DPA case Délibération n°13FR/2021 – Violation Found (Luxembourg, 2021)

The Luxembourg DPA launched an investigation on a controller that had implemented a geolocation system on their snowplowing and salting vehicles. Such system used on-line software, although the data was not transferred via WiFi but via phone cards. The employees participated in the activities relating such vehicles on a voluntary basis. They had only been informed about the system, however, orally. The DPA argued that, even if Article 12 GDPR does not de facto exclude the possibility of providing the information from Articles 13 and 14 orally, it poses an accountability problem. The controller must be able to demonstrate that it has provided such information. However, having provided the information in an oral manner, in this case the controller could not prove that had provided the information, and therefore the DPA concluded that the controller had violated Article 13 GDPR. The DPA took into account that the controller had implemented, during the proceedings, adequate measures to fulfill their information obligation, following the authority's proposal. Therefore, the CNPD decided to only warn the controller.