Recital 155
General Data Protection Regulation · UE 2016/679
| (155) | Member State law or collective agreements, including ‘works agreements’, may provide for specific rules on the processing of employees' personal data in the employment context, in particular for the conditions under which personal data in the employment context may be processed on the basis of the consent of the employee, the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship. |
In Luxembourg, employee monitoring is strictly framed by article L.261-1 of the Labour Code (Law of 1 August 2018 on CNPD organisation). Any monitoring activity requires prior information of the staff delegation (or joint committee) and of the employees concerned, and may justify a prior consultation request to the CNPD. The CNPD has published sector guidelines (CCTV, company vehicle geolocation, email monitoring).
Luxgap practice: before deploying any monitoring tool (DLP, CCTV, GPS, biometric clocking), build the full L.261-1 file (purpose, proportionality, retention, delegation information) BEFORE go-live. The CNPD sanctions deployments without prior consultation.
