Introduction

The Law of 1 August 2018 on the Organisation of Luxembourg's National Commission for Data Protection (CNPD) and the General System for Protecting Data was published in Memorial A 686 on 16 August 2018. The law came into force on 20 August 2018.

The law aims to:

  • supplement the EU General Data Protection Regulation (GDPR) with specific national provisions; and
  • adapt the CNPD's laws in order to grant it the powers necessary to fulfil its role under the GDPR.

The law also revoked the Modified Law of 2 August 2002 on the Protection of Personal Data and modified Article L 261-1 of the Labour Code with regard to employer monitoring of employees.

Key changes

Processing personal data in order to monitor employees Employers can process personal data in order to monitor employees in the circumstances set out in Articles 6(1)(a) to (f) of the GDPR. Thus, the circumstances in which such processing is permitted have been extended, as the previous legislation allowed employers to use a monitoring system in the workplace in only five circumstances, as listed in the Labour Code.

Employers no longer have to obtain the CNPD's prior authorisation for such monitoring.

Notifying employees of personal data processing In order to monitor employees' activities, employers must still provide so-called 'prior information' before undertaking personal data processing to the employees in question and:

  • the relevant joint committee; or
  • the relevant staff delegation; or
  • the Inspectorate of Labour and Mines.

The law now specifies that such information must include:

  • a detailed description of the purpose of the planned processing;
  • the process for implementing the monitoring system; and
  • the duration and criteria for storing the data and a formal commitment by the employer not to use the data collected for any purpose other than that specifically defined in the prior information, if applicable.

Requests for advance compliance opinions If an employer plans to process data in order to monitor its employees, the staff delegation or – failing that – the employees concerned can, within 15 days of receiving the prior information, submit a request for an advance compliance opinion to the CNPD. The CNPD must provide its opinion within one month of receiving the request. Advance compliance opinions have a suspensive effect, which means that the planned monitoring cannot be implemented until the CNPD has issued its opinion.

Co-decision system The processing of personal data in the following circumstances is still subject to the co-decision system in accordance with the Labour Code:

  • employee monitoring for health and safety reasons;
  • temporary monitoring of an employee's work or services when such a measure is the only way in which their exact salary can be determined; and
  • employee monitoring in order to organise their work on a flexitime basis.

However, the co-decision system does not apply if the purpose of the processing is to fulfil a legal or regulatory obligation.

For further information on this topic please contact Guy Castegnaro or Ariane Claverie at Castegnaro by telephone (+352 26 86 82 1) or email ([email protected] or [email protected]). The Castegnaro website can be accessed at www.castegnaro.lu.

This article was first published by the International Law Office, a premium online legal update service for major companies and law firms worldwide. Register for a free subscription.