CNPD – Court Ruling (Luxembourg, 2024)

The Luxembourg DPA ("Commission Nationale pour la Protection des Données - CNPD") launched an investigation on a group of companies with a subsidiary based in Luxembourg (the controller). The group of companies had appointed a single DPO (the group's DPO) under Article 37(2) GDPR to handle all data protection matters and had appointed a lawyer as the local contact point in Luxembourg to assist the group's DPO. Article 37(2) GDPR allows for the possibility to appoint one DPO for a group of undertakings. The controller had also established a GDPR Board, a committee dedicated to data protection in Luxembourg. The DPO however was not a member of the GDPR Board and was only informed of the subjects discussed there through the minutes of the GDPR Board and through the questions raised by the local contact point during these meetings. The group's DPO did not seat in Luxembourg and was involved mostly indirectly, through the local contact point, in data protection-related matters of the Luxembourg entity. During the course of the investigation, the controller did appoint its own DPO, that started on 1 October 2020. The DPA found that even if the Group's DPO was participating in numerous meetings at a group level and regularly organised meetings with its local points of contact, this was not sufficient to demonstrate the direct, formal and permanent involvement of the DPO in Luxembourg. Therefore, the DPA found that the controller did not sufficiently involve the DPO with data protection matters violating Article 38(1) GDPR and Article 39 GDPR. It further found that the controller did not provided its DPO with the necessary resources and power, violating Article 38(2) GDPR. Thus, the DPA fined the controller €18,000. The controller appealed this decision at the Administrative Court of the Grand Duchy of Luxembourg ("Tribunal administratif du Grand-Duché de Luxembourg - TADM"), seeking annulment of the decision. The controller argued that the DPA used their power excessively in finding violations of Article 38(1) and (2) and Article 39 GDPR. Moreover, the controller argued that the French DPA ("CNIL") had investigated its parent company and the other entities located in France and did not find any violations or made any comments regarding the appointment of the group’s DPO. The controller also argued that the fine amount was disproportionate. Involvement of the group's DPO The court held that in order for the DPO to comply with its obligation to inform and advise the controller under Article 39(1) GDPR, it is necessary and imperative for the DPO to be involved in questions and projects involving issues relating to the protection of personal data at the earliest possible stage. The court found that the handling of the requests and complaints by data subjects was done by a local contact point without intervention of the group's DPO. The group's DPO was only involved when a data subject was not satisfied with the handling by the local contact point. Although the controller referred to regular communications via telephone, video conferences and e-mails between the local contact point and the group's DPO, it did not provide any documentation of these communications. It was also not demonstrated that the group's DPO had preliminary been consulted about putting into place the GDPR Board. The court dismissed the controller's argument that the DPA did not take into account that the controller appointed its own DPO during the investigation. The DPA only considered the facts as they existed on the day it started its investigation. The court agreed with the DPA that any changes made by the controller during the investigation would not eliminate an established breach and would not relieve the controller from their responsibility. The court also dismissed the controller's argument that the CNIL came to a different conclusion during its investigation of the parent company of the group and the other entities located in France. The court held that the CNIL's finding had no relevance as it did not concern the activities in Luxembourg and both the court and DPA are not bounded by decisions from administrative authorities or courts in other countries. Thus, the court found that the DPO was not directly involved in all data protection-related matters. Therefore, the controller violated Article 38(1) GDPR and Article 39 GDPR. Available resources for the DPO The court held that the controller did not present any information about formalising the working time devoted to data protection of the local contact point. The court also noted that the local contact point was the only lawyer in the controller's company in Luxembourg. The court held that the DPO had to be involved in all personal data protection related matters, general consultation was not sufficient. The court then took into account the volume of activities of the controller in Luxembourg (70 sites, between 1600 and 2100 employees and 25000 consumers per day), which would have justified at least one full time person being devoted to data protection. The court thus found that the controller violated Article 38(2) GDPR by not providing sufficient resources to its DPO. Imposed fine Concerning the proportionality of the fine, the court took into account Article 83 GDPR and the seriousness of the violation. The court found that the fine was proportionate as the violations that were found were serious, involved potentially a large number of people and lasted at least from 25 May 2018 to 1 October 2020. Thus, the court dismissed the appeal and upheld the DPA's decision that the controller violated Article 38(1) and (2) and Article 39 GDPR.