Processes personal data, in Luxembourg

Regulation (EU) 2016/679, Arts. 12-21; Loi du 1er aout 2018, Arts. 63, 65 · Read the law's page

• Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Luxembourg within one month of receipt.
• If you process personal data in Luxembourg for scientific or historical research or for statistics, you may depart from the rights of access, rectification, restriction and objection (GDPR Articles 15, 16, 18 and 21) to the extent they would make that purpose impossible or seriously impair it, provided you take the additional safeguards Article 65 requires, under Loi du 1er aout 2018 Article 63.

Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page

• Notify the CNPD without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Luxembourg, unless the breach is unlikely to risk their rights and freedoms.
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
• Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.

Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page

• Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Luxembourg outside the European Economic Area.

Regulation (EU) 2016/679, Arts. 82-83 · Read the law's page

• Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.

Code du travail, Art. L.261-1 (Titre VI, loi du 1er août 2018) · Read the law's page

• If you monitor employees through the processing of personal data, do so only in the cases of GDPR Article 6(1)(a) to (f) and in accordance with Labour Code Article L.261-1 (paragraph 1).
• Before the monitoring starts, inform the joint committee or, failing it, the staff delegation or, failing that, the Labour and Mines Inspectorate, or for statutory staff the staff representation bodies, with a detailed description of the purpose, the way the system works and any retention period or criteria, and give a formal commitment not to use the data for another purpose (Article L.261-1, paragraph 2).
• Where the monitoring serves safety and health needs, production or performance control that is the only means to determine exact pay, or flexible working hours, apply Articles L.211-8, L.414-9 and L.423-1 unless the processing meets a legal obligation (Article L.261-1, paragraph 3).
• Do not treat an employee's complaint to the Commission nationale pour la protection des données as a serious or legitimate ground for dismissal (Article L.261-1, paragraph 5).

Loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et du régime général sur la protection des données (Mémorial A n° 686 du 16 août 2018) · Read the law's page

• Establish a GDPR Article 6 lawful basis before processing personal data of a person in Luxembourg, including data collected by crawling.

Loi du 1er août 2018, Art. 65, points 3 and 4 · Read the law's page

• If you process personal data in Luxembourg for scientific or historical research or for statistics, anonymise or pseudonymise the data, or apply another functional separation measure, so that the data collected cannot be used to take decisions or actions concerning the people it relates to (Loi du 1er août 2018, Article 65, point 3).
• Use a trusted third party, functionally independent of you, to anonymise or pseudonymise the data (Article 65, point 4).
• For each research or statistics project, document and justify the exclusion of any of the measures Article 65 lists (Article 65, final paragraph).