The case was first introduced in July 2019, when a job applicant claimed that the prosecutor’s office had accessed the so-called Ju-Cha database during the application process.
The database is a repository of all criminal matters dealt with by the justice system, from a case being filed with the public prosecutor to a verdict and entry in the criminal record. It lists cases, suspects, victims, witnesses and other involved parties, such as insurance companies.
The CNPD “considers it necessary to pronounce a ban on consulting the Ju-Cha database within the framework of the recruitment of a government employee,” it said in a document published on Monday, but which was issued to the public prosecutor’s office in March.
In addition, any information pulled by the prosecutor’s office from the Ju-Cha database included in government employee personnel files must be deleted, the CNPD said.
However, its decision related only to recruitment procedures for government employees and not for civil servant posts, a higher category in public service careers.
The job applicant in his complaint to the CNPD had said his data had been stored too long and should not have been accessed under data protection rules. Information in the Ju-Cha is stored indefinitely although cases are archived progressively, with access to the archive limited.
The database included an assault case involving the job applicant, but this was never prosecuted, and the man had no criminal record. He claimed to have been refused the job because of the Ju-Cha data.
The case prompted a widespread investigation into the use of personal information by Luxembourg’s police and justice system. The government in January this year presented new laws, limiting access to databases by officers and officials and ensuring that data is moved to the more restricted archive sooner.
The CSV, the biggest opposition in parliament, demanded a meeting between lawmakers and justice minister Sam Tanson to discuss the CNPD’s decision, and submitted an urgent parliamentary question to the minister.
The CNPD on 7 June published its first GDPR-related fines on its websites after facing criticism over taking too long to punish offenders. There is no fine mentioned in the decision related to the Ju-Cha.