Luxembourg: New data protection law
The National Commission for Data Protection (Commission nationale pour la protection des données, CNPD) presented its annual report for 2015 during a press conference in Esch/Belval.
New rules from 2018
The new data protection regulation will come into force on 25 May 2018. It is designed to give citizens more control over their personal information, make businesses more accountable while also reducing their administrative duties and reinforce the role of data protection bodies like the CNPD.
The new rules, which will replace the 1995 directive currently in place, will apply to all member states of the European Union, including Luxembourg, and to everyone working in the region. As well as the data protection regulation, the legislative package includes a specific directive for the police and the legal system.
Within the context of the Digital Lëtzebuerg initiative, the CNPD and the Ministry of State (Department for Media and Communication) will organise a series of events specifically designed to present the new data protection regulation to the different stakeholders and offer guidance about its implementation. The programme will begin with a conference on 11 October 2016 in Belval. This conference will be followed by industry-specific information sessions, which will be held between 14 and 18 November 2016.
Replacement of “Safe Harbor” with the “Privacy Shield”
On 6 October 2015, the Court of Justice of the European Union declared the “Safe Harbor” agreements invalid (1). The transfer of data to companies based in the United States of America based on this agreement was illegal until the “EU-US Privacy Shield Framework” was adopted by the European Commission. Since 12 July 2016, this new system for protecting data transferred between the European Union and the United States has governed transatlantic exchanges of personal data.
In the next few years, the CNPD’s services will be reorganised to improve the way that the new needs and expectations of the different stakeholders involved are fulfilled within the context of the European regulation coming into force in 2018. Well aware of the CNPD’s larger role and the growing complexity of the issues raised by handling personal data in the digital era, the government has decided to start gradually increasing its staff numbers. The CNPD welcomes this decision, as it will help to tackle the future challenges involved with the appropriate resources.