DPA case 37FR/2021 – Violation Found (Luxembourg, 2021)

In 2018, the Luxembourg DPA (the CNPD) initiated 25 different audit proceedings both in the private and public sector with regard to the obligations relating to the Data Protection Officer (DPO) under Section 4 of Chapter 4 of the GDPR (see in particular Article 37 GDPR to Article 39 GDPR). One of these audit proceedings concerned a Luxembourg private company (hereafter, the controller). During the investigation, it was found that the controller had failed to communicate the contact details of its DPO to the DPA on time, in breach of Article 37(7) GDPR. Furthermore, it was found that the DPO appointed by the controller had other tasks and duties that could result in a conflict of interests, in breach of Article 38(6) GDPR. Because the controller had communicated the contact details of the DPO on 28 September 2018 (that is, more than 4 months after the day of application of the GDPR), the DPA found that the controller had violated Article 37(7) GDPR. Because the DPO of the controller was also "Head of Compliance, Money Laundering Reporting Officer", it was found that the DPO was involved in tasks that could result in a conflict of interest. As pointed out by the investigator of the DPA in his report, a DPO cannot exercise within the same company a function which allows him or her to determine the purposes and means of processing of personal data. In this case, the DPO was involved in the determination and implementation of personal data processing as part of his duties as Head of Compliance, and was therefore bound to assess the data processing practices which he/she had put in place himself/herself. None of the measures taken by the controller to mitigate the risk of conflict of interest (such as the fact that, in the event of a potential conflict of interest, the processing practices concerned would need to be countersigned by the hierarchical superior of the DPO) were found to be sufficient. In the course of the audit proceeding, however, the controller