LuxembourgAct of 1 August 2018 on the Organisation of the CNPD and the General Data Protection Framework
Loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et du régime général sur la protection… des données (Mémorial A n° 686 du 16 août 2018)
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- periodic
- Who audits it
- Independent third party
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Luxembourg, including data collected by crawling.
These lines are LexLint's reading of the law's text. Also read by: Commission nationale pour la protection des données (CNPD) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://cnpd.public.lu/en/professionnels/obligations/liceite.html
- Guidance body
- Commission nationale pour la protection des données (CNPD)
- Open questions
- Does processing that serves journalism or academic, artistic or literary expression alongside a commercial purpose count as processing carried out 'for the sole purpose' of that expression under Article 62 of the Act of , so that it escapes the Article 9(1) prohibition and GDPR Chapter V?
- Which processing counts as 'the exercise of the specific rights of the controller in the field of labour law and insurance' under Article 66 of the Act of , which prohibits the processing of genetic data for those purposes?
What it makes you log
What the log must hold
Event time, Actor identity, Access record
Logging duty
Article 65, point 8 lists, among the measures a controller of scientific or historical research or statistical processing must implement, log files that establish the reason, date and time of each consultation and the identity of the person who collected, modified or deleted the data. The controller must document and justify any exclusion of a listed measure. The reason for a consultation is not a field in the contents vocabulary, so only time, person and access are listed. Point 10 adds a regular evaluation of the effectiveness of the measures through an independent audit, with no interval stated; no recipient of the audit result is named.
- Kind
- Explicit
- As of
- Provision
- Act of , Article 65, point 8
- Trigger
- personal_data_processing
What this law does
Luxembourg's private-sector regime is the General Data Protection Regulation (GDPR) plus the Act of on the organisation of the National Data Protection Commission (CNPD) and the general data protection framework, in effect from , which repealed the prior data protection law. The Act supplies domestic derogations and procedural rules and establishes the CNPD's own organisation.
Its chapter on special categories of personal data prohibits processing genetic data for the controller's rights in labour law and insurance (Article 66); see the sensitive-categories instrument below.
When LexLint raises it
When your app profile says your app crawls the web or processes personal data.
Back to the example · Lint your app
Page updated .