LuxembourgGDPR Articles 12-21 and Loi du 1er août 2018 Article 63, Data Subject Rights in Luxembourg
Regulation (EU) 2016/679, Arts. 12-21; Loi du 1er aout 2018, Arts. 63, 65
In force since .
A data subject rights rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- periodic
- Who audits it
- Independent third party
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Luxembourg within one month of receipt.
- If you process personal data in Luxembourg for scientific or historical research or for statistics, you may depart from the rights of access, rectification, restriction and objection (General Data Protection Regulation (GDPR) Articles 15, 16, 18 and 21) to the extent they would make that purpose impossible or seriously impair it, provided you take the additional safeguards Article 65 requires, under Loi du 1er aout 2018 Article 63.
These lines are LexLint's reading of the law's text. Also read by: Commission nationale pour la protection des données (CNPD) (guidance, recorded ); Case C-307/22 FT v DW, judgment of the Court of Justice (First Chamber) of (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0307
- Guidance link
- https://cnpd.public.lu/fr/particuliers/vos-droits/droit-acces.html
- Case citation
- Case C-307/22 FT v DW, judgment of the Court of Justice (First Chamber) of
- Guidance body
- Commission nationale pour la protection des données (CNPD)
- Open questions
- Does the research derogation of Articles 63 to 65 of the Loi du 1er août 2018 reach the right to erasure, as the CNPD's page on erasure applies it?
What record it asks for
What the log must hold
Event time, Actor identity, Access record
Logging duty
Article 65, point 8 lists, among the measures a controller of scientific or historical research or statistical processing must implement, log files that establish the reason, date and time of each consultation and the identity of the person who collected, modified or deleted the data. The controller must document and justify any exclusion of a listed measure. The reason for a consultation is not a field in the contents vocabulary, so only time, person and access are listed. Point 10 adds a regular evaluation of the effectiveness of the measures through an independent audit, with no interval stated; no recipient of the audit result is named.
- Kind
- Explicit
- As of
- Provision
- Act of , Article 65, point 8
- Trigger
- personal_data_processing
What this law does
Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Luxembourg can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.
The Loi du 1er aout 2018 narrows these rights for research: a controller processing for scientific or historical research or for statistics may depart from the rights of access, rectification, restriction and objection to the extent they would make that purpose impossible or seriously impair it, provided it takes the additional safeguards Article 65 lists.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .