Data Privacy and Cybresecurity

GDPR Guide to National Implementation: Luxembourg

A practical guide to national GDPR compliance requirements across the EEA

Article
|
15 min read

Luxembourg

In this chapter:

Q1/ Applicable legislation

Q2/ Personal data of deceased persons

Q3/ Legal bases for processing

Q4/ Consent of children

Q5/ Processing of sensitive personal data

Q6/ Data relating to criminal offences or convictions

Q7/ Exemptions

Q8/ Restrictions on data subjects’ rights

Q9/ Joint controllership

Q10/ Processor

Q11/ Data protection Impact Assessments

Q12/ Prior authorisation and public interest

Q13/ DPOs

Q14/ International data transfers

Q15/ DPAs

Q16/ Claims by not-for-profit bodies

Q17/ Administrative fines, penalties and sanctions

Q18/ Freedom of expression and information

Q19/ National identification numbers

Q20/ Processing in the context of employment

Q21/ Other material derogations

Q22/ Current legal challenges

Q23/ Enforcement

Q24/ Regulatory Guidance

———

[back to top of page]

 

 

Q1/ Applicable legislation

(a) Have the requirements of the GDPR been addressed by introducing a new law, or by updating existing legislation?

New legislation has been passed.

———

(b) Relevant legislation includes:

  • Law of 1 August 2018 organising the National Commission on Data Protection and implementing the GDPR (the “Data Protection Law”)
    • Date in force: 20 August 2018
    • Link: see here

———

(c) What is the status of national pre-GDPR data protection law?

The relevant pre-GDPR legislation has been repealed in full.

———

[back to top of page]

 

 

Q2/ Personal data of deceased persons

Does national law make specific rules regarding the processing of personal data of deceased persons?

There are no specific rules governing this issue.

———

[back to top of page]

 

 

Q3/ Legal bases for processing

(a) Does national law make specific rules regarding the processing of personal data in compliance with a legal obligation?

There are no specific rules governing this issue.

———

(b) Does national law make specific rules regarding the processing of personal data for the performance of tasks carried out in the public interest?

There are no specific rules governing this issue.

———

(c) Does national law make specific rules regarding the processing of personal data in the exercise of official authority vested in the controller?

There are no specific rules governing this issue.

———

(d) Does national law contain criteria in addition to those listed in the GDPR, to determine whether processing for a new purpose is compatible with the purpose for which the personal data were initially collected?

There are no specific additional criteria governing this issue.

———

[back to top of page]

 

 

Q4/ Consent of children

At what age can a child give their consent to processing in relation to ISS?

16 years of age.

———

[back to top of page]

 

 

Q5/ Processing of sensitive personal data

(a) Are there any sensitive personal data which cannot be processed on the basis of a data subject’s consent?

Genetic data cannot be processed even if the data subject’s consent has been obtained.

———

b) Does national law contain any specific requirements regarding the processing of sensitive personal data in respect of the following:

(i) Employment, social security and/or social protection law

Processing genetic data in the employment context is prohibited.

(ii) Substantial public interest

There are no specific rules on processing this category of data.

(iii) Preventative or occupational medicine; employee working capacity, medical diagnosis, provision of health or social care, or management of health or social care systems or services

There are no specific rules on processing this category of data.

(iv) Public interest in the area of public health

There are no specific rules on processing this category of data.

(v) Archiving purposes, scientific or historical research purposes or statistical purposes

When processing sensitive personal data for archiving purposes, scientific or historical research purposes or statistical purposes which allow for the exemption of data subjects’ rights, national law provides for certain additional safeguards, intended to protect the data subjects‘ rights and freedoms. These include:

  • the designation of a DPO;
  • the requirement to perform an Impact Assessment; and
  • the obligation of anonymisation or pseudonymisation when processing this category of data.

———

(c) Has national law introduced any further conditions and/ or limitations with regard to the processing of genetic data, biometric data, or health data?

Processing genetic data in the context of employment and insurance is prohibited.

———

[back to top of page]

 

 

Q6/ Data relating to criminal offences or convictions

Under what conditions does national law permit the processing of personal data relating to criminal convictions?

The processing of personal data relating to criminal convictions and offences for the purposes of journalistic, academic, artistic or literary expression is not subject to the restrictions set out in Art. 10 GDPR.

However, data relating to criminal convictions and offences can only be processed under specific legal provisions. For example, the processing of criminal records is strictly regulated by the Law of 29 March 2013.

———

[back to top of page]

 

 

Q7/ Exemptions

(a) Does national law specify exemptions to a data subject’s right to erasure?

There are no specific exemptions to the right to erasure.

———

(b) Does national law specify exemptions to a data subject’s right to be provided information under Art. 14 GDPR where the personal data has not been obtained from the data subject?

Processing personal data for the purposes of journalistic, academic, artistic or literary expression is not subject to the obligation to provide information to data subjects where the application of this right could compromise the collection of data, the publication of such data, or could provide information which would allow identification of the sources of information.

———

(c) Does national law specify exemptions to a data subject’s right to not be subject to a decision based solely on automated processing, including profiling?

There are no specific exemptions to the right to not be subject to automated individual decision-making.

———

[back to top of page]

 

 

Q8/ Restrictions on data subjects’ rights

Aside from the exemptions noted in Q7, does national law contain any other restrictions on the rights of data subjects under Chapter III GDPR?

There are no additional restrictions on data subjects’ rights.

———

[back to top of page]

 

 

Q9/ Joint controllership

Does national law provide rules or guidance on the apportionment of responsibility between joint controllers?

There are no additional rules on apportionment of liability between joint controllers.

———

[back to top of page]

 

 

Q10/ Processor

In addition to the contract between controller and processor, are there any pieces of legislation which govern processing by a processor?

The Civil Code, which governs contracts, applies to data processing agreements.

———

[back to top of page]

 

 

Q11/ Impact Assessments

Are there any circumstances in which national law requires an Impact Assessment to be carried out, where the GDPR would not otherwise require such an assessment?

When processing personal data for scientific or historical research purposes or statistical purposes, the controller may be required to perform an Impact Assessment depending on the nature, scope, context and purposes for processing, as well as the varying levels of likelihood and severity of risk to the rights and freedoms of natural persons.

———

[back to top of page]

 

 

Q12/ Prior authorisation and public interest

Are there any circumstances in which national law requires controllers to consult with, or obtain prior authorisation from, the DPA in relation to processing for the performance of a task carried out by the controller in the public interest (including processing in relation to social protection and public health)?

Prior authorisation from the DPA is only required in accordance with the provisions of the GDPR.

———

[back to top of page]

 

 

Q13/ DPOs

(a) Does national law require controllers to appoint a DPO in circumstances other than those in Art. 37(1) GDPR?

When processing personal data for scientific or historical research purposes or statistical purposes, the controller may be required to appoint a DPO, depending on the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of data subjects.

Controllers and processors must communicate the contact details of their designated DPO to the DPA.

———

(b) Does national law impose secrecy and confidentiality obligations on DPOs and if so, in what circumstances do they apply?

DPOs are not subject to specific secrecy obligations under the Data Protection Law or under other laws.

———

[back to top of page]

 

 

Q14/ International data transfers

(a) Does national law make specific rules about transfers of personal data from public registers?

Data transfers from public registers are not subject to specific rules.

———

(b) Does national law restrict the transfer of specific categories of personal data to third countries?

Data transfers are not subject to restrictions beyond those set out in the GDPR.

———

[back to top of page]

 

 

Q15/ DPAs

(a) Details of the DPA(s).

  • Name of DPA: National Commission for Data Protection (CNPD)
    • Address: 1 Avenue du Rock’n’Roll, L-4361 Esch-sur-Alzette, Luxembourg
    • Website: cnpd.public.lu

———

(b) If more than one national DPA has been established, what is the rationale behind multiple DPAs?

Not applicable as there is only one DPA.

———

(c) How does national law ensure consistent application of the GDPR by the various DPAs in accordance with Art. 63 GDPR?

Not applicable.

———

(d) Does national law grant the relevant DPA additional powers beyond those set out in Art. 58 GDPR?

The DPA has the power to impose daily penalty payments of up to 5% of the daily average turnover of the previous year, in order to oblige the controller to:

  • communicate to the DPA any information requested in accordance with Art. 58(1)(a) GDPR; and
  • comply with measures adopted by the DPA in its enforcement of Art. 58(2)(c)-(h) & (j) GDPR.

———

(e) What national appeals process exists to enable parties to challenge the decisions of the DPA?

Decisions of the DPA may be challenged before the Luxembourg Administrative Tribunal.

———

(f) Have specific national rules been adopted regarding the DPA’s power to obtain information from controllers or processors that are subject to obligations of professional secrecy (or equivalent)?

There are specific rules that apply to the DPA’s power to obtain information from lawyers, notaries and auditors. Access to such information is restricted, and the DPA can only obtain access to personal data and information that is necessary for the performance of its tasks under the professional regulations applicable to lawyers, notaries and auditors. Additionally, access to the premises of lawyers and auditors is subject to the legal provisions regulating their profession.

———

[back to top of page]

 

 

Q16/ Claims by not-for-profit bodies

Does national law specify any not-for-profit bodies that are entitled to bring claims on behalf of individuals without the specific mandate of those individuals?

There are no not-for-profit bodies that are specifically mandated to bring such claims.

———

[back to top of page]

 

 

Q17/ Administrative fines, penalties and sanctions

(a) Does national law lay down rules on whether and to what extent administrative fines may be imposed on public authorities for breaches of the GDPR?

The DPA cannot impose administrative fines on the State or municipalities.

———

(b) Does national law impose penalties/sanctions in addition to those set out in the GDPR, for breaches of the GDPR not subject to administrative fines (e.g., criminal penalties)?

The following additional sanctions are available:

  • criminal fines ranging from €251 to €250,000 and/or prison sentences ranging from eight days to one year can be imposed in the case of a breach of the legal provision regulating the processing of data for monitoring purposes in the employment context;
  • daily penalty payments of up to 5% of the daily average turnover of the previous year can be imposed by the DPA, in order to oblige the controller to:
    • communicate to the DPA any information requested in application of Art. 58(1)(a) GDPR; and
    • comply with measures adopted by the DPA in the application of Art. 58(2)(c)-(h) & (j) GDPR;
  • criminal fines ranging from €251 to €250,000 and/or prison sentences ranging from eight days to one year can be imposed for obstructing the performance of the DPA’s duties; and
  • publication of the DPA’s decisions.

———

[back to top of page]

 

 

Q18/ Freedom of expression and information

(a) What (if anything) does national law do to balance the provisions of the GDPR against the right to freedom of expression and information?

Specific derogations exist with respect to the processing of personal data for the purposes of journalistic, academic, artistic or literary expression in order to balance the provisions of the GDPR with fundamental rights (see Q18(b) below).

———

(b) What derogations have been introduced by national law concerning the processing of personal data for the purpose of academic, artistic or literary expression?

The processing of personal data for the purpose of journalistic, academic, artistic and or literary expression is not subject to the following provisions of the GDPR:

  • provisions on the prohibition and restriction to process sensitive personal data (i.e., an exception to Arts. 9(1) & 10 GDPR);
  • provisions on the transfer of personal data to third countries or international organisations, to the extent that data  protection provisions should be balanced against the right to freedom of expression and information (i.e., an exception to Arts. 44-50 GDPR);
  • provisions on the obligation to inform data subjects when the application of such rights may compromise the collection of data, the publication of such data, or could provide information which would allow identification of the sources of information (i.e., an exception to Arts. 13-14 GDPR); and
  • provisions on the right of access by the data subject (i.e., an exception to Art. 15 GDPR).

———

[back to top of page]

 

 

Q19/ National identification numbers

Does national law stipulate specific conditions for the processing of a national identification number, and if so, what are the conditions?

The conditions for the processing of the Luxembourg National Identification Number are set out in specific legislation relating to national identification.

———

[back to top of page]

 

 

Q20/ Processing in the context of employment

(a) For what purposes can employees’ personal data in the employment context be processed under national law?

The Data Protection Law provides a legal basis to process personal data in the employment context for monitoring purposes. Additionally, other legal provisions may allow or require employers to process employees’ personal data.

———

(b) Does national law provide safeguards for employees’ dignity, legitimate interests, and fundamental rights?

The Data Protection Law provides the following safeguards in relation to the processing of employees’ data for monitoring purposes:

  • the controller must inform the works council or, if no works council exists, the Inspectorate of Labour and Mines, of any processing for monitoring purposes in the employment context, prior to the implementation of such processing; and
  • the works council or, as the case may be, the employees, can request the DPA to provide its opinion on the compliance of the monitoring activities within 15 days of being notified of the processing by the controller.

———

[back to top of page]

 

 

Q21/ Other material derogations

Are there any other material derogations from, or additions to, the GDPR under national law?

There are no other material derogations.

———

[back to top of page]

 

 

Q22/ Current legal challenges

Are there any current legal challenges (e.g., court cases or regulatory appeals) regarding the validity or operation of the national GDPR implementation law (e.g., claims that the law incorrectly applies the GDPR; claims that the law is incompatible with constitutional principles; etc.)?

There are no current legal challenges ongoing.

———

[back to top of page]

 

 

Q23/ Enforcement

Has the local DPA issued any material fines or taken any material enforcement action to date for breaches of the GDPR?

The DPA has yet to take enforcement action for breaches of the GDPR.

———

[back to top of page]

 

 

Q24/ Regulatory Guidance

Has the DPA issued any significant guidance on the application of the GDPR or national implementation law?

XXX

The DPA has issued the following guidance on the application of the GDPR and/or GDPR implementation law:

  • guidelines on CCTV (see here (in French));
  • general guidelines on application of the GDPR (see here (in French));
  • overview of the consequences of Brexit for international data transfers (see here (cnpd.public.lu/en/dossiers-thematiques/transferts-internationaux-donnees-personnelles/brexit.html) (in English)); and
  • the decision of the DPA with respect to the list of processing operations for which an Impact Assessment is required (see here (in French)).

———

[back to top of page]

 

 

LG Avocats contributor

Herve Wolff

Hervé Wolff
Partner, LG Avocats
T +352 44 37 37 65
E hw@lgavocats.lu

Hervé is specialised in data protection & privacy, e-commerce, media, telecommunications and intellectual property.

In the field of data protection, he provides legal advice on all aspects of Luxembourg and EU privacy and data protection law, including on international data transfers, CCTV, monitoring of employees, outsourcing agreements, data breaches and privacy policies. He represents clients at the DPA and assists them with enquiries when necessary.

Hervé is a lawyer registered at the Luxembourg bar (“Avocat à la Cour”). He is a member of CyAN since 2015, a Cybersecurity Advisors Network, and he regularly publishes articles in his areas of expertise.

———

[back to top of page]

 

 

Other chapters

———

See also:

Our Global Data, Privacy & Cybersecurity Practice »

GDPR Handbook: Unlocking the EU General Data Protection Regulation »

———

[back to top of page]

 

 

This publication is provided for your convenience and does not constitute legal advice. This publication is protected by copyright.
© 2019 White & Case LLP

 

Top