The subject is not new, but now the government has changed. Tine Larsen, the president of the National Commission for Data Protection (CNPD), and her commissioners say that the head of government Luc Frieden (CSV) and justice minister Élisabeth Margue (CSV) have listened attentively to grievances that are almost as old as the General Data Protection Regulation (2018).

A European exception, the Luxembourg CNPD is not allowed to disclose the identity of those who behave badly in the management of personal data. It’s only permitted within a very restrictive framework--once all avenues of appeal have been exhausted and provided that the damage caused by “naming and shaming” is not disproportionate to what the company is accused of.

Out of 434 notifications of breaches of the GDPR last year, almost two-thirds were due to simple human error. That’s already a lot. But almost a quarter were due to data being sent to the wrong person.

At a time when social networks are becoming increasingly outrageous in their efforts to attract an audience, good luck judging whether a public posting is “disproportionate.” But after all, everyone will have had time to put in place everything the law provides to avoid trouble.

Others simply shrug their shoulders and point out that each and every one of us already gives out personal data so easily that the fact that a service provider is caught “red-handed” won't make much difference.

The CNPD has been very fair in implementing the GDPR since 2018. Publicly, the regulator has never put the brakes on, preferring to increase its educational activities, inform the various players and find ways to improve certain situations.

Practical experience has shown that Luxembourg law was way off the mark in the Amazon case. While the CNPD was unable to communicate about the €746m fine--either to the media or to the general public--the information was known and shared by the European regulator and national regulators, which meant that it was only in Luxembourg that the story could not be told. The information itself had been revealed by Bloomberg, which had spotted it in the middle of Amazon’s annual report filed as part of its obligations to the US Securities and Exchange Commission. No communication in Luxembourg, but published in the United States and around the world.

But there are other, less publicised issues that Larsen raised as early as 2021, often with the consent of Viviane Reding, a former European Commissioner who was very much at the forefront of the issue and is now a member of the Luxembourg Chamber of Deputies:

1. The CNPD cannot name and shame, but the Luxembourg Financial Sector Supervisory Commission (CSSF) and the Conseil de la concurrence can;

2. The state and municipalities, among those who violate the GDPR, cannot be sanctioned or called to order properly by the CNPD, notes the minutes of a meeting in the Chamber of Deputies in 2021;

3. Some players, such as notaries, may invoke their professional secrecy in the face of questions from the CNPD.

It is this imbalance that the CNPD is calling on the government to remedy. And if the state and local authorities have nothing to reproach themselves for, there is no reason to put the brakes on this change. Particularly as, over the past five years, the CNPD has shown that it works in the public interest with all the intelligence that its mission requires.

This article was originally published in French.