Introduction

The interests of our residents are paramount to the City of Luxembourg ("the City").
Accordingly, protecting your personal data is also a priority for the City. The Service Circulation – which manages the retractable bollards controlling access to the city's pedestrian zones – may be required to process your personal data. This notice reflects our commitment to transparency and explains how we process your personal data – i.e. how we collect, record, store, use, share, archive and delete it – as part of our video monitoring measures. It also explains what your rights are in this regard, and how to exercise them.

Who is the Data Controller?

Where the processing of your personal data is concerned, the role of Data Controller is carried out by the City of Luxembourg municipal authority, whose head office is at 42, Place Guillaume II, L-1648 Luxembourg. As such, we are responsible for how your personal data is processed, and for how it is collected, recorded, stored, used, shared and protected before it is deleted.

Which categories of personal data are processed, and to what end (purposes of the processing)?

In accordance with its public-interest remit, the City has decided to control access to the pedestrian zones by means of retractable bollards. Starting in March 2022, these retractable bollards will be rolled out progressively to prevent vehicular access to the pedestrian zones in compliance with traffic regulations. Save for exceptional cases, only persons with special permits, business operators and the emergency services will be able to gain access to the city centre; they will be given badges and other devices allowing them to enter and exit the pedestrian zones.

These efforts to modernise and adapt our urban infrastructure are designed to ensure that residents, users and visitors enjoy the highest level of safety when they enter the areas that are covered by our video monitoring system. To successfully implement this system, we process some of your personal data, such as your video images.

Such personal data is processed for the following purposes:

  • Installing retractable bollards to control access to the pedestrian zones in the city centre, and introducing vehicle filtering measures, as part of the City's public-interest remit. Enabling real-time viewing of video images transmitted by cameras when the call button on the access-control unit is pressed.
  • Securing and restricting access to pedestrian zones by raising and lowering the retractable bollards. Combating violations and transgressions. Preventing acts that threaten the safety of persons (users, tourists and business operators) and property (City infrastructure and buildings) in the city centre and surrounding areas that are especially exposed. Identifying behaviour that is likely to cause accidents or incidents.
  • Controlling access to pedestrian zones in compliance with the municipal regulations.
  • The viewing of video images in real time is not a form of processing that is part of broader routine surveillance of a public space. The caller's voice on the intercom is not processed at the end of the conversation. In the event of disputes or abuse, a detailed report based on the viewing of video images, or the conversation with the caller, may be shared with the City's college of aldermen and/or Service juridique (Legal Department).
  • Managing and administering users' or the Authorities' rights with regard to the protection of personal data – in particular, the right of access.

In all cases, the City will ensure that such video data is collected for the purposes listed above, and that it is processed in an appropriate and proper manner, and only to the extent necessary to achieve the intended purposes.

The City of Luxembourg's formal commitment:

The City hereby formally undertakes to use the data it collects only for the purposes mentioned above.

How is your personal data collected and used?

We process – i.e. collect and view in real time – the personal data we obtain from the video cameras in and around the pedestrian zones. The viewing angles of the cameras have been set to cover the retractable bollards and their associated intercom systems. The areas around the retractable bollards, such as pavements and other public zones, are not filmed.

The images captured by video cameras are transmitted to the Service Circulation's bollard control centre only when the call button on the access control unit is pressed. This call feature is available 24 hours a day.

For each of the aforementioned purposes, your personal data is processed:

  • in accordance with the applicable laws on the protection of personal data, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation – GDPR), and the Law of 1 August 2018 establishing the National Commission for Data Protection (CNPD) and implementing the GDPR (loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et mise en œuvre du RGPD),
  • because it is legally necessary to accomplish a public-service obligation to which the City authorities are bound.

How long is your personal data retained?

We have conducted an analysis of the need for and proportionality of such data processing. We retain the video files for as little time as possible, and only for as long as it takes to achieve the purposes for which they are being processed. For reasons of data redundancy, the video files are retained for no more than 5 minutes. No functional features enabling access to these video files have been implemented by the City.

  • If an incident occurs during the operation of a bollard, technical data that is recorded at the same time as the video files (e.g. operational log files) may be extracted from the system.
  • The bollard use and operation data is then saved on another medium for as long as it takes to complete the procedures in connection with the incident (to protect the City's interests), and is accessible only to persons authorised for that purpose.

Who can access your personal data?

The video images are viewed in real time by a team of specialist operators from the Service Circulation, who are on duty around the clock. Maintenance is carried out by an external contractor under the City's supervision to ensure that the processed data remains protected and confidential.

In strict observance of your rights regarding the protection of your personal data, the City has implemented all of the appropriate contractual, technical and organisational measures to safeguard the security, confidentiality, integrity and availability of your personal data.

This data is or may be shared with certain municipal departments, strictly for the purpose of allowing them to carry out their assigned duties:

  • the heads of authorised departments,
  • the Service juridique (Legal Department),
  • the members of the college of aldermen.

External contractors may have access to video-camera infrastructure to carry out maintenance and repairs at the request of the relevant municipal departments.
We contractually require external contractors to provide guarantees that they are able to safeguard the security and confidentiality of your personal data by implementing appropriate technical and organisational measures, in compliance with the regulations.

All selected contractors provide all of the required guarantees. Thanks to rigorous specifications, the signing of contractual commitments, and appropriately implemented technical and organisational measures regarding access to personal data, we can guarantee that the contractors' activities comply with GDPR requirements.

Where is your personal data processed? Is your personal data transferred?

In addition to being accessible to City of Luxembourg departments, your personal data may be forwarded to Luxembourg's judicial authorities or the police.

Your personal data is processed only by a team of specialist operators from the Service Circulation, who are on duty around the clock. At this time, the City does not transfer your personal data outside the European Union for processing. The City may subcontract all or part of the data processing.

What are your rights regarding your personal data?

In accordance with the relevant regulations, you have the right to:

  • Access your personal data that is processed by the City (and also the personal data of any underage children in your care)
  • Object to the processing of your personal data, in certain circumstances
  • Restrict the processing of your personal data, and to request the deletion of your personal data in light of your personal circumstances

For further details on data subjects' rights, please refer to the "Data Protection" section on the City's website.

How can you exercise your rights?

  • If you have any comments or queries in connection with the processing of your personal data, or if you wish to exercise your rights as listed above, you may contact the City's Data Protection Officer (DPO).
  • Postal address:

Délégué à la protection des données                  Administration communale de la Ville de Luxembourg

42, Place Guillaume II                                      42, Place Guillaume II

L-1648 Luxembourg                                         L-1648 Luxembourg

Email address                                                   Email address

DPO@vdl.lu                                                    protectiondesdonnees@vdl.lu

You have the right to access and rectify your personal data and, where applicable, the right to restrict the processing of your data.

You may also object to the processing of your personal data, provided that you have legitimate reasons for doing so, and only insofar as the conditions of Article 21 of the GDPR are satisfied.

Should you have any complaints in connection with the processing of your personal data, you may contact the City at the postal address mentioned above, and/or the National Commission for Data Protection ( www.cnpd.public.lu)

Updates to this information notice

As part of our effort to comply as fully as possible with current regulations, and with any technical changes to the way in which personal data is processed, the City updates this information notice whenever necessary. A notification is published whenever this notice is updated.

This notice was last updated in (February 2022). It is the current version and the one which appears on the City's website.