New Law On Monitoring At The Workplace

Following the entry into force of the General Data Protection Regulation ("GDPR") on 25 May 2018, the Law of 1 August 2018 implements the provisions of the EU regulation into Luxembourg Labour Law. This Law entered into force on 20 August 2018. Article L.261-1 of the Labour Code now contains specific provisions regarding the processing of personal data for monitoring purposes in the context of the employment relationship.

The scope within which employers may process personal data for monitoring has been extended. The monitoring of employees is only permissible:

if the employee gives their written consent to the processing of their personal data; if the processing of personal data is necessary for the performance of the employment contract; if the employer is subject to a legal obligation to process personal data; or if the processing of personal data is justified by a legitimate interest. Article L. 261-1 of the Labour Code introduces increased obligations for the employer regarding prior information to be given to employees regarding the processing of their data. Firstly, the employer is required to inform each employee concerned by the monitoring individually before any data is processed (ECHR, Bărbulescu v Romania, 5 September 2017, No. 61496/08). Secondly, the employer must provide prior information to the employees' representatives, or failing that, to the Labour and Mines Inspectorate (ITM) including a detailed description of the purpose of the intended processing, the arrangements for implementing the monitoring system, the duration or criteria for storing the data where applicable, as well as a...