Recital 56
General Data Protection Regulation · UE 2016/679
| (56) | Where in the course of electoral activities, the operation of the democratic system in a Member State requires that political parties compile personal data on people's political opinions, the processing of such data may be permitted for reasons of public interest, provided that appropriate safeguards are established. |
In Luxembourg, the law of 1 August 2018 organising the Commission nationale pour la protection des donnees and the electoral law do not provide a specific derogatory regime for political parties beyond the GDPR. The CNPD (not the non-existent APDL) is the competent authority and has issued guidance reminding that a Luxembourg political party must base its processing on Article 9(2)(d) for members, or collect explicit consent for any prospect, with no exemption based on Recital 56.
Luxgap practice: before each communal, legislative or European election in Luxembourg, trigger a Political Data Guardrail audit 6 months before the vote to qualify your base and purge contacts without a legal basis.
