At the time we released our last e-alert on the bill of law n°7024 aiming, among others, at amending article 41 of the Luxembourg act of 5 April 1993 on the financial sector, as amended (the Banking Act 1993) on professional secrecy1, it was expected that the final text of the law would be adopted at short notice.

However, the comments of the Chambre de Commerce and the Conseil d’Etat concerning the form of client consent in the context of outsourcing arrangements have led to a further delay and additional discussions between the various stakeholders.

On 8 January 2018, the Commission des Finances et du Budget of the Parliament adopted new amendments to address the latest comments of the Conseil d’Etat.

While the main features of the new article 41 remain unchanged, a new paragraph 9 has been added to article 41 of the Banking Act 19932, which makes it clear (even though there was in our view no doubt about it) that the rules described therein are only relevant from a professional secrecy perspective and do not release the professional from its obligation to comply with applicable data protection legislation. In this context, it is worth noting that under the data protection legislation, client consent is not the only lawful basis for the transfer of personal data to a third party: in many circumstances there may be a more appropriate legal basis for such data transfer.

The amendments have now been submitted to the Conseil d’Etat and one can now reasonably expect that the final law will be adopted soon.

1 Please refer to our alert of 30 August 2017  for further details: http://www.allenovery.com/publications/en-gb/Pages/Professional-secrecy-and-outsourcing-arrangements-%E2%80%93-Final-text-to-be-adopted-soon.aspx.

2 A similar amendment is proposed for article 30 of the law of 10 November 2009 on payment services and article 300 of the law of 7 December 2015 on the insurance sector.