The Luxembourg Data Protection Authority (CNPD) has
published its first decisions following investigations of
non-compliance with the General Data Protection Regulation (GDPR).
The decisions relate to the role of the DPO, the geolocation of
employees and video surveillance. This newsflash sets out the key
takeaways on these three topics.
Data protection officer (DPO)
In the event the function of DPO is combined with another role
within the organisation, it must be clearly demonstrated that this
combination of functions does not lead to a conflict of
interest.
In one decision, the CNPD found that combining
the roles of chief compliance officer, a position involved in
AML/KYC matters, and DPO was problematic. The CNPD concluded that
even when the CCO acts as a "second line of defence" in
reviewing the KYC process, the role of CCO in principle conflicts
with the role and responsibilities of the DPO, who can only review
data processing activities over which (s)he
