Operates a social platform, in Luxembourg

Loi du 18 avril 2001 sur les droits d’auteur, les droits voisins et les bases de données, article 70 bis · Read the law's page

• Obtain authorization from the rights holders before giving the public access to protected works your users have uploaded; the access counts as your own communication to the public (Article 70 bis(2)).
• If you have no authorization, avoid liability for unauthorized communication by showing that you made best efforts to obtain authorization, made best efforts, to high industry standards of professional diligence, to ensure the unavailability of specific works for which rights holders gave you the relevant and necessary information, and acted promptly on a sufficiently substantiated notice to block access to or remove the work and made best efforts to prevent its future upload (Article 70 bis(5)).
• If your services have been available to the public in the Union for less than three years and your annual turnover is below EUR 10 million, show only best efforts to obtain authorization and prompt action on a sufficiently substantiated notice; if your average monthly unique visitors, calculated on the previous calendar year, exceed 5 million, also show best efforts to prevent further uploads of the notified works (Article 70 bis(7)).
• Do not let cooperation with rights holders prevent the availability of uploaded works that do not infringe copyright, including works used under the exceptions for quotation, criticism, review, caricature, parody or pastiche (Article 70 bis(8)).
• On request, give rights holders adequate information on how your cooperation works and, where you have licensing agreements, on the use of the content they cover (Article 70 bis(9)).
• Provide users an effective and expeditious complaint and redress mechanism for blocked or removed uploads, decide complaints without undue delay, have a natural person review each decision to block or remove, and tell users in your terms and conditions that they may use works under the exceptions and limitations (Article 70 bis(10)).

Loi du 24 juillet 2024 portant mise en oeuvre du règlement (UE) 2021/784, Mémorial A n° 310 de 2024 · Read the law's page

• Remove terrorist content, or block access to it in all Member States, within one hour of receiving a removal or blocking order from the minister responsible for the Grand-Ducal Police (Article 3(3) and Article 4(2) of Regulation (EU) 2021/784, as backed by Article 6(1) of the Loi du 24 juillet 2024).
• Immediately inform the competent authorities of terrorist content that presents an imminent threat to life (Article 14(5) of the Regulation).
• Communicate with the minister and the Haut-Commissariat à la protection nationale by electronic means in French, German or English, and confirm receipt of any communication from them within three working days (Article 5).
• After a formal notice, meet the obligations of the Regulation that Article 7 backs with an administrative fine: Article 3(6), Article 4(7) and Articles 11, 15 and 17 as monitored by the minister, and Article 5(1), (2), (3) and (5) and Articles 6, 7 and 10 as monitored by the HCPN, together with any decision the HCPN takes under Article 5(6).

Loi du 4 avril 2025 portant mise en oeuvre du règlement (UE) 2022/2065, Mémorial A n° 125 de 2025 · Read the law's page

• Comply with Articles 9 to 18, 20 to 28 and 30 to 32 of the Digital Services Act to the extent that Article 15(2) of the Loi du 4 avril 2025 sets a fine of up to 6 percent of worldwide turnover for their breach.
• Answer an information request or decision of the Autorité de concurrence with accurate and complete information within the time it sets, correct incorrect, incomplete or misleading information within the time it sets, and submit to an inspection it orders (Articles 6, 7 and 15(3)).

Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité, Art. 11, 12, 13 · Read the law's page

• Take technical, operational and organisational measures appropriate and proportionate to the risks facing the network and information systems you use for your activities or to provide your services, and act to eliminate or reduce the impact of an incident on the recipients of your services and on other services.
• Cover at least: risk analysis and information-system-security policy; incident handling; business continuity, including backup management and crisis management; supply-chain security, including the security of your relationships with direct suppliers and service providers; security in the acquisition, development and maintenance of your systems, including vulnerability handling and disclosure; evaluating the effectiveness of your own risk-management measures; basic cyber-hygiene practices and cybersecurity training; policies on cryptography and, where appropriate, encryption; personnel security, access-control policy and asset management; and multi-factor or continuous authentication, secure voice, video and text communications, and secure emergency communication systems as needed.
• Notify the measures you take under this duty to the competent authority in the form, format and timeframe it sets by règlement or circulaire.
• Have your management body approve these risk-management measures, oversee their implementation, and complete regular training on assessing risk and risk-management practice; expect the body to be held liable for the entity's violation of this duty.
• Where you find you are not complying with these measures, take, without undue delay, all necessary, appropriate and proportionate corrective measures.
• This binds an entité essentielle (essential entity) or entité importante (important entity) under Article 11, which reaches you where you qualify as at least a medium-sized enterprise under the EU size-cap rule (Commission Recommendation 2003/361/EC) and you are named in Annexe II point 6 as an online-marketplace provider, an online-search-engine provider or a social-networking-services-platform provider, or where you are a public-administration entity under Annexe I point 10; the wider sector classes Annexe I and Annexe II also reach (energy, transport, health, digital infrastructure, ICT-service management, banking and financial-market infrastructure among them) are reached too, by declaring that you are an essential or important entity.

Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité, Art. 14 · Read the law's page

• Notify the competent authority, without undue delay, of any incident with a significant impact on the provision of your services: treat an incident as significant where it has caused or is capable of causing severe operational disruption or financial loss to you, or considerable material, physical or moral damage to another person.
• Submit an early warning within 24 hours of becoming aware of the significant incident, stating whether it is suspected to result from unlawful or malicious acts or could have cross-border effect.
• Follow with a fuller incident notification within 72 hours of becoming aware, updating the early warning and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise.
• Submit an intermediate report if a CSIRT or the competent authority requests one, and a final report within one month of the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report within one month of the handling of the incident (Article 14, paragraph 4).
• Where appropriate, notify the recipients of your services, without undue delay, of a significant incident likely to affect the services they receive from you, and of any measures or corrections they can apply in response to a significant cyber threat.
• If you are a trust-service provider, notify a significant incident affecting your trust services within 24 hours of becoming aware of it, in place of the 72-hour incident notification; the early warning, the intermediate report and the final report still apply.
• This binds an entité essentielle or entité importante under Article 11, which reaches you where you qualify as at least a medium-sized enterprise under the EU size-cap rule (Commission Recommendation 2003/361/EC) and you are named in Annexe II point 6 as an online-marketplace provider, an online-search-engine provider or a social-networking-services-platform provider, or where you are a public-administration entity under Annexe I point 10; the wider sector classes are reached as on this jurisdiction's companion risk-management row.