The welfare and safety of visitors, and of its own staff, are of the utmost importance for the City of Luxembourg's Service Voirie (Department of Streets). Accordingly, protecting your personal data is a top priority for both the City of Luxembourg and its Service Voirie. This notice asserts our commitment to full transparency, and explains how we process your personal data – i.e. how it is collected, recorded, stored, used, shared, archived, and deleted – as part of our CCTV monitoring operations. It also explains what your rights are in this regard, and how you can exercise them.

Who is the Data Controller?

Where the processing of video footage in which you appear is concerned, the Data Controller is the City of Luxembourg municipal administration, whose head office is located at 42, Place Guillaume II L-1648 Luxembourg. As such, we are responsible for how your personal data is processed, and for how it is collected, recorded, stored, used, shared, and protected, before it is deleted in compliance with our data retention policy. Our Data Protection Officer is responsible for checking the lawfulness of our data processing operations.

Which categories of personal data are processed, and to what end (purposes of the processing)?

As part of its public-interest mandate, the City is responsible for ensuring that roads and thoroughfares in Luxembourg City are kept in serviceable condition. The City's and its Service Voirie's ongoing efforts to improve the city's road systems are beneficial to all users and visitors. The City has introduced CCTV monitoring at its Centre d'Intervention et d'Entretien (Intervention and Maintenance Centre) in Cessange with a view to improving security to the highest possible level. To that end, we may need to process some of your personal data, such as video footage in which you appear.

As such, your personal data may be processed for the following purposes:

  • To assist and support the City in fulfilling the task of securing access to buildings outside working hours;
  • To ensure the safety of visitors, City staff and suppliers;
  • To detect and identify potentially suspicious, dangerous and unlawful behaviour. To prevent acts that threaten the safety of persons – visitors, City staff, watchmen, suppliers, providers, etc. – and property – buildings and their surroundings, vehicles, stocks, etc. – in areas that are particularly exposed. To identify behaviour that could result in serious incidents or accidents;
  • To deter ill-intentioned persons from committing criminal offenses;
  • To pinpoint the origin of incidents or accidents. To deter ill-intentioned individuals from committing offenses against property, such as theft and vandalism, and to gather evidence in support of established offenses;
  • To assist in determining the truth when a theft or loss is reported;
  • To respond to data subjects' or public or judicial authorities' requests to access video footage;
  • To produce statistics.

In all cases, the City will ensure that such video data is collected for the purposes listed above, and that it is processed in an appropriate manner, and only to the extent that is required to achieve the intended purposes.

Given the location of the Service Voirie site, and the specific risks that were identified in an impact analysis that we conducted, the CCTV monitoring system's operating schedule has been adjusted so that it complies with the purposes listed above, and particularly with the data minimisation principle.

City of Luxembourg's formal commitment

The City hereby formally undertakes to use any data that it collects solely for the above-mentioned purposes. Such data will never be used to assess individuals' performance, or to systematically monitor staff in their workplace. Visitors' data will not be processed for marketing purposes. Personal data will never be sold to third parties.

How is your personal data collected and used?

The City processes – collects, records, and uses (i.e. views, extracts and, if need be, securely shares) – personal data (video footage) from all of the CCTV cameras installed in and around the buildings at the City's site. For each of the aforementioned purposes, your personal data is processed:

  • in accordance with the applicable laws on the protection of personal data, including the "GDPR Regulation" – i.e. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, which regulation repeals Directive 95/46/EC (General Data Protection Regulation) – and the Law of 1 August 2018 establishing the National Commission for Data Protection and implementing the GDPR (loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et mise en œuvre du RGPD);
  • because it is legally required to fulfil a public-interest mandate with which the City is vested, or to discharge a legal obligation incumbent on the City.

How long will your personal data be retained?

The City will retain your personal data for as little time as possible, and only for as long as it takes to achieve the purposes for which it is being processed, i.e.:

Images in which you appear (video files) are normally kept for no more than seven days.

Such images may be retained for longer periods of time, should any of the following arise:

  • incidents or accidents, for the purpose of sharing data with the police or competent judicial authorities (until a final legal ruling is issued);
  • circumstances requiring the City to take steps to defend its interests in a dispute (until the dispute is finally settled). Some of your personal data may be transferred to the City's Service des archives (Archives Department) – for archiving in the public interest, or for historical or statistical purposes – or to the Luxembourg National Archives.

Who will be able to access your personal data?

Access to video footage in which you appear may be granted to various City of Luxembourg departments with a view to achieving the purposes of the processing, as mentioned above. A procedure for extracting and sharing video files has been established. In strict observance of your data protection rights, the City has implemented all appropriate technical and organisational measures to safeguard the security, confidentiality, integrity and availability of your personal data. Such data will or may be shared with certain municipal employees, for the sole purpose of enabling them to perform the duties entrusted to their departments. Recipients may include:

  • Heads of departments or their authorised representatives;
  • the City's Service juridique (Legal Department) and the DPO;
  • the members of the City's College of Aldermen.

Such data may also be shared with external recipients, including the Luxembourg authorities (police, justice) and insurers. External contractors may have access to CCTV camera infrastructure to carry out maintenance and repair work at the request of the City's relevant departments. Owing to the technical and organisational measures that have been implemented, your personal data will not be accessible to external contractors while this work is being carried out. In all cases, such technical interventions will be carried out under the supervision of City staff. We contractually require external contractors to provide guarantees that they are able to safeguard the security and confidentiality of your personal data by implementing appropriate technical and organisational measures, in compliance with the regulations. The City may subcontract some of the work (e.g. installation, repairs, etc.) in connection with the CCTV cameras. In that case, the work would be subcontracted to contractors that can provide the required guarantees. By establishing detailed specifications, and requiring contractual commitments and appropriately implemented technical and organisational measures regarding access to data, we can guarantee that subcontractors' activities comply with the GDPR's requirements.

Where is your personal data processed? Is your personal data transferred?

In addition to being accessible to City of Luxembourg departments, your personal data may be transferred to Luxembourg's judicial authorities or the police. This may occur, for example, when a complaint for damage or assault has been filed, and for the purposes of ascertaining a committed offence.
At this time, the City does not transfer your personal data outside the European Union for processing. However, the City may subcontract all or part of the data processing, and transfer your personal data outside the European Union. Should the City do so, we will contractually require contractors to provide guarantees that they are able to safeguard the security and confidentiality of your personal data by implementing appropriate technical and organisational measures, and we will ensure that these guarantees are enforced. The City has taken note that the European Commission has introduced a new mechanism for transferring data to the United States (Data Privacy Framework). Should data be transferred to the United States, we will implement appropriate security and confidentiality measures, as mentioned above, to ensure that the level of protection of your personal data meets the GDPR's requirements.

What are your rights in respect of your personal data?

In accordance with current regulations, you have the right to:

  • access the video recordings in which you (or a minor of whom you are the legal representative) appear.
    Further information can be found in the legal notice published on our website.
  • file a complaint with the Luxembourg authority in charge of personal data protection matters, i.e. the National Commission for Data Protection (Commission nationale pour la protection des donnéesCNPD –

How can you exercise your rights?

Further information on how you can exercise your rights can be found in the legal notice published on our website.

Updates to this notice

To ensure full compliance with current regulations, and with any technical changes in the way in which personal data is processed, the City will update this notice whenever necessary. An announcement will be made whenever this notice is updated.

This notice was last updated in (March 2024). It is the version that is currently in force and can be found at