We would like to ensure that you are still receiving content that you find useful – please confirm that you would like to continue to receive ILO newsletters.
17 July 2019
Luxembourg implemented the EU General Data Protection Regulation (GDPR) through the Law of 1 August 2018 on the Organisation of Luxembourg's National Commission for Data Protection (CNPD) and the General System for Protecting Data, which came into force on 20 August 2018.
The law modified Article L 261-1 of the Labour Code, which concerns the monitoring of employees.
Employers can process personal data to monitor their employees under the circumstances set out in Article 6(1) of the GDPR. Thus, the scope of such processing has been extended in Luxembourg, as employers could previously use a monitoring system in the workplace only in the five circumstances set out in the Labour Code. Further, employers no longer have to obtain the CNPD's prior authorisation to monitor employees.
Employers must still inform the person in question – as well as the relevant staff delegation or, failing that, the Inspectorate of Labour and Mines – in advance of any processing of personal data to monitor employees' activities. The Labour Code now specifies that this prior notice must include:
Where an employer plans to process data in order to monitor employees, the relevant staff delegation or, failing this, the employees concerned can submit a request for an advance compliance opinion to the CNPD within 15 days of receipt of the notice. The CNPD must provide its opinion within one month of the request. Requests for an advance compliance opinion have a suspensive effect (ie, the planned monitoring cannot be implemented until the CNPD has given its opinion).
The following types of data processing are still subject to the co-decision system in accordance with the Labour Code, unless the aim of the processing is to fulfil a legal or regulatory obligation:
The CNPD has received numerous notifications of data breaches since the GDPR and the Law on the Organisation of Luxembourg's CNPD and the General System for Protecting Data entered into force. However, to date, it has imposed no major fines.
For further information on this topic please contact Guy Castegnaro or Ariane Claverie at Castegnaro by telephone (+352 26 86 82 1) or email (firstname.lastname@example.org or email@example.com). The Castegnaro website can be accessed at www.castegnaro.lu.
The materials contained on this website are for general information purposes only and are subject to the disclaimer.
ILO is a premium online legal update service for major companies and law firms worldwide. In-house corporate counsel and other users of legal services, as well as law firm partners, qualify for a free subscription.