Page 1

OFFICIAL NEWSPAPER
OF THE GRAND DUCHY OF LUXEMBOURG
MEMORIAL A
No. 686 of August 16, 2018

Law of 1 st August 2018 on the organization of the National Commission for Data Protection
and implementation of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016
on the protection of individuals with regard to the processing of personal data
personal data and the free movement of such data, and repealing Directive 95/46 / EC (regulation
General on Data Protection), amending the Labor Code and the amended law
of March 25, 2015 setting the salary system and the conditions and procedures for the advancement of
state officials.
We Henri, Grand Duke of Luxembourg, Duke of Nassau,
Our Council of State heard;
With the consent of the Chamber of Deputies;
Considering the decision of the Chamber of Deputies of July 26, 2018 and that of the Council of State of July 27, 2018
bearing that there is no need for a second vote;

Have ordered and are ordering:

Title I st - General Provisions
Chapter 1 st - Scope
Art. 1 st .
(1) Any processing of personal data that is not covered by Regulation (EU) 2016/679
of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons
with regard to the processing of personal data and the free movement of such data, and repealing
Directive 95/46 / EC, hereinafter referred to as "Regulation (EU) 2016/679" or by the law of 1 st August 2018
on the protection of individuals with regard to the processing of personal data
in criminal matters and in matters of national security, is covered by the provisions of Chapter I st ,
Article 4 of chapters II to VI, VIII and IX and Chapter VII, Section 1 re Regulation (EU) 2016/679 and
this law, subject to existing legal texts which provide for other specific provisions in
protection of personal data.
(2) This law does not apply to the processing of personal data carried out by
natural persons within the framework of a strictly personal or domestic activity.
Art. 2.
The provisions of Title II apply to data controllers and subcontractors established on the
Luxembourg territory.

A 686 - 1

Page 2

MEMORIAL A - 686 of August 16, 2018

OFFICIAL JOURNAL of the Grand Duchy of Luxembourg

Chapter 2 - National Commission for Data Protection
Section I re - Legal status and independence
Art. 3.
The National Commission for Data Protection, hereinafter referred to as "CNPD", is a
independent public establishment with legal personality.
It enjoys financial and administrative autonomy.
Its seat is fixed by grand-ducal regulation.
Section II - Competences of the CNPD
Art. 4.
The CNPD is responsible for monitoring and verifying whether the data submitted for processing is processed in accordance with
compliance with the provisions:
1 ° of Regulation (EU) 2016/679;
2 ° of this law;
3 of the Act of 1 st August 2018 on the protection of individuals with regard to the processing of
personal data in criminal matters as well as in matters of national security;
4 ° legal texts providing for specific provisions on the protection of personal data
staff.
Art. 5.
The CNPD is not competent to control personal data processing operations.
carried out by the courts of the judicial order, including the public prosecutor, and of the administrative order
in the exercise of their judicial functions.
Art. 6.
The CNPD represents Luxembourg on the "European Data Protection Board" set up by
Article 68 of Regulation (EU) 2016/679 and contributes to its activities.
Section III - The missions of the CNPD
Sub-section I re - The missions of the CNPD under Regulation (EU) 2016/679
Art. 7.
The CNPD carries out the missions with which it is vested under Article 57 of Regulation (EU) 2016/679.
Subsection II - the DPA missions as part of the Law of 1 st August 2018 on the protection
of natural persons with regard to the processing of personal data relating to
criminal law as well as national security
Art. 8.
As part of the Law of 1 st August 2018 on the protection of individuals with regard to the processing
personal data in criminal matters as well as in matters of national security, the CNPD:
1 ° monitors the application of the provisions and implementing measures and ensures that they are observed;
2 ° promotes public awareness and understanding of the risks, rules, guarantees and
rights relating to the processing of personal data;
3 ° advises the Chamber of Deputies, the Government and other institutions and bodies on matters
legislative and administrative measures relating to the protection of the rights and freedoms of individuals
physical with regard to the processing of personal data;

A 686 - 2

Page 3

MEMORIAL A - 686 of August 16, 2018

OFFICIAL JOURNAL of the Grand Duchy of Luxembourg

4 ° encourages the awareness of data controllers and processors of the obligations that
incumbent;
5 ° provides, on request, to any data subject, information on the exercise of their rights and, if
as appropriate, cooperate to this end with the supervisory authorities of other Member States;
6 ° deals with complaints lodged by a data subject or by a body, an organization
or association under Article 44 of the Law of 1 st August 2018 on the protection of
natural persons with regard to the processing of personal data in criminal matters as well as
that in matters of national security, investigation of the subject of the complaint, to the extent necessary,
and inform the author of the complaint of the progress and the outcome of the investigation within a
reasonable, especially if further investigation or coordination with another
control is necessary;
7 ° verifies the lawfulness of the processing, and informs the data subject within a reasonable time of the outcome of
verification, in accordance with Article 16, paragraph 3, of the Law of 1 st August 2018 on the protection
of natural persons with regard to the processing of personal data in criminal matters
as well as in matters of national security, or the reasons which prevented its realization;
8 ° put in place effective mechanisms to encourage confidential reporting of breaches of
processing of personal data;
9 ° cooperate with other supervisory authorities, including by sharing information, and provide them
mutual assistance within this framework to ensure consistent application of the Law of 1 st August
2018 on the protection of individuals with regard to the processing of personal data
personnel in criminal and national security matters and the measures taken to
ensure respect;
10 ° investigates the application of the Law of 1 st August 2018 on the protection of individuals
physical with regard to the processing of personal data in criminal matters as well as in
national security matters, including on the basis of information received from another supervisory authority
or another public authority;
11 ° monitors relevant developments, insofar as they have an impact on the protection of
personal data, in particular in the field of information technology and
communication;
12 ° provides advice on processing operations referred to in Article 27 of the Law of 1 st August 2018 on
the protection of individuals with regard to the processing of personal data by
criminal matters as well as national security.
Art. 9.
The CNPD facilitates the lodging of complaints referred to in Article 8, point 6, through measures such as the
provision of a complaint form which can also be completed electronically, without
other means of communication are excluded.
Sub-section III - Common provisions
Art. 10.
The CNPD draws up an annual report on its activities, which includes a list of the types of violations notified
and the types of sanctions imposed under Regulation 2016/679 and the Act of 1 st August 2018 on the
protection of individuals with regard to the processing of personal data relating to
criminal law as well as in matters of national security. The reports are sent to the Chamber of Deputies, to the
Government, the European Commission and the European Data Protection Board and are
made public.
Art. 11.
The accomplishment of the missions is free for the person concerned and, if necessary, for the delegate
to data protection which acts within the framework of its missions.

A 686 - 3

Page 4

MEMORIAL A - 686 of August 16, 2018

OFFICIAL JOURNAL of the Grand Duchy of Luxembourg

When a request is manifestly unfounded or excessive, the CNPD may demand the payment of fees.
reasonable costs based on its administrative costs or refuse to comply with the request. It is the responsibility of the
CNPD to demonstrate the manifestly unfounded or excessive nature of the request.
Section IV - Powers of the CNPD
Art. 12.
Within the framework of the missions of article 7, the CNPD has the powers as provided for in article 58 of the
Regulation (EU) 2016/679.
Art. 13.
The DPA has the power to bring any violation of Regulation (EU) 2016/679 of the Law of 1 st August 2018
on the protection of individuals with regard to the processing of personal data
in criminal matters as well as in matters of national security and of this law to the knowledge of
judicial authorities and, where applicable, the right to take legal action in the interests of Regulation (EU) 2016/679
accordance with Article 58 and in the interest of the law of 1 st August 2018 on the protection of individuals
physical with regard to the processing of personal data in criminal matters as well as in
national security.
Art. 14.
Within the framework of the missions of article 8 , the CNPD has the following powers:
1 ° obtain from the controller or the processor access to all personal data
which are processed and all the information necessary for the performance of its missions;
2 ° notify a controller or a subcontractor that the planned processing operations
might violate the provisions adopted under the Act of 1 st August 2018 on the
protection of individuals with regard to the processing of personal data relating to
criminal law as well as in matters of national security;
3 ° order the controller or the processor to put the processing operations in
accordance with the provisions adopted under the Act of 1 st August 2018 on the protection of
natural persons with regard to the processing of personal data in criminal matters as well as
that in matters of national security, where appropriate, in a specific manner and within a specified timeframe, in
in particular by ordering the rectification or erasure of personal data or the limitation
treatment under Article 15 of the Law of 1 st August 2018 on the protection of individuals
physical with regard to the processing of personal data in criminal matters as well as in
national security;
4 ° temporarily or permanently limit, including prohibiting, processing;
5 ° advise the controller in accordance with the prior consultation procedure referred to in
Article 27 of the Law of 1 st August 2018 on the protection of individuals with regard to the processing
personal data in criminal matters as well as in national security matters;
6 ° issue, on its own initiative or on request, opinions for the attention of the Chamber of Deputies and
his Government or other institutions and bodies as well as the public, on any question relating to
the protection of personal data.

A 686 - 4

Page 5

MEMORIAL A - 686 of August 16, 2018

OFFICIAL JOURNAL of the Grand Duchy of Luxembourg

Section V - Certification
Art. 15.
The certification bodies referred to in Article 43, paragraph 1 st of Regulation (EU) 2016/679 must be
approved by the CNPD.
Section VI - Composition and appointment of the CNPD
Art. 16.
The CNPD is a collegial body made up of four members, including a president. Members are called
Data Protection Commissioners and are authorized to bear the title of "Commissioner" without
it does not change their rank or salary. Four alternate members are also appointed.
Substitute members are called upon to make up for the absence or inability to sit by members.
of college.
Art. 17.
The members of the college and substitute members are appointed and dismissed by the Grand Duke on a proposal.
of the Governing Council. The president is appointed by the Grand Duke. College members and
Alternate members are appointed for a six-year term, renewable once.
The members of the college and the substitute members act in complete independence in the exercise of their
missions and powers. They remain free from any external influence, whether direct or indirect, and
do not seek or accept instructions from anyone.
Art. 18.
The Governing Council proposes to the Grand Duke as members of the college and substitute members
people fulfilling the admission conditions for the examination-competition of treatment group A1
and having Luxembourg nationality.
College members and alternate members are appointed on the basis of their competence and
experience in the protection of personal data.
The vacancies for the mandates of the members of the college are published at the latest six months before
the expiration of the mandate. The publication takes the form of a call for candidates specifying the number of
vacant places, the conditions of appointment, the missions of the body to be composed and the terms of
submission of the application.
Art. 19.
Before taking office, the president takes the oath in the hands of the Grand Duke or his representative.
next: "I swear loyalty to the Grand Duke, obedience to the Constitution and to the laws of the State." I promise to
perform my duties with integrity, accuracy and impartiality. "
Before taking up their duties, members and alternate members shall lend into the hands of the chairman the
following oath: “I swear loyalty to the Grand Duke, obedience to the Constitution and to the laws of the State. I promise
to perform my duties with integrity, accuracy and impartiality. "
Art. 20.
The members of the college have the status of civil servant with regard to their status, salary and
pension scheme.
They benefit from a special allowance taking into account the commitment required by the functions, to be set by
Grand-Ducal regulation without, however, the total of the scale salary and the special allowance not being
may exceed the grade S1 baremic treatment.

A 686 - 5

Page 6

MEMORIAL A - 686 of August 16, 2018

OFFICIAL JOURNAL of the Grand Duchy of Luxembourg

Art. 21.
Without prejudice to the application of any disciplinary sanctions, the member of the college, who benefited from
previously of the status of State agent, whose mandate is not renewed or which is revoked, is appointed
at the last grade of the highest function in any of the treatment subgroups, except the
subgroup with special attributions, of treatment category A, treatment group A1 of its
administration of origin, at the treatment step corresponding to the treatment step reached in the
previous post or, in the absence of a corresponding step, to the salary step immediately below.
The special allowances attached to his function as a member of the college are not maintained. he can
be subject to a change of administration in another administration or a public establishment,
in accordance with article 6 of the amended law of April 16, 1979 establishing the general status of civil servants
the state.
Art. 22.
Without prejudice to the application of any disciplinary sanctions, the member of the college, who did not benefit from
not previously of the status of State agent, whose mandate is not renewed or which is revoked, is
appointed to the last grade of the highest function in one of the treatment subgroups, except
of the sub-group with special responsibilities, of treatment category A, treatment group A1 of a
ministerial department, at the salary step corresponding to the salary step reached in the
previous post or, in the absence of a corresponding step, to the salary step immediately below.
The special allowances attached to his function as a member of the college are not maintained. he can
be subject to a change of administration in another administration or a public establishment,
in accordance with article 6 of the amended law of April 16, 1979 establishing the general status of civil servants
the state.
Art. 23.
If there is no vacant budgetary post in the salary group referred to in Articles 21 and 22,
the number of staff is temporarily increased until the next vacancy occurs
in this treatment group.
Art. 24.
The substitute members receive an indemnity, the amount of which is fixed by Grand-Ducal regulation.
Art. 25.
(1) College members and alternate members may only be removed from office if they
have committed a serious fault or if they no longer meet the conditions necessary for the exercise of their
functions. In these cases, the dismissal takes place by the Grand Duke on a proposal from the Council of Government.
(2) By way of derogation from the age limit provided for in article 7.I.2 of the amended law of 25 March 2015 establishing a
special transitional pension scheme for civil servants of the State and municipalities as well as for
agents of the Luxembourg National Railway Company, and in article 67.II.1 of the amended law of
August 3, 1998 establishing special pension schemes for state and municipal civil servants
as well as for the agents of the Luxembourg National Railway Company, the members of the
college who reach the age of sixty-five during their term of office may continue this term until
the age of sixty-eight.
The age limit applicable to substitute members is sixty-eight years.
(3) By way of derogation from Article 29, the powers attributed in disciplinary matters to the relevant minister
are exercised with regard to the members of the college by the Minister having Relations with the Commission
national data protection authority in its remit.

A 686 - 6

Page 7

MEMORIAL A - 686 of August 16, 2018

OFFICIAL JOURNAL of the Grand Duchy of Luxembourg

Art. 26.
In the event of termination of office by a member of the college or a substitute member, a
successor in accordance with Articles 17 to 19.
Art. 27.
Members of the college or substitute members cannot be members of the Government, of the
Chamber of Deputies, of the Council of State or of the European Parliament, nor to exercise any professional activity or
directly or indirectly hold interests in a company or any other body operating in
the field of data processing.
Section VII - Operation of the CNPD
Art. 28.
The staff of the CNPD includes officials of the different categories of processing
as provided for by the amended law of 25 March 2015 setting the salary system and the conditions and
methods of advancement of civil servants. The staff framework can be supplemented, depending on
needs and within the limits of budgetary appropriations, by interns, employees and State employees.
Art. 29.
The powers conferred on the head of administration by the grand-ducal laws and regulations applicable to
State agents are exercised with regard to the personnel of the CNPD by the president. The powers conferred on
relevant minister or to the Council of Government or to the authority vested with the power of appointment by the
the aforementioned laws and regulations are exercised with regard to CNPD staff by the college.
Art. 30.
The remuneration and other allowances of all members of the college, substitute members and
the CNPD are the responsibility of the CNPD.
Art. 31.
The CNPD may call on external experts whose services are defined and remunerated on the basis of
basis of a private law contract.
Art. 32.
(1) The CNPD establishes its internal regulations adopted unanimously by the members of the college meeting at the
complete and including its procedures and working methods. The internal regulations are published in
Official Journal of the Grand Duchy of Luxembourg.
(2) The college may delegate powers of a technical or administrative nature to a member of the
middle School. Such delegation must be fixed by the internal regulations.
Art. 33.
Subject to the provisions of this law and without prejudice to the texts cited in article 4, the regulations
fixed domestic order:
1 ° the operating conditions of the CNPD;
2 ° the organization of CNPD services;
3 ° the terms and conditions for convening the members of the college and the holding of collegial meetings.

A 686 - 7

Page 8

MEMORIAL A - 686 of August 16, 2018

OFFICIAL JOURNAL of the Grand Duchy of Luxembourg

Art. 34.
The college cannot validly sit or deliberate unless it brings together at least three members of the college.
Art. 35.
The members of the college and substitute members cannot sit, deliberate or decide in a matter
in which they have a direct or indirect interest.
Art. 36.
Decisions are taken by majority vote. In the event of a tie, the president's vote is
preponderant. Abstentions are not admissible.
Section VIII - Investigation and decision on the outcome of the investigation
Art. 37.
The CNPD can intervene on its own initiative or at the request of any natural or legal person
in accordance with Articles 77 and 80 of Regulation (EU) 2016/679 and Articles 44 and 46 of the Law of 1 st
August 2018 on the protection of individuals with regard to the processing of personal data
personnel in criminal matters as well as in national security matters.
Art. 38.
The opening of an investigation can be proposed at any time by a member of the college. He submits this
proposal to the college which approves it within a period of one month by majority vote and which appoints a
member of the college as head of investigation. The president cannot be designated as the head of the investigation.
Art. 39.
The investigation must be charged and discharged.
Art. 40.
A CNPD regulation defines the procedure before the CNPD in accordance with the adversarial principle.
Art. 41.
The college takes a decision on the outcome of the investigation as soon as possible. The head of investigation cannot
neither sit nor deliberate when the college decides on the outcome of the inquiry.
Section IX - Professional secrecy
Art. 42.
Without prejudice to article 23 of the Code of Criminal Procedure, all persons exercising or having exercised
an activity for the CNPD are bound by professional secrecy and liable to the penalties provided for in article 458
of the Penal Code in case of violation of this secrecy. This secrecy implies that the confidential information they
received in a professional capacity may not be disclosed to any person or authority whatsoever, except
in summary or aggregated form so that persons under surveillance cannot be
identified, without prejudice to cases falling under criminal law in the event of a violation of this secrecy.
Art. 43.
By way of derogation from the prohibition of disclosure and communication provided for in article 42 of this law and
in article 458 of the Penal Code, the members of the college, substitute members and CNPD agents are
authorized, during the exercise of their activity, to communicate to the authorities and public services

A 686 - 8

Page 9

MEMORIAL A - 686 of August 16, 2018

OFFICIAL JOURNAL of the Grand Duchy of Luxembourg

and documents necessary for them for the exercise of their missions, provided that these authorities, bodies
and persons fall under professional secrecy equivalent to that referred to in article 42 of this law.
Art. 44.
By way of derogation from the prohibition of disclosure and communication provided for in article 42 of this law and
in article 458 of the Penal Code, the members of the college, substitute members and CNPD agents are
authorized, during the exercise of their activity, to communicate to the supervisory authorities of other States
members, the European Data Protection Board and the European Commission
information and documents necessary for them to exercise their supervision, provided that these
authorities, bodies and persons fall under professional secrecy equivalent to that referred to in Article 42 of
this law and to the extent that these authorities, bodies and persons grant the same information
at the CNPD.
Section X - Financial provisions
Art. 45.
The CNPD's financial year coincides with the calendar year.
Art. 46.
CNPD accounts are kept according to the rules of commercial accounting. Before June 30 of
each year, the president of the CNPD college submits to the college the annual accounts including the
balance sheet and profit and loss account, the appendix, closed on December 31 of the past financial year, as well as its
activity report and the report of the approved statutory auditor. The annual budget of the CNPD is proposed to the
college by the president of the college before December 31 for the following year.
The annual accounts at December 31 of the past financial year with the report of the approved statutory auditor,
the activity report and the annual budget are sent to the Government in Council which decides on the discharge
to give to the CNPD. The decision noting the discharge granted to the CNPD as well as the annual accounts
of the CNPD are published in the Official Journal.
The Government in Council appoints an approved statutory auditor on the proposal of the CNPD college.
The role of the approved statutory auditor is to verify and certify the annual accounts of the CNPD. The
certified statutory auditor is appointed for a renewable period of 3 years. It can be loaded by the
college of the CNPD to carry out specific verifications. His remuneration is the responsibility of the CNPD.
Art. 47.
The CNPD benefits from an endowment of an amount to be determined on an annual basis and to be entered in the budget
of State.
Without prejudice to Article 11, the CNPD may impose fees within the framework of its powers.
authorization and consultation pursuant to Article 58 (3), letters e), f), h) and j) of Regulation (EU)
2016/679. A CNPD regulation determines the amount and terms of payment of royalties.
Section XI - Sanctions
Art. 48.
(1) The CNPD may impose administrative fines as provided for in Article 83 of Regulation (EU)
2016/679, except against the State or the municipalities.
(2) In the context of an infringement of Article 10 of Regulation (EU) 2016/679 by a natural person or
a legal person governed by private or public law, with the exception of the State or the municipalities, the CNPD
may impose the administrative fines provided for in Article 83 (4) of Regulation (EU) 2016/679.

A 686 - 9

Page 10

MEMORIAL A - 686 of August 16, 2018

OFFICIAL JOURNAL of the Grand Duchy of Luxembourg

Art. 49.
(1) The CNPD may, by decision, impose on the controller or processor , with the exception of
from the State and the municipalities, penalties up to 5 percent of daily turnover
average achieved during the previous financial year, or during the last closed financial year, per day
late from the date he fixes in his decision, to compel him:
1 to provide any information that the DPA has requested pursuant to Article 58, paragraph 1 st ,
letter a) of Regulation (EU) 2016/679;
2 ° to comply with a corrective measure adopted by the CNPD pursuant to article 58, paragraph 2, letters
c), d), e), f), g), h) and j) of Regulation (EU) 2016/679.
For the purposes of applying this paragraph, officers of the Registration Administration
and domains are required to communicate to the CNPD any information they hold and which is
necessary for setting the penalty payments.
(2) When the data controllers have fulfilled the obligation for the execution of which the penalty payment
has been imposed, the CNPD may set the final amount thereof at a lower figure than that resulting from
the initial decision.
Art. 50.
The collection of fines or periodic penalty payments is entrusted to the Administration of Registration and
areas. It is done as in recording.
Art. 51.
Anyone who knowingly prevents or hinders in any way the accomplishment of the
missions incumbent on the CNPD, is punished by imprisonment of eight days to one year and a fine of
251 to 125,000 euros or just one of these penalties.
Art. 52.
The CNPD may order, at the expense of the sanctioned person, the full publication or by extracts of its
decisions with the exception of decisions relating to the imposition of periodic penalty payments, and provided that:
1 ° the means of appeal against the decision are exhausted; and
2 ° the publication does not risk causing disproportionate prejudice to the parties involved.
Section XII - Requirements
Art. 53.
(1) The powers conferred on the CNPD under Article 58 of Regulation (EU) 2016/679 and Articles 14,
48, 49 and 52 of this law are subject to the five-year limitation period.
(2) The prescription runs from the day the violation of Regulation (EU) 2016/679 of the Law of 1 st August
2018 on the protection of individuals with regard to the processing of personal data
personnel in criminal matters as well as in matters of national security and this law has ended.
(3) The prescription is interrupted by any act of the CNPD. The interruption of the prescription takes effect on
day on which the act is notified to the controller or processor who participated in the processing.
(4) The prescription runs again from each interruption. However, the prescription is acquired at
later than the day on which a period equal to twice the limitation period expires without the CNPD having
pronounced a fine or a periodic penalty payment. This period is extended by the period during which the prescription
is suspended in accordance with paragraph 5.
(5) The limitation period is suspended as long as the decision of the CNPD is the subject of a procedure
pending before the Administrative Court.

A 686 - 10

Page 11

MEMORIAL A - 686 of August 16, 2018

OFFICIAL JOURNAL of the Grand Duchy of Luxembourg

Art. 54.
(1) The fines and periodic penalty payments imposed in application of Articles 48 and 49 shall be prescribed by five
past years.
(2) Prescription runs from the day on which the decision becomes final.
(3) The limitation period for the execution of the decision is interrupted:
1 ° by the notification of a decision modifying the initial amount of the fine or the penalty payment or rejecting a
request for such a modification;
2 ° by any act of the Registration and Domains Administration aimed at the forced recovery of
the fine or the periodic penalty payment.
(4) The prescription runs again from each interruption.
(5) The limitation period for the execution of the decision is suspended:
1 ° as long as a period of payment is granted;
2 ° as long as the forced execution of the payment is suspended by virtue of a judicial decision.
Section XIII - Appeal against decisions of the CNPD
Art. 55.
An appeal against the decisions of the CNPD taken in application of this law is open to the
Administrative court which rules as the merits judge.
Chapter 3 - Government Data Protection Commissioner to the State
Art. 56.
An administration called the “Government Data Protection Commissioner” is created.
to the State ”, hereinafter referred to as“ Commissariat ”.
The Commissariat is placed under the authority of the Prime Minister, Minister of State.
Art. 57.
The relevant ministers or, under their authority, the competent heads of administration designate one or
several data protection officers.
The relevant ministers or, under their authority, the competent heads of administration, may appoint the
Commissariat as their data protection officer.
The designation is notified to the Commissariat.
Art. 58.
The Commissariat can also act as a data protection officer for
communes.
The colleges of mayors and aldermen can designate the Commissariat as their delegate to
Data protection.
The designation is notified to the Commissariat.
Art. 59.
The Commissariat's mission is:
1 ° to develop the protection of personal data within the state administration;
2 ° to promote good practices through the state administration and to stimulate the awareness of
agents;
3 ° to contribute to a coherent implementation of policies in this area:

A 686 - 11

Page 12

OFFICIAL JOURNAL of the Grand Duchy of Luxembourg

a) by proposing to the Government a compliance management program for processing activities
data of state administration entities with applicable legislation, guiding and
supporting the competent heads of administration in the implementation of appropriate measures,
procedures and guidelines for public officials;
b) assisting the data protection officers of the state administration;
c) advising, on request, members of the Government;
4 ° to ensure, in the event of application of article 57, paragraph 2, the function of data protection officer
as defined in Article 38 of Regulation (EU) 2016/679 with the tasks described in Article 39 of
Regulation (EU) 2016/679;
5 ° to collaborate closely with the Minister having Data Protection in his attributions.

MEMORIAL A - 686 of August 16, 2018

Art. 60.
The Commissariat is headed by a Government Data Protection Commissioner with
the state. The commissioner may be assisted by a deputy commissioner.
Art. 61.
(1) The personnel framework includes a government commissioner, a government commissioner
State Data Protection Officer appointed by the Grand Duke on a proposal from the
Government in Council, as well as officials of different salary categories such as
provided for by the amended law of 25 March 2015 fixing the treatment regime and the terms and conditions
advancement of civil servants.
(2) This framework may be supplemented by trainee civil servants, employees and employees of the following State
the needs of the service and within the limits of budgetary appropriations.
(3) Candidates for the office of Government Data Protection Commissioner at
State or Deputy Government Commissioner must have specialized knowledge of
data protection laws and practices and fulfill the conditions for admission to the group of
A1 treatment.
Title II - Specific provisions according to Regulation (EU) 2016/679
Chapter 1 st - Processing and freedom of expression and information
Art. 62.
The processing implemented for the sole purposes of journalism or academic, artistic or literary expression
is not subject:
1 ° a) the prohibition on processing special categories of data as provided for in Article 9,
Paragraph 1 st of Regulation (EU) 2016/679;
b) the limitations concerning the processing of judicial data provided for in Article 10 of the Regulation
(EU) 2016/679;
when the processing relates to data made manifestly public by the person
data subject or to data which is directly related to the public life of the data subject or
with the fact in which it is involved in a voluntary way;
2 ° in Chapter V relating to transfers to third countries or to international organizations of the settlement
(EU) 2016/679;
3 ° the information obligation of Article 13 of Regulation (EU) 2016/679, when its application
jeopardize the collection of data from the data subject;
4 ° the information obligation of Article 14 of Regulation (EU) 2016/679, when its application
would compromise either the data collection, a planned publication, or the availability of the
public, in any way whatsoever of these data or would provide indications allowing to identify
sources of information;
5 ° the right of access of the data subject which is deferred and limited in that it cannot relate to
information relating to the origin of the data and which would make it possible to identify a source. Under this

A 686 - 12

Page 13

MEMORIAL A - 686 of August 16, 2018

OFFICIAL JOURNAL of the Grand Duchy of Luxembourg

reserve access must be exercised through the CNPD in the presence of the Chairman of the
press or his representative, or the chairman of the duly called press council.
Chapter 2 - Processing for scientific or historical research or statistical purposes
Art. 63.
When personal data is processed for scientific or historical research purposes,
or for statistical purposes, the controller may derogate from the rights of the data subject
provided for in Articles 15, 16, 18 and 21 of Regulation (EU) 2016/679 insofar as these rights risk
make it impossible or seriously hinder the achievement of the specific purposes, subject to putting
in place appropriate measures as referred to in Article 65.
Art. 64.
The processing of special categories of personal data as defined in Article 9,
Paragraph 1 st of Regulation (EU) 2016/679, may be implemented for the purposes specified in Article
9, paragraph 2, point j) of the same regulation, if the controller fulfills the conditions of
section 65.
Art. 65.
Taking into account the nature, scope, context and purposes of the processing as well as the risks, including
the degree of probability and severity varies, for the rights and freedoms of individuals, the person responsible
processing carried out for scientific or historical research purposes, or for statistical purposes,
must implement the following additional appropriate measures:
1 ° the appointment of a data protection officer;
2 ° carrying out an analysis of the impact of the planned processing operations on the protection of
personal data;
3 ° anonymization, pseudonymization within the meaning of Article 4, paragraph 5, of Regulation (EU) 2016/679
or other functional separation measures ensuring that the data collected for the purposes of
scientific or historical research, or for statistical purposes, cannot be used to take
decisions or actions with regard to the persons concerned;
4 ° recourse to a trusted third party functionally independent from the controller to
anonymization or pseudonymization of data;
5 ° the encryption of personal data in transit and at rest, as well as key management
state of the art;
6 ° the use of technologies strengthening the protection of the privacy of the persons concerned;
7 ° the implementation of restrictions on access to personal data within the manager
processing;
8 ° log files which make it possible to establish the reason, date and time of the consultation and
identification of the person who collected, modified or deleted the personal data;
9 ° raising the awareness of staff involved in the processing of personal data and secrecy
professional;
10 ° the regular evaluation of the effectiveness of the technical and organizational measures put in place through
an independent audit;
11 ° the prior establishment of a data management plan;
12 ° the adoption of sectoral codes of conduct as provided for in Article 40 of Regulation (EU) 2016/679
approved by the European Commission under Article 40 (9) of Regulation (EU)
2016/679.
The data controller must document and justify for each project for research purposes
scientific or historical or for statistical purposes the exclusion, where applicable, of one or more of the measurements
listed in this article.

A 686 - 13

Page 14

MEMORIAL A - 686 of August 16, 2018

OFFICIAL JOURNAL of the Grand Duchy of Luxembourg

Chapter 3 - Processing of special categories of personal data
Art. 66.
The processing of genetic data for the purpose of exercising the rights specific to the controller
in matters of labor law and insurance is prohibited.
Chapter 4 - Secrecy obligations
Art. 67.
(1) Access The powers of the DPA as provided for in Article 58, paragraph 1 st , e) and f) of Regulation
(EU) 2016/679 must be exercised with or with regard to a lawyer in accordance with the rules laid down in
article 35, paragraph 3, of the amended law of 10 August 1991 on the profession of lawyer.
(2) access to the powers of the DPA as provided for in Article 58, paragraph 1 st , letter e) of Regulation
(EU) 2016/679 must be exercised with or with regard to a notary in accordance with the rules laid down in
article 41 of the amended law of 9 December 1976 relating to the organization of the notarial profession.
(3) access to the powers of the DPA as provided for in Article 58, paragraph 1 st , e) and f) of Regulation
(EU) 2016/679 must be exercised with or in respect of a professional covered by the amended law of 23
July 2016 relating to the audit profession, in accordance with article 28, paragraph 8, of this law.
(4) In accordance with Article 90 (2) of Regulation (EU) 2016/679, the rules provided for in
paragraphs 1 st , 2 and 3 shall apply only personal data that the lawyer, the notary
or the professional referred to in the amended law of 23 July 2016 relating to the auditing profession has received or
obtained in the context of an activity covered by its professional secrecy.
Title III - Amending, repealing, transitional and final provisions
Chapter 1 st - Amending provisions
Art. 68.
Any reference to the amended law of 2 August 2002 on the protection of individuals with regard to processing
personal data is replaced by a reference to Regulation (EU) 2016/679, to the law
1 st August 2018 on the protection of individuals with regard to the processing of data
personal character in criminal matters as well as in matters of national security and this law.
Art. 69.
The amended law of March 25, 2015 setting the salary system and the conditions and methods of advancement
civil servants is completed as follows:
(1) Article 12 is amended as follows:
(a) In paragraph 1 st , item 8 ° the words "full member of the National Commission for
data protection ”is deleted and the words“ Deputy Government Commissioner
data protection at the state, ”are added after the words“ commissioner of the
Deputy government of the police station in charge of disciplinary investigation, ”;
(b) In paragraph 1 st , item 9 ° the reference to "and the Government Commissioner for Protection
data to the State ”is added after that of“ Government commissioner responsible for
disciplinary instruction ”;
(c) In paragraph 1 st , item 16 ° the words "President of the National Commission for Protection
data ”is replaced by“ data protection commissioner ”;
(d) In paragraph 1 st , item 23 ° marked ", chairman of the National Commission for Protection
data ”is added after“ president of the accident insurance association ”.
(2) Article 16 (3) (g) is deleted.
(3) Annex A - Classification of functions - is amended as follows:
(a) at grade 16, the function of "effective member of the National Commission for the Protection of
data ”is deleted and the function of“ Deputy Government Commissioner for Protection

A 686 - 14

Page 15

MEMORIAL A - 686 of August 16, 2018

OFFICIAL JOURNAL of the Grand Duchy of Luxembourg

data from the State, ”is added after that of“ Deputy Government Commissioner
the Government police station in charge of disciplinary investigation, ”;
(b) at grade 17, the function of "President of the National Commission for Data Protection"
is replaced by "data protection commissioners" and the function of "commissioner
of the Government to the protection of data with the State, ”is added after that of
“Government commissioner responsible for disciplinary investigation,”;
(c) at grade 18, the function of "President of the National Commission for Data Protection"
is added.
(4) Annex B - B2) Elongations - is amended as follows:
(a) in paragraph 1 st , the terms "effective member of the National Commission for Protection
data ”is deleted;
(b) in paragraph 1 st , the terms "Commissioner Assistant Government Data Protection
to the State, ”are added after“ of Deputy Government Commissioner of the Commissariat
of the Government responsible for disciplinary investigation, ”and the words“, of an effective member of the
National Commission for Data Protection ”are deleted.

Art. 70.
The title of Title VI of Book II of the Labor Code reads as follows:
"
Title VI - Processing of personal data for
monitoring purposes in the context of labor relations.
"
Art. 71.
Article L.261-1 of the Labor Code reads as follows:
"
L. 261-1.
(1) The processing of personal data for the purposes of monitoring employees in the
labor relations framework can only be implemented by the employer in the cases referred to in
Article 6, paragraph 1 st , a) to f) of Regulation (EU) 2016/679 of the European Parliament and of
Council of 27 April 2016 on the protection of individuals with regard to the processing of
personal data and on the free movement of such data and repealing Directive 95/46 /
CE (General Data Protection Regulation), and in accordance with the provisions of this
article.
(2) Without prejudice to the data subject's right to information, are informed in advance by
the employer: for persons falling under the influence of the legislation on the private law contract:
the joint committee or, failing that, the staff delegation or, failing that, the labor inspectorate
and mines; for persons falling under the empire of a statutory regime: the organizations of
staff representation as provided for by the relevant laws and regulations.
This prior information contains a detailed description of the purpose of the intended processing, as well as
that the procedures for implementing the surveillance system and, where applicable, the duration or
data retention criteria, as well as a formal commitment by the employer to
use of the data collected for a purpose other than that explicitly provided for in the information
prior.
(3) When the processing of personal data provided in paragraph 1 st is implemented:
1.for the safety and health needs of employees,
2.for the control of production or employee services, when such a measure is the only means
to determine the exact salary, or
3.within the framework of a work organization according to flexible working hours in accordance with the provisions of
this code,

A 686 - 15

Page 16

MEMORIAL A - 686 of August 16, 2018

OFFICIAL JOURNAL of the Grand Duchy of Luxembourg

the provisions of Articles L.211-8, L.414-9 and L.423-1 apply, except when the processing
meets a legal or regulatory obligation.
(4) For projects of the treatments referred to in paragraph 1 st , the staff delegation or, failing that,
the employees concerned, may, within fifteen days following the prior information, submit a
request for a prior opinion on the compliance of the treatment plan for the purpose of monitoring the
employee in the context of labor relations at the National Commission for Data Protection,
which must deliver its opinion within one month of the referral. This request has a suspensive effect during this period.
(5) The employees concerned have the right to lodge a complaint with the National Commission
for data protection. Such a complaint does not constitute a serious reason, nor a legitimate reason.
dismissal.
"
Chapter 2 - Repealing provision
Art. 72.
The amended law of 2 August 2002 on the protection of individuals with regard to data processing
of a personal nature is repealed.
Chapter 3 - Transitional provisions
Art. 73.
The CNPD continues the legal personality, including staff and legal commitments, of the
National Commission for Data Protection as created by the amended law of 2 August 2002
on the protection of individuals with regard to the processing of personal data.
Art. 74.
The term of office of the members of the college and of the substitute members, appointed before the entry into force
of this law, is calculated from the date of appointment of their current mandate at the time of entry
in force of this law.
Art. 75.
The members of the college, appointed before the entry into force of this law, are classified in the new
grade at the same step number, reduced by one step or, in the absence of such a step, to the last step of the
grade to which they were reclassified, without prejudice to the postponement of the seniority in step acquired under the former
legislation.
Art. 76.
In the event of non-renewal or revocation of a mandate of a member of the college, appointed for the
first time before the entry into force of this law, he becomes general counsel to the
CNPD with maintenance of his status and his level of basic remuneration, namely grade 17 for the
president and grade 16 for the other two members, with the exception of the special allowances attached
to his previous function. It may be subject to a change of administration in an administration or
in another public establishment, in accordance with article 6 of the amended law of April 16, 1979 setting the
general status of civil servants.

A 686 - 16

Page 17

MEMORIAL A - 686 of August 16, 2018

OFFICIAL JOURNAL of the Grand Duchy of Luxembourg

Chapter 4 - Title of citation
Art. 77.
Reference to this law may be made in abbreviated form by using the following title: “Law of
1 st August 2018 on the organization of the National Commission for Data Protection and diet
general on data protection ”.
Mandate and order that this law be inserted in the Official Journal of the Grand Duchy of Luxembourg
to be performed and observed by all concerned.
For the Minister of Communications
and the Media,
the Minister of Agriculture, Viticulture
and Consumer Protection,
Fernand Etgen

Cabasson on 1 st August 2018.
Henri

Doc. speak 7184; sess. ord. 2016-2017 and 2017-2018.

A 686 - 17

