Short Reads

A new Luxembourg bill on data retention

A new Luxembourg bill on data retention

A new Luxembourg bill on data retention

30.04.2015

On January 7, 2015, the Luxembourg Ministry of Justice filed with the Chamber of Deputies bill n° 6763 (the Bill) modifying Article 67-1 of the Luxembourg Criminal Procedure Code (the Criminal Code) and Articles 5, 5-1 and 9 of the Act of May 30, 2005 laying down specific provisions for the protection of persons with regard to the processing of personal data in the electronic communications sector, as amended from time to time (the 2005 Privacy Act).

By so doing, the Luxembourg government aims to comply with the Court of Justice of the European Union (the ECJ) ruling of April 8, 2014, the so-called “Digital Rights”, in joint cases C-293/12 - Digital Rights Ireland and C-594/12 - Seitlinger and Others, whereby the ECJ has declared the Data Retention Directive 2006/24/EC to be invalid.

The Bill focuses on traffic data (Article 5 of the 2005 Privacy Act) and location data other than traffic data (Article 9 of the 2005 Privacy Act).

Firstly the Bill intends to amend the current access by the judicial authorities to retained data for the purposes of the investigation, detection and prosecution of criminal offences subject to a criminal or correctional penalty of at least one year of imprisonment. Now Articles 5 (1) (a) and 9 (1) (a) will refer to Article 67 -1 (4) of the Criminal Code where an exhaustive list of offences has been inserted.

Furthermore, the Bill proposes to amend Articles 5 (1) (b) and 9 (1) (b) by stating that service providers and operators must delete irrevocably and without any delay the retained data at the end of the 6 months retention period. Service providers and operators cannot keep anonymous data at the end of the retention data anymore.

The Bill also amends Articles 5 (6)- and 9 (6) of the 2005 Privacy Act by modifying the penalties to be imposed in case of breach of Article 5 (1) to 5 (5) and Article 9 (1) to 9 (5) o the 2005 Privacy Act. The penalty incurred will be now a sentence of six months to two years of imprisonment and/or a fine of between EUR 251 and EUR 125 000.

Finally, the Bill will oblige service providers and operators, through the amended Article 5-1, to store data on the territory of the European Union.

Click here for a PDF version of the 51st edition of our ICT Law Newsletter.

Team

Related news

06.06.2019 BE law
TMT Roundtable: Getting a handle on software quality

Roundtable - Erik Valgaeren, TMT Partner at Stibbe Brussels, and his team organize a roundtable on software quality in our Brussels office on June 6th, 2019. Software quality is a recurring theme in many matters handled by our TMT team. Whether our assistance relates to preparing tender documents, contracting effectively, assessing proper performance or allocating ownership and accountability in challenging IT projects, questions concerning software quality always arise.

Read more

21.05.2019 EU law
Part one - GDPR and Public Law - Applicability of GDPR to public bodies

Articles - Since the GDPR became applicable almost one year ago, multiple questions have arisen about its interaction with other fields of law. In this three-part blog series of “GDPR and Public Law”, we discuss three capita selecta of the interaction of GDPR with public law and government. In this blog we discuss the applicability of GDPR to public bodies.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring