Following the legislative developments in Luxembourg based on
the adoption of the Law dated 16 December 2021, amending the Law of
17 July 2020 on measures to combat Covid-19 (“Covid
Law”), on 12 January 2022 the national data
protection supervisory authority
(“CNPD”) updated its FAQ on data
protection and CovidCheck.
The updated FAQ (only available in French for
the moment) notably details the strict conditions under which
employers are authorised to set up a list of vaccinated or
recovered employees to facilitate checks on the validity of their
certificates. In particular, registration on a list must be
voluntary meaning that employees must give their explicit consent
(also meaning that they can request deletion from the list at any
time without justification), the list can only contain limited
information aimed at verifying the controls pertaining to the
CovidCheck and is limited in time.
