LuxembourgAct of 30 May 2005, Article 4(1) to (3), Confidentiality of Communications and Recording in Professional Practice
Art. 4, paragraphes (1) à (3), loi modifiée du 30 mai 2005
In force since .
An interception and recording consent rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Prohibition, Retention
As of .
What it requires
- If you are a service provider or operator, guarantee the confidentiality of communications made over a public communications network and publicly available electronic communications services, and of the related traffic data.NIST Privacy FrameworkPR.DS-P2
- Do not listen to, intercept or store communications and the related traffic data, or subject them to any other means of interception or surveillance, unless you are the user concerned or the user concerned has consented; technical storage necessary for the routing of a communication is not prevented.NIST Privacy FrameworkCT.PO-P1
- If you record communications and the related traffic data in lawful professional practice to provide proof of a commercial transaction or other commercial communication, inform the parties beforehand that recordings may be made, why, and for how long they will be kept at most, and delete the recordings as soon as the purpose is achieved and in any event when the legal period for challenging the transaction expires.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.DM-P5
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P5Data are destroyed according to policy.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P2Data-in-transit are protected.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Imprisonment of eight days to one year and a fine of EUR 251 to EUR 125,000, or one of those penalties only; the court may also order the processing to stop under a penalty payment (Article 4(4)).
Who enforces it
Enforcement body
The National Commission for Data Protection (Commission nationale pour la protection des données), which Article 12 charges with ensuring the application of the Act.
Settledness
- As of
- Open questions
- Which recordings are made "dans le cadre des usages professionnels licites" to prove "une transaction commerciale ou de toute autre communication commerciale" under Article 4(3)(d) of the amended Act of , and does a recording kept for quality control or training fall outside it?
What this law does
Article 4, paragraph 1 of the Act of requires every service provider or operator to guarantee the confidentiality of communications made over a public communications network and publicly available electronic communications services, and of the related traffic data.
Paragraph 2 prohibits any person other than the user concerned from listening to, intercepting or storing the communications and the related traffic data, or subjecting them to any other means of interception or surveillance, without the consent of the user concerned. Paragraph 2 does not prevent the technical storage necessary for the routing of a communication.
Paragraph 2 does not affect the recording of communications and the related traffic data when it is carried out in lawful professional practice to provide proof of a commercial transaction or of any other commercial communication. The parties to the transactions or other commercial communications must be informed beforehand that recordings may be made, of the reason or reasons for recording, and of the maximum retention period of the recordings.
Recorded communications must be deleted as soon as the purpose is achieved and in any event when the legal period for challenging the transaction expires.
When LexLint raises it
When your app profile says your app records calls, records text chat or processes voice recordings.