The Luxembourg law dated July 23rd 2016  (the “New Law”) amending inter alia the law dated March 29th 2013 relating to the organisation of the criminal records came into force on February 1st 2017. The Law clarifies the right of an employer to request criminal records, in particular in the context of pre-hiring checks.
The criminal record is divided into 5 different categories (bulletins) for natural persons, Bulletin n°2 under the New Law will no longer be available to employers; only the newly created Bulletin n°3 and Bulletin n°4 and 5 will be available under specific conditions.
The “new” Bulletin n°2 of a natural person will contain information on convictions with criminal and correctional penalties and on the granting of an order to be remanded in custody at the time of the criminal procedure of the relevant person with the exception of:
The “new” Bulletin n°3 of a natural person will contain information on convictions with criminal and correctional penalties with the exception of :
The new law provides that an employer prior to hiring a job applicant may have access to the followings “bulletins” under the following conditions:
In all cases, if the employer makes the decision not to hire the job applicant, the bulletin will have to be immediately destroyed. If the job applicant is hired, the employer will only be entitled to retain the criminal records for one month.
During the employment relationship, the employer will also be allowed to request the bulletin n°3 in the following cases:
In that case, the bulletin may not be retained longer than 2 months unless otherwise provided for by the law and the employer is not allowed to process the data contained in the bulletin.
Criminal penalties apply in case of breach by an employer:
In all events, the authorisation from the Data Protection Authority is required because judicial data are considered as sensitive data. The processing of judicial data must be justified by a legal provision, which will now be Article 8-5(2) of the law dated March 29, 2013 relating to the organisation of the criminal records as amended. The authorisation if and when issued by the Data Protection Authority will be valid for all requests and not for one request for one employee.
 Loi du 23 juillet 2016 portant modification 1) de la loi du 29 mars 2013 relative à l’organisation du casier judiciaire, 2) du Code d’instruction criminelle, 3) du Code pénal.