Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation) LU-LDP-Enforcement-Sanctions-Article-43-Public-Sector-Cap-Administrative-Fines-CNPD-Article-9-Powers: Luxembourg LDP Enforcement + Article 43 Public Sector Cap + Administrative Fines + CNPD

Luxembourg LDP Article 43 + 57 Enforcement and Sanctions + Transitional Provisions. Article 43 Limitation on Administrative Fines for Public Sector (LUXEMBOURG-UNIQUE) - administrative fines under GDPR Article 83 do not apply to State + municipalities + public legal entities except where they operate as economic operators in competitive market or process personal data in commercial context similar to private sector + alternative sanctions for public sector include warnings + corrective orders + injunctions + cooperation with internal disciplinary procedures + parliamentary oversight + Court of Audit (Cour des Comptes) supervision. CNPD Administrative Fines for private sector follow GDPR Article 83 tiered system: (i) up to EUR 10 million or 2% of total worldwide annual turnover whichever is higher for lower-tier infringements; (ii) up to EUR 20 million or 4% of total worldwide annual turnover whichever is higher for higher-tier infringements (e.g., Amazon Luxembourg EUR 746 million CNPD fine 2021 - highest GDPR fine to date). CNPD Resolution criteria mirroring GDPR Article 83(2): gravity + good faith + advantage obtained + adverse impact + cumulative + mitigation + cooperation. Article 25 + 48 Criminal Sanctions - Luxembourg Penal Code (Code Penal) Article 458 (violation of professional secrecy) imprisonment up to 6 months or fine + Article 195 + Loi du 1er aout 2018 specific criminal provisions for wilful violations + corporate criminal liability. Article 57 Transitional Provisions + entry into force 20 August 2018 + repeal of 2002 Luxembourg Data Protection Law. Article 9 CNPD Cooperation with EDPB consistency mechanism + Convention 108+ Committee + Luxembourg-Belgium-France-Germany cross-border DPA cooperation + cooperation with CSSF + CAA + ABBL + ALFI + ACA + ILR + CIRCL. Judicial review by Luxembourg Administrative Tribunal (Tribunal Administratif) + appeal to Administrative Court (Cour Administrative) + Constitutional Court for constitutional issues.