Consulting

September Data Protection Newsletter

insight featured image
Grant Thornton Luxembourg welcomes you to the first edition of its Data Protection Newsletter! Each month, we will bring you a clear and accessible overview of key developments in data protection, AI, and tech regulation helping you stay ahead in an ever-evolving digital landscape. Whether you are a business navigating your compliance obligations or simply a citizen wanting to make your online life safer and more informed, this newsletter is for you. For more tailored advice or support, do not hesitate to reach out to our Data Protection Team.
Contents

CNPD Guidance on AI literacy: Using AI responsibly

The Luxembourgish supervisory authority (CNPD) has published a guidance for organisations to ensure a sufficient level of artificial intelligence (AI) literacy for their staff and other persons dealing with the operation and use of AI systems.

Key takeaway

This is an obligation under the new EU AI Act, in force since 2 February 2025, for companies and organisations to ensure “AI literacy” among people who use, deploy, or are otherwise involved with AI systems (Article 4 of the EU AI Act). It applies to all AI systems (not only the high risk ones), though the riskier ones attract greater scrutiny.

What this means in practice is that everyone handling AI, whether employees or providers, and depending on how the system is used, must have sufficient understanding of how the AI works, what risks it brings (for example, bias, or misuse of personal data), and how to use it responsibly. Organisations should assess the technical knowledge, education, and experience levels of the people involved; also look at what the AI is being used for (its context) and who will be affected (e.g., vulnerable persons).

Why is it important?

Ensuring that people understand the systems they interact with is not only a regulatory requirement but also key to maintaining trust and protecting individuals’ rights. AI misuse can lead to reputational damage, legal liability, and ethical consequences. Literacy is the first line of defence.

Non-compliance could lead to serious penalties: under the AI Act, fines of up to €35 million or 7% of global turnover.

For further guidance, contact our team to see how we can help you.

 

What are the risks when sharing photos and videos of your child on social networks?

The French supervisory authority (CNIL) has published a guidance about what risks “sharenting” (posting images/videos of children) can bring.

Key takeaway

Parents may underestimate how much information is exposed when content about children is shared publicly. 

Metadata in photos (location, time), visibility settings, the permanence of content, and how third parties (or even AI tools) might misuse images are all concerns. For example, images that seem innocent may be used for identity theft, deepfakes, or to build long‑term digital traces that the child may not want.

The guidance includes practical advice: use private messaging rather than public social media; limit visibility; ask for consent from the child (age appropriately) and from the other parent; avoid posting sensitive images such as those in private settings; hide or anonymise children’s faces; and regularly clean up by deleting old posts.

Why is it important?

The internet never forgets, and what seems like a harmless post today could become a source of embarrassment or harm later. Protecting children’s privacy is not just a personal choice, but a legal and ethical responsibility.

 

CNPD Luxembourg 2024 Activity Report

The Luxembourg supervisory authority (CNPD) released its 2024 annual report, spotlighting how central AI has become in its work.

Key takeaway

Since the entry into force of the EU AI Act, the CNPD has taken on its new role as the lead national authority in Luxembourg by actively supporting the responsible development and deployment of AI. 

Therefore, the CNPD has published several resources and initiatives. One such example is the “Sandkëscht”, a secure testing environment where companies can experiment with digital innovations, particularly those involving AI, while remaining aligned with GDPR principles. 

It also introduced DP4AI (Data Protection Basics: Artificial Intelligence), a training initiative designed to help individuals and professionals understand what “good, respectful AI” looks like in practice.

Beyond AI, several important developments also marked the year. As such, Luxembourg approved its first sector‑specific code of conduct (for temp‑employment services) to tailor data protection to specific work sectors.

Why is it important?

This report is important for several reasons. First, being one of the designated coordinators under the AI Act means the CNPD will have greater influence and responsibility. Organisations operating in Luxembourg or whose products or services reach the Luxembourg market, will increasingly need to align with the AI‑related frameworks the CNPD is developing.

Second, the emphasis on training, sandboxing, and codes of conduct means expectations will tighten. The supervisory authority is signaling that demonstrating responsible design, transparency, user accountability, and risk management is the norm.

 

Huge fine for SHEIN in France over cookies

The French supervisory authority (CNIL) fined SHEIN €150 million for placing cookies without valid consent, for insufficient information in the cookie banner, not properly enabling users to refuse second level (detailed) cookies and not honouring withdrawals of consent.

Key takeaway

During an inspection in August 2023, CNIL found that SHEIN was placing advertising cookies before users had given consent. Visitors were confronted with cookie banners that were incomplete, lacked crucial information (especially about what advertising cookies do and who third parties are), and often made “refuse all” or withdrawal of consent options ineffective. Some cookies stuck around even after users tried to reject them.

The scale of the violation played a role in determining the fine: SHEIN’s website gets approximately 12 million visits a month from users in France. The magnitude, combined with repeated failures, resulted in a sizable penalty.

Why this case matters

This case underscores the point that consent is not just a form to show users: it has to be real, informed, revocable, and technically enforced. 

Tools like cookie banners and settings interfaces are closely inspected now by all supervisory authorities around Europe and anything less than clear, honest, and effective puts any business at risk of a fine.

 

Contact

Seeking advice on data protection requirements or assistance navigating new privacy regulations? Our Data Protection team is ready to help. Contact us to explore how we can assist you : Dara Kelly, Co-Lead Advisory Partner, or Pasquale Esposito, Data Protection Officer.