[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5x6KSf5roy-ui3AolTwzF3hQ_-jsg4z5tm1V2f5Vooc":3},{"article":4,"iocs":44,"watch_terms":51,"solutions":52,"lesson":55},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"c5e5e610-6a5e-44a2-aafa-b6b95a7beb9c","CNPD (Luxembourg) - Délibération n° 3018","cnpd-luxembourg-deliberation-n-3018-fd6e73","← Older revision Revision as of 13:57, 23 June 2026 Line 10: Line 10: |ECLI= |ECLI= |Original_Source_Name_1= |Original_Source_Name_1=private blog |Original_Source_Link_1=https:\u002F\u002Fblog.zoller.lu\u002F2020\u002F05\u002Fhow-to-effectively-evade-gdpr-and-reach.html |Original_Source_Link_1=https:\u002F\u002Fblog.zoller.lu\u002F2020\u002F05\u002Fhow-to-effectively-evade-gdpr-and-reach.html |Original_Source_Language_1=English |Original_Source_Language_1=English","The Luxembourg National Data Protection Commission (CNPD) has refused to open an investigation into Rocketreach, a company accused of selling personal data of EU subjects without a legal basis. The CNPD cited Rocketreach's foreign establishment and lack of an EU representative as reasons for not proceeding, despite acknowledging potential GDPR breaches. This decision has drawn criticism for potentially allowing companies to evade accountability by operating outside the EU.","Luxembourg's CNPD refuses to investigate Rocketreach for GDPR violations due to its foreign establishment.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CNPD_(Luxembourg)_-_D%C3%A9lib%C3%A9ration_n%C2%B0_3018&diff=51958&oldid=37289","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F57\u002FLogoLU.png","2026-06-23T13:57:33+00:00","2026-06-23T14:00:25.872386+00:00",7,[17,20],{"name":18,"type":19},"Rocketreach","vendor",{"name":21,"type":22},"personal data","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",[45,49],{"type":46,"value":47,"context":48},"url","https:\u002F\u002Fblog.zoller.lu\u002F2020\u002F05\u002Fhow-to-effectively-evade-gdpr-and-reach.html","Source article discussing GDPR evasion",{"type":46,"value":50,"context":48},"https:\u002F\u002Fblog.zoller.lu\u002F2020\u002F10\u002Fhow-to-effectively-evade-gdpr-and-reach.html",[18,21],{"controls":53,"vendors":54},[],[],{"slug":56,"title":57,"body":58,"framework_refs":59,"framework_notes":69},"cnpd-refuses-to-investigate-rocketreach-over-gdpr-data-sales","CNPD Refuses to Investigate Rocketreach Over GDPR Data Sales","Rocketreach, a foreign company selling personal data of EU residents without a legal basis, escaped regulatory scrutiny because it lacked an EU establishment and a designated EU representative — both requirements under GDPR Articles 3 and 27. The Luxembourg CNPD acknowledged potential GDPR violations but declined to investigate due to these jurisdictional gaps. This case highlights a critical enforcement loophole: non-EU companies can process and monetize EU personal data while remaining practically unaccountable if they ignore GDPR establishment requirements. The decision undermines data subject rights and erodes trust in GDPR as a globally enforceable framework.",[60,61,62,63,64,65,66,67,68],"GDPR Article 3 (Territorial Scope)","GDPR Article 27 (Representatives of Controllers\u002FProcessors Not Established in the EU)","GDPR Article 6 (Lawfulness of Processing)","GDPR Article 46 (Transfers Subject to Appropriate Safeguards)","GDPR Article 58 (Powers of Supervisory Authorities)","NIST Privacy Framework PR.DS-P1 (Data Processing Policies)","NIST SP 800-53 PT-1 (Personally Identifiable Information Processing and Transparency Policy)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27701 (Privacy Information Management)",{}]