The Luxembourg law dated July 23rd 2016 [1] (the “New Law”) amending inter alia the law dated March 29th 2013 relating to the organisation of the criminal records came into force on February 1st 2017. The Law clarifies the right of an employer to request criminal records, in particular in the context of pre-hiring checks.
The criminal record is divided into 5 different categories (bulletins) for natural persons, Bulletin n°2 under the New Law will no longer be available to employers; only the newly created Bulletin n°3 and Bulletin n°4 and 5 will be available under specific conditions.
The “new” Bulletin n°2 of a natural person will contain information on convictions with criminal and correctional penalties and on the granting of an order to be remanded in custody at the time of the criminal procedure of the relevant person with the exception of:
- convictions with a fine where such fine was suspended unless suspension has been revoked
- decisions on suspended sentences
- convictions granted on suspended basis that are considered as null and void
- judgments given in default of appearance that have not been notified to the person
The “new” Bulletin n°3 of a natural person will contain information on convictions with criminal and correctional penalties with the exception of :
- convictions with imprisonment for 24 months or less with the imprisonment on a suspended basis, unless suspension has been revoked
- convictions with fines on a suspended basis unless suspension has been revoked
- decisions on suspended sentences
- convictions with suspension that are considered as null and void
- convictions to fines up to EUR2,500.-
- judgments given in default of appearance that have not been notified to the person
- convictions to community work.
The new law provides that an employer prior to hiring a job applicant may have access to the followings “bulletins” under the following conditions:
- The new bulletin n°3: the request must be made to the job applicant in writing, indicate the justification by reference to the nature of the position and must be indicated in the job offer.
- The new bulleting n°4 (containing references to crimes and misdemeanors contained in Bulletin N°3 and driving prohibitions): the request may be made to the job applicant if the driving licence is a prerequisite for the job, if the possession of a valid driving licence is required as per the employment contract, if the request is presented in writing duly motivated and if the request has been indicated in the job offer.
- The bulleting N°5 (containing offenses involving minors): the request must be made to the job applicant if the job implies professional or volunteer activities involving regular contacts with minors.
In all cases, if the employer makes the decision not to hire the job applicant, the bulletin will have to be immediately destroyed. If the job applicant is hired, the employer will only be entitled to retain the criminal records for one month.
During the employment relationship, the employer will also be allowed to request the bulletin n°3 in the following cases:
- in the case of an assignment to a new position when such position justifies a new control of the employee’s good standing.
- as part of HR management requirements, if specific legal provisions so require.
In that case, the bulletin may not be retained longer than 2 months unless otherwise provided for by the law and the employer is not allowed to process the data contained in the bulletin.
Criminal penalties apply in case of breach by an employer:
- penalties of 8 days to 1 year in prison and fines from EUR251.- up to EUR5,000.- for natural persons (and from EUR 500.- up to EUR 10,000.- for legal entities) in case of breach of the conditions for the delivery of the bulletins.
- Fines from EUR 251.- up to EUR 3,000.- for natural persons (and from EUR 500.- up to EUR 6,000.- for legal entities) in case of breach of the retention periods of time.
In all events, the authorisation from the Data Protection Authority is required because judicial data are considered as sensitive data. The processing of judicial data must be justified by a legal provision, which will now be Article 8-5(2) of the law dated March 29, 2013 relating to the organisation of the criminal records as amended. The authorisation if and when issued by the Data Protection Authority will be valid for all requests and not for one request for one employee.
[1] Loi du 23 juillet 2016 portant modification 1) de la loi du 29 mars 2013 relative à l’organisation du casier judiciaire, 2) du Code d’instruction criminelle, 3) du Code pénal.
