Consulting

October Data Protection Newsletter

insight featured image
Grant Thornton Luxembourg welcomes you to the October Data Protection Newsletter! Following the launch of our first issue in September, we continue our mission to provide you with a clear and practical overview of the latest developments in data protection, AI, and tech regulation, helping you stay informed and compliant in this ever-changing digital landscape. Whether you are a business navigating your compliance obligations or simply a citizen wanting to make your online life safer and more informed, this newsletter is for you. For more tailored advice or support, do not hesitate to reach out to our Data Protection Team using the details provided at the bottom of this page. We’ll be delighted to arrange an introductory meeting tailored to your needs.
Contents

EDPB adopts its opinion on the European Union (EU) Commission’s draft UK adequacy decisions

On 16 October 2025, the European Data Protection Board (EDPB) adopted its positive opinion on the European Commission’s proposal to extend the UK’s GDPR adequacy decision for six years beyond its expiry in December 2025.

Key takeaway

On 22 July 2025, the European Commission issued a draft decision renewing the UK’s adequacy status for 6 years, confirming that the UK GDPR and the Data Protection Act 2018 (as amended by the Data Act) remain essentially equivalent to the EU GDPR.

In its opinion, the EDPB welcomed the regulatory renewal but urged the UK Commission to closely monitor and clarify several issues, especially including:

  • the new adequacy test, which omits key elements from the previous framework;
  • the expanded national security exemptions;
  • the UK – U.S. Cloud Act Agreement;
  • the use of Technical Capability Notices that could weaken encryption; and
  • the Investigatory Powers Amendment Act 2024, which permits bulk data retention and examination where individuals have “low or no reasonable expectation of privacy.”

Why is it important?

The extension of the UK adequacy decision will allow EU organisations to continue transferring personal data to the UK without needing additional safeguards. 

While the final decision rests with the EU Commission, the EDPB’s assessment provides key guidance on potential risks and areas of regulatory focus, helping companies anticipate future changes and strengthen their compliance measures.

 

Did you know people could possibly buy your “reputation report” online?

Lithuania-based “Whitebridge Artificial Intelligence (AI)” faces a GDPR complaint for scraping personal data and selling AI-generated “reputation reports” on individuals without their consent.

Key takeaway

Whitebridge AI markets “reputation reports” on nearly anyone with an online presence, compiling scraped personal data from the web. The reports include AI-generated assumptions about individuals, such as alleged personality traits, conversation topics, and even analyses of whether users shared political, religious, or adult content.

Many data subjects are unaware their information has been collected, and the platform sells access to their own reports, rather than offering free access as required under GDPR. This business model appears to profit from users’ fear, encouraging them to pay to see what data has been gathered about them. 

A non-profit organisation has filed a complaint with the Lithuanian Data Protection Authority, arguing violations of data minimization, transparency, and access rights under the GDPR.

Why is it important?

This is a reminder that AI systems can easily cross privacy lines if they collect or are used to predict information about individuals without their consent. Companies using or developing AI systems should verify data sources, consent, and access rights compliance to mitigate risks of fines from regulators as well as the potential loss of customer trust.

 

If your business uses AI platforms that gather or analyse personal data, it is important to check how that data is sourced and used. Our team can help you understand the risks and make sure your AI use stays safe for users’ privacy.

 

CNIL sanctions the SAMARITAINE for hidden cameras filming employees in stockrooms

On 18 September 2025, The French supervisory authority (CNIL) fined the company SAMARITAINE SAS €100,000 for concealing cameras in the store’s stockrooms.

 

Key takeaway

In August 2023, SAMARITAINE SAS installed hidden cameras disguised as smoke detectors in its stockrooms to address increasing cargo thefts. Although the cameras were removed in September 2023 after employees discovered them, the CNIL fined the company for failing to implement adequate safeguards to balance its security objectives with employees’ privacy.

The CNIL found that SAMARITAINE SAS failed to:

·       conduct a Data Protection Impact Assessment or document the legitimacy of such an invasive temporary surveillance measure.

·       record the processing in its Record of Processing Activities;

·       involve the Data Protection Officer before installation; and

·       ensure proportionality, as the cameras also recorded audio, breaching the data minimization principle.

 

Why is it important?

This case shows that hidden or excessive monitoring, especially in workplaces, can lead to significant fines and loss of employee trust.

Organisations using cameras or other monitoring tools should make sure they are transparent, proportionate, and properly documented. 

NB: If you are based in Luxembourg, please note that the CNPD has published detailed guidance on how to lawfully implement video surveillance measures in the workplace.

 

Luxembourg’s CNPD reinforces the importance of appointing a DPO 

The Commission Nationale pour la protection des données (CNPD) in Luxembourg has published on its website the results of its recent review of public organizations’ compliance with the obligation to appoint a Data Protection Officer (DPO). 

 

Key takeaway

The CNPD conducted a targeted review of public-sector organisations that had not yet appointed a DPO as required under General Data Protection Regulation (GDPR) Article 37. 

 All reviewed institutions subsequently designated a DPO and submitted the contact details to the CNPD. 

 

Why is it important?

The CNPD is actively verifying whether public organisations that are required to have a Data Protection Officer (DPO) have appointed one, and its review is ongoing. This shows that the regulator is constantly moving from guidance to enforcement, ensuring that organisations meeting the criteria comply with their legal obligations under the GDPR.

Failing to designate a DPO where required to do so can lead to regulatory action and reputational risks. Now is the time for organisations, both public and private, to review whether they meet the criteria and ensure their DPO appointment and notification to the CNPD are properly in place. 

We can help your organisation assess whether a DPO is required, or if the DPO details have not been properly communicated to the competent authority. 

 

Contact

Need advice on Data Protection, AI, or Whistleblowing compliance?

Our Data Protection team is ready to help. Contact us to explore how we can assist you : Dara Kelly, Co-Lead Advisory Partner, or Pasquale Esposito, Data Protection Officer.