Publication Of The First Government Amendments To Bill Of Law ('Projet De Loi No.7184') Complementing The European General Data Protection Regulation ('GDPR')

On 12 September 2017, the Luxembourg Parliament issued bill of law no. 7184 (the "Bill of Law") in order to complement Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC ("GDPR")1.

Through the Bill of Law, the Luxembourg legislator intends to make use of the margin for manoeuver that the GDPR grants to EU Members States to enact additional legislation vis-à- vis the protection of personal data.

Pursuant to the publication of the Bill of Law, several public and private bodies have issued detailed opinions, in some cases criticising certain points of the Bill of Law. This led the Luxembourg Government to introduce some amendments to the Bill of Law on 8 March 2018 (the "Amendments").

The Amendments introduce three major changes to the Bill of Law. The changes are as follows:

Amendments to Luxembourg labour law, especially with respect to the monitoring of employees; Insertion of a specific procedure relating to the imposition of penalty payments by the Luxembourg data protection supervisory authority (the "CNPD"); Establishment of a Commissariat du Gouvernement à la protection des banques de données de l'Etat (the "Commissariat"). I.Amendments to the Luxembourg Labour Code

The first version of the Bill of Law did not contain any provisions relating to the monitoring of employees, which led to criticism of the Bill of Law.

This likely encouraged the Luxembourg Government to introduce some Amendments to replace Article L. 261-1 of the Luxembourg Labour Code.

Indeed, the current version of Article L. 261-1 of the Labour Code refers to the definition of supervision provided under the current Luxembourg data protection Law of 2 August 2002 as amended, which will be repealed by the entry into force of the Bill of Law. This would leave Article L. 261-1 of the Labour Code with a reference to a concept no longer defined under Luxembourg law, thus creating a situation of great legal uncertainty for employers and employees.

The new Article L. 261-1 of the Labour Code introduced by the Amendments now provides for specific provisions relating to supervision in the context of employment relationships.

In this regard, the new Article L. 261-1 first states that an employer may process its employees' personal data for the purpose of monitoring, as long as such processing is carried out in compliance with the principles of the GDPR.

The Amendments establish...