Unknown – €15,400 Fine (Luxembourg, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A company in Luxembourg was fined EUR 15,400 for not properly involving its data protection officer in privacy matters. The officer was not reporting directly to top management, which is required by GDPR. This case shows that companies must ensure their privacy officers are fully integrated into their data protection processes.
What happened
The company failed to involve its data protection officer in all relevant privacy matters and did not have them report directly to top management.
Who was affected
The company's data protection officer and potentially the individuals whose data was not properly managed.
What the authority found
The Luxembourg authority decided that the company did not adequately involve its data protection officer in privacy matters, violating GDPR requirements.
Why this matters
This case highlights the critical role of data protection officers and the need for them to be directly involved in privacy decisions. Companies should ensure their officers have the authority and access needed to fulfill their duties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 13 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Luxembourg DPA has imposed a fine of EUR 15,400 on a company. According to the DPA, the controller failed to involve the data protection officer in all matters related to the protection of personal data. In addition, contrary to the requirements of the GDPR, the data protection officer did not report directly to the highest management level; instead, there were two levels of hierarchy in between. Also, the controller did not have a data protection control plan in place to demonstrate that the data protection officer was performing their duties appropriately.
Related Enforcement Actions (14)
Other enforcement actions involving Unknown in LU
Fine
€15K
Details
Fine Date
27 October 2021
Authority
Commission Nationale pour la Protection des Données
Fine Amount
€15,400
About this data
Cite as: Cookie Fines. Unknown - Luxembourg (2021). Retrieved from cookiefines.eu
Last updated: