Ministry of Health data protection policy

Personal data protection statement

As part of its remit, the Ministry of Health and Social Security, which is based at 1, rue Charles Darwin, L-1443 Luxembourg, is required to process personal data of a highly sensitive nature.

We attach the utmost importance to protecting personal data at all times during processing.
Below you will find detailed information about the protection of your data. 

Applicable legislation

The Ministry of Health is subject to personal data protection legislation, and most notably:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereafter the GDPR);
• the Law of 1 August 2018 on the organisation of the National Commission for Data Protection (Commission nationale pour la protection des données) and implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

Data controller

The Ministry of Health and Social Security is the data controller.

How personal data is processed

Data will be processed using paper documents or electronic means, based on the principles of lawfulness, loyalty and transparency, in order to protect the confidentiality and the rights of the data subject at all times, in accordance with the legislative provisions in force.

Data retention period

In accordance with the provisions of the legislation in force, data will be retained only for as long as is necessary to achieve the purposes for which it is processed.

Your data protection rights

The General Data Protection Regulation gives you certain specific rights, including the right to ask the controller to: 

• Confirm whether or not your personal data is processed and, if it is, grant you access to said data and provide you with a copy of it (right of access - Article 15 of the GDPR);
• Correct your personal data if it is inaccurate, or complete data that is incomplete (right to rectification - Article 16 of the GDPR);
• Erase your personal data, unless there are legitimate grounds for retaining it (right to erasure - Article 17 of the GDPR);
• Restrict the processing of your personal data under the conditions provided for in Article 18 of the GDPR (right to restriction of processing);
• Provide your personal data in a structured, commonly used, machine-readable format, and transmit this data to another data controller under the conditions provided for in Article 20 of the GDPR (right to data portability);
• Comply at all times if you notify them that you object to the processing of your personal data, unless there are legitimate and compelling grounds for the processing that take precedence over the data subject's interests, rights and freedoms (right to object - Article 21 of the GDPR);
• Comply at all times if you decide to withdraw your consent to the processing of your data, without affecting the lawfulness of any processing that was carried out with your consent before you withdrew your consent (note that most of the personal data that is processed by the Ministry of Health is processed based on a law and, therefore, the right to object is limited).

Exercising your rights

For any information concerning the processing of your personal data by the Ministry of Health, and for any requests relating to the exercise of your rights, you can write to the following address:

Ministère de la Santé et de la Sécurité sociale
1, rue Charles Darwin
L-1433 Luxembourg
Délégué à la protection des données

E-mail: dateprotection@mss.etat.lu

For the sake of confidentiality and to protect your personal data, your identity must be verified before we can respond to your request. To that end, you may be asked to provide a copy of your identity document. The information that appears on your identity document will only be retained for as long as is necessary to verify your identity.

The General Data Protection Regulation gives you the right to lodge a complaint with the national control authority, i.e., the National Commission for Data Protection (CNPD): 15, boulevard du Jazz L-4370 Belvaux - www.cnpd.public.lu.

Security of your personal data

As part of the Ministry of Health's remit, Ministry of Health and Social Security employees have access to your data. They are bound by professional secrecy and by data protection legislation.

The Ministry of Health undertakes to protect and secure your personal data by implementing regularly updated physical, technical, organisational and procedural protection measures that are designed to protect the confidentiality of your personal data, and to prevent its destruction, loss, modification or disclosure.

Recipient

The Ministry of Health uses a public establishment as a data processor. Depending on the purposes and the required processing, the Ministry of Health may send certain data to other health or social security stakeholders, or to other State authorities, where necessary.   

Notification

In the event of a personal data breach, the Ministry of Health and Social Security will notify the National Commission for Data Protection (CNPD) within 72 hours of learning of the breach.

If such a breach concerns your personal data and the incident is likely to pose a high risk to your rights and freedoms, the Ministry of Health and Social Security will notify you as soon as possible.