The Law of 1 August, 2018 establishing the national commission for data protection and the general scheme on data protection (hereinafter “the Law”), implements the general data protection regulation (hereinafter “the GDPR”) that entered into force on 25 May, 2018.
As the GDPR is directly applicable in Luxembourg, it settles most of the provisions now applicable with regard to data protection. The Law thus completes the European framework where necessary.
To this extent, article 71 of the Law amended article L.261-1 of the Labour Code regarding supervision of employees in the context of labour relations. The main innovations in this area, applicable as from 20 August, 2018, are as follows:
The legal requirement to seek an authorisation from the national commission for data protection (“the CNPD”) no longer applies.
As a result, the processing of personal data for the purpose of supervising employees may now be carried out by the employer, if he is the controller, in accordance with the cases mentioned in article 6, paragraph 1, letters a) to f) of the GDPR and in accordance with the new article L.261-1 of the Labour Code.
According to the previous version of article L.261-1 of the Labour Code, such a processing was only possible if necessary:
From now on, it is sufficient for the employer to rely on one of the 6 conditions of lawfulness of article 6 of the GDPR. Processing can therefore be implemented if:
In terms of supervision of employees in the context of labour relations, the most appropriate condition of lawfulness will generally be that the processing is necessary for the legitimate interests pursued by the employer. On the contrary, consent does not seem to be an appropriate lawfulness basis in labour relations.
If the processing is considered lawful, it will nevertheless have to be determined whether the supervision is necessary and proportional to the intended purpose (data minimisation principle, article 5 of GDPR).
A collective right to information is now provided for employees. Without prejudice to the information right of the data subject, the employer must also provide certain information to the joint committee or, failing that, the staff delegation or, failing that, the labour mining inspectorate (“Inspection du travail et des mines”) in advance.
This prior information must include a detailed description of the purpose of the intended processing, the arrangements for implementing the supervision system, and, where appropriate, the duration or criteria for storing the data, and a formal undertaking by the employer that the data collected will not be used for a purpose other than that explicitly provided for in the prior information.
Furthermore, when supervision is implemented:
it remains subject to co-decision: processing may therefore only be carried out with the agreement of the employees’ representatives, except where the processing complies with a legal or regulatory obligation.
The staff delegation or, failing that, the concerned employees, may, within 15 days following receipt of prior information, request an opinion from the CNPD regarding the compliance of the processing project for the purposes of supervising the employees in the context of labour relations. The CNPD must deliver its opinion within 1 month of such request.
The request has suspensive effect. The employer will therefore not be able to implement the supervision before the CNPD has delivered its opinion.
It is also provided that the employees concerned have the right to lodge a complaint with the CNPD. Such a complaint is neither a grave nor a legitimate reason for dismissal.
 Memorial A n°686 dated 16 August, 2018.