Not-for-profit Noyb, founded by data privacy activist Max Schrems, had called out the Luxembourg data protection watchdog for being one of the few national authorities to yet issue any fines since the European data protection regulation GDPR came into force in May 2018.

The CNPD on Monday added a section to its website on decisions taken following enquiries launched into data protection violations, with 18 cases uploaded.

In three cases, the CNPD levied fines with another three entities ordered to pay a fine and take corrective measures. Fines range between €1,000 to €18,000, with five of them issued for video surveillance and geolocalisation offences.

In nine cases the investigation was closed without a penalty and in three cases corrective measures were ordered.

The case files are anonymous, with Luxembourg having chosen not to pursue a “name and shame” approach.  And the penalties are the results of lengthy investigations.

In the case of an €18,000 fine over the failure to meet legal standards in the appointment of a data protection officer, the investigation began in September 2018.  

The entities fined have three months to appeal the CNPD’s decision.

This story was first published in French on Paperjam. It has been translated and edited for Delano.