In Luxembourg, on August 1st, 2018, two data protection laws were adopted:
- Law on the organisation of the Commission Nationale pour la Protection des Données and implementation of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), amending the Labour Code and the amended the Law of 25 March 2015 laying down the salaries and conditions and procedures for the advancement of State officials. This law was published in MEMORIAL A, No. 686 of 16 August 2018.
- Law on the protection of individuals regarding the processing of personal data in criminal matters and in matters of national security, which was published in MEMORIAL A, No. 689 of 16 August 2018.
The Luxembourg law adopted some specificities regarding the GDPR provisions. These specificities are relating to sanctions. Article 48 (1) of the law provides that “the CNPD may impose administrative fines as provided for in Article 83 of Regulation (EU) 2016/679, except against the State or the communes (municipalities) “.
This is also the case for the “processing and freedom of expression and information” provided for in section 62 of the law, the “processing for purposes of scientific or historical research or for statistical purposes” provided for in section 63 and the “processing of personal data for monitoring purposes in the context of employment relations” provided for in Articles 70 and the following of Luxembourg Law.