On Monday 20 August 2018, a new law came into effect in Luxembourg that amends the article in Luxembourg labour law that governs the monitoring of employees at work. The new law comes in the wake of the EU’s GDPR (General Data Protection Regulation), which came into force on 25 May 2018.
Our colleagues at Paperjam took a look at what the changes introduced will mean in practice:
Prior to 20 August, when an employer wanted to set up surveillance in the workplace (cameras, a badge access/exit system or GPS etc.), the 2002 law on the protection of personal data in Luxembourg only required authorisation from the National Commission for Data Protection (CNPD), which implemented checks and controls to verify that such monitoring was justified. The 2002 legal text did not require employees’ consent.
However, under the new law, the employer must now inform employees of the type of monitoring system it intends to set up. It is then up to the individual employee to take any concerns they may have to the CNPD directly.
The company must also give prior notice to the staff delegation before the installation of any monitoring equipment or, failing that, the ITM (Luxembourg’s labour inspectorate).
Upon receipt of the prior notification, the staff delegation has 15 days to contact CNPD to raise any issues. The CNPD has one month to respond, during which time the employer may not install any form surveillance equipment. Employees of a company of fewer than 15 people (where there is no staff delegation) may contact the trade unions with any concerns. As for the data resulting from such employee supervision, GDPR only allows for its use under certain conditions including:
the employee gives his express consent;
where the use of personal data is necessary for the execution of his employment contract;
where the employer has a legal obligation to use the data;
where the use of the data is in the legitimate interest of the employer.