Whistleblower confidentiality and data processing

The Competition Authority handles all reports in strict confidence as regards the identity of the whistleblower.

The Authority will never disclose:

• the identity of the whistleblower without their express consent;
• or any other information from which the identity of a whistleblower can be directly or indirectly deduced.

Where applicable, the Authority will not use or disclose trade secrets for purposes going beyond what is necessary for proper follow-up.

In order to carry out the missions entrusted to it by the Law of 16 May 2023 on the protection of people who report breaches of EU law (whistleblowers), and more specifically concerning the handling of reports, the Authority may need to process personal data concerning you.

All processing of personal data pursuant to the law on the protection of whistleblowers, including the exchange or transmission of personal data by the competent authorities, is done in accordance with Regulation (EU) 2016/679, hereinafter referred to as the 'General Data Protection Regulation' or the 'GDPR'.

As a public authority processing personal data, the Authority is bound to respect the obligations incumbent on it in its capacity as a data controller.

If you have any questions concerning the processing of your personal data by the Authority, you can contact the Authority's data protection officer (DPO) by letter marked For the Attention Of the DPO, by telephone (+352 247 84 728) or by email at the following address: dpo@concurrence.etat.lu.

Purpose and legal basis for processing

The Authority may be contacted by any whistleblower wishing to report a breach externally, i.e. outside the company where they work. Following an assessment, where necessary, and subject to the obligations in respect of confidentiality, the personal data thus obtained may be processed in the context of the performance of the tasks or investigations falling within the Authority's remit.

In that context, it is necessary to process your data for the performance of the public-interest mission in the exercise of the powers vested in the Authority (Article 6(1)(e) of the GDPR).

Data processed

Whistleblowers can use the secure platform MyGuichet.lu. In such cases, for the report to be processed, an email address must be provided, thereby enabling the Authority to give feedback and to ensure that the reports are followed up. Potential whistleblowers must also provide a description of the alleged breach and state who has committed it. It is therefore possible that information relating to the behaviour of other persons, and in particular the perpetrator of the breach or witnesses, will be processed.

It is recommended, when describing the breach, to mention only information which is needed in order for the report to be dealt with. In particular, unless absolutely necessary, refrain from including sensitive data (within the meaning of Article 9 of the GDPR) concerning you, the whistleblower or third persons (for example, data concerning health, political opinions or religious beliefs).

Whistleblowers can also make their reports by telephone or in person. In such cases, other contact details may be collected and they do not need to provide an email address.

Categories of recipients

Recipients 

Only members of the Competition Authority's staff who are authorised to receive reports and follow them up have access to the Authority's secure reporting platform or to the minutes, as applicable.

In the case of reporting through other channels or via other members of Authority staff, the latter are likewise bound to observe confidentiality concerning the identity of the whistleblower or of the person concerned, and will forward the report without delay to the members of staff assigned to handle it.

As regards reporting via the MyGuichet.lu platform, for which the CTIE is responsible (acting in the capacity of data processor), personal data provided by the whistleblower will be accessible only to persons designated by the CTIE in the context of a request for support or technical assistance.

Potential recipients

If a report does not fall within the Authority's remit, the data collected may be forwarded confidentially and securely to other competent authorities within a reasonable timeframe.

Where a report addressed to the Authority prompts an investigation into the alleged facts, the persons authorised to access reports will, according to the subject matter thereof (DMA, P2B, anti-competitive practices), forward the report in question to the competent departments within the Authority. If anonymisation is not possible without compromising the Authority's investigation and inspection activities, only the personal data needed for the purposes of the investigation will be transmitted.

Data retention period

Personal data which is manifestly not relevant for the processing of a specific report will not be collected or, if accidentally collected, will be deleted without undue delay.

Personal data obtained via a report which is held by the duly authorised staff to be unfounded and which falls outside the Authority’s remit will be deleted without delay.

Personal data obtained via a report shall be kept for 2 months following the closure of the investigation carried out by the Authority in the performance of its respective tasks or of the procedure concerning the facts alleged in the report until the end of the period allowed for lodging an appeal.

In accordance with the Law of 17 August 2018 relating to archiving, files with an asset value must be retained for archiving in the public interest after they are no longer useful for administrative purposes.

Rights of data subjects

You can access any data concerning you and obtain a copy (Article 15 of the GDPR), have any inaccurate or incomplete data rectified (Article 16 of the GDPR), oppose the processing of your data under the conditions provided for in Article 21 of the GDPR, request the erasure of said data under the conditions provided for in Article 17 of the GDPR, and restrict the processing of said data under the conditions provided for in Article 18 of the GDPR.

If you have any questions about how the Authority processes your personal data or if you wish to exercise your rights, please contact the Data Protection Officer (DPO) of the Competition Authority by email (dpo@concurrence.etat.lu) or by post:

Autorité de la concurrence
For the attention of the Data Protection Officer (DPO)
2A, rue d’Anvers
L-1130 Luxembourg.

Complaints

If, after contacting us, you feel that your rights regarding your data have not been respected, you may lodge a complaint with the National Data Protection Commission (Commission nationale pour la protection des données).