skip to content
 

Data Protection Laws and Freedom of Expression: Luxembourg Flag of Luxembourg

 

Constitutional/Primary Law Background - see also ECHR and EU Charter

Article 24 of the contemporary Luxembougish Constitution (1868 as revised 2009) on freedom of expression prohibits censorship and guarantees freedom of speech in relation to opinion and freedom of the press but with a saving for the repression of any legal offenses in this regard.  Whilst there is no protection of data protection as such, Article 11(3) guarantees the protection of private life (save with the exceptions established by law), article 15 declares the inviolability of domicile (with intrusion only according to law) and article 28 the secrecy of correspondence/letters (but allowing for a law to interference with this as regards the post and with only a statement that the law regulates the guarantee as regards telegrams).

With the exception to the reference to telegrams which dates from 1868, provisions on freedom of expression, domicile and correspondence/letters which are essentially identical to the above can be found in the 1848 Constitution (see articles 25, 16 and 29).  The general protection of private life dates from 2007.

 

First-Generation Statutory Law

Luxembourg first adopted a data protection law in 1979, namely the ‘Nominal Data (Automatic Processing) Act of 31 March 1979’ (Loi du 31 mars 1979 réglementant l’utilisation des données nominatives dans les traitements informatiques).
 
Special Expression Derogation
There was no specific provision.
 
Broad Expression Derogation
There was no specific provision.
 
Personal Exemption
There was no specific provision.  However, it was explicitly stated that the law did not apply to ‘databases’ that contained data exclusively relating to the owner of the data base (art. 3(2)(b)).
 
Knowledge Facilitation Provision
There was no specific provision.
Parliamentary Debates
Special Expression Derogation
One parliamentarian seemed to make a comment on the lack of ability of journalists to invoke the secrecy of their sources before criminal courts.[1] It is, however, unclear how related to the general discussion about the proposed law. From the context of the debate it would seem that the parliamentarian was making these observations in order to argue for a analogous position for members of the Consultative Commission established in the Act, whose members were supposed to be bound by professional secrecy.
 
Broad Expression Derogation
Nothing.
 
Personal Exemption
Nothing.
 
Knowledge Facilitation Provision
With regard to anonymized scientific and statistical data it was observed that such data would fall outside the definition of personal data and thus would not be regulated by the proposed law.[2]
 

Second-Generation Statutory Law

The Luxembourg second-generation Law of 2 August 2002 on the Potection of Persons with regard to the Processing of Personal Data Act 2002 (‘Loi du 2 août 2002 relative à la protection des personnes à l’égard du traitement des données à caractère personnel’) entered into force on August 2, 2002 transposing Directive 95/46.
 
Special Expression Derogation
The data quality principles and the need for a legitimating ground of processing were applied without restriction to journalistic, artistic or literary expression. With regard to proactive transparency, Art. 9 of the law provided that the rules did not apply ‘if its application would compromise the collection of data from the data subject’ but added a general rider that the exemption only applies ‘in so far as … necessary to reconcile the right to privacy to the rules governing freedom of expression’. It was also stated that these provisions were without prejudice to provisions in the Media Law. The proactive transparency rule applicable to cases of indirect collection of data was also subject to a more permissive public interest exemption.[3] With regard to the retroactive transparency rule, Luxembourg set out a exception based on compliance with strict rules, namely, that the controller agreed to allow the Data Protection Authority to access data vicariously on the data subject’s behalf (with at least the Chair of the Press Council having been duly summoned).[4] The restrictions on processing criminal-related and other sensitive data were lifted only when such data had manifestly been made public by the data subject themselves or were directly related to the public life of the data subject or an event in which they are involved in a deliberate manner.[5] An unconditional derogation was granted from requirement to notify the DPA of processing[6] and an exemption based on the basis of a permissive public interest test set out from the international data transfer conditions.[7]
 
Broad Expression Derogation
No specific provisions adopted.
 
Personal Exemption
The law did not apply to the processing of data carried out by a natural person exclusively in the context of his or her personal or domestic activities.[8]
 
Knowledge Facilitation Framework – see also GPDR, art. 5(1)(b) (compatibility), art. 5(1)(e) (time limits) and art. 89(1) (appropriate safeguards)
From 2007, an exception applied for the processing of personal data for historical, statistical or scientific purposes from to the compatibility principle but only so long as this received prior authorization from the DPA.[9] The other data quality principles applied in full. An exemption from the proactive direct and indirect transparency rules was applicable to the processing of personal for statistical, historical or scientific purposes, if notification was not possible or required disproportionate efforts.[10] Moreover, the retrospective transparency rule was excluded from application to the processing of personal data for scientific research, if there was ‘obviously no risk of breaching the privacy of the data subject’, and for statistical purposes, ‘if stored … for a period not exceeding that necessary’ and the respective data could not be used for the purpose of taking a measure or a decision relating to specific persons.[11] Processing of sensitive data other than judicial data was permitted if necessary for reasons of public interest for historical, statistical or scientific purposes.[12] However, special provisions were applicable to the processing of genetic data where a DPA permit was required and data concerning health and sex life necessary for healthcare or scientific research purposes which could only be carried out by medical authoriteis or where research had been approved under legislation applicable to biomedical research with an indication of a delegated controller subject to professional secrecy in cases where the controller was a legal person.[13] No exemptions for historical, statistical or scientific purposes were provided from the international data transfer, legitimating ground and notification conditions.  DPA and court supervision applied in full.  
Opinions of Extra-Parliamentary Organs
Special Expression Derogation
In their written statement on the draft law in May 2001, the Board of the Public Officers and Employees and the Chamber for Trade observed that there were a number of provisions in the proposed law—including those relating to freedom of expression—which regulate a specific field and should therefore rather find their place in the corresponding specific legislation.[14] In response to the Conseil d’Etat’s opinion to postpone the implementation of Art. 9 of Directive 95/46 EC until after the passing of the new media law,[15] the Commission on Media and Communications maintained that the Directive did nnot grant the Member States any leeway on whether to implement Art. 9 and that the implementing draft Art. 9 should therefore be maintained despite the prospect of a new media law. This was in particularly so since the said media law would only include special provisions on the processing of personal data for journalistic but not other relevant i.e. artistic or literary purposes.[16] The Commission on Media and Communications accordingly adopted an amendment which subjected the application of Art. 9 of the proposed law to the legislation concerning the freedom of the press.[17]
The Conseil d’Etat observed that Art. 9 of the Directive required the national legislator to arbitrate between two essential rights and fundamental freedoms: the freedom of expression and the right to privacy. It maintained that the proposed provision would not prejudice the press law, but emphasized that a balanced solution would be required.[18]
With regard to the lack of definition of ‘journalism or artistic or literary expression’, it maintained that the Belgian doctrine favoured a functional conception of these notions. These terms would not denote a professional category, but rather aimed at regulating the data processing carried out in the context of journalism and a form of artistic or literary expression. The exception meant to exclude processing for purposes of communicating to the public an expression with a definite aesthetic, intellectual or news content. The controller was therefore not necessarily a journalist, writer or artist. Media organisations, publishers etc. would also be covered.[19]
In an additional Notice, the State Council explained that an initial draft of the article implementing Art. 9 was somewhat misleading. This stated ‘[w]ithout prejudice to the provisions laid down in legislation on freedom in the mass media and insofar as it is necessary to reconcile the right to privacy with the rules governing freedom of expression, processing carried out solely for the purposes of journalism or artistic or literary expression shall not be subject ‘(a) to the prohibition on processing special categories of data as laid down in Article 6 (1) […].’ The State Council elaborated that such a formulation would suggest that exceptions to the general rules prevailing in this area were likely to come into play as soon as processing was carried out solely for the purposes of journalism or artistic or literary expression and proved necessary to reconcile the right to privacy with the rules governing freedom of expression. It was argued that perspective seemed ‘obviously’ incompatible with the philosophy underlying Art. 9 of the Directive 95/46. The State Council therefore proposed replacing in the first setence of the above quoted para. 1 the words ‘it is necessary’ by the words ‘where the following derogations are necessary’.[20]Parliamentary Debates
Special Expression Derogation
In the parliamentary debates, Alex Bordry MP, of the Socialist Workers Party, stated that the challenge of the law was to accommodate data protection with the freedom of expression and freedom of the press. He then went on to reflect on this in more detail, arguing that there is both a need to protect personal data from the press but also a need not to inhibit the work of the press as well as to protect the freedom of information and free speech. He then referred to the provisions of the Directive to this effect, underlining that according to the Directive, the standard of protection of personal data is slightly lower in this regard in order to allow the press to work freely and to permit the development of the arts and literature. He outlined the two-step approach that Luxembourg was taking in implementing the Art. 9 of the Directive. In a first step, the draft implementing regulation lays down the relevant principles in order to ensure compliance with the obligation to transpose the Directive in its entirety. In a second step, a more detailed regime would be implemented by the adoption of a new media law, at the time planned within half a year. He maintained that in the legislation currently under debate, the freedom of media was accorded an important role. Derogations for journalistic purposes were allowed from a number of provisions. These included (i) the possibility to use sensitive data in the context of journalistic work; (ii) the possibility to transfer data to third countries, even where the latter did not have an adequate data protection regime; (iii) the duty to inform the person concerned of the use that is made of his or her data did not apply as strictly as in other contexts; and (iv) a person’s access to his or her own data is more limited if such data is processed for journalistic purposes. He further recalled that the protection of the source was in order. He underlined that the notification (to the data subject) which must be made if personal information is processed for journalistic purposes does not relate to the content of the data but rather and exclusively the indication of the person responsible for the processing of the data. Bordry concluded that the proposed provisions would allow journalists to carry out their work appropriately, even after the enactment of this new data protection regime. It would, however, be for the media law to specify how the national DPA should address these issues. He deemed specific rules, deviating from the general data protection regime, necessary in order to allow journalists to pursue their work, upholding freedom of information and expression.[21]
Serge Urbany MP observed that the provisions exempting the processing for journalistic purposes had been criticized, including by newspapers on the very day the parliamentary debate took place. He argued that processing of personal data for journalistic purposes should be dealt with in the media law rather than in the more general data protection law under debate.[22]
Fançois Biltgen, a member of the government in charge of Communications, explained that journalism is not addressed in more detail in the proposed implementing law as many stakeholders, including the National Commission for the Protection of Human Rights as well as representatives of the press, had claimed that processing for journalistic purposes should be addressed in a specific, standalone law, namely the new media law.[23]
Subsequently, Fernand Greisen MP briefly outlined that the freedom of the press as well as the freedom of expression are delicate matters and that in a free and democratic society, these freedoms as well as the right to access information would have to co-exist with the right to data protection. The new media law would have to introduce clarification as to how the tension between these rights and freedoms should be reconciled.[24]
 
Broad Expression Derogation
Nothing.
 
Personal Exemption
In the parliamentary debate, Patrick Santer MP, the MP responsible for reporting on the draft legislation, elaborated briefly that the use of personal data for exclusively private/domestic purposes was excluded from the law’s ambit. Such regulation would otherwise constitute a disproportionate intrusion into the private sphere of the individual. There was, however, no further discussions on this provision.[25]
 
Knowledge Facilitation Framework
The report of the Committee on Media and Communications briefly elaborated that the further processing of personal data for historical, statistical or scientific purposes would be allowed. Such further processing would have to be authorized by the National Commission i.e. the DPA which would examine whether the said purposes could not also be achieved with anonymized data.[26]
In the parliamentary debate, Patrick Santer MP specifically addressed the processing of genetic data for scientific research purposes. Such research could only be carried out where not prohibited by specific legislative provisions or the principle of the inviolability of human life and limb. Research on cloning would be prohibited. He further mentioned the processing of personal data in research in medicine or biology would have to be submitted to a ‘medical authority’ as defined in Art. 2 of the implementing law for approval.[27] However, he observed that exceptions are foreseen for health care organisations, pension funds and the like.[28] No further substantive debate on the knowledge facilitation derogation took place.
 

Third-Generation Statutory Law

Luxembourg adopted third-generation data protection legislation including implementing the GDPR through a first vote in the Chamber of Deputies on 26 July 2018 and in the Council of State on 27 July 2018. This new law was promulgated and entered into force on 1 August 2018.
 
Special Expression Derogation
Pursuant to Art. 62, Luxembourg continues to subject processing for the sole purpose of journalism and academic, artistic or literary expression to the data protection principles, the need for a legal ground of processing and the requirement to compile a registration of processing. Derogations from the proactive transparency rules apply whenever their application would compromise the collection of data from the data subject, or, in other cases, where it would compromise the collection of data, the identity of any sources or the planned publication or making available of information to the public in whatever way. In contrast, only a rule-restricted derogation from reactive subject access is established since, whilst the origin and source of data may be absolutely protected, they otherwise must allow the DPA to vicariously access the data on any data subject’s behalf (with the president of the Press Council at least duly summoned to attend). Exemption from the restrictions on processing criminal-related or other sensitive data can apply only to ‘data manifestly made public by the data subject or data which are directly related to the public life of the subject or a fact in which they are voluntarily involved’. Finally, the law sets out a complete exemption from the international data transfer conditions.  These provisions do not explicitly establish the priority of the special expression derogation over the Knowledge Facilitation Framework.
 
Broad Expression
There is no specific provision.
 
Personal Exemption – see GDPR, art. 2(2)(c)
 
Knowledge Facilitation Framework
All processing for scientific and historical research purposes is subject a requirement that for each project the controller either implements a list of technical (e.g. pseudonymisation, encryption, log file tracking) and organisational (e.g. implementation of an impact assessment) or documents set out in Article 65 or justifies any exclusion of these.  Art. 63 provides derogation from arts. 15, 16, 18 and 21 GDPR for scientific or historical research purposes, or for statistical purposes, to the ‘extent that it makes it impossible or seriously impedes the achievement’ of these aims.  Under article 64, sensitive data can be similarly processed subject to the conditions of Article 65.  Processing for archival purposes is not seperately addressed.
Opinions of Extra-Parliamentary Organs[29]
Special Expression Derogation
Pursuant to the commentary by the Chambre des Députés (i.e. the Parliament) which accompanied the first draft of the proposed implementation law, it would be up to judges to verify whether in the pursuit of journalistic, academic, artistic or literary expressions the right balance has been struck between the respect for the protection of personal data and freedom of expression. Processing carried out for a journalistic, academic, artistic or literary purpose may therefore derogate from the general restrictions laid down in the draft law.[30]
The commentary further suggests that such a derogation is possible under three alternative conditions: (i) the data subject has clearly and unequivocally expressed his/her will to make the respective personal data publicly available; (ii) the relevant data relates to the data subject as a public figure. Data of public figures may not be protected even if it falls within their private lives if it relates to their public character; and (iii) the data is closely connected with a fact of public interest and the data subject volunteers data in that connection. The Parliament gave the example of a psychiatric hospital having been burnt down. If a victim voluntarily gives testimony to the media about the event and it hence becomes evident that the respective victim is a patient of the affected facility, the victim’s data are not protected.[31]
The parliamentary commentary further elaborated that journalists must have a certain margin for ‘manoeuvre’ and that they therefore do not have an obligation to inform the affected data subject if this would jeopardise the journalistic collection of data. If journalists do not collect the relevant data from the concerned data subject, it is not necessary to inform the respective data subject if this would (i) compromise the collection of journalistic data; (ii) jeopardise the publication project; (iii) in any way jeopardise the availability to the public of data processed for the journalistic, academic, artistic or literary purposes of expression; (iv) provide indications enabling the identification of the sources of information.[32]
With regard to the amended draft law, the Conseil d’État (Council of State) asked a question relating to the condition (taken forward from the previous legislation) that derogations must be necessary to reconcile the right to privacy with the rules governing freedom of expression.  It observed that this wording would either have to be solely of explanatory value and should thus be omitted or left up to the National Commission for Data Protection i.e. DPA to judge whether the criteria of necessity and proportionality are met. The Council of State thereby did not express an opinion on whether the derogations should be ‘global’ or judged on a ‘case-by-case’ basis but asked the government to clarify for the sake of legal certainty. Similarly, with regard to the deferred or indirect access to data processed for journalistic purposes by a data subject, the Council of State asked the legislature to explain the exact working of the proposed mechanism. It criticised in particular that the Chairman of the Press Council would be included by the National Commission for Data Protection when deciding on such access to data. This would taint the appearance of independence of the National Commission for Data Protection and could hence not be reconciled with the right to data protection and the right to freedom of expression.[33]
These calls for clarifications and suggestions for amendments were largely complied with by the legislature.[34] The National Commission for Data Protection argued with regard to the question on the nature of the derogations from the guarantees provided for in the regulation that it was indeed ‘global’. However, it did not share the opinion of the Council of State that the presence of the President of the Press Council in case a data subject would like to exercise his or her right to access personal data would jeopardise the independence of the National Commission of Data Protection, particularly given the role of the press in a democratic society.[35] This provision was maintained in the legislation without amendment.
 
Knowledge Facilitation Framework
The Parliament’s commentary to the draft law observed that the rights of data subjects pursuant to Articles 15, 16, 18 and 21 GDPR are limited. It discussed several examples of when an exercise of the rights provided in these articles would severely impact on valuable research, observing that a rectification of personal data might take several months and hence endanger a scientific project.[36] Pursuant to the commentary, draft Art. 58 (ultimately art. 65) listed a number of safeguards which the data controller should take in addition to the legal safeguards and technical or organizational measures usually necessary in accordance with the state of the art. It was emphasized that the list was not exclusive and other appropriate measures could be taken.[37]
 
Parliamentary Debates
Rapporteur Eugène Berger elaborated on the articles, restating their content. No further debates took place.[38]
 

[1] Chamber of Deputies, Debates of 8 March 1979, p. 3750.
[2] ‘Projet de loi réglementant l’utilisation des données normatives dans les traitements informatiques N° 2131’ (25 October 1977) https://www.chd.lu/wps/portal/public/Accueil/TravailALaChambre/Recherche... (last accessed 14 February 2020).
[3] Luxembourg, Data Protection Act, art. 9.
[4] Luxembourg, Data Protection Act, art. 29(3).
[5] Luxembourg, Data Protection Act, art. 9(a).
[6] Luxembourg, Data Protection Act, art. 12(2)(d).
[7] Luxembourg, Data Protection Act, art. 9.
[8] Luxembourg, Data Protection Act, art. 3(3).
[9] Luxembourg, Data Protection Act, art. 4(2) and 14(1)(c).
[10] Luxembourg, Data Protection Act, art. 27(3).
[11] Luxembourg, Data Protection Act, art. 29(2).
[12] Luxembourg, Data Protection Act, art. 6(2)(g).
[13] Luxembourg, Data Protection Act, art. 6(3)(c) and (d) and art. 7(2).
[14] Avis de la Chambre des Fonctionnaires et Employés Public (22 May 2001) Doc. No. 4735/1 https://www.chd.lu/wps/portal/public/Accueil/TravailALaChambre/Recherche... (last accessed 14 January 2020); Avis de la Chambre des Métiers (22 November 2001) Doc. No. 4735/5 https://www.chd.lu/wps/portal/public/Accueil/TravailALaChambre/Recherche... (last accessed 14 February 2020).
[15] Ibid.
[16] Rapport de law Commission des Media et des Communication (10 July 2002) Doc. No. 4735/13 https://www.chd.lu/wps/portal/public/Accueil/TravailALaChambre/Recherche... (last accessed 14 February 2020).
[17] Amendments adoptés par la Commission des Media et des Communications – Dépêche du Président de la Chambre des Députés au Président du Conseil d’Etat (6 June 2002) Doc. No. 4735/8 https://www.chd.lu/wps/portal/public/Accueil/TravailALaChambre/Recherche... HANET2GOLE0AUD8KJ0P18U7019404_secondList=&PC_Z7_28HHANET2GOLE0AUD8KJ0P18U7019404_selectedDocNum=6#Z7_28HHANET2GOLE0AUD8KJ0P18U7 (last accessed 14 February 2020).
[18] Avis du Conseil d’Etat (29 January 2002) Doc. No. 4735/6 https://www.chd.lu/wps/portal/public/Accueil/TravailALaChambre/Recherche... (last accessed 14 February 2020).
[19] Ibid.
[20] Avis Complémentaire du Conseil D’Etat (2 July 2002) Doc. No. 4735/10 https://www.chd.lu/wps/portal/public/Accueil/TravailALaChambre/Recherche... (last accessed 21 February 2020).
[21] In Rapport de la Commission des Media et des Communications – 3. Projet de Loi 4735 relatif à la protection des personnes à l’égard du traitement des données à caractère personelle, p. 2484 et seq. https://www.chd.lu/wps/portal/public/Accueil/TravailALaChambre/Recherche... (last accessed 21 February 2020).
[22] Ibid, p. 2499.
[23] Ibid, p. 2502.
[24] Ibid, p. 2493. 
[25] Ibid.
[26] Ibid.
[27] Luxembourg, Data Protection Act, art. 2(i), ‘any health practitioner and any person subject to the same professional secrecy obligations as well as any hospital covered by the Law of 28 August 1998 on hospitals, carrying out the data processing necessary for the purpose of preventative medicine, medical diagnosis, provision of care or treatment, or health service management’.
[28] Ibid.
[29] For an overview of all published documents in the legislative processes as well as the videos of the parliamentary debates, see https://www.chd.lu/wps/portal/public/Accueil/TravailALaChambre/Recherche... (last accessed 26 February 2021).
[30] Chambre des Députés, Projet de Loi portant création de la Commission nationale pour la protection des données et la mise en oevre du règlement (UE) 2016/679 du Parlement eurpéen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l’égard du tratement des données à caractère personnel et à la libre circulation de ces données, portant modification de la loi du 25 mars 2015 fixant le régime des tratements et les condition et modalitös d’avancement des fonctionanaires de l’état et abrogeant la loi modifiée du 2 août 2002 relative à law protection des personnes à l’égard du tratement des données à caractère personnel, N° 7184, Session ordinaire 2016-2017 (10 October 2017), p. 27.
[31] Ibid.
[32] Ibid, p. 28.
[33] Chambre Des Députés, Projet de Loi protant création de la Commission nationale pour la protection des données et la mise en oevre du règlement (UE) 2016/679 du Parlement eurpéen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l’égard du tratement des données à caractère personnel et à la libre circulation de ces données, portant modification de la loi du 25 mars 2015 fixant le régime des tratements et les condition et modalitös d’avancement des fonctionanaires de l?etat et abrogeant la loi modifiée du 2 août 2002 relative à law protection des personnes à l’égard du tratement des données à caractère personnel, N° 7184(10), Session ordinaire 2016-2017, Avis Du Conseil D’Etat (8 May 2018), pp. 23-24.
[34] Chambre des Députés, Projet de Loi protant création de la Commission nationale pour la protection des données et la mise en oevre du règlement (UE) 2016/679 du Parlement eurpéen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l’égard du tratement des données à caractère personnel et à la libre circulation de ces données, portant modification de la loi du 25 mars 2015 fixant le régime des tratements et les condition et modalitös d’avancement des fonctionanaires de l?etat et abrogeant la loi modifiée du 2 août 2002 relative à law protection des personnes à l’égard du tratement des données à caractère personnel, N° 7184(28), Session ordinaire 2016-2017, Avis Complementaire Du Conseil D’Etat (19 July 2018), pp. 11-13.
[35] Chambre des Députés, Projet de Loi protant création de la Commission nationale pour la protection des données et la mise en oevre du règlement (UE) 2016/679 du Parlement eurpéen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l’égard du tratement des données à caractère personnel et à la libre circulation de ces données, portant modification de la loi du 25 mars 2015 fixant le régime des tratements et les condition et modalitös d’avancement des fonctionanaires de l’état et abrogeant la loi modifiée du 2 août 2002 relative à law protection des personnes à l’égard du tratement des données à caractère personnel, N° 7184(28), Session ordinaire 2016-2017, Avis Complementaire Du Conseil D’Etat (19 July 2018), pp. 46-47.
[36] Ibid.
[37] Ibid.
[38] Chambre des Députés, Séance 59 (26 July 2018) https://www.chd.lu/wps/wcm/connect/public/c6665ff6-7b13-4fa8-8cc5-7955fb... (last accessed 26 February 2021).