DPA case Délibération n° 2FR/2024 – Complaint Upheld (Luxembourg, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Luxembourg data protection authority upheld a complaint about the use of video surveillance footage for employee dismissal. This matters because it reinforces that companies must have clear reasons for using personal data, especially in sensitive situations like employment. The ruling emphasizes the importance of transparency in data processing.
What happened
A company used video surveillance footage to justify an employee's dismissal without properly documenting the reasons for its use.
Who was affected
The employee whose dismissal was assessed using video footage was affected.
What the authority found
The authority confirmed that the company did not adequately specify the purposes for using the video footage, violating data protection rules.
Why this matters
This ruling stresses the need for companies to document and communicate the purposes of data processing clearly. It serves as a reminder that transparency is crucial in handling personal data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In 2013, a controller installed a video surveillance system located outside all the municipal buildings. The Luxemburgish DPA (‘CNPD’) authorised this installation. In March 2020, a data subject lodged a complaint with the CNPD regarding her dismissal by the controller who had consulted the video surveillance footage in order to assess the serious misconduct of the data subject as accurately as possible. In March 2021, during its investigation, the CNPD confirmed that the video surveillance system had been installed to guarantee the safety of the employees and users of the infrastructure. The controller argued that independently of data protection legislation, Luxemburgish employment law requires that the letter of dismissal states precisely the misconduct of which the employee is accused. Therefore, it was necessary to use the footage to avoid the dismissal being declared unfair by the competent court. Article 5(1)(b) GDPR states that personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. The CNPD added that in a video surveillance context, the EDPB specified that before using a video device, the purposes of processing have to be specified in detail under Article 5(1)(b) GDPR and that the monitoring purposes should be documented in writing ([https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201903_video_devices_en_0.pdf Guidelines 3/2019 on processing of personal data through video devices], §15). The CNPD also noted that the EDPB indicated that if any further processing is to take place, the controller must first make sure that this processing had purposes compatible with the original ones and design such processing accordingly. Whether a new purpose is compatible or not is assessed according to Article 6(4) GDPR ([https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201904_dataprotection_by_design_and_by_defau
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Délibération n° 2FR/2024 in LU
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
21 May 2024
Authority
Commission Nationale pour la Protection des Données
GDPRhub ID
gdprhub-8039About this data
Cite as: Cookie Fines. DPA case Délibération n° 2FR/2024 - Luxembourg (2024). Retrieved from cookiefines.eu
Last updated: