by Guy Lloyd | 17th July 2019 1:44 pm
Luxembourg implemented the EU General Data Protection Regulation (GDPR) through the Law of 1 August 2018 on the Organisation of Luxembourg’s National Commission for Data Protection (CNPD) and the General System for Protecting Data, which came into force on 20 August 2018.
The law modified Article L 261-1 of the Labour Code, which concerns the monitoring of employees.
Employers can process personal data to monitor their employees under the circumstances set out in Article 6(1) of the GDPR. Thus, the scope of such processing has been extended in Luxembourg, as employers could previously use a monitoring system in the workplace only in the five circumstances set out in the Labour Code. Further, employers no longer have to obtain the CNPD’s prior authorisation to monitor employees.
Employers must still inform the person in question – as well as the relevant staff delegation or, failing that, the Inspectorate of Labour and Mines – in advance of any processing of personal data to monitor employees’ activities. The Labour Code now specifies that this prior notice must include:
Where an employer plans to process data in order to monitor employees, the relevant staff delegation or, failing this, the employees concerned can submit a request for an advance compliance opinion to the CNPD within 15 days of receipt of the notice. The CNPD must provide its opinion within one month of the request. Requests for an advance compliance opinion have a suspensive effect (ie, the planned monitoring cannot be implemented until the CNPD has given its opinion).
The following types of data processing are still subject to the co-decision system in accordance with the Labour Code, unless the aim of the processing is to fulfil a legal or regulatory obligation:
The CNPD has received numerous notifications of data breaches since the GDPR and the Law on the Organisation of Luxembourg’s CNPD and the General System for Protecting Data entered into force. However, to date, it has imposed no major fines.
This article was originally posted here: https://www.internationallawoffice.com/Newsletters/Employment-Benefits/Luxembourg/Castegnaro/GDPR-one-year-on
Source URL: https://www.gdpr.associates/gdpr-one-year-on-2/
Copyright ©2020 GDPR Associates unless otherwise noted.