New law on monitoring at the workplace

Following the entry into force of the General Data Protection Regulation (“GDPR”) on 25 May 2018, the Law of 1 August 2018 implements the provisions of the EU regulation into Luxembourg Labour Law. This Law entered into force on 20 August 2018. Article L.261-1 of the Labour Code now contains specific provisions regarding the processing of personal data for monitoring purposes in the context of the employment relationship.

The scope within which employers may process personal data for monitoring has been extended. The monitoring of employees is only permissible:

• if the employee gives their written consent to the processing of their personal data;
• if the processing of personal data is necessary for the performance of the employment contract;
• if the employer is subject to a legal obligation to process personal data; or
• if the processing of personal data is justified by a legitimate interest.

Article L. 261-1 of the Labour Code introduces increased obligations for the employer regarding prior information to be given to employees regarding the processing of their data. Firstly, the employer is required to inform each employee concerned by the monitoring individually before any data is processed (ECHR, Bărbulescu v Romania, 5 September 2017, No. 61496/08). Secondly, the employer must provide prior information to the employees’ representatives, or failing that, to the Labour and Mines Inspectorate (ITM) including a detailed description of the purpose of the intended processing, the arrangements for implementing the monitoring system, the duration or criteria for storing the data where applicable, as well as a formal commitment by the employer not to use the collected data for any purpose other than that explicitly specified in the prior information.

Prior authorisation by the National Commission for Data Protection ("CNPD") is no longer required. However, the staff delegation or, in its absence, the employees concerned may request a prior opinion by the CNPD regarding the compliance of the intended processing of personal data. This request must be submitted to the CNPD within fifteen days following the prior information. Such a request shall suspend the implementation of the intended processing pending the opinion by the CNPD, which must provide an answer within one month following the request.

The new law on monitoring of employees requires a co-decision from the employees’ representatives as stated in the Labour Code if monitoring is intended for health and safety reasons, for supervision of the employees’ work performance when such supervision is the only way to determine the exact salary due to the employees, or for organisation of work in case of flexitime arrangements, except if such monitoring is mandatory under legal or regulatory provisions.