First Administrative Fines Imposed By The Luxembourg Data Protection Supervisory Authority

On 7 June 2021, the Luxembourg National Data Protection Commission (Commission Nationale pour la Protection des Données – the "CNPD") published 18 decisions:

• in nine decisions, the CNPD found that controllers (Luxembourg-based companies) did not breach any of the provisions of the (EU) General Data Protection Regulation 2016/679 (the "GDPR") and decided therefore to close the ongoing investigation;
• in six decisions, the CNPD issued a formal warning (rappel à l'ordre) or an injunction to comply (injonction de se mettre en conformité) to companies due to breaches of the GDPR (sometimes associated with a fine);
• finally, in six cases, the CNPD decided to impose administrative fines on the entities concerned due to more significant violations of the GDPR.