Your questions
Businesses established in the United Kingdom
I am a company established in the United Kingdom and I would like to post an employee temporarily to Luxembourg. Which provisions in terms of social security will apply?
The provisions of the Trade and Cooperation Agreement between the EU and the UK provide for the possibility of temporarily posting a worker to the territory of the other State while keeping him/her affiliated to the social security system of origin, provided that the States concerned notify their decision to continue to apply the rules on posting in relations with the United Kingdom.
Since Luxembourg has decided to opt for this possibility, an employee posted to Luxembourg therefore remains covered by the British social security scheme during the period of posting, provided that the posting period does not exceed 24 months.
I am a company based in the United Kingdom and I posted an employee to work temporarily in Luxembourg before 1 January 2021 for a posting period exceeding that date. What will his social security situation be from that date?
Under the provisions of the withdrawal agreement between the EU and the UK, the EU regulations regarding social security coordination (No. 883/2004 and No. 987/2009) remain applicable to this situation after 31 December 2021 until the end of the posting.
The employee will therefore continue to be covered by to British social security scheme during the posting period, even after 31 December 2020.
I bought products online from a company based in Luxembourg. This company transmits my purchase history to one of its subsidiaries in the United Kingdom for the purpose of its stock management. Is the Luxembourg company authorised to transfer my personal data to its UK subsidiary after the United Kingdom’s withdrawal?
Yes.
Until the end of the transition period, the European regulation continues to apply.
In addition, the data subject has certain rights under the General Data Protection Regulation, including the right to information. As such, anyone who decides to process a data subject’s personal data, is obliged to inform the data subject of :
- their identity;
- the purpose of collecting data and whether the provision of the data is mandatory or optional;
- the recipients of the data;
- the rights granted to the data subject under the General Data Protection Regulation;
- any transfers of data to a country outside the European Union.
The controller must provide these elements in plain and clear language when personal data are collected or, at the latest, within one month following the data collection, if the data are not collected directly from the data subject.
Consequently, and subject to compliance with the general principles of the General Data Protection Regulation, including the right to information detailed above, the Luxembourg company is able to continue to transfer the data subject’s personal data to its UK subsidiary, at least until the end of the transition period.
For further information:
- Protection of privacy and electronic data on Guichet.lu;
- Filing a claim with the National Commission for Data Protection;
- Your rights on the website of the National Commission for Data Protection;
- The right to information on the website of the National Commission for Data Protection;
- Asserting your rights on the website of the National Commission for Data Protection.
I bought products online from a company established in the United Kingdom. Will I have the same rights as currently under the General Data Protection Regulation after the United Kingdom’s withdrawal?
Yes.
The European regulation continues to apply until the end of the transition period. Therefore, the data subject will have the same rights as currently, at least until the end of the transition period.
In addition, the data subject has certain rights under the General Data Protection Regulation, including the right to information. For example, anyone who decides to process a data subject’s personal data, is obliged to inform the data subject of :
- their identity;
- the purpose of collecting data and whether the provision of the data is mandatory or optional;
- the recipients of the data;
- the rights granted to the data subject under the General Data Protection Regulation;
- any transfers of data to a country outside the European Union.
The controller must provide these elements in plain and clear language when personal data are collected or, at the latest, within one month following the data collection, if the data are not collected directly from the data subject.
For further information:
- Protection of privacy and electronic data on Guichet.lu;
- Filing a claim with the National Commission for Data Protection;
- Your rights on the website of the National Commission for Data Protection;
- The right to information on the website of the National Commission for Data Protection;
- Asserting your rights on the website of the National Commission for Data Protection.
I am employed in Luxembourg and regularly travel to the UK for professional reasons. In this context, my Luxembourg employer systematically sends my personal data (name, first name, telephone number, etc.) to an entity based in the United Kingdom, which is responsible for managing my work-related journeys. Will my employer have the right to continue to transfer my data after the United Kingdom’s withdrawal?
Yes.
The European regulation continues to apply until the end of the transition period.
In addition, the data subject has certain rights under the General Data Protection Regulation, including the right to information. For example, anyone who decides to process a data subject’s personal information, is obliged to inform the data subject of :
- their identity;
- the purpose of collecting data and whether the provision of the data is mandatory or optional;
- the recipients of the data;
- the rights granted to the data subject under the General Data Protection Regulation;
- any transfers of data to a country outside the European Union.
The controller must provide these elements in plain and clear language when personal data are collected or, at the latest, within one month following the data collection, if the data are not collected directly from the data subject.
Consequently, and subject to compliance with the general principles of the General Data Protection Regulation, including the right to information detailed above, the Luxembourg employer can continue to transfer the data subject’s personal data to its UK entity, at least until the end of the transition period.
For further information:
- Protection of privacy and electronic data on Guichet.lu;
- Filing a claim with the National Commission for Data Protection;
- Your rights on the website of the National Commission for Data Protection;
- The right to information on the website of the National Commission for Data Protection;
- Asserting your rights on the website of the National Commission for Data Protection.
I am a natural person holding shares in a Luxembourg investment fund. The financial institution which set up the investment fund, is established in the UK and wishes to receive my personal data for statistical purposes. Is the Luxembourg investment fund authorised to transfer my personal data to the UK financial institution after the United Kingdom’s withdrawal?
Yes.
The current European regulation continues to apply until the end of the transition period.
In addition, the data subject has certain rights under the General Data Protection Regulation, including the right to information. For example, anyone who decides to process a data subject’s personal information, is obliged to inform the data subject of :
- their identity;
- the purpose of collecting data and whether the provision of the data is mandatory or optional;
- the recipients of the data;
- the rights granted to the data subject under the General Data Protection Regulation;
- any transfers of data to a country outside the European Union.
The controller must provide these elements in plain and clear language when personal data are collected or, at the latest, within one month following the data collection, if the data are not collected directly from the data subject.
Consequently, and subject to compliance with the general principles of the General Data Protection Regulation, including the right to information detailed above, the investment fund can continue to transfer the data subject’s personal data to the financial institution, at least until the end of the transition period.
For further information:
- Protection of privacy and electronic data on Guichet.lu;
- Filing a claim with the National Commission for Data Protection;
- Your rights on the website of the National Commission for Data Protection;
- The right to information on the website of the National Commission for Data Protection;
- Asserting your rights on the website of the National Commission for Data Protection.