DPA case CNPD 38FR/2021 – €18,000 Fine (Luxembourg, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A public establishment in Luxembourg was fined €18,000 for not properly managing its data protection officer. This case highlights the importance of having adequate resources and documentation for compliance with data protection laws. It serves as a reminder for organizations to ensure they meet their obligations regarding data protection officers.
What happened
A public establishment was fined €18,000 for failing to meet data protection officer requirements.
Who was affected
The company involved was a public establishment in Luxembourg.
What the authority found
The authority ruled that the establishment did not provide sufficient resources for its data protection officer, violating GDPR requirements.
Why this matters
This ruling emphasizes that organizations must prioritize their data protection responsibilities. Companies should ensure they allocate proper resources for compliance to avoid penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Review needed — 18 October 2026.
Processing notes: amount discrepancy, date discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
CNPD decision 38FR/2021 of 15 October 2021 imposed a EUR 18,000 fine on anonymised Public Establishment A for failures concerning the data protection officer under GDPR Articles 37(7), 38(1), 38(2) and 39(1)(b). It ordered sufficient DPO resources and formally documented compliance monitoring within six months. The final decision did not retain an Article 38(6) infringement.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case CNPD 38FR/2021 in LU
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
15 October 2021
Authority
Commission Nationale pour la Protection des Données
Fine Amount
€18,000
GDPRhub ID
gdprhub-4324About this data
Cite as: Cookie Fines. DPA case CNPD 38FR/2021 - Luxembourg (2021). Retrieved from cookiefines.eu
Last updated: