Luxembourg. ePrivacy / marketing. Act
Loi du 30 mai 2005Law of 30 May 2005 on specific provisions for the protection of persons with regard to the processing of personal data in the electronic communications sector
In force
Partly verified
Low confidence.Not verified this session.
§1Summary
- Synopsis
The 2005 law implements the ePrivacy Directive in Luxembourg: consent for cookies (Art 4(3)(e)) and opt-in for unsolicited electronic communications (Art 11).
- Key themes
- Unique features
Breaches can be criminally sanctioned.
- SaaS relevance
Any SaaS website, app or product that sets non-essential cookies/SDKs or sends marketing emails/SMS to users in this country needs prior consent (subject to exemptions) under this law, regardless of where the provider is based.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Telecom providers: authority notification under Reg 611/2013; otherwise GDPR
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Criminal fines; GDPR fines
§3Dates
- Key dates
- Adopted
- In force
- Amended 2011 for ePrivacy 2009
§4Text and authority
- Text
- Authoritative text legilux.public.lu
- Authority
- CNPD; Institut Luxembourgeois de Régulation (ILR) for telecom
§5Where it applies
- Domestic law of
- Luxembourg
§6Sources and verification
- Sources consulted
- Verification
Low confidence.
Partly verified
Low confidence.Not verified this session.