter of October 9, 2018.

site visits took place on February 4 and May 2, 2019. Following these discussions, the chef

investigation prepared the audit report no. […] (hereafter: the "audit report").

6. It emerges from the audit report that in order to verify the compliance of the organization with section

4 of Chapter 4 of the GDPR, the head of the investigation defined eleven control objectives, namely:

1) Ensure that the body subject to the obligation to appoint a DPO has done so;

1The guidelines concerning DPOs were adopted by the “Article 29” working group on 13
December 2016. The revised version (WP 243 rev. 01) was adopted on April 5, 2017.
________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of

survey no. […] conducted with Company A 2/25 2) Ensure that the organization has published the contact details of its DPO;

3) Ensure that the organization has communicated the contact details of its DPO to the CNPD;

4) Ensure that the DPO has sufficient expertise and skills to

carry out its missions effectively;

5) Ensure that the missions and tasks of the DPO do not give rise to a conflict of interest;
6) Ensure that the DPO has sufficient resources to perform effectively

of its missions;

7) Ensure that the DPO is able to carry out his missions to a sufficient degree

autonomy within their organization;

8) Ensure that the organization has put in place measures to ensure that the DPO is associated with

all matters relating to data protection;

9) Ensure that the DPO fulfills his mission of information and advice to the

data controller and employees;

10) Ensure that the DPO exercises adequate control over data processing within

of his body;

11) Ensure that the DPO assists the data controller in carrying out the

impact analyzes in the event of new data processing.

7. By letter of 7 November 2019 (hereinafter: the “statement of objections”), the Chief

investigation informed the control of breaches of obligations under the GDPR

which he found during his investigation. The audit report was attached to this letter.

8. In particular, the head of the investigation noted in the statement of objections

breaches of:

 the obligation to involve the DPO in all matters relating to the protection of
2
personal data;
3
 the obligation to guarantee the autonomy of the DPO;
4
 the DPD's control mission;
5
 the DPD's mission of information and advice.

9. By letter of December 4, 2019, the inspector sent the head of the investigation

position on the shortcomings identified in the statement of objections.

2Objective 8
3Objective n ° 7
4Objective n ° 10
5Objective 9

________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
3/2510. On August 10, 2020, the head of the investigation sent the inspectorate an additional letter to the

statement of objections (hereinafter: the "additional letter to the communication of

grievances ") by which he informs the inspector about the corrective measures and the fine
administrative office that he proposes to the National Commission sitting in a restricted group (here-

after: the "restricted formation") to adopt. In this letter, the investigator proposed

to the restricted formation to adopt three different corrective measures, as well as to impose
at the control an administrative fine in the amount of 15,000 euros.

11. By letter of September 17, 2020, the inspector sent the head of the investigation his

observations on the additional letter to the statement of objections.

12. The case was on the agenda of the restricted formation session on November 13
2020. In accordance with article 10.2. b) the rules of procedure of the Commission

national, the head of investigation and the supervisee presented their oral observations in support of

of their written observations and answered questions posed by the training

restraint. The controlled had the floor last.

II. Place

A. On the breach of the obligation to involve the DPO in all matters relating to

the protection of personal data

1. On the principles

13. According to Article 38.1 of the GDPR, the organization must ensure that the DPO is involved, in a

in an appropriate and timely manner, in all matters relating to the protection of

personal data.

14. The DPO Guidelines state that "[i] t is essential that the DPO, or

his team, is involved from the earliest possible stage in all questions

relating to data protection. [...] Information and consultation of the DPO from
start will facilitate compliance with the GDPR and encourage a grounded approach

on data protection by design; it should therefore be a procedure

usual in the governance of the organization. In addition, it is important that the DPO is

________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
4/25 considered as an interlocutor within the organization and that he is a member of groups

of work devoted to data processing activities within the organization ". 6

15. The DPO guidelines provide examples on how to

to ensure this association of the DPO, such as:

 invite the DPO to participate regularly in management meetings
upper and intermediate;

 to recommend the presence of the DPO when decisions having implications

in terms of data protection are taken;

 always take due account of the opinion of the DPO;

 immediately consult the DPO in the event of a data breach or any other

incident occurs.

16. According to the guidelines on DPOs, the body could, where appropriate,

develop data protection guidelines or programs

indicating the cases in which the DPO must be consulted.

2. In this case

17. It emerges from the audit report that, in order for the investigator to consider objective 8 as

completed by the inspected as part of this audit campaign, he expects the DPD

participates in a formalized manner and on the basis of a defined frequency in the

Management, project coordination committees, new product committees,
security committees or any other committee deemed useful in the context of data protection.

18. According to the statement of objections, page 3, “the DPO participates in the board of directors on

invitation or on request, but not systematically (...) The DPO's participation

to project meetings with an impact on data protection is planned, but not
still in place systematically. The statement of objections then states

that "The fact that the DPO's intervention in the various meetings relevant to the

with regard to the protection of personal data is not systematic is not

such as to guarantee an appropriate involvement of the DPO, nor to establish his position in
as an interlocutor within the organization. "

6 WP 243 v.01, version revised and adopted on April 5, 2017, p. 16
________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. […] carried out with Company A 5/2519. In addition, the head of the investigation, taking into consideration the protection policy

data which, during the investigation, was being prepared by the inspected, notes

in the statement of objections, page 3, that "if the existence of a policy of protection
data specifying the need to integrate the DPO in all questions related to the

data protection is an important element of governance, it is not enough to

ensure the appropriate and timely involvement of the DPO at the operational level. Of
internal procedures specifically specifying how the DPO must be involved,

systematic invitation of the DPO to meetings or his designation as

permanent member of a committee would be, for example, elements allowing to

demonstrate its operational involvement. "

20. In his position paper of 4 December 2019, page 2, the inspected indicates that "[i] he is

important (...) to take into account the particularities of each organization as well as its

decision-making and organizational functioning in order to assess how "
appropriate "the controller, together with the processor, must associate the DPO" with

all matters relating to data protection ”” and argues that “Neither the GDPR,

nor do the guidelines provide for an obligation for the data controller to

make the DPO a permanent member of any decision-making committee ”. Also, according to
the controlled "the requirement formulated in the report that the DPO is a member

standing of the Board of Directors […] is neither in conformity with these texts, nor necessary to

the exercise of the DPD's missions. "

21. The inspector also recalls that measures have been taken "to help the DPO to

carry out its missions ", including by appointing for each service," one or more

"GDPR correspondents" whose missions are in particular to relay the objectives of the
data protection policy within their service and coordinate operations

compliance under the responsibility of the head of the department concerned and the DPO. They

have direct access to it. "

22. The restricted committee notes that the GDPR does not specify which measures are

should be taken by the controller to ensure the involvement of the DPO

to all questions relating to data protection. As for the guidelines

concerning DPOs, they formulate recommendations and best practices,
in order to guide data controllers in ensuring compliance with their

________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
6/25 governance, in particular by providing examples of how to ensure this

association.

23. Nevertheless, the restricted formation notes that it is rightly specified on page 2 of the

statement of objections (under "preliminary remarks") that "[t] he requirements of the

GDPR is not always strictly defined. In such a situation, it is up to the
supervisory authorities to verify the proportionality of the measures put in place by the

data controllers with regard to the sensitivity of the data processed and the risks

incurred by the persons concerned. "

24. In this regard, the restricted committee notes that the inspectorate has approximately […]

collaborators (according to the investigation file), that it has an internal department of […].

[…]. It follows, however, that the activities of the inspected involve processing of

personal data that potentially affects a significant number of
persons concerned. However, if the inspected has put in place, prior to the start of

the investigation, certain organizational measures facilitating the association of the DPO, in

in particular by appointing “GDPR correspondents” for each service, the training

restricted considers, however, that the formalized and systematic participation of the DPO
at relevant meetings, as expected by the investigator, is a measure

proportionate in order to ensure the involvement of the DPO in all matters relating to the

Protection of personal data.

25. The restricted committee took note of the fact that in its letter of September 17, 2020, the

controlled indicates that it was decided to "formalize monthly meetings between the DPD

and the heads of departments who process the most personal data (mainly
IT, human resources and […]) (…) as well as biannual meetings with

the other heads of departments "and add" as an annex to the general management policy

data, a form allowing each person in charge of a project to deal with

the DPO the question of data protection ”. If these measures should allow
to ensure the involvement of the DPO in all matters relating to data protection,

it should be noted that these were decided during the investigation by the inspectorate.

The limited training therefore agrees with the findings of the head of the investigation that,

at the start of the investigation, the inspected was unable to demonstrate that the DPO was
appropriately associated with all data protection matters

personal.

________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
7/2526. The limited training further notes that it does not have the documentation that

would make it possible to demonstrate the taking of such measures by the inspected.

27. In view of the above, the restricted panel concludes that Article 38.1 of the GDPR does not have
been respected by the inspected.

B. On the breach of the obligation to guarantee the autonomy of the DPO

1. On the principles

28. According to Article 38.3 of the GDPR, the body must ensure that the DPO "does not receive

no instructions regarding the exercise of the missions ”. In addition, the DPD "makes

directly to the highest level of "management" of the organization.

29. Recital (97) of the GDPR further states that DPOs “should be able to

to exercise their functions and missions in complete independence ”.

7
30. According to the guidelines on DPOs, Article 38.3 of the GDPR "provides for certain
basic guarantees intended to ensure that DPOs are able to exercise their

missions with a sufficient degree of autonomy within their organization. […] That means

that, in carrying out their duties under Article 39, DPOs must not

receive instructions on how to handle a case, for example, what outcome should

be obtained, how to investigate a complaint or whether to consult with the
control. Furthermore, they cannot be required to take a certain point of view on a

issue related to data protection legislation, for example, a

particular interpretation of the law. […] If the controller or the processor

takes decisions that are incompatible with the GDPR and the opinion of the DPO, the latter

should be given the opportunity to clearly state their dissent at the highest level
management and decision-makers. In this regard, Article 38 (3) provides that the

DPD "reports directly to the highest level of management of the person responsible for

processing or subcontractor ”. Such direct accountability ensures that

senior management (e.g. the board of directors) is aware of the opinions and

DPD recommendations that fall within the scope of the latter's mission

7WP 243 v.01, version revised and adopted on April 5, 2017, p. 17 and 18
________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of

the survey no. […] carried out with Company A 8/25 consisting in informing and advising the controller or the processor.

The preparation of an annual report on the activities of the DPO intended for the highest level

management is another example of direct accountability. "

2. In this case

31. It emerges from the audit report that, in order for the investigator to consider objective 7 as

completed by the inspected as part of this audit campaign, he expects the DPD
either "attached to the highest level of management in order to guarantee as much as possible

autonomy ”.

32. According to the statement of objections, page 3, '' It appears from the investigation that the […] indicates

that the DPO reports directly to the highest level of the Company, in this case
the Board of Directors and General Management. However, Company A has not been in

able to demonstrate the existence of such a direct relationship at the highest level of

management, for example, through an activity report. Regarding the connection

hierarchical, the DPO was initially attached to the legal director, himself
to the administrative and financial director. "

33. Regarding the establishment of an activity report, the head of the investigation noted on page

4 of the statement of objections that a modification was made during the investigation

in the direction of compliance, the DPO now establishing a monthly report
for the attention of the Director-General. The head of the investigation, however, notes that the DPO should

be able to independently determine the content of this monthly report which is first

discussed with the Administrative and Financial Director.

34. Regarding hierarchical reporting, the head of the investigation recalls on page 4 of
the statement of objections that 'the existence of several hierarchical levels between the

DPD and the highest level of management is not such as to guarantee its

autonomy. "And underlines that during the investigation, the inspector indicated" that the attachment

hierarchy of the new DPD was uncertain ”.

35. In his position paper of 4 December 2019, page 3, the inspected argued that the DPO

previously in office "regularly reported to the Director

Administrative and Financial in 2018 "and that a particular context in terms of

recruitment of the current DPO resulted in the latter “reporting to the
Administrative and financial director informally (...) until March 2019 ". The

________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
9/25 controlled then specifies that since March 15, 2019, the legal service and the DPO have been

part of […], placed under the responsibility of the Chief Executive Officer and that since May 2019,

a “formal activity report” is drawn up each month.

36. As for the content of the report drawn up by the DPO, the inspector specifies on page 4 of his report

position of 4 December 2019 that "The monthly activity report is (...) sent to the

Chief Executive Officer without the content of the report having been modified, except

report of the meeting with the Administrative and Financial Director ”.

37. In its position paper of 4 December 2019, the controlled also argues, on page
3, that “The report cites […] of Company A to identify a breach by making a

fragmentary quotation: "the data protection officer reports directly to the

highest level of the Company, in this case the Board of Directors and the
Executive management ". However, the CNPD omitted the part of the text of […] specifying that

the DPO reports to the Board of Directors and General Management “for all

significant problem occurring or noted in the course of his duties ”.

38. The inspected continues by indicating that “The GDPR and the guidelines not specifying

what should be the nature of the report made at the highest level of the hierarchy, Company A
considered, in view of the size and organization of Company A, that it was preferable to

discuss data protection issues at a lower level (heads of

department who have the delegations of power to make decisions or even directors
depending on the nature of the problem) in order to resolve them in the most efficient way and

then report to the Chief Executive Officer. Of course, in the event that the DPD

would notice a significant blockage, he has the opportunity to speak directly to the Management

General and to the Board of Directors. "

39. On this point, the restricted committee notes that the direct report to the highest level of the

direction is, according to [...], conditioned on the existence of a "significant problem" (or

“Significant blocking”, according to the controlled position of December 4, 2019). Outraged

the question of knowing what are the criteria which make it possible to determine, in practice,
the existence of such a problem, the restricted party has reservations about this

condition which could constitute an obstacle to the direct access of the DPO at the highest level

management, in that the DPO could be in the position of having to justify

the existence of such a "significant problem" before intervening at the highest level
of management. However, the restricted committee considers that the DPO should be able to bypass

the intermediate hierarchical levels as soon as it deems necessary.
________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
10/2540. The restricted training is also in this regard, that in its letter of September 17

2020, the inspector informed the head of the investigation of measures decided in this regard, namely

that it will be added, in its "general policy for the management of personal data
personnel ", the following indication:" the DPO, if he considers it necessary, can directly

contact the Managing Director of Company A in order to provide him with any

problematic ”.

41. If measures were decided during the investigation by the inspected in the sense of a
compliance, the limited training nevertheless agrees with the report of the chief

investigation according to which, at the start of the investigation, the inspector was not able to

demonstrate that the DPO could act without receiving instruction regarding the exercise

of his assignments or that he reported directly to the highest level of management.

42. The restricted committee notes that it does not have the documentation that would allow

demonstrate that the measures described in point 40 of this decision have been taken

by the controlled.

43. In view of the above, the restricted panel concludes that Article 38.3 of the GDPR does not have
been respected by the inspected.

C. On the failure to provide information and advice to the DPO

1. On the principles

44. Under section 39.1. a) of the GDPR, one of the missions of the DPO is to "inform and

advise the controller or processor as well as the employees who

carry out the processing on their obligations under this
regulation and other provisions of Union law or of the law of the Member States in

data protection '.

2. In this case

45. It emerges from the audit report that, in order for the investigator to consider objective 9 as

completed by the inspected as part of this audit campaign, he expects

"The organization has formal reporting on the activities of the DPO to the

Direction based on a defined frequency. Regarding information to employees, it is

________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
11/25 whereas the organization has put in place an adequate training system for personnel

in terms of data protection ”.

46. On these two points, according to the statement of objections, page 4, 'It emerges from the investigation
that the staff of Company A have been made aware by the DPO alone or accompanied by the

CISO. Specific training has been carried out for senior executives,

human resources and the IT department. With regard to the person responsible for

treatment, the DPO issues recommendations on an ad-hoc basis (13 between 25 May
2018 and February 4, 2019). In a logic of daily management of the protection of

data and given the volume of data processed, the sensitivity of certain

these data or the complexity of the processing operations (see remarks

preliminary), it is expected that information and advisory missions with regard to the
controller are better formalized, for example with a report

activity. "It is then specified that during the investigation" the CNPD agents were

informed that there is now a monthly report for the attention of the Director General ”.
The limited training nevertheless notes that it does not have the documentation

which would make it possible to demonstrate that this measure has been put in place. This being specified,

it is stated in the statement of objections, page 5, that at the start of the investigation, "the

controller has not been able to demonstrate that the DPO is exercising his
information and advice missions with regard to the data controller. "

47. In his position paper of December 4, 2019, the controlled first argues "that neither the

GDPR nor the guidelines impose any formality on how

which the DPO carries out his information and advice missions "and" that the absence of
formal activity report on a regular basis is not sufficient to demonstrate that the DPO has not

carried out its information and advisory missions. »The inspected then describes how

way the data protection officer carries out his information and

advice “notably through the review of contracts (service provision,
outsourcing, etc.), data protection impact assessments (DPIA) or

further responses to requests from the various GDPR correspondents or

services "and specifies that" the DPO is confronted every day with requests and

issues related to data protection for which it issues an opinion either
informal (telephone for example) or formal (most often email or report). "

48. With regard to the mission of informing employees about their obligations

are incumbent under the GDPR, the inspected indicated in its position paper of 4 December

________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
12/25 2021 that “[c] as stressed by the CNPD, the DPD also carries out his

information and advice during training and awareness sessions. "

49. In this regard, the restricted panel notes that the breach noted by the chief

of investigation only concerns the DPD's information and advice mission with regard to

the data controller, and not the DPO's information and advice mission to

with regard to employees.

50. The restricted committee notes that article 39.1 of the GDPR lists the tasks that the

DPD must at least be entrusted, whose mission is to inform and advise the organization
as well as the employees, without however specifying whether specific measures must be

put in place to ensure that the DPO can accomplish his information and

advice. The DPO guidelines, which formulate recommendations and

best practices to guide data controllers in implementing

compliance with regard to their governance, also briefly discuss the

DPD advisory and information mission. Thus, they specify that the keeping of the register

processing activities referred to in Article 30 of the GDPR may be entrusted to the DPD and that
"[This] register must be considered as one of the tools enabling the DPO to exercise his

monitoring missions for compliance with the GDPR as well as providing information and advice to the

controller or processor. "8

51. In the present case, the restricted committee notes that it appears from the investigation file that the DPO

been involved in the establishment of the register of processing activities and ensure a
9
followed by this register.

52. The restricted committee further notes that in its position paper of 4 December
2019, the inspected provided information to describe how the DPO performs in

performs its missions of information and advice with regard to the controller.

53. Nevertheless, the restricted committee recalls that it has already noted in point 23 of the

this decision which is rightly specified on page 2 of the statement of objections

(under "preliminary remarks") that "[t] he requirements of the GDPR are not always

strictly defined. In such a situation, it is up to the supervisory authorities to verify

the proportionality of the measures put in place by the data controllers

8WP 243 v.01, version revised and adopted on April 5, 2017, p. 22
9 Visit report of February 4, 2019, p. 5
________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
13/25 with regard to the sensitivity of the data processed and the risks incurred by individuals

concerned. "

54. However, in view of the fact that it has already been found in point 24 of this decision that
the activities of the inspected involve the processing of personal data which

potentially affect a large number of people concerned, the training

Restricted considers that formal reporting of the DPO's activities to management, on

the basis of a defined frequency, constitutes a proportionate measure to demonstrate
that the DPO performs his duties of information and advice with regard to the head of

treatment.

55. The restricted committee noted that the inspected indicated that a formal report, on a

monthly basis, was set up during the survey, but nevertheless supports the
report by the head of the investigation that, at the start of the investigation, the data controller

has not been able to demonstrate that the DPO carries out his information and

advice to the data controller.

56. The restricted formation further recalls that it does not have the documentation which
would make it possible to demonstrate that this measure was put in place by the inspected.

57. In view of the foregoing, the Select Committee concludes that Article 39.1. a) of the GDPR does not have

not respected by the inspected.

D. On the breach relating to the DPO's control mission

1. On the principles

58. According to section 39.1. b) of the GDPR, the DPO has, among other things, the task of "monitoring compliance
of this Regulation, other provisions of Union or State law

members in terms of data protection and internal rules of the controller

processing or subcontractor with regard to the protection of personal data,

including with regard to the division of responsibilities, awareness raising and
training of staff involved in processing operations, and audits

reporting ”. Recital (97) specifies that the DPD should help the organization to verify the

internal compliance with the GDPR.

________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
14/2559. It follows from the guidelines concerning DPOs that, in the context of its mission of

control, the DPO may in particular:

 collect information to identify processing activities;

 analyze and verify the compliance of processing activities;

 inform and advise the controller or the processor and formulate

recommendations to him.

2. In this case

60. It appears from the audit report that, in order for the investigator to consider Objective 10 as
completed by the inspected as part of this audit campaign, he expects

"The organization has a formalized control plan for the protection of

data (even if it is not yet executed) ”.

61. According to the statement of objections, page 5, “The investigation showed that the body

carries out ad hoc checks in the context of projects for which the DPO
participates. In a logic of daily management of data protection, and

given the volume of data processed, the sensitivity of some of these data

or the complexity of the processing operations (see preliminary remarks), it is

whereas the DPD's control missions are better formalized, for example with

the establishment of a control plan. "

62. In his position paper of 4 December 2019, the controlled argued “that it is not

because there is no formalized control plan that no adequate control of the treatment

data within the organization is carried out. Moreover, this control is often done

implicitly within the framework of projects for which the DPD intervenes. Indeed, through

the review of the register of processing, DPIA, issues raised, the DPD
monitors the application of the rules and feeds the information back to the hierarchy as needed in order

to regularize the situation. "

63. The restricted committee notes that article 39.1 of the GDPR lists the missions that the

DPD must at least be entrusted with the task of monitoring compliance with the GDPR, without

however, require the body to put in place specific measures to ensure that

the DPO can accomplish his control mission. Thus, the guidelines concerning

10WP 243 v.01, version revised and adopted on April 5, 2017, p. 20
________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
the survey no. [...] conducted with Company A 15/25 the DPOs specify in particular that the keeping of the register of processing activities referred to in
Article 30 of the GDPR can be entrusted to the DPD and that "[this] register must be considered

as one of the tools allowing the DPO to carry out his compliance control missions

of the GDPR as well as information and advice from the controller or sub

treating. "

64. The restricted committee has already noted in point 51 of this decision that it is apparent from

investigation file that the DPO was involved in establishing the activity register
12
processing and monitor this register. The controlled, in his position

of December 4, 2019, argues that the DPO monitors the application of the GDPR
in particular “through the review of the processing register”.

65. Nevertheless, as has already been recalled in points 23 and 53 above, it is specified in

rightly on page 2 of the statement of objections (under "preliminary remarks")

that “[t] he requirements of the GDPR are not always strictly defined. In such

situation, it is up to the supervisory authorities to verify the proportionality of the measures

implemented by data controllers with regard to the sensitivity of the data

processed and the risks incurred by the data subjects. "

66. However, in view of the fact that it has already been found in point 24 of this decision that

the activities of the inspected involve the processing of personal data which
potentially affect a large number of people concerned, the training

restricted considers that the control mission carried out by the DPO with the controlled

should be further formalized, for example through a control plan for

data protection, in order to be able to demonstrate that the DPO is carrying out his

adequate monitoring of compliance with the GDPR.

67. The restricted committee took note of the fact that in its letter of September 17, 2020, the

controlled indicates that it was decided "to put in place an audit and control strategy
through the development in 2020 of a control plan ”. However, this decision being

intervened during the investigation, the small group agrees with the chief's observation

investigation according to which the inspected was not able to demonstrate that the DPO exercises

its missions of monitoring compliance with the GDPR.

11
12WP 243 v.01, version revised and adopted on April 5, 2017, p. 22
February 4, 2019 visit report, p. 5
________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
16/2568. The limited group notes that it does not have the documentation that would allow

to demonstrate that this measure has been implemented by the inspected.

69. In view of the foregoing, the Select Committee concludes that Article 39.1. b) of the GDPR does not have

not respected by the inspected.

III. On corrective measures and the fine

A. Principles

70. In accordance with article 12 of the law of 1 August 2018 on the organization of the

National Commission for Data Protection and the General Regime on

data protection, the National Commission has the powers provided for in Article

58.2 of the GDPR:

a) notify a controller or processor that data processing operations
planned treatment are likely to violate the provisions of this

regulation;

b) call to order a controller or a processor when the

processing operations have resulted in a violation of the provisions of this

regulation;

c) order the controller or processor to comply with the requests

presented by the data subject in order to exercise their rights under the

this regulation;

d) order the controller or processor to put the data processing operations

processing in accordance with the provisions of these regulations, if applicable,
in a specific manner and within a specified timeframe;

e) order the controller to communicate to the data subject a

personal data breach;

f) impose a temporary or permanent limitation, including a ban, on the

treatment;

g) order the rectification or erasure of personal data or the

restriction of processing in application of Articles 16, 17 and 18 and the notification of these
________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
the survey no. [...] carried out at Company A 17/25 measures to the recipients to whom the personal data have been

disclosed in accordance with Article 17, paragraph 2, and Article 19;

h) withdraw a certification or order the certification body to withdraw a
certification issued in application of Articles 42 and 43, or order the

certification not to issue certification if the requirements applicable to the

certification are not or no longer satisfied;

i) impose an administrative fine in application of Article 83, in addition to or
the place of the measures referred to in this paragraph, depending on the characteristics

specific to each case;

j) order the suspension of data flows addressed to a recipient located in a

third country or to an international organization. "

71. Article 83 of the GDPR provides that each supervisory authority ensures that fines
administrative requirements are, in each case, effective, proportionate and

dissuasive, before specifying the elements that must be taken into account in deciding

whether to impose an administrative fine and to decide on the amount of this
fine:

(a) the nature, gravity and duration of the breach, taking into account the nature, extent or

the purpose of the processing concerned, as well as the number of data subjects

affected and the level of damage they suffered;

(b) whether the violation was committed willfully or negligently;

c) any measures taken by the controller or processor to mitigate the

damage suffered by the persons concerned;

d) the degree of responsibility of the controller or processor, account

taking into account the technical and organizational measures they have implemented in accordance with the

Articles 25 and 32;

e) any relevant breach previously committed by the controller or

the subcontractor ;

f) the degree of cooperation established with the supervisory authority in order to remedy the violation

and mitigate any negative effects;
________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
18/25 g) the categories of personal data affected by the breach;

h) the manner in which the supervisory authority became aware of the breach, in particular whether,

and to what extent the controller or processor has notified the
violation;

(i) where measures referred to in Article 58 (2) have previously been

ordered against the controller or the processor concerned for the

same object, compliance with these measures;

j) the application of codes of conduct approved in accordance with Article 40 or
certification mechanisms approved under Article 42; and

k) any other aggravating or mitigating circumstance applicable to the circumstances of

the species, such as financial benefits obtained or losses avoided, directly or

indirectly, as a result of the violation ”.

72. The restricted panel would like to point out that the facts taken into account in the context of the

this decision are those noted at the start of the investigation. Any

subsequent changes relating to the subject of the investigation, even if they

allow compliance to be fully or partially established, do not allow
retroactively cancel a breach found.

73. Nevertheless, the steps taken by the inspected to comply with

the GDPR during the investigation procedure or to remedy the shortcomings identified

by the head of investigation in the statement of objections, are taken into account by the
limited training in the context of any corrective measures to be taken.

B. In this case

1. As to the imposition of an administrative fine

74. In his additional letter to the statement of objections of 10 August 2020, Chief

of investigation proposes to the restricted formation to pronounce against the controlled a
administrative fine relating to the amount of 15,000 euros.

75. In his letter of September 17, 2020, the inspected maintains “that the proposed sanction

to Restricted Training is not in line with the grievances invoked ”.

________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
19/2576. In order to decide whether to impose an administrative fine and to decide, if

if applicable, the amount of this fine, the restricted committee analyzes the criteria

by Article 83.2 of the GDPR:

- As to the nature and seriousness of the violation [article 83.2 a) of the GDPR], with regard to

breaches of Articles 38.1, 38.3, 39.1 a) and 39.1 b) of the GDPR, training

restricted notes that the appointment of a DPO by an organization cannot be efficient

and effective, namely to facilitate compliance with the GDPR by the organization, only in the event that the
DPD is involved from the earliest possible stage in all questions relating to the

data protection, exercise their functions and missions in complete independence, exercise

effectively its missions, including the information and advice of the manager

processing and the task of monitoring compliance with the GDPR.

- As for the duration criterion [article 83.2.a) of the GDPR], the restricted committee notes that the

controlled indicated, in its letter of September 17, 2020:

(1) That it was decided to take measures in September 2020 to formalize

involving the DPO in all matters relating to data protection. The
breach of Article 38.1 of the GDPR therefore lasted over time, at least between

May 25, 2018 and September 2020;

(2) That the DPO has been attached to [...] since March 2019 and that it was decided to take

measures in September 2020 to formalize the possibility for the DPO, if he
considers it necessary, "to contact the Chief Executive Officer directly in order to

escalate any problem to him ”. The breach of Article 38.3 of the GDPR therefore

lasted at least between May 25, 2018 and September 2020.

(3) That it was decided to put in place "an audit and control strategy by
the development in 2020 of a control plan. "The breach of section 39.1. b) from

GDPR therefore lasted over time, at least between May 25, 2018 and September

2020.

Regarding the mission of information and advice, the limited training falls under

that it emerges from the audit report that the audited party indicated that formal reporting was
implemented in May 2019. The breach of Article 39.1.a) of the GDPR therefore lasted for

at least between May 25, 2018 and May 2019.

________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
20/25 - As to the number of data subjects affected by the violation and the level of

damage they have suffered [article 83.2 a) of the GDPR], the restricted training recalls the

findings made in point 24 of this decision, namely that the audited account
approximately […] collaborators (according to the investigation file), […].

- As for the degree of cooperation established with the supervisory authority [Article 83.2 f) of the GDPR],

the restricted training takes into account the assertion by the head of the investigation that the

Controlled demonstrated constructive participation throughout the investigation.

- As to the categories of personal data affected by the violation

[article 83.2 g) of the GDPR], the restricted training takes into account the fact that the inspected

has an internal service […].

77. The restricted committee notes that the other criteria of Article 83.2 of the GDPR are not
neither relevant nor likely to influence his decision on whether to impose a fine

administrative and its amount.

78. The restricted committee notes that if several measures have been decided by the inspected

in order to remedy in whole or in part certain shortcomings, these have not been
decided that following the launch of the investigation by CNPD agents on

17 September 2018 (see also point 72 of this decision).

79. Therefore, the restricted panel considers that the imposition of an administrative fine

is justified with regard to the criteria set out in Article 83.2 of the GDPR for breach of

Articles 38.1, 38.3, 39.1 a) and 39.1 b) of the GDPR.

80. Regarding the amount of the administrative fine, the restricted panel recalls that

Article 83.3 of the GDPR provides that in the event of multiple violations, as is the case in

the case, the total amount of the fine may not exceed the amount set for the violation

worse. To the extent that a breach of Articles 38.1, 38.3, 39.1 a) and 39.1 b)
of the GDPR is criticized for the inspectorate, the maximum amount of the fine that can be retained

amounts to 10 million euros or 2% of global annual turnover, the most

high being withheld.

81. In view of the relevant criteria of Article 83.2 of the GDPR mentioned above, the training
Restricted considers that the imposition of a fine of 15,000 euros appears at the same time

effective, proportionate and dissuasive, in accordance with the requirements of Article 83.1 of the GDPR.

________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
21/25 2. As to the taking of corrective measures

82. In his additional letter to the statement of objections, the head of the investigation

suggests that the restricted group take the following corrective measures:

"A) Order the implementation of measures ensuring the formalized association and

documented by the DPO in all matters relating to data protection,

in accordance with the requirements of Art.38 para.1 GDPR and the principle of

"Accountability". Although several ways can be considered to achieve
this result, one of the possibilities could be to analyze, with the DPO, all the

relevant committees / working groups with regard to data protection and

formalize in writing the terms of his intervention (previous information from the agenda

meetings, invitation, frequency, permanent member status, etc.). It is to be remembered
that the presence of the DPO in the various committees / working groups should enable him to be

directly and fully informed, but that this presence does not mean that the DPO has

necessarily a decision-making role.

b) Order the establishment and maintenance of a formal mechanism ensuring
the autonomy of the DPO in accordance with the requirements of Article 38 (3) of the GDPR.

Several ways can be envisaged to achieve this result, such as

attach the DPD to the highest level of management in order to guarantee as much as possible

autonomy or to create a formal and regular direct reporting line, as well as a
formal emergency escalation mechanism to management to bypass the

intermediate hierarchical level (s) on the initiative of the DPO.

c) Order the formal and documented deployment of the DPD's control mission

in accordance with Article 39 paragraph 1 b) of the GDPR and the principle of “accountability”.
Although several ways can be implemented to achieve this result, the

DPD should document its controls on the application of internal rules and procedures

data protection (second line of defense). This documentation

could take the form of a control plan followed by control and audit reports. "

83. As to the corrective measures proposed by the head of the investigation and by reference to point

73 of this decision, the restricted committee takes into account the procedures

carried out by the inspected in order to comply with the provisions of articles 38.1, 38.3, and

39.1 b) of the GDPR, as detailed in his letter September 17, 2020. More
in particular, it takes note of the following facts:

________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
22/25 - With regard to the violation of article 38.1 of the GDPR, measures have been

decided by the inspectorate in order to ensure the involvement of the DPO in all questions

relating to data protection. Indeed, the inspected decided to "formalize
monthly meetings between the DPO and the heads of departments that process the most data

personal […] (…) as well as biannual meetings with the other heads of

services "and add" as an annex to the general data management policy, a
form allowing each person in charge of a project to deal with the DPO the

question of data protection. ”However, the limited training does not have

no documentation to demonstrate that such enforcement measures have been taken

in conformity by the inspected. The restricted training therefore considers that
pronounce the corrective measure proposed by the head of investigation under a).

- With regard to the violation of article 38.3 of the GDPR, the inspected recalls that the

DPD has been attached to [...] since March 2019 and indicates that the following indication will be
added to the general policy for the management of personal data

Company A: "the DPO, if he considers it necessary, can directly contact the

General Manager of Company A in order to report any problem to him.

restricted party considers that such a measure would allow the DPO, if he considers
necessary, bypass the intermediate hierarchical levels. Nevertheless, the

restricted training does not have the documentation to demonstrate that

this compliance measure was taken by the inspected. Restricted training

therefore considers that the corrective measure proposed by the
head of investigation under b).

- With regard to the violation of Article 39.1 b) of the GDPR, the inspector indicates that he
was decided "to put in place an audit and control strategy by developing

in 2020 of a control plan ”. However, the restricted formation does not have

the documentation to demonstrate the implementation of this implementation measure

in conformity by the inspected. The restricted training therefore considers that
to pronounce the corrective measure proposed by the head of investigation under c).

84. With regard to the violation of Article 39.1 a) of the GDPR, taking into account the findings

made in points 55 and 56 of this decision, the restricted committee considers that there
place to order the implementation of corrective measures to ensure that the DPO

________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
23/25 exercises, in a formal and documented manner, its mission of information and advice with regard to

of the controller.

In view of the foregoing developments, the National Commission sitting

in restricted formation and deliberating unanimously decides:

- to retain the breaches of articles 38.1, 38.3, 39.1 a) and 39.1 b) of the GDPR;

- to pronounce against Company A an administrative fine in the amount of fifteen

one thousand euros (15,000 euros) with regard to the violation of articles 38.1, 38.3, 39.1 a) and 39.1 b)

of the GDPR;

- to issue an injunction against Company A to comply with

Article 38.1 of the GDPR, within four months of the notification of the decision to

the restricted training, the proof of compliance to be sent to the
restricted training at the latest within this period, in particular:

ensure the formal and documented association of the DPO with all questions relating to
data protection;

- to issue an injunction against Company A to comply with

Article 38.3 of the GDPR, within four months of the notification of the decision to
the restricted training, the proof of compliance to be sent to the

restricted training at the latest within this period, in particular:

ensure the establishment and maintenance of a formal mechanism guaranteeing autonomy
of the DPD;

- to issue an injunction against Company A to comply with

Article 39.1 b) of the GDPR, within four months of notification of the decision
of the restricted training, proof of compliance to be sent to the

restricted training at the latest within this period, in particular:

ensure the formal and documented deployment of the DPD's control mission;
________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A
24 / 25- to issue an injunction against Company A to comply with

Article 39.1 a) of the GDPR, within four months of notification of the decision

of the restricted training, proof of compliance to be sent to the
restricted training at the latest within this period, in particular:

ensure that the DPO exercises, in a formal and documented manner, his mission of information and

advice to the controller.

So decided in Belvaux on June 11, 2021.

For the National Commission for Data Protection sitting in a restricted body

Tine A. Larsen Thierry Lallemang Marc Lemmer
President Commissioner Commissioner

Indication of remedies

This administrative decision may be the subject of an appeal for reformation within three

months following its notification. This appeal is to be brought before the administrative tribunal and must

must be introduced through a lawyer at the Court of one of the Bar Associations.

________________________________________________________________________

Decision of the National Commission sitting in restricted formation on the outcome of
survey no. [...] conducted with Company A 25/25