Data protection

Stricter crime records access after protection concerns

Justice minister Sam Tanson and interior security minister Henri Kox (centre) during the press conference on 15 September Photo: MJ

Justice minister Sam Tanson and interior security minister Henri Kox (centre) during the press conference on 15 September Photo: MJ

The Luxembourg government is tightening access to a critical database that records personal information on cases treated by the justice system after serious protection shortcomings were revealed in 2019.

A job applicant in July 2019 claimed that the prosecutor’s office had accessed the so-called Ju-Cha database as part of background checks. The database is a repository of all criminal matters dealt with by the justice system, from a case being filed with the public prosecutor to a verdict and entry in the criminal record. It lists cases, suspects, victims, witnesses and other involved parties, such as insurance companies.

The matter prompted a review of personal data protection implemented by the police and justice system, with justice minister Sam Tanson and interior security minister Henri Kox (both Déi Gréng) presenting stricter rules during a press conference on Wednesday.

The database will be split into different categories, the ministers said. Criminal records will be housed separately on the platform, with set deadlines on when information is deleted. Fines will be struck from the records after five years, prison sentences under six months after ten years, and prison sentences of under two years after 15 years. Data on prison sentences of more than two years will remain accessible for 20 years.

“Our aim is to protect personal data as best as possible without hindering the justice system in its work,” said Tanson during the press conference on 15 September.

Access to information related to ongoing proceedings will be limited to judges and staff dealing with the cases for up to ten years after the last entry in the file, depending on the severity of the offence. After this time, data will be archived with even more restricted access for a period of five years. In case of acquittal, the files will be closed after six months.

With the police force keeping their own records and databases, an automated system will in future ensure that data deleted in the Ju-Cha records is also removed from police databases. Interior security minister Henri Kox in January had presented new rules on access to the police’s central database, meant to work hand-in-hand with the new Ju-Cha regulations.

“All of these criteria allow those affected to understand exactly who viewed the data and for what reason,” Tanson said further.

The draft law--which will need to be voted into force by parliament--also introduced a legal basis for information on convictions to be communicated to relevant authorities. This includes bans on driving but also hunting or fishing, professional bans or the closing of businesses.

The public prosecutor will also be able to inform relevant actors of ongoing criminal proceedings in case of public interest. This applies, for example, to suspects of paedophilia working with children. The prosecutor will have to decide on a case-by-case basis and keep the employer, or other actor informed, and up to date on the outcome of the court case.

The presentation of the new laws came after Luxembourg’s data protection watchdog, the CNPD, told the public prosecutor it can no longer use the Ju-Cha database to carry out background checks as part of recruitment procedures.