On September 1, 2007, a new law (the “Law”) came into force that amends Luxembourg’s data protection rules to bring them in line with EU Data Protection Directive (95/46/EC). The Law updates the law of August 2, 2000 on the processing of personal data, the law of May 30, 2005 on the protection of private life in electronic communications, and the law of June 8, 2004 on freedom of the press. The Law introduces several new exemptions from the requirement to notify and get prior approval when processing personal data: (i) for certain professions, including journalists, writers, artists, lawyers, notaries and court clerks; (ii) for businesses, government offices, associations and professions for the most common types of data processing; (iii) for health and social service professionals using data concerning the health and sexual life of patients except for genetic data; (iv) for financial sector professionals as regards credit and solvency-related data pertaining to their own customers; and (v) for certain types of video surveillance and other security means that do not involve the recording of data. Companies with a data processing officer, who can now be an employee of the firm, are exempt from notification requirements. Moreover, the data processing rules no longer cover the processing of data of legal entities.
The full text of the new law (in French) is available at: http://www.cnpd.lu/objets/fr/doc_loi020820002modfr.pdf
A description of the new exemptions is available (in French) at: http://wwwcnpd.lu/fr/nouvelle_loi_exemptions/index.html