Luxembourg
Other chapters
Foreword and issue-by-issue comparison
Luxembourg
Get your copy
Request a hard copy of the GDPR Guide to National Implementation »
In this chapter:
Q1/ Applicable legislation
(a) Have the requirements of the GDPR been addressed by introducing a new law, or by updating existing legislation?
New legislation has been passed.
———
(b) Relevant legislation includes:
- Law of 1 August 2018 organising the National Commission on Data Protection and implementing the GDPR (the “Data Protection Law”)
- Date in force: 20 August 2018
- Link: see here
———
(c) What is the status of national pre-GDPR data protection law?
The relevant pre-GDPR legislation has been repealed in full.
Q2/ Personal data of deceased persons
Does national law make specific rules regarding the processing of personal data of deceased persons?
There are no specific rules governing this issue.
Q3/ Legal bases for processing
(a) Does national law make specific rules regarding the processing of personal data in compliance with a legal obligation?
There are no specific rules governing this issue.
———
(b) Does national law make specific rules regarding the processing of personal data for the performance of tasks carried out in the public interest?
There are no specific rules governing this issue.
———
(c) Does national law make specific rules regarding the processing of personal data in the exercise of official authority vested in the controller?
There are no specific rules governing this issue.
———
(d) Does national law contain criteria in addition to those listed in the GDPR, to determine whether processing for a new purpose is compatible with the purpose for which the personal data were initially collected?
There are no specific additional criteria governing this issue.
Q4/ Consent of children
At what age can a child give their consent to processing in relation to ISS?
16 years of age.
Q5/ Processing of sensitive personal data
(a) Are there any sensitive personal data which cannot be processed on the basis of a data subject’s consent?
Genetic data cannot be processed even if the data subject’s consent has been obtained.
———
b) Does national law contain any specific requirements regarding the processing of sensitive personal data in respect of the following:
(i) Employment, social security and/or social protection law
Processing genetic data in the employment context is prohibited.
(ii) Substantial public interest
There are no specific rules on processing this category of data.
(iii) Preventative or occupational medicine; employee working capacity, medical diagnosis, provision of health or social care, or management of health or social care systems or services
There are no specific rules on processing this category of data.
(iv) Public interest in the area of public health
There are no specific rules on processing this category of data.
(v) Archiving purposes, scientific or historical research purposes or statistical purposes
When processing sensitive personal data for archiving purposes, scientific or historical research purposes or statistical purposes which allow for the exemption of data subjects’ rights, national law provides for certain additional safeguards, intended to protect the data subjects‘ rights and freedoms. These include:
- the designation of a DPO;
- the requirement to perform an Impact Assessment; and
- the obligation of anonymisation or pseudonymisation when processing this category of data.
———
(c) Has national law introduced any further conditions and/ or limitations with regard to the processing of genetic data, biometric data, or health data?
Processing genetic data in the context of employment and insurance is prohibited.
Q6/ Data relating to criminal offences or convictions
Under what conditions does national law permit the processing of personal data relating to criminal convictions?
The processing of personal data relating to criminal convictions and offences for the purposes of journalistic, academic, artistic or literary expression is not subject to the restrictions set out in Art. 10 GDPR.
However, data relating to criminal convictions and offences can only be processed under specific legal provisions. For example, the processing of criminal records is strictly regulated by the Law of 29 March 2013.
Q7/ Exemptions
(a) Does national law specify exemptions to a data subject’s right to erasure?
There are no specific exemptions to the right to erasure.
———
(b) Does national law specify exemptions to a data subject’s right to be provided information under Art. 14 GDPR where the personal data has not been obtained from the data subject?
Processing personal data for the purposes of journalistic, academic, artistic or literary expression is not subject to the obligation to provide information to data subjects where the application of this right could compromise the collection of data, the publication of such data, or could provide information which would allow identification of the sources of information.
———
(c) Does national law specify exemptions to a data subject’s right to not be subject to a decision based solely on automated processing, including profiling?
There are no specific exemptions to the right to not be subject to automated individual decision-making.
Q8/ Restrictions on data subjects’ rights
Aside from the exemptions noted in Q7, does national law contain any other restrictions on the rights of data subjects under Chapter III GDPR?
There are no additional restrictions on data subjects’ rights.
Q9/ Joint controllership
Does national law provide rules or guidance on the apportionment of responsibility between joint controllers?
There are no additional rules on apportionment of liability between joint controllers.
Q10/ Processor
In addition to the contract between controller and processor, are there any pieces of legislation which govern processing by a processor?
The Civil Code, which governs contracts, applies to data processing agreements.
Q11/ Impact Assessments
Are there any circumstances in which national law requires an Impact Assessment to be carried out, where the GDPR would not otherwise require such an assessment?
When processing personal data for scientific or historical research purposes or statistical purposes, the controller may be required to perform an Impact Assessment depending on the nature, scope, context and purposes for processing, as well as the varying levels of likelihood and severity of risk to the rights and freedoms of natural persons.
Q12/ Prior authorisation and public interest
Are there any circumstances in which national law requires controllers to consult with, or obtain prior authorisation from, the DPA in relation to processing for the performance of a task carried out by the controller in the public interest (including processing in relation to social protection and public health)?
Prior authorisation from the DPA is only required in accordance with the provisions of the GDPR.
Q13/ DPOs
(a) Does national law require controllers to appoint a DPO in circumstances other than those in Art. 37(1) GDPR?
When processing personal data for scientific or historical research purposes or statistical purposes, the controller may be required to appoint a DPO, depending on the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of data subjects.
Controllers and processors must communicate the contact details of their designated DPO to the DPA.
———
(b) Does national law impose secrecy and confidentiality obligations on DPOs and if so, in what circumstances do they apply?
DPOs are not subject to specific secrecy obligations under the Data Protection Law or under other laws.
Q14/ International data transfers
(a) Does national law make specific rules about transfers of personal data from public registers?
Data transfers from public registers are not subject to specific rules.
———
(b) Does national law restrict the transfer of specific categories of personal data to third countries?
Data transfers are not subject to restrictions beyond those set out in the GDPR.
Q15/ DPAs
(a) Details of the DPA(s).
- Name of DPA: National Commission for Data Protection (CNPD)
- Address: 1 Avenue du Rock’n’Roll, L-4361 Esch-sur-Alzette, Luxembourg
- Website: cnpd.public.lu
———
(b) If more than one national DPA has been established, what is the rationale behind multiple DPAs?
Not applicable as there is only one DPA.
———
(c) How does national law ensure consistent application of the GDPR by the various DPAs in accordance with Art. 63 GDPR?
Not applicable.
———
(d) Does national law grant the relevant DPA additional powers beyond those set out in Art. 58 GDPR?
The DPA has the power to impose daily penalty payments of up to 5% of the daily average turnover of the previous year, in order to oblige the controller to:
- communicate to the DPA any information requested in accordance with Art. 58(1)(a) GDPR; and
- comply with measures adopted by the DPA in its enforcement of Art. 58(2)(c)-(h) & (j) GDPR.
———
(e) What national appeals process exists to enable parties to challenge the decisions of the DPA?
Decisions of the DPA may be challenged before the Luxembourg Administrative Tribunal.
———
(f) Have specific national rules been adopted regarding the DPA’s power to obtain information from controllers or processors that are subject to obligations of professional secrecy (or equivalent)?
There are specific rules that apply to the DPA’s power to obtain information from lawyers, notaries and auditors. Access to such information is restricted, and the DPA can only obtain access to personal data and information that is necessary for the performance of its tasks under the professional regulations applicable to lawyers, notaries and auditors. Additionally, access to the premises of lawyers and auditors is subject to the legal provisions regulating their profession.
Q16/ Claims by not-for-profit bodies
Does national law specify any not-for-profit bodies that are entitled to bring claims on behalf of individuals without the specific mandate of those individuals?
There are no not-for-profit bodies that are specifically mandated to bring such claims.
Q17/ Administrative fines, penalties and sanctions
(a) Does national law lay down rules on whether and to what extent administrative fines may be imposed on public authorities for breaches of the GDPR?
The DPA cannot impose administrative fines on the State or municipalities.
———
(b) Does national law impose penalties/sanctions in addition to those set out in the GDPR, for breaches of the GDPR not subject to administrative fines (e.g., criminal penalties)?
The following additional sanctions are available:
- criminal fines ranging from €251 to €250,000 and/or prison sentences ranging from eight days to one year can be imposed in the case of a breach of the legal provision regulating the processing of data for monitoring purposes in the employment context;
- daily penalty payments of up to 5% of the daily average turnover of the previous year can be imposed by the DPA, in order to oblige the controller to:
- communicate to the DPA any information requested in application of Art. 58(1)(a) GDPR; and
- comply with measures adopted by the DPA in the application of Art. 58(2)(c)-(h) & (j) GDPR;
- criminal fines ranging from €251 to €250,000 and/or prison sentences ranging from eight days to one year can be imposed for obstructing the performance of the DPA’s duties; and
- publication of the DPA’s decisions.
Q18/ Freedom of expression and information
(a) What (if anything) does national law do to balance the provisions of the GDPR against the right to freedom of expression and information?
Specific derogations exist with respect to the processing of personal data for the purposes of journalistic, academic, artistic or literary expression in order to balance the provisions of the GDPR with fundamental rights (see Q18(b) below).
———
(b) What derogations have been introduced by national law concerning the processing of personal data for the purpose of academic, artistic or literary expression?
The processing of personal data for the purpose of journalistic, academic, artistic and or literary expression is not subject to the following provisions of the GDPR:
- provisions on the prohibition and restriction to process sensitive personal data (i.e., an exception to Arts. 9(1) & 10 GDPR);
- provisions on the transfer of personal data to third countries or international organisations, to the extent that data protection provisions should be balanced against the right to freedom of expression and information (i.e., an exception to Arts. 44-50 GDPR);
- provisions on the obligation to inform data subjects when the application of such rights may compromise the collection of data, the publication of such data, or could provide information which would allow identification of the sources of information (i.e., an exception to Arts. 13-14 GDPR); and
- provisions on the right of access by the data subject (i.e., an exception to Art. 15 GDPR).
Q19/ National identification numbers
Does national law stipulate specific conditions for the processing of a national identification number, and if so, what are the conditions?
The conditions for the processing of the Luxembourg National Identification Number are set out in specific legislation relating to national identification.
Q20/ Processing in the context of employment
(a) For what purposes can employees’ personal data in the employment context be processed under national law?
The Data Protection Law provides a legal basis to process personal data in the employment context for monitoring purposes. Additionally, other legal provisions may allow or require employers to process employees’ personal data.
———
(b) Does national law provide safeguards for employees’ dignity, legitimate interests, and fundamental rights?
The Data Protection Law provides the following safeguards in relation to the processing of employees’ data for monitoring purposes:
- the controller must inform the works council or, if no works council exists, the Inspectorate of Labour and Mines, of any processing for monitoring purposes in the employment context, prior to the implementation of such processing; and
- the works council or, as the case may be, the employees, can request the DPA to provide its opinion on the compliance of the monitoring activities within 15 days of being notified of the processing by the controller.
Q21/ Other material derogations
Are there any other material derogations from, or additions to, the GDPR under national law?
There are no other material derogations.
Q22/ Current legal challenges
Are there any current legal challenges (e.g., court cases or regulatory appeals) regarding the validity or operation of the national GDPR implementation law (e.g., claims that the law incorrectly applies the GDPR; claims that the law is incompatible with constitutional principles; etc.)?
There are no current legal challenges ongoing.
Q23/ Enforcement
Has the local DPA issued any material fines or taken any material enforcement action to date for breaches of the GDPR?
The DPA has yet to take enforcement action for breaches of the GDPR.
Q24/ Regulatory Guidance
Has the DPA issued any significant guidance on the application of the GDPR or national implementation law?
XXX
The DPA has issued the following guidance on the application of the GDPR and/or GDPR implementation law:
- guidelines on CCTV (see here (in French));
- general guidelines on application of the GDPR (see here (in French));
- overview of the consequences of Brexit for international data transfers (see here (cnpd.public.lu/en/dossiers-thematiques/transferts-internationaux-donnees-personnelles/brexit.html) (in English)); and
- the decision of the DPA with respect to the list of processing operations for which an Impact Assessment is required (see here (in French)).
LG Avocats contributor
|
Hervé Wolff |
|
Hervé is specialised in data protection & privacy, e-commerce, media, telecommunications and intellectual property. In the field of data protection, he provides legal advice on all aspects of Luxembourg and EU privacy and data protection law, including on international data transfers, CCTV, monitoring of employees, outsourcing agreements, data breaches and privacy policies. He represents clients at the DPA and assists them with enquiries when necessary. Hervé is a lawyer registered at the Luxembourg bar (“Avocat à la Cour”). He is a member of CyAN since 2015, a Cybersecurity Advisors Network, and he regularly publishes articles in his areas of expertise. |
|
Other chapters
- Foreword and issue-by-issue comparison
- Country-by-country guides:
|
———
See also:
Our Global Data, Privacy & Cybersecurity Practice »
GDPR Handbook: Unlocking the EU General Data Protection Regulation »
———
This publication is provided for your convenience and does not constitute legal advice. This publication is protected by copyright.
© 2019 White & Case LLP
