Outlook and latest updates with the upcoming changes on e-Archiving

The foreseen change in the legal framework

A legal framework concerning electronic archiving already exists in Luxembourg. However, this framework does not provide sufficient legal guarantee regarding the destruction of an original document that had already been digitalised.

To overcome this limitation, a team of experts was gathered to design a new legal framework based a new law on electronic archiving and an update of other impacted laws (Civil code, Commercial code, Financial sector law) and of the related Règlement Grand Ducal (RGD).
The proposed legal framework puts forward three major considerations:

• Creation of the Dematerialisation and Conservation service provider (defined as ‘PSDC’ in the draft law) status: the objective is to organise the activity of digitalisation and archiving and thus to build trust on activities for service receiving companies, as well as for judges, ministries, administrations and courts. PSDCs will be monitored by the ILNAS with a specified accreditation scheme. An organisation can choose to become accredited for digitalisation and/or for archiving
• Reversal of the charge of proof: In case of faithful copy of the original document produced and archived by a PSDC under conditions set forth in the RGD, it would be up to the charging party to evidence that the copy is not a faithful or sustainable reproduction of the original document
• Technical and organisational requirements: The RGD, and more specifically, the accreditation scheme will set precise technical requirements, organisational constraints and implementation conditions

Technical regulation requirements and measures

As part of the accreditation scheme, technical requirements have been published by the ILNAS. The framework is based on 3 layers. The first layer is the foundation and applies ISO/IEC 270011 and 270022. 

The second layer provides more details into a number of ISO/IEC 27002 controls and tailors them to reflect digitalisation/archiving activities. The third layer contains controls additional to the ISO/IEC 27002 that are specific to the digitalisation/archiving activities and systems.

The accreditation scheme also includes documents related to supervision of PSDCs and audit guidelines.

What if digitalisation and archiving services are provided to financial institutions?

Whenever digitalisation/archiving services are provided to financial institutions, all PSDCs are required to obtain a PSF status. Two new Support PSF statuses (Articles 29-5 and 29-6) would be added to the law of 5 April 1993 on the financial sector. Conditions set forth for the PSF status include a share capital forecasted at EUR 50,000 for digitalisation service providers (PSF/PSDC-D) and at EUR 125,000 for archiving service providers (PSF/PSDC-C).

Consequently, the PSDC will be supervised by both ILNAS for its PSDC status and by CSSF for its PSF status. As of yet, other than those circulars already applicable to Support PSF, no regulation/circulars specific to PSF/PSDCs have been published by the CSSF.

Things are moving

The draft bill, draft updates to impacted laws, and draft updates to the RGD were initially submitted in February 2013 and had received four major objections from the State Councel in November 2013. Xavier Bettel’s government has set this draft bill as one of its priorities and actions have been taken in that direction. 

One of the key actions is a communication to European Commissions enabling recognition of a dematerialised evidence outside of Luxembourg’s borders. The economical commission is currently reviewing updates and an expected date for adoption is December 2014.

ILNAS, on its side, is considering updating the “Technical regulation requirements and measures” to the 2013 version of the ISO27001.