Luxembourg received a favourable mention in Privacy International’s review of data retention regulation across the EU for its active approach Pexels

Luxembourg received a favourable mention in Privacy International’s review of data retention regulation across the EU for its active approach Pexels

The watchdog singled out the grand duchy as the only country that had begun steps to introduce legislation off its own bat and not as a result of a court challenge.

Luxembourg’s justice ministry formulated a new bill in 2015 for a data retention regime to be in place following the ECJ's landmark judgment of April 8, 2014, Digital Rights Ireland (C-293/12), invalidating the Data Retention Directive 2006/24/EC.

Bill 6763 sets out to modify the previous law on the protection of personal data in electronic communications (2005 Privacy Act) by placing a six-month limit on the retention of user data by ISPs within the EU.

It would enable courts to access data retained by ISPs for investigations, detection and prosecution of criminal offences subject to a correctional or criminal penalty of at least one year in prison. The law would also compel service providers and operators to delete without delay the retained data after the six months and enable the judicial system to increase the penalties for breaching these obligations.

The bill has, however, been shelved in order to reach an agreement among European justice ministers.