Introduction:

Article 37 of GDPR requires the appointment of a Data Protection Officer (“DPO”). The appointment of a DPO is a critical compliance requirement and recent decisions of the Luxembourg Data Protection Commission (a.k.a the “CNPD”) illustrate the implications of a failure to appoint a DPO, as well as the failure to adhere to GDPR’s prerequisites relating to the DPO’s function.

In addition, we note that use of video surveillance and geolocation technologies is another area that is subject to GDPR constraints. The use of such technologies requires an understanding of the lawfulness and conditions for compliance with GDPR.

We would like to bring to your attention four recent decisions of the CNPD published on November 2, 2021, relating to the implementation and enforcement of GDPR.

Three CNPD decisions were rendered following a deliberate and concerted investigation campaign carried out by the CNPD since 2018 in respect of the position and role of the DPO, as well as the importance of its integration into the organizational fabric of a company.

A fourth decision relates to the setting up of video surveillance and geolocation systems.

We note that the decisions taken are detailed and reasoned legal opinions that cite the legal basis for these decisions. These decisions serve as future guidance to organizations in the implementation of GDPR. The CNPD’s decisions imposed a range of sanctions ranging from warnings to fines. The fines ranged from EUR 3,500 to 18,000. In this context, we note that the CNPD applies GDPR strictly and will not hesitate to impose severe penalties.

The CNPD adapts the sanctions to the factual circumstances and takes into account the approach and collaborative attitude of the audited entity during the investigation.

It should be noted that the basis for a decision is taken on the findings at the outset of the investigation. Any subsequent corrective measures taken by the audited entity may be considered in determining the sanctions imposed.

The cases in detail:

Decision n ° 38 FR 2021 issued on October 15, 2021

The CNPD reiterated that:

• the identity of the DPO must be provided to the CNPD;
• the DPO will have all the resources necessary to enable it to carry out his mission, and these resources must be provided to the DPO by the entity;
• the DPO needs to be involved in all decisions relating to data protection and exercise a real control mission; and
• the DPO will require specific qualifications to be able to hold this position.

Sanction: administrative fine of € 18,000 and an order to comply.

Decision n ° 37 FR 2021 issued on October 13, 2021

The CNPD reiterated that:

• the identity of the DPO must be provided to the CNPD; and
• the independence of the DPO must be guaranteed, and in particular, to ensure that there is no conflict of interest.

Sanction: during the investigation, voluntary compliance measures were undertaken; only a call of legal reminder was made by the CNPD.

Decision n ° 36 FR 2021 issued on October 13, 2021

The CNPD reiterated that:

• the DPO has to be appointed based on professional qualifications;
• three years of professional experience in the field of data protection were deemed sufficient in the particular circumstances;
• the DPO must be involved in all decisions relating to data protection and exercise real control over decisions; and
• the entity concerned is required to introduce a formal data protection control plan.

Sanction: the CNPD issued an administrative fine of € 13,200.

CCTV Decision n ° 35 FR 2021 issued on October 13, 2021

• The audited entity had installed CCTV cameras within the company and geolocation systems in part of its fleet of vehicles.
  The CNPD reiterated the principle of “data minimization” in terms of video surveillance. This principle implies only strictly required data can be collected.
  To this end, before installing a video surveillance system, the data controller must define, in a precise manner, the purpose(s) it wishes to achieve by using such a system.
• The CNPD reiterated that an employee must not be subject to permanent surveillance, especially during their hours of rest.
• In the same order, the CNPD reiterated that the cameras intended to monitor an access point (entrance and exit, doorstep, porch, door, awning, hall, etc.) must have a limited field of vision.
• Clear and complete information must be provided in areas of surveillance (not a mere post sign).
• Information for employees on geolocation must be complete, clear and individualized (a mere post sign in the car is insufficient).

Fine: the CNPD imposed a fine of € 5,300 and orders to comply.

Contact:

Ronnen Gaito        gaito@rjgaito.com
Gwendoline Bella   gwendoline@rjgaito.com

40 rue Glesener
L-1630 Luxembourg

Tél. (352) 20 600 333
Fax. (352) 20 600 334
Mob. (352) 621 32 37 34

e-mail: info@rjgaito.com

https://rjgaito.com/

Overview

Contact:

Ronnen Gaito         gaito@rjgaito.com
Gwendoline Bella   gwendoline@rjgaito.com

40 rue Glesener
L-1630 Luxembourg

Tél. (352) 20 600 333
Fax. (352) 20 600 334

https://quizzical-clarke.77-68-21-77.plesk.page

Download Article

 

Formation of commercial contracts and enforceability of Luxembourg agreements

Highlights:

Our client, a leader in the software industry, recently prevailed in the Luxembourg Court of Appeal and received a favorable judgment that tacitly reconfirms a Supreme Court (“Cour de Cassation”) jugment of January 24, 2019. The judgment is of particular importance since it touches upon the essential elements of Luxembourg commerce and contract law and we were gratified that the Luxembourg Court of Appeal followed our reasoning.

Legal issues at stake:

Article 109 of the Luxembourg Code of Commerce states, inter alia, that “purchases and sales are evidenced by way of an invoice”. Until recently, this provision of the Code of Commerce operated as an implied and irrebuttable provision whereby the failure of a business to contest, within a reasonable time frame, an invoice rendered gave rise to an immediate debt recovery claim and served as conclusive and final evidence of the existence of a due and uncontestable debt, as well as the existence of an underlying agreement among parties (a.k.a “Facture Acceptée”). In these circumstances, irrespective of overwhelming evidence to the contrary, the Luxembourg courts were reluctant to intervene and adjudicated that, once an invoice was delivered and not disputed promptly, an irrebuttable presumption was created. Consequently, it was often the case that draconian judgments were rendered.

On January 24, 2019, the Luxembourg Supreme Court had softened this notion of “Facture Acceptée” in contracts which are non-sale of goods contracts. The Supreme Court stated that, “in the context of non-sale of goods contracts the “Facture Acceptée” is no longer an irrebuttable presumption of the existence of an alleged debt”.

Facts of the case:

Our client had a written and explicit non-sale of goods contract with certain counterparties. The counterparties spuriously served on our client a baseless (high value) invoice which was disputed. In the first instance, the Luxembourg District Court found that the invoice was not disputed in due course and further found that the invoice was based on a separate agreement on the basis of the principle of “Facture Acceptée”. The Luxembourg District Court chose, erroneously, to ignore the written contract.

We referred the matter to the Court of Appeal citing the Supreme Court judgment in question and the basic principle of Civil Law known as “Pacta Sunt Servanda” i.e. the contract governs the parties’ rights and obligations. Without citing the Supreme Court’s judgment of January 24, 2019, the Court of Appeal reversed the District Court’s decision, arguing that, in the face of our client’s disputed invoice, the burden of proof rests with the creditor to prove (i) the existence of the alleged debt and (ii) the existence of an underlying agreement. Considering the written contract produced and the lack of proof on the side of the claimant, the court applied the terms of the written agreement.

Our Take and Practical Advice:

• Clear and detailed written agreements are imperative for securing parties’ rights in Luxembourg. Note that, “boilerplate clauses”, such as an “Integration Clause”, can play a material role and will be enforced in accordance with their terms.
• The Luxembourg courts, de facto, reaffirmed their commitment to strict application of written agreements and enforcing agreements in accordance with their terms.
• Unlike courts in other Member States of the EU, the Luxembourg courts are reluctant to intervene in written contractual terms.
• Facture Acceptée remains a basic principle for sale of goods contracts. Therefore, contest your invoices promptly in a clear manner to avoid being trapped in a legal quagmire.
• If confronted with a debt claim regarding non-sale of goods contracts, we recommend to promptly and clearly dispute your invoice(s), however, bearing in mind that, if one fails to do so, and with a written agreement at hand, all is not lost in advance since the existence of a debt is no longer an irrebuttable presumption.

Download the PDF article (EN)