Library picture: Eugène Berger addresses the Chamber of Deputies in April 2018. The Democratic Party MP was rapporteur of two GDPR-related bills that passed parliament this week. Photo credit: Chambre des Députés
Bill 7168 enshrines several of the GDPR’s principles in Luxembourg law. This includes the requirement that each organisation have a data privacy officer in charge of implementing data security policies and informing regulators of breaches.
Bill 7184 changes the charter of the regulator in charge of personal privacy, the National Commission for Data Protection (CNPD). This includes allowing the CNPD to conduct “ex post” (retrospective) inspections, placing more responsibility on organisations to conduct internal audits. The law also grants the CNPD to power to issue fines of up to €20m or 4% of global turnover.
Bill 7168 was introduced by Félix Braz, the Green justice minister. Bill 7184 was introduced by Xavier Bettel, the DP prime minister and communications minister. The rapporteur for the two bills was the DP MP Eugène Berger.
Both bills passed the Chamber of Deputies by votes of 57-3 on 26 July, with ADR MPs voting against the measures.