Following the latest legislative developments in the Grand Duchy
of Luxembourg based on the adoption of the Law dated 16 December
2021, amending the Law of 17 July 2020 on measures to combat
Covid-19 (the “Covid Law”), on 12
January 2022 the national data protection supervisory authority
(the Commission Nationale pour la Protection des
Données, “CNPD”) updated
its FAQ on data protection and CovidCheck.
The updated FAQ (only available in French
for the moment) notably details the strict conditions under which
employers are authorised to set up a list of vaccinated or
recovered employees to facilitate checks on the validity of their
certificates. In particular, registration on a list must be
voluntary meaning that employees must give their explicit consent
(also meaning that they can request deletion from the list at any
time without justification), the list can only contain limited
information aimed at verifying the controls pertaining to the
CovidCheck and is
