DATA PROTECTION

Everybody is talking about GDPR

In case you are not yet aware of this, companies processing personal data will be confronted with legal and technical challenges following the adoption last year of GDPR (i.e. the General Data Protection Regulation (GDPR), EU Regulation n° 2016/680) strengthening the individual’s rights regarding their data, while enhancing data controllers’ and processors’ obligations and reducing the administrative burden for data controllers.

Be prepared, kick-off date is 25 May 2018

GDPR will apply not just to data controllers and processors established in the EU, but also to those established outside the EU whenever the processing activities concern the offering of goods or services to EU residents or the monitoring of their behaviour within the EU.

GDPR is directly applicable in Luxembourg law without any specific Luxembourg implementation instruments. However, the pending Luxembourg draft law n°7049 of 31 August 2016 aiming to facilitate the transition to the new upcoming regime is still under discussion.

Questions remain as to whether this draft law will retain the system of prior authorisation or notification for certain issues, where, for example, the withdrawal of authorisation for the monitoring of employees might be a breach of privacy. This might conflict with the GDPR’s ending of prior authorisation and notification to the CNPD.

On 1st August 2017, the National Commission on Data Protection issued a seven-steps approach to help local market players to comply with this major reform:

Within this overall data protection field, additional measures and draft laws have been approved by the Luxembourg Government to meet all the new EU expectations issued from the data protection’s package.

The second pillar of the data protection package has led to a new bill of law n°7168 relating to data protection in criminal matters and national protection, implementing EU Directive 2016/680 of 27 April 2016, on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.

The new bill of law was published on 10 August 2017 and provides in particular for the creation of a new Luxembourg authority (“Autorité de contrôle judiciaire”), which will control the application of the new provisions. This new supervisory authority will work closely with the actual Luxembourg data protection authority (”Commission Nationale pour la protection des données personnelles”). It will have effective corrective powers such as, to issue warnings to a controller or processor that intended processing operations are likely to infringe data protection provisions, to order the controller or processor to bring processing operations into compliance with data protection provisions, and to impose a temporary or definitive limitation, including a ban, on processing.

Concerning the processing of air passenger data, another draft law n°7151 of 19 June 2017 has been filed in order to implement EU Directive 2016/681 of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime.

IP TAX REGIME

The end of the IP box? Not yet!

In line with the OECD’s approach, the new Luxembourg draft law, released on 4 August 2017, introduces a new IP tax regime that remains attractive for particular assets in R&D: patents and similar as well as copyrighted software with a non-commercial character.

This new IP tax regime provides an exemption of 80% on income tax and a full exemption on wealth tax from 1 January 2018.

Taxpayers benefitting from the former “IP Box” regime who are also eligible for the new IP tax regime will have to choose which regime to apply by 30 June 2021.

CONSUMER LAW

You don’t want to miss the next amendments in consumer law

Among several upcoming amendments, the Grand-Duchy of Luxembourg is acting in favour of both businesses and consumers in draft law n°7147 of 4 July 2017.

In order to support consumers’ rights, some infringements of rights such as those provided by the Luxembourg Consumer Code are not dissuasive enough for companies, in particular the violation of the consumer’s right of information or the right for a consumer to rescind their purchase could soon result in higher criminal fines.

To encourage business competition, some modifications could also be made as regards the legal warranty in a sale of second-hand products. The 2 years legal warranty for second–hand products could be reduced to a minimum of 1 year after being negotiated between BtoC and written into the purchase agreement. The negotiation phase between BtoC to reduce the length of the warranty should be repealed.

ONLINE MEDICINE

Want to buy non-prescription medicines online?

Online sale of non-prescription medicines to the public was made available by a law dated 7 June 2017, but can only be proposed by a pharmacist operating its activity in a pharmacy and after notification to the Luxembourg Ministry of Health.

E-CIGARETTES

Limited online sales of vaping products

Last June, Luxembourg decided to prohibit online sales of vaping products including e-cigarettes from its territory as well as online sales targeting its territory. However, this new rule does not apply between e-businesses.

LABELLING

New levelling-up for national agricultural products

As the Luxembourg Government wants to harmonize and formalize a new national labelling system for agricultural products consistent with the EU market, Draft Law n°7170 of 17 August 2017 will propose a prior official State recognition of labelling in order for customers to get quality systems and provide better credibility for label representatives.

COPYRIGHTS

The end of geo-blocking for portable online content and paid services

No later than 20 March 2018, any subscriber to portable online content and paid services, such as Netflix, Spotify and DAZN, will be allowed to use these services when temporarily present in an EU Member State which is not their residence with no additional fee.