Luxembourg

A controller must notify the CNPD without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Luxembourg, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. No Act of 1 August 2018 derogation from this timeline is identified.

Luxembourg's private-sector regime is the General Data Protection Regulation (GDPR) plus the Act of 1 August 2018 on the organisation of the National Data Protection Commission (CNPD) and the general data protection framework, in effect from 20 August 2018, which repealed the prior 2 August 2002 data protection law. The Act supplies domestic derogations and procedural rules and establishes the CNPD's own organisation.

A CMS Expert Guide entry, read, states directly that no specific provisions regarding biometrics are envisaged in the Act, the genuine finding for this jurisdiction rather than a gap; see the sensitive-categories instrument below.

Transferring personal data of a person in Luxembourg outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. No Act of 1 August 2018 derogation broadening or narrowing this is identified.

General Data Protection Regulation (GDPR) Articles 12 to 23 apply, including Article 22 rights against a decision based solely on automated processing. No Luxembourg-specific broadening or narrowing of these rights is identified.

The CNPD is the supervisory authority for administrative enforcement (General Data Protection Regulation (GDPR) Article 83 fines), while a GDPR Article 82 compensation claim is brought before the ordinary civil courts (tribunal d'arrondissement) rather than the CNPD itself, per secondary commentary read. No Luxembourg-specific fine ceiling beyond the GDPR Article 83 maximum was identified.

General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. Luxembourg has no biometric-specific national derogation: a CMS Expert Guide entry states directly that no specific provisions regarding biometrics are envisaged in the Act of 1 August 2018, and that the general GDPR framework applies without a national addition. A voiceprint or faceprint captured for identification purposes is therefore governed in Luxembourg by GDPR Article 9 alone. No Luxembourg-specific voiceprint case or regulatory guidance is known.

Article 509-1 punishes fraudulently accessing or remaining in all or part of an automated data-processing or transmission system with two months to two years of imprisonment and a fine of 500 to 25,000 euros, rising to four months to two years and 1,250 to 25,000 euros where data is suppressed or modified or the system's functioning is altered.

Because the offence's trigger is fraudulent access, a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision. Article 509-2 punishes intentionally interfering with or falsifying a system's functioning, and article 509-3 punishes intentionally introducing, suppressing, altering or (since a 2014 amendment) intercepting its data, each with three months to three years of imprisonment and 1,250 to 12,500 euros.

Article 509-4 raises the penalty to four months to five years and 1,250 to 30,000 euros where any of these offences causes a transfer of money or monetary value for economic gain, and article 509-5 punishes producing, selling, holding or distributing a device or electronic key intended to commit these offences at the same level. Attempt and participation in an association formed to commit these offences are punished the same as the completed offence, under articles 509-6 and 509-7.

Article 10, point 16, added by the Loi du 1er avril 2022 transposing the Digital Single Market Directive, permits reproductions and extractions of lawfully accessible works for text and data mining without the rightholder's authorization, unless the rightholder has expressly and appropriately reserved that use, including by machine-readable means for content made available online.

Article 10, point 15 gives research organizations and publicly accessible libraries, museums, archives and film or sound heritage institutions the same permission for scientific research text and data mining, without being subject to that reservation. The statute defines text and data mining as any automated analytical technique to analyze text and data in digital form in order to generate information such as patterns, trends and correlations.

The amending law's own text does not state a specific entry-into-force day for these provisions beyond the Journal officiel publication mechanism.

A database producer may forbid extraction or reuse of the whole, or a qualitatively or quantitatively substantial part, of the database's contents, and may also forbid the repeated and systematic extraction or reuse of insubstantial parts where that conflicts with normal exploitation of the database or unreasonably prejudices the producer's legitimate interests.

Extraction is defined as the permanent or temporary transfer of all or a substantial part of the contents to another medium by any means, and reuse as any form of making the contents available to the public, excluding public lending in both cases. The right, part of the original 2001 law implementing the EU Database Directive, is unaffected by the 2022 Digital Single Market transposition, which did not amend article 67.

Article 12 requires an entité essentielle (essential entity) or entité importante (important entity) to take technical, operational and organisational measures appropriate and proportionate to the risks threatening the security of the network and information systems it uses for its activities or services, and to eliminate or reduce the impact of incidents on the recipients of its services and on other services.

The measures must follow an all-hazards approach and cover at least ten categories: risk-analysis and information-system-security policy, incident handling, business continuity including backup and crisis management, supply-chain security, security in the acquisition, development and maintenance of systems including vulnerability handling and disclosure, evaluating the measures' own effectiveness, basic cyber-hygiene and training, cryptography and encryption policy, human-resources security, access control and asset management, and multi-factor or continuous authentication and secure communications, transposing NIS2 Article 21.

Annexe II point 6 names an online-marketplace provider, an online-search-engine provider and a social-networking-services-platform provider among the digital providers this duty reaches expressly. Annexe I point 10 separately reaches public-administration entities, as defined by Article 2. Article 13 requires the entity's management body to approve these measures and oversee their implementation, and states that the body may be held liable for the entity's violation of Article 12.

Article 14 requires an entité essentielle or entité importante to notify the competent authority, without undue delay, of any incident with a significant impact on the provision of its services (an incident important), and, where appropriate, to notify the recipients of its services of a significant incident likely to affect the supply of those services.

An incident is significant if it has caused or is capable of causing severe operational disruption or financial loss to the entity, or has affected or is capable of affecting other natural or legal persons through considerable material, physical or moral damage.

The notification runs on a graduated clock: an early warning within 24 hours of becoming aware of the incident, a fuller notification within 72 hours giving an initial assessment of its severity and impact and any indicators of compromise, an intermediate report on request, and a final report within one month of the 72-hour notification (or a progress report followed by a final report if the incident is still ongoing at that point), transposing NIS2 Article 23.

A qualified trust-service provider notifies on the shorter 24-hour clock alone, by derogation. The mere act of notifying an incident does not itself increase the notifying entity's liability, and the competent authority forwards the notification to the relevant CSIRT and the single point of contact upon receiving it.

A provider of audiovisual media services must ensure that programs likely to harm minors' physical, mental or moral development are made available only under conditions that normally prevent minors from seeing or hearing them. A grand-ducal regulation sets the specific measures, which may include age-verification tools.

A provider of a video-sharing platform within Luxembourg's jurisdiction must take proportionate measures to protect minors from harmful programs, user-generated videos and audiovisual commercial communications. Those measures include systems to verify the age of users for content likely to cause such harm. Minors' personal data collected under either duty may not be processed for commercial purposes such as profiling or targeted advertising.

Article 56 bis gives press publishers the reproduction and making-available rights of articles 43 and 44 for the online use of their press publications by information-society service providers. The right does not reach private or non-commercial use by individual users, acts of hyperlinking, or the use of isolated words or very short extracts of a press publication.

It expires two years after publication, counted from the January 1 following the date of first publication, and does not apply to a press publication first published before 6 June 2019.

Authors of works integrated in a press publication are entitled to an appropriate share of the revenue the publisher receives from information-society service providers, and article 56 ter makes any transfer or licence of an author's rights to a publisher a sufficient legal basis for the publisher to claim a share of statutory-exception compensation for uses of the work.

The amending law's own text does not state a specific entry-into-force day for these provisions beyond the Journal officiel publication mechanism.

Article 10, point 16 permits reproductions and extractions of lawfully accessible works, including news articles, for text and data mining without the rightholder's authorization, unless the rightholder has expressly reserved that use by an appropriate means, including a machine-readable reservation for content made available online.

Article 10, point 15 gives research organizations and public libraries, museums, archives and film or sound heritage institutions the same permission for scientific-research text and data mining, without being subject to that reservation. A news aggregator indexing or mining Luxembourg press content for purposes other than scientific research falls under the general, opt-out-able exception; a publisher's machine-readable reservation removes the exception's protection for that content.