1. General presentation of the data processing carried out by the City of Luxembourg in the context of videosurveillance

The City of Luxembourg (hereafter the "City") processes images as part of the videosurveillance of various areas in and around the Champ du Glacis during the Schueberfouer. The images can be viewed in real time or recorded for later review.

The videosurveillance footage is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (known as the General Data Protection Regulation, or GDPR), repealing and replacing Directive 95/46/EC.

3. Information to data subjects in accordance with Article 13 of the GDPR

I. Data Controller

The City of Luxembourg and the point of contact, the Service Evénements, fêtes et marchés (Events, Festivals and Markets Department), for information and clarifications:  EFM@vdl.lu

The personal data is processed in a manner that ensures that it is appropriately secured – including protection against unauthorised or illegal processing and against accidental loss, destruction or damage – using appropriate technical or organisational measures. Our subcontractors are also contractually bound to implement these technical and organisational measures when they process data.

II. Data Protection Officer

dpo@vdl.lu

III. Purposes of the data processing

The City processes the video images and footage for the following purposes:

  • To secure access to the Champ du Glacis during and outside of the fair's opening hours, to prevent illegal intrusions and threats from outside;
  • To ensure the safety of municipal staff, visitors, exhibitors and fairground workers;
  • To detect and identify suspicious or potentially dangerous behaviour that could cause accidents or incidents;
  • To communicate effectively with on-site municipal personnel, security contractors, and/or the Police and/or the CGDIS (fire brigade) in the event of illness or incident, and to protect municipal personnel if they need to intervene (as well as the security company contracted for that purpose).
  • To identify the cause of an incident;
  • To protect property (buildings, installations, equipment, etc.);
  • To analyse pedestrian flows and possible bottlenecks at Schueberfouer entrances/exits, and rearrange fairground rides and stalls for subsequent Schueberfouers in light of these logistical issues;
  • To assist the operator in counting the number of people passing through entrances/exits, in order to abide by the maximum occupancy set in the Schueberfouer's commodo authorisation.

IV. "Legitimate interest" is the legal basis for data processing

The data processing by the videosurveillance system takes place under the terms of Article 6(1)(f) of the GDPR, as is required for the legitimate-interest purposes pursued by the data controller or a third party (the purposes have been determined in light of the RETEX Event Security Operational System developed by provider G4S).

The legitimate interests are consistent with the purposes mentioned in point iii, to which they refer.

In practice, the balance of interests at stake – between the data subject's right to data protection and the purposes as mentioned above – is weighted in favour of the City processing temporary videosurveillance footage.

V. Data recipients

The aim is to be able to respond to requests from the judicial authorities – as provided for in the Code of Criminal Procedure – or from any other authorised authority in the event of an incident, and, where applicable, to requests from the Grand-Ducal Police, most notably in the case of an official complaint, in accordance with the laws, Grand-Ducal regulations and legislative texts in force.

VI. Data retention

The images will be retained for no more than 7 days.

VII. Data subjects' rights

Please refer to the notice here: https://www.vdl.lu/en/personal-data

In order for requests to be processed, the data subject must specify the location, date and approximate time of the footage that the applicant wishes to access.

In addition, in accordance with Article 12 of the GDPR, the City must have sufficient guarantees to be able to establish, beyond a doubt, the identity of the party requesting the information, so as not to infringe the rights of another data subject. Additional information may be needed in order to process the request.