Updated CNPD’s FAQ on CovidCheck controls

Following the latest legislative developments in the Grand-Duchy of Luxembourg based on the adoption of the Law dated 16 December 2021, amending the Law of 17 July 2020 on measures to combat Covid-19 (“Covid Law”), on 12 January 2022 the national data protection supervisory authority (Commission Nationale pour la Protection des Données, “CNPD”) updated its FAQ on data protection and CovidCheck.

The updated FAQ (only available in French for the moment) notably details the strict conditions under which employers are authorised to set up a list of vaccinated or recovered employees to facilitate checks on the validity of their certificates. In particular, registration on a list must be voluntary meaning that employees must give their explicit consent (also meaning that they can request deletion from the list at any time without justification), the list can only contain limited information aimed at verifying the controls pertaining to the CovidCheck and is limited in time.

Please see our other publication for more information about the mandatory CovidCheck controls in the workspace based on the Covid Law.