Recital 12
General Data Protection Regulation · UE 2016/679
| (12) | Article 16(2) TFEU mandates the European Parliament and the Council to lay down the rules relating to the protection of natural persons with regard to the processing of personal data and the rules relating to the free movement of personal data. |
In Luxembourg, the law of 1 August 2018 organising the National Commission for Data Protection and the general data protection regime specifies the national margins opened by the GDPR (health data, research data, employee data via Article L.261-1 of the Labour Code). Outside these explicit margins, no Luxembourg practice can derogate from the GDPR, and the CNPD strictly applies EDPB doctrine.
Luxgap practice: we systematically distinguish in your analyses what falls under EU GDPR (non-negotiable) and what falls under the Luxembourg law of 1 August 2018 (adaptation margin), to avoid argumentative confusion during a CNPD audit.
