Unknown – €2,800 Fine (Luxembourg, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A company in Luxembourg was fined for keeping location data from its fleet's cars for too long and not informing drivers properly. The data was stored for over two years, which was deemed unnecessary. This case shows the importance of limiting data storage and being transparent with employees about data use.
What happened
A company installed location sensors on its cars and kept the data for over two years, which was excessive.
Who was affected
Drivers whose location data was collected and stored by the company's fleet management system.
What the authority found
The authority found the company violated GDPR by storing location data longer than necessary and failing to inform drivers properly.
Why this matters
This case underscores the need for businesses to limit how long they keep personal data and to clearly inform individuals about data use. Companies should review their data retention policies and transparency practices.
GDPR Articles Cited
The DPA from Luxembourg (CNPD) has imposed a fine of EUR 2,800 on a company. The controller had installed location sensors on a number of cars in its fleet. The purpose of this was to protect the company's assets, monitor the transport of goods and the drivers' working hours, among other things. Some of the location data collected by the controller was stored for two years and four months. The DPA states that this was clearly excessive and not necessary for the purposes of the processing. The DPA considered this to be a violation of the principle of storage limitation. In addition, the DPA found that the controller had not sufficiently informed the data subjects about the processing of the location data and had thus violated its information obligations pursuant to Art. 13 GDPR.
Related Enforcement Actions (8)
Other enforcement actions involving Unknown in LU
Fine
€3K
Details
Fine Date
8 April 2021
Authority
Commission Nationale pour la Protection des Données
Fine Amount
€2,800
Enforcement Tracker ID
ETid-742
About this data
Cite as: Cookie Fines. Unknown - Luxembourg (2021). Retrieved from cookiefines.eu
Last updated: