LUXEMBOURG Law and Practice Contributed by: Romain Tiffon and Marie Bentley, ATOZ Tax Advisers
The holder of a trade secret may bring proceedings before the Luxembourg District Court against any person who unlawfully acquires, uses or discloses the protected information. Certain exceptions apply, notably where the acquisition, use or disclosure of the information is connected with the exercise of freedom of expression, whistle-blowing activities or the disclo - sure of unlawful conduct. Other Related Rights In addition to trade secret protection, Luxembourg law provides protection for other intangible assets, includ - ing software, databases, domain names and related rights granted to performers, phonogram producers and broadcasting organisations. The processing of personal data in Luxembourg is principally governed by Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regula - tion, or GDPR), which has been directly applicable in all member states since 25 May 2018. The GDPR is supplemented by the Luxembourg law of 1 August 2018 on the organisation of the National Commis - sion for Data Protection and the implementation of the GDPR, which specifies and gives effect to certain provisions of the Regulation, notably with respect to the structure, powers and enforcement functions of the National Commission for Data Protection ( Com- mission nationale pour la protection des données – CNPD). 8. Data Protection 8.1 Applicable Regulations The Law of 1 August 2018 further establishes spe - cific provisions applicable to particular categories of processing activities. These include the processing of special categories of personal data, notably health data, as well as processing undertaken for journalistic purposes and for scientific or historical research and statistical purposes. The law also regulates employee monitoring within the context of employment relation - ships, an area in which Luxembourg law provides for enhanced safeguards and specific compliance requirements.
In addition to the GDPR framework, the processing of personal data in the electronic communications sec - tor is subject to supplementary obligations under the Luxembourg Act of 30 May 2005 on electronic com - munications, as amended. This legislation addresses, inter alia, the use of cookies and similar technologies, the confidentiality of communications, and direct marketing activities. At the European Union level, the proposed ePrivacy Regulation is expected to replace or further harmonise the existing national framework and, once adopted, would be directly applicable throughout the member states in a manner compa - rable to the GDPR. More generally, Luxembourg’s data protection regime is founded upon the core principles established by the GDPR, including: • lawfulness; • fairness and transparency; While closely aligned with the European framework, the Luxembourg regime also reflects certain national particularities, especially in relation to employment- related processing and regulatory oversight. In this regard, the CNPD exercises active supervisory author - ity and is empowered to impose administrative fines, corrective measures and other enforcement actions in accordance with the GDPR and applicable national legislation. 8.2 Geographical Scope Luxembourg data protection law follows the territorial and extraterritorial scope of the GDPR. Accordingly, the GDPR applies not only to processing activities carried out in the context of an establishment located in Luxembourg or elsewhere in the European Union, irrespective of where the processing itself takes place, but also to certain processing activities conducted by organisations established outside the EU. • purpose limitation; • data minimisation; • accuracy; • storage limitation; • integrity and confidentiality; and • accountability.
620 CHAMBERS.COM
Powered by FlippingBook