The Law of 1 August, 2018 establishing the national commission for data protection and the general scheme on data protection[1] (hereinafter “the Law”), implements the general data protection regulation (hereinafter “the GDPR”) that entered into force on 25 May, 2018.
As the GDPR is directly applicable in Luxembourg, it settles most of the provisions now applicable with regard to data protection. The Law thus completes the European framework where necessary.
To this extent, article 71 of the Law amended article L.261-1 of the Labour Code regarding supervision of employees in the context of labour relations. The main innovations in this area, applicable as from 20 August, 2018, are as follows:
Absence of prior authorisation
The legal requirement to seek an authorisation from the national commission for data protection (“the CNPD”) no longer applies.
As a result, the processing of personal data for the purpose of supervising employees may now be carried out by the employer, if he is the controller, in accordance with the cases mentioned in article 6, paragraph 1, letters a) to f) of the GDPR and in accordance with the new article L.261-1 of the Labour Code.
According to the previous version of article L.261-1 of the Labour Code, such a processing was only possible if necessary:
- for the safety and health needs of the employees, or
- for the protection of the company’s assets, or
- for the control of the production process relating only to machinery, or
- for the temporary control of the employee’s production or services, where such a measure is the only means of determining the exact salary, or
- within the framework of a mobile work organisation in accordance with the Labour Code.
From now on, it is sufficient for the employer to rely on one of the 6 conditions of lawfulness of article 6 of the GDPR. Processing can therefore be implemented if:
- the data subject has consented to the processing of his/her personal data for one or more specific purposes;
- the processing is necessary for the performance of a contract to which the data subject is a party or for the performance of pre-contractual measures taken at the request of the data subject;
- the processing is necessary to comply with a legal obligation to which the controller is subject;
- the processing is necessary to protect the vital interests of the data subject or of another natural person;
- the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- the processing is necessary for the legitimate interests pursued by the controller or by a third party, unless the interests or fundamental rights and freedoms of the data subject requiring protection of personal data prevail.
In terms of supervision of employees in the context of labour relations, the most appropriate condition of lawfulness will generally be that the processing is necessary for the legitimate interests pursued by the employer. On the contrary, consent does not seem to be an appropriate lawfulness basis in labour relations.
If the processing is considered lawful, it will nevertheless have to be determined whether the supervision is necessary and proportional to the intended purpose (data minimisation principle, article 5 of GDPR).
Information of the staff representatives and of the employees
A collective right to information is now provided for employees. Without prejudice to the information right of the data subject, the employer must also provide certain information to the joint committee or, failing that, the staff delegation or, failing that, the labour mining inspectorate (“Inspection du travail et des mines”) in advance.
This prior information must include a detailed description of the purpose of the intended processing, the arrangements for implementing the supervision system, and, where appropriate, the duration or criteria for storing the data, and a formal undertaking by the employer that the data collected will not be used for a purpose other than that explicitly provided for in the prior information.
Furthermore, when supervision is implemented:
- for the safety and health needs of the employees,
- for the temporary control of the employee’s production or services, where such a measure is the only means of determining the exact salary or,
- within the framework of a mobile work organisation,
it remains subject to co-decision: processing may therefore only be carried out with the agreement of the employees’ representatives, except where the processing complies with a legal or regulatory obligation.
Request for a prior opinion to the CNPD
The staff delegation or, failing that, the concerned employees, may, within 15 days following receipt of prior information, request an opinion from the CNPD regarding the compliance of the processing project for the purposes of supervising the employees in the context of labour relations. The CNPD must deliver its opinion within 1 month of such request.
The request has suspensive effect. The employer will therefore not be able to implement the supervision before the CNPD has delivered its opinion.
It is also provided that the employees concerned have the right to lodge a complaint with the CNPD. Such a complaint is neither a grave nor a legitimate reason for dismissal.
[1] Memorial A n°686 dated 16 August, 2018.
