Recital 164
General Data Protection Regulation · UE 2016/679
| (164) | As regards the powers of the supervisory authorities to obtain from the controller or processor access to personal data and access to their premises, Member States may adopt by law, within the limits of this Regulation, specific rules in order to safeguard the professional or other equivalent secrecy obligations, in so far as necessary to reconcile the right to the protection of personal data with an obligation of professional secrecy. This is without prejudice to existing Member State obligations to adopt rules on professional secrecy where required by Union law. |
In Luxembourg, the law of 1 August 2018 organising the CNPD details in Article 12 the CNPD's investigative powers and expressly organises reconciliation with professional secrecy. Article 458 of the Luxembourg Criminal Code remains the pivot of banking and professional secrecy, and in practice the CNPD must coordinate its inspections in the financial sector with the CSSF, and consult the bar president for law firms.
Luxgap practice: for CSSF-regulated entities and regulated professions, we prepare a CNPD inspection welcome protocol validated upstream by your professional order or legal counsel, which avoids both the sanction for failure to cooperate and the breach of secrecy.
