Data Protection at the Ministry of Health and Social Security

The Ministry of Health and Social Security (M3S), located at 1, rue Charles Darwin, L-1433 Luxembourg, attaches particular importance to the protection of your personal data and ensures that it is processed in accordance with the requirements of Regulation (EU) 2016/679 (GDPR) and the Law of 1 August 2018 on the organisation of the National Commission for Data Protection.

As part of its remit, the M3S is required to process personal data, including sensitive data, particularly in the fields of health and social security.

Data controller

The data controller is:

Ministry of Health and Social Security
1, rue Charles Darwin
L-1433 Luxembourg

Email: dataprotection@mss.etat.lu

Purposes and legal bases of processing

The processing of personal data carried out by the M3S serves specific, explicit and legitimate purposes, in particular:

  • the management of administrative and health records;
  • the implementation of public policies on health and social security;
  • the management of relations with users;
  • the management of the Ministry’s legal and regulatory obligations.

This processing is primarily based on the following legal grounds:

  • Article 6(1)(c) of the GDPR: compliance with a legal obligation;
  • Article 6(1)(e) of the GDPR: task carried out in the public interest;
  • for sensitive data, in particular health data:
    • Article 9(2)(h) (healthcare and management of health systems);
    • Article 9(2)(i) (public interest in the area of public health);
    • Article 9(2)(b) (social security obligations)

as well as specific national provisions.

In certain specific cases, processing may also be based on the data subject’s consent.

Categories of data processed

Depending on the purposes pursued, the data processed may include, in particular:

  • identification data (surname, first name, employee number, etc.);
  • contact details;
  • administrative data;
  • social security data;
  • health data, to the extent necessary and in accordance with applicable legislation.

Methods of processing

Data is processed in paper and/or electronic form, in accordance with the principles of:

  • lawfulness, fairness and transparency;
  • purpose limitation;
  • data minimisation;
  • accuracy;
  • storage limitation;
  • integrity and confidentiality.

Recipients of the data

To the extent strictly necessary for the performance of its duties, the M3S may be required to transfer data to:

  • other Luxembourg public authorities;
  • stakeholders in the health and social security sector;
  • competent public bodies;
  • technical subcontractors acting on its behalf, in particular:
    • the State Information Technology Centre (CTIE);
    • the Joint Social Security Centre (CCSS).

These recipients are subject to strict confidentiality and security obligations.

Data transfers outside the European Union

Data processed by the M3S is not, in principle, transferred outside the European Economic Area.

Should such a transfer exceptionally take place, it would be governed in accordance with Articles 44 et seq. of the GDPR, in particular through the implementation of appropriate safeguards.

Retention period

Data is retained for a period not exceeding that necessary for the purposes pursued, in accordance with:

  • applicable legal obligations;
  • public archiving rules.

Data security

The M3S implements appropriate technical and organisational measures to ensure the security and confidentiality of data, in particular:

  • access control;
  • physical and logical security measures;
  • staff awareness;
  • confidentiality undertakings.

Ministry staff are bound by professional secrecy.

Data breaches

In the event of a personal data breach, the M3S will notify the National Data Protection Commission within 72 hours.

Where such a breach is likely to result in a high risk to the rights and freedoms of the data subjects, they will be informed as soon as possible.

Your rights

In accordance with the GDPR, you have the following rights:

  • right of access (Article 15);
  • right to rectification (Article 16);
  • right to erasure (Article 17), unless otherwise required by law;
  • right to restriction of processing (Article 18);
  • right to data portability (Article 20), where applicable;
  • right to object (Article 21), unless there are compelling legitimate grounds.

You may also withdraw your consent at any time where the processing is based on consent.

Note: certain rights may be restricted where the processing is based on a legal obligation or a task carried out in the public interest.

Exercising your rights

For any request regarding your personal data, you may contact:

Ministry of Health and Social Security

For the attention of the Data Protection Officer (DPO)
1, rue Charles Darwin
L-1433 Luxembourg

Email: dataprotection@mss.etat.lu

Verification of identity

When you exercise your rights regarding the protection of personal data, the Ministry of Health and Social Security may need to verify your identity.

This verification aims to ensure that the information provided is not disclosed to an unauthorised person and to prevent any risk of fraudulent access to your personal data.

In accordance with Article 12(6) of Regulation (EU) 2016/679 (GDPR), where the Ministry has reasonable doubts as to the identity of the person making a request, it may ask for additional information necessary to confirm the identity of the data subject.

Where necessary, a copy of an identity document may be requested. This request is strictly limited to what is necessary for the verification of identity, and the data thus collected is used solely for this purpose.

The information provided in this context is retained only for the period strictly necessary for the verification of identity, after which it is securely deleted.

Data Protection Officer

The M3S has appointed an external Data Protection Officer (DPO), responsible in particular for:

  • Informing and advising the Ministry;
  • Monitoring compliance;
  • Cooperating with the supervisory authority.

Contact details:

Government Data Protection Commissioner
5, rue Plaetis
L-2338 Luxembourg

Email: info@cgpd.etat.lu

Within the Ministry, the M3S has appointed a Data Protection Officer (DPO) who acts as the point of contact for the DPO; their contact details are as follows:

Ministry of Health and Social Security

Data Protection Service
1, rue Charles Darwin
L-1433 Luxembourg.

Email: dataprotection@mss.etat.lu

Right to lodge a complaint

You have the right to lodge a complaint with the

National Commission for Data Protection
1, avenue du Rock’n’Roll
L-4361 Esch-sur-Alzette

www.cnpd.public.lu

Updates to this notice

This notice may be updated to reflect legal or organisational changes.

When we publish changes to the privacy policy, we update the date and version number. Significant changes will be highlighted on our homepage. However, we encourage you to review our Privacy Policy periodically.

Last update