“We are awaiting decisions from our supervisory minister [
The CNPD, which had 65 staff members last year, was presenting its activity report for 2023. Its president took the opportunity to outline the future development of the CNPD, which celebrated its 20th anniversary in 2022. “Among the changes we are calling for in our organic law, we would like to publish our decisions as soon as they are handed down, and also give the names of the companies sanctioned when the European regulation on artificial intelligence [AI Act, editor’s note] comes into force,” added Larsen.
44 opinions published
In its 2023 activity report, the CNPD lists all the activities it has undertaken over the past year. In 2023, the commission published 44 opinions (compared with 32 in 2022) on draft or proposed legislation or regulatory measures, including opinions on laws relating to the register of companies and beneficial owners, the rental of affordable housing and bodycams, among others.
“2023 marked the fifth anniversary of the entry into force of the General Data Protection Regulation (GDPR), a legal text that has had a profound impact on the CNPD’s missions and is only becoming more relevant. The almost ubiquitous collection and other processing of data--often of a personal nature--continues to drive the CNPD to resolutely pursue its mission as a supervisory authority, providing information and raising awareness about the protection of personal data and privacy.”
Human error the cause of data breaches
“The majority of requests for information sent to the CNPD in 2023 related either to surveillance in the workplace or to the rights of data subjects (right of access, right to erasure, etc.), demonstrating a public awareness and even a marked concern about data protection,” noted Larsen.
At the same time, the main reasons for the complaints received the previous year included questioning the lawfulness of data processing, failure to respect the right of access and data breaches. In addition, the 434 breach incidents reported to the national commission in 2023 included hacking, disclosure of personal data to the wrong person or personal data sent to the wrong person. The main cause of data breaches remained human error (61%).
Three fines totalling €6,500
CNPD officers also continued their investigative work, conducting 21 investigations in 2023 and analysing 32 cases. The committee took 15 decisions over the past year, three of which resulted in administrative fines totalling €6,500. “The three fines were imposed on private entities; they cannot be imposed on the state or local authorities. In particular, they concerned the use of a geolocation device on the cars of employees who had not been properly informed,” explained Larsen.
“Digital technology is not likely to stop its development, so our missions will continue to grow, which is why our workforce will also continue to increase. In 2023, we had 65 employees, compared with 54 in 2022, and in 2024 we will have six more. For 2025, our budget is currently under bilateral discussion with the relevant ministries, but we still hope to be able to recruit new staff,” said the CNPD president.
It should also be noted that the commission will have an annex in Statec’s new Twist complex as from October 2024, in addition to its current headquarters just opposite in Belval.
This article was originally published in French.
