Recital 16
General Data Protection Regulation · UE 2016/679
| (16) | This Regulation does not apply to issues of protection of fundamental rights and freedoms or the free flow of personal data related to activities which fall outside the scope of Union law, such as activities concerning national security. This Regulation does not apply to the processing of personal data by the Member States when carrying out activities in relation to the common foreign and security policy of the Union. |
In Luxembourg, the activities of the State Intelligence Service (SREL) are governed by the law of 5 July 2016 on the organisation of the SREL and fall outside the GDPR on national security grounds. Conversely, processing carried out by the Grand-Ducal Police in a judicial context falls under the law of 1 August 2018 transposing the Police-Justice Directive (EU 2016/680), not the GDPR. The CNPD remains competent to verify that the boundary between the two regimes is not misused.
Luxgap practice: for any contract with a Luxembourg public entity (ministries, municipalities, institutions), we systematically verify whether the processing falls under the GDPR, the law of 1 August 2018 or the SREL exception, and document this qualification in an opposable memo.
