A New Dawn For Professional Secrecy In Luxembourg

A draft law that affects professional secrecy has been adopted—well, not secretly, but perhaps out of the spotlight. Finance Minister Pierre Gramegna, back in July 2016, proposed draft law no. 7024 on the eve of the parliamentary break. The draft would implement, nationally in Luxembourg, a European regulation1 on interchange fees for card-based payments, with the larger goal of making data outsourcing to intragroup or external providers easier. But the draft also modified the Laws of 5 April 1993 and 7 December 2015, removing the obligation to process financial institutions' data inside Luxembourg's borders. This reduces the scope of professional secrecy.

On 22 February 2018, the State Council opted not to revise the draft law, meaning that it is now deemed to be adopted. It has thus become to Law of 27 February 2018, and came into force a month ago on 5 March 2018.

Déjà-vu

The conversations about secrecy that the new law poses are reminiscent of those from some years ago, when large depositary banks questioned the relevance of banking secrecy. To them, it made no sense to adhere to costly and cumbersome professional secrecy requirements if there were a possibility of benefitting from high-performing IT platforms based at their international headquarters instead.

In response, the CSSF adopted a pragmatic stance, permitting a few exceptions to professional secrecy on certain grounds.2 Under the exceptions, data could be exported abroad provided that it be transmitted on an anonymous and encrypted basis so as to conceal client names on computer screens located in foreign IT centres.

What does the new law change?

The Law of 27 February 2018 acknowledges the trend of outsourcing by allowing it. It distinguishes between, and provides guidance on, outsourcing to CSSF-, ECB-, and CAA-supervised firms, and covers other outsourcing situations as well. Additionally, article 41 of the new law exempts professional secrecy requirements—if the client consents—under the terms and conditions agreed on amongst all parties concerned.

Entities under CSSF supervision

The new law sets out organisational requirements for the outsourcing activities of credit institutions and investment firms under CSSF supervision. These include:

The level and quality of services provided to the clients must not be endangered by the outsourcing. A service level agreement must have been concluded. Credit institutions and investment firms bear full responsibility of their...