The classic trap
This recital clarifies articles 6(1)(c), 6(1)(e) and 6(3) GDPR: when you rely on a legal obligation or a public interest task as lawful basis, CNPD and CNIL require you to point to a clear, precise and foreseeable text. The trap: invoking a ministerial circular, an internal policy or a professional custom as if it were an enforceable legal basis. CNPD then requalifies the processing as lacking lawful basis (article 6 breach), sanctionable up to 20 M EUR or 4% of global turnover.
The foreseeability test: what CNPD and CJEU check
For a legal basis to hold up before CNPD, it must cumulatively meet these criteria from CJEU case-law (Tele2 Sverige, La Quadrature du Net, Schrems II):
- Publicly accessible text (law, grand-ducal regulation, ministerial decree published in the Memorial, EU regulation, registered collective agreement).
- Purpose of processing explicitly identifiable from reading the text, not by inference.
- Categories of data and data subjects circumscribed.
- Retention period or criteria determinable.
- Safeguards against arbitrariness (remedies, oversight, transparency).
- Demonstrable proportionality: the text allows no more than strictly necessary.
In Luxembourg practice: a sectoral code of conduct, a CSSF circular, an ILR recommendation or a CNPD guideline are not legal bases within article 6(3). They are interpretive aids. The basis must be the underlying statute (banking law, law of 1 August 2018 on data protection, sectoral health law, etc.).
How Luxgap automates this risk
Our Luxgap Legal Basis Validator turns every legal basis claimed in your article 30 register into an enforceable legal reference, validated in real time against EUR-Lex, Legilux and CJEU JURIS databases. The tool silently rejects vague bases (internal circular, group policy, industry custom) and enforces a stable URL pointer to the official text, dated and still in force.
- Scans your processing register (Odoo, OneTrust, Excel register, Notion) and extracts each claimed legal basis to confront it with the CJEU foreseeability test.
- Continuously verifies via Legilux and EUR-Lex APIs that cited texts are still in force and alerts instantly in case of repeal or amendment.
- Detects fragile bases (reference to a circular, internal note, non-approved article 40 code of conduct) and proposes requalification toward a solid basis.
- Generates for each processing a timestamped legal qualification sheet citing the text, the precise article, the Memorial publication date and applicable CJEU case-law.
- Produces a cryptographically sealed PDF report, enforceable before CNPD during an inspection, demonstrating that each processing rests on a clear and foreseeable basis within recital 41.
Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams prepare a demonstration on your actual register, with a free white audit within 48h to identify your fragile legal bases before any commitment.
