Introduction
A key objective of the City of Luxembourg ("the City") is to provide residents with a user-friendly service.
It therefore goes without saying that protecting your personal data is a major priority for the City and its bus service (Autobus de la Ville de Luxembourg – "AVL") when they need to process such data.
This notice represents our commitment to transparency and explains how we process your personal data – i.e. how we collect, record, store, use, share, archive and delete it – for the purpose of implementing video-surveillance measures. It also explains your rights and how to exercise them.
Who is the data controller?
The City of Luxembourg, with its registered office at 42, place Guillaume II, L-1648 Luxembourg, is the data controller. As such, we are responsible for the processing method and the way in which we collect, record, store, use, share and protect your data before deleting it.
What categories of personal data are processed, and with what objectives (purposes of the processing)?
As part of its public-service obligation, the City is responsible for transporting persons throughout Luxembourg City, directing investment in vehicles and modernising its infrastructure. Through these modernisation efforts, the City is able to guarantee the highest level of safety for passengers and City of Luxembourg staff. To successfully fulfil our mission, we process some of your personal data, such as your video image.
Your data is processed in order to:
- assist and support drivers, ensure that passengers can safely get on or off the bus;
- ensure the safety of staff and passengers;
- detect and identify potentially suspicious, dangerous or unlawful behaviour; prevent acts that threaten the safety of persons (passengers and drivers, ticket inspectors) and property (City buses) in places and surrounding areas that are especially exposed; identify behaviour that is likely to cause accidents or incidents;
- use deterrence to protect against physical and verbal attacks on drivers, ticket inspectors and other City staff, as well as on passengers;
- pinpoint the origin of an incident or accident; use deterrence to prevent property crime such as theft and vandalism, and gather evidence relating to ascertained offences; as well as
- help establish the truth when a theft or loss is reported.
In all cases, the City ensures that this video data is collected for the purposes listed above and that it is processed in an appropriate and proper manner, and only to the extent necessary to achieve the intended purpose(s).
Formal commitment of the City of Luxembourg:
The City hereby formally undertakes to use the data it collects only for the purposes mentioned above.
Under no circumstances will the data be used to assess the performance or observe the conduct of drivers or ticket inspectors while working, or of passengers for marketing purposes. Personal data will never be sold to third parties.
How is your data collected and used?
We process (collect and use through viewing) the personal data we obtain from all the video cameras installed in Luxembourg City buses.
For each of the aforementioned purposes, your data is processed:
- in accordance with the applicable laws on the protection of personal data, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR), and the Law of 1 August 2018 establishing the National Commission for Data Protection (CNPD) and implementing the GDPR (loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et mise en œuvre du RGPD); and
- because it is legally necessary to accomplish a public-service obligation with which the City is vested.
How long is your data retained?
We retain your personal data for as little time as possible and only for as long as it takes to accomplish the purposes for which it is being processed, i.e.:
- 30 days for Luxembourg City buses,
- 30 days for Luxembourg City buses used for the City Night Bus service.
As a rule, your personal data is retained for the period specified above. It may be retained for even longer, should any of the following situations arise:
- incidents or accidents, for the purpose of forwarding data requested by the relevant legal authorities (until a final legal ruling is issued);
- circumstances that require the City to take steps to defended its interests as part of a dispute (until the final settlement of the dispute).
Who has access to your data?
Access to video recordings of your data may be granted to different City of Luxembourg departments to accomplish the purposes of the processing as mentioned above. A procedure for extracting and transferring video files has been established and implemented.
To fully protect your personal data, the City has implemented all appropriate technical and organisational measures to safeguard the security, confidentiality, integrity and availability of your data.
This data is or may be shared with certain municipal departments, in strict compliance with the duties assigned to them. Accordingly, your data may be shared with:
- the head of the authorised department;
- the Cellule juridique (Legal Unit);
- members of the management staff.
External service providers may have access to video-camera infrastructure to perform maintenance and repairs at the request of the relevant municipal departments. Owing to the technical measures that have been implemented, your personal data will not be accessible to external service providers while they perform this work.
We contractually require any external service providers to safeguard the security and confidentiality of your personal data through appropriate technical and organisational measures, in accordance with the regulations.
The City subcontracts some of the work in connection with the video cameras installed in its buses. A Luxembourg-based service provider, offering all the required safeguards, has been selected. Thanks to rigorous specifications, the signing of contractual commitments, and appropriately implemented technical and organisational measures regarding access to data, we can guarantee that the subcontractor's activities comply with the GDPR's requirements.
Where is your data processed? Is your data transferred to other parties?
In addition to being accessible to City of Luxembourg departments, your personal data may be forwarded to the legal authorities or the police. This may occur, for example, when a complaint for damage or assault has been filed, and for the purposes of ascertaining a committed offence.
At this time, the City does not transfer your personal data outside the European Union for processing. The City may subcontract all or part of the data processing and transfer your personal data outside the European Union. Should the City do so, we will contractually require service providers to safeguard the security and confidentiality of your personal data through appropriate technical and organisational measures, and we will ensure compliance with these safeguards.
We have taken note of the Court of Justice of the European Union's ruling invalidating the framework for the transfer of personal data to the United States (Privacy Shield), as implemented by the European Commission. Should data be transferred to the United States, we will implement the appropriate security and confidentiality measures, as mentioned above, so the level of protection of your personal data meets the GDPR's requirements.
What are your rights regarding your personal data?
In accordance with the regulations, you have the right to:
- access the video recordings that concern you (or those of a minor of whom you are the legal representative); and
- file a complaint with the Luxembourg authority in charge of protecting personal data (CNPD – www.cnpd.public.lu).
How can you exercise your rights?
- Comments or requests for information on the processing of your personal data and/or exercise your aforementioned rights can be sent to the City's Data Protection Officer:
- by post:
Délégué à la protection des données Administration communale de la Ville de Luxembourg
42, place Guillaume II 42, place Guillaume II
L-1648 Luxembourg L-1648 Luxembourg
or via email: or via email:
DPO@vdl.lu protectiondesdonnees@vdl.lu
You have the right to access and rectify your personal data and, where applicable, the right to restrict the processing of your data.
You may object to the processing of your personal data provided that you have legitimate grounds to do so, and only insofar as the conditions of Article 21 of the GDPR are met.
You may request access to your personal data by filling in the following form:
For the administrative and judicial authorities, please fill in the following form:
The duly completed form should be sent to the City of Luxembourg's Bus Department (Service Autobus)
either by email to autobus@vdl.lu,
or by post to Service Autobus, B.P. 914, L-2019 Luxembourg
You may send a complaint regarding the processing of your personal data to the City at the postal address above and/or to the authority responsible for data protection, the CNPD: 15, boulevard du Jazz, L-4370 Belvaux (www.cnpd.public.lu).
Updates to this information notice
As part of our effort to comply as fully as possible with current regulations and any technical changes to the processing of personal data, the City updates this information notice whenever necessary. A notification is published whenever this notice is updated.
This notice was last updated in December 2020. This version is the current version and the one published on the City of Luxembourg's website.
