The purpose of this document is to provide any data subject with information relating to the processing and protection of personal data by the Autorité luxembourgeoise indépendante de l’audiovisuel (Luxembourg independent audiovisual authority) (hereinafter « ALIA »), as well as to inform about the rights arising from the new European legislation on the protection of personal data, in particular the General Data Protection Regulation (hereinafter «GDPR»)1). In the execution of its missions, ALIA, as «data controller» within the meaning of the aforementioned regulation, ensures compliance with the applicable European and Luxembourg legal provisions on the protection of such data.
Data protection
Data protection
Information on the protection of personal data
I. Type of personal data that are processed
ALIA processes the personal data provided by persons filing a complaint. Therefore, the personal data subject to processing are identity data, i.e., the name, address and title, as well as the email address and phone number of the complainant. ALIA considers that these data are essential for the execution of its missions, since they allow ALIA officers to identify the complainants and to contact them. By doing so, ALIA complies with the principle of data minimization as provided for in Art. 5 (1) (c) of the GDPR. The ALIA regulation concerning procedures against an audiovisual or audio media service clearly states, in its Art. 3 (5), that any complaint must «identify the complainant» and that «it must include in particular the first and last name or the name and address or registered office».
The complaints essentially relate to a sound or visual programme element broadcast by an audiovisual media service provider. This recording may contain the voice and/or images or other elements that make it possible to identify the complainant or a third person. The examination of the complaint requires the repeated hearing/viewing of this recording and its preservation.
Therefore, the data processed by ALIA as identified above must be considered as being «adequate, relevant and limited to what is necessary with regard to the purposes for which they are processed».2
II. Legal basis and purpose of processing personal data
By lodging a complaint, complainants accept that their personal data will be processed by ALIA on the basis of Art. 6 (1) (e) of the GDPR. This provides for the lawfulness of the processing of personal data when «the processing is necessary for the performance of a task in the public interest or relating to the exercise of public authority vested in the data controller».3
Regarding the purposes of processing personal data, Art. 35 (2) of the amended law of July 27, 19914 on the electronic media determines the missions of ALIA. Among others, ALIA mainly proceeds, by handling complaints, to the control and supervision of audiovisual media to ensure compliance with European and Luxembourg legal and regulatory provisions. ALIA’s tasks are related to a mission of public interest or the exercise of public authority within the meaning of the aforementioned provision.
The performance of this mission requires that the decisions taken by ALIA be published on its website. As part of this publication, the decisions are anonymised so that the complainants cannot be identified.
III. Access to personal data
Only ALIA officers in charge of processing personal data will be granted access to complainants’ data. As part of the transmission of the elements of the complaint to the audiovisual media service provider, ALIA may have to communicate the complaints to the targeted operator, including the identity of the complainants. ALIA may also be required, as part of the cooperation between regulatory authorities within the European Union, to forward complaints to the competent authority of another Member State of the European Union.
ALIA does not share personal data with third parties, either for profit or free of charge. ALIA does not systematically use such data for internal needs.
IV. Preservation of personal data
ALIA processes and stores personal data for the period necessary to carry out its missions in the public interest. This indefinite period may vary on a case-by-case basis, depending on the content and complexity of the complaint. Data are kept in any case until the end of the procedure conducted by ALIA, including any legal remedies. ALIA may decide to keep personal data after the end of the procedure concerning a complaint, not only to be able to detect possible abuse of procedure by iterative complainants, but also for archiving purposes in the public interest, scientific or historical research, or for statistical purposes.5
V. Transfer of personal data to third countries
ALIA does not transmit personal data to companies or authorities in third countries located outside the European Union. Exceptionally, as part of a control of a supplier established outside the European Union for which ALIA is competent, it may have to transmit personal data to authorities located outside the European Union. In this case, ALIA ensures, by case-by-case assessment, that the level of protection of personal data is equivalent to that implemented by the GDPR.
VI. Rights of the data subject with regard to the protection of personal data
Complainants have a right to access their personal data. Thus, any complainant can contact ALIA at any time to receive information about the processing of personal data. In addition, data subjects have the right to the rectification of their personal data.
In addition, data subjects have the right to have their personal data erased. Thus, complainants may, at any time, request the erasure of their personal data from ALIA’s data protection officer. However, it should be noted that ALIA may object to this request if it considers that these data are necessary to perform a mission in the public interest or relate to the exercise of ALIA’s powers as a public authority 6, or if it considers that these data are necessary for « archiving purposes in the public interest ».7
VII. Legal remedies
Data subjects have, should they consider that ALIA has violated the rules implemented by the GDPR, two legal remedies. They can file a complaint with the supervisory authority, the Commission nationale pour la protection des données (National Commission for Data Protection) (hereinafter « CNPD ») in accordance with Art. 77 of the GDPR. Without prejudice to any other administrative or extra-judicial remedy, data subjects may also exercise effective judicial remedy (Art. 79 of the GDPR) without first having to file a complaint with the CNPD.
VIII. Further information
For further information on the processing of personal data by ALIA, data subjects may contact the data protection officer :
ALIA – Service de protection des données
18, rue Erasme
L-1468 Luxembourg
Phone : +352 247-70140
Email :
To contact the CNPD, data subjects may use the form on the CNPD website, accessible via the following link or via the link.
The form can be sent to the CNPD electronically or by post to the following address :
Commission nationale pour la protection des données
Service des réclamations
1, avenue du Rock’n’Roll
L-4361 Esch-sur-Alzette
Phone : (+352) 26 10 60-1
References
1 Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ 2016, L 119, 4.5.2016, pp. 1-88).
2 Idem, Art. 5(1)(c).
3 Idem, Art. 6(1) (e).
4 Law of August 27, 2013 on the creation of the public establishment «Autorité luxembourgeoise indépendante de l’audiovisuel», and amending the amended law of July 27, 1991 on electronic media, Memorial A, n ° 163, p. 3113, available on : http://legilux.public.lu, last visited on 30.5.2018.
5 Such processing is explicitly provided for in Articles 5 (1) (b) and 89 of the GDPR («Special processing situations»).
6 Regulation (EU) 2016/679, op. cit., Art. 17(3)(b).
7 Idem, Art. 17(3)(d).