Professional secrecy and outsourcing arrangements – Final text to be adopted soon?

Allen & Overy LLP
Contact

Allen & Overy LLP

Since our last e-alert on the bill of law n°7024 (the Bill of Law 7024)1, aimed, among others, at amending article 41 of the Luxembourg act of 5 April 1993 on the financial sector, as amended (the Banking Act 1993), which deals with professional secrecy obligations for credit institutions and other professionals of the financial sector, several institutions have again taken position.

Subject to a series of comments, in particular concerning the form of client consent, the Chambre de Commerce overall agrees upon the governmental amendments to the Bill of Law 7024 proposed on 4 April 2017 while, on the contrary, the Chambre des Salariés still objects to the proposed amendments to article 41 of the Banking Act 1993 considering the potential impact on employment in the financial sector but also in the insurance and payment services sectors. Most importantly, although it still has some comments concerning the wording and content of the governmental amendments, the Conseil d’Etat has now lifted its objections to the Bill of Law 7024, particularly in light of the new organisational requirements and the new rules on client consent in the context of outsourcing arrangements introduced by the governmental amendments.

However, it appears that the precise form that the client consent to the transfer of certain of his confidential data should take is still subject to some uncertainty. The governmental amendments do not include any reference to a written consent of the protected person (which tends to imply that it should be possible, under certain conditions, to obtain such a consent by the insertion of a provision to that effect in the general terms and conditions of the professional). However, the Conseil d’Etat (and going in the same direction, the Chambre de Commerce), although not formally imposing a written consent requirement, seem to have a stricter approach as regards the form that such an acceptance should take, based on the provisions of the EU General Data Protection regulation, which will enter into force on 25 May 2018. In any case, those two institutions have recommended that this matter be clarified in the final text. More recently, the Commission Nationale pour la Protection des Données (the Luxembourg data protection authority), while maintaining its initial comments, also insisted on the fact that the form of the client consent should be clarified, notably whether such consent ought to follow the strict requirements for client consent set forth in the EU General Data Protection regulation.
 
One can expect that the legislative process will most probably come to an end soon. Once the final text of the Bill of Law 7024 is adopted, this matter will require special attention in order for professionals to assess the appropriate course of action to be taken.
 
1 Please refer to our alert of 11 April 2017 for further details, click here

 

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Allen & Overy LLP | Attorney Advertising

Written by:

Allen & Overy LLP
Contact
more
less

Allen & Overy LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.