Financial – RJ Gaito Law Firm https://rjgaito.com International Business Law Firm Sat, 10 Jan 2026 09:22:47 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 Private Equity Year in Review 2025 and Considerations for 2026 https://rjgaito.com/private-equity-year-in-review-2025-and-considerations-for-2026/ Sat, 10 Jan 2026 09:22:47 +0000 https://rjgaito.com/?p=2174

Ronnen and Martin provide a detailed insight and review of the latest on Private Equity in Luxembourg during an interview with Lexology.
Their interview can be read in detail by downloading the full interview and covers key points that should be considered by private capital actors.

Key Points of Private Equity in Luxembourg:

WHAT TRENDS ARE YOU SEEING IN OVERALL ACTIVITY LEVELS FOR PRIVATE EQUITY BUYOUTS AND INVESTMENTS IN YOUR JURISDICTION DURING THE PAST YEAR OR SO ?

Following strong years from 2017–2022 that were underpinned by technology and real estate transactions, post-pandemic inflationary pressures, interest rate rises and the war in Ukraine have had an impact on deal volumes and reduced valuations. The cost of debt financing deals has been a key factor in deal flows. A vibrant Luxembourg real estate sector is now experiencing a sharp downturn and clients who have used venture debt have come under significant pressure. However, in mid-2024, the European Central Bank (ECB) started to cut interest rates, which boosted deal activity and improved the exit environment.

In 2025, it seems that the private equity landscape is rebounding from a challenging 2024. The trend demonstrated an uptick in technology, media and telecommunications transactions and, notably, software, software as a service and AI-related transactions. Private credit funds experienced significant growth and renewable energy firms wishing to optimize their group activities to position themselves for growth in the coming years have remained active. An uptick in activity in the M&A and IPO space was followed by continuous growth of private debt fund activities among private equity funds seeking to deploy capital into new investments and to exit investments within their existing private equity portfolios.

Luxembourg itself is not a large market in terms of target businesses for private equity (PE) investors, and we see only a small number of Luxembourg headquartered businesses being acquired by PE. Luxembourg is rather used as a fund and investment platform domicile for making acquisitions.

We see a variety of strategies being pursued, with not only traditional majority buyouts (a lot of the time with founders and management remaining as minority investors), but also some firms have launched separate funds to pursue minority stakes. This latter strategy does come with some different concerns, however, because the PE stakeholder will not have a significant influence over how the investment is funded. With this inflexibility, due to the majority investor holding the pen on how the deal is structured, some degree of work can be necessary for the minority investor – that is, our client – to ensure the investment remains viable in terms of tax leakage and internal rate of return metric. Recently, we have witnesses carve out transactions that enable the PE fund to gain complete control of the purchased business.

A recent keynote transaction – one of the largest carve-out transactions in Luxembourg’s history – involved assisting a PE fund specializing in buy-outs in the formation, consolidation and integration of the carved-out entity into a consolidated multinational company.

We assisted a PE fund specializing in the funding space to acquire a portfolio of claims from a Luxembourg-based litigation funder. The transaction involved several EU jurisdictions and the United States. This transaction required an interplay of tax, M&A, credit and enforcement considerations within a cross-border context.

Another notable deal was leading the construction of a pan-European and Latin American solar energy project finance platform and a subsequent debt raising transactions required for capitalizing the transactions.
These transactions required the coordination of lawyers and tax advisers in various jurisdictions with over 50 legal entities involved. It required an intensely interdisciplinary transaction team with deep knowledge of group reorganisations, M&A, equity and debt financing and deep understanding of the energy and software industries as well as understanding of international arbitration. It demonstrated our capabilities in cross-border transactions and business operations, as well as dispute resolution capabilities.

M&A deals are inevitably cross border in nature, because you have investors in a variety of jurisdictions, the fund and investment platform in Luxembourg, the top of the target group in another jurisdiction and in the majority of cases the target will operate in more than one jurisdiction.

When it comes to tax, this presents challenges in terms of how the investment is funded – that is, how much equity versus how much debt – and elicits all sorts of questions in terms of how much debt would it be appropriate to be borne by the target entities. This is of course primarily a business decision, but causes tax issues in all of the relevant territories in terms of whether any debt that is advanced is done so at an arm’s-length basis.

In addition, there are various rules introduced within the European Union designed to limit the tax deductibility of interest on debt, introduced as part of the EU Anti-Tax Avoidance Directive (ATAD).

Also included in this package of ATAD rules are those that target instances where there is a disparity in how a debt is viewed, resulting in different tax treatments in different jurisdictions.

During 2022 through mid-2024, the tightening of the monitoring conditions and the extra cautious approach of traditional banking lenders have resulted in a contraction in the availability of credit. It is now a general consensus in the market that private credit is the flavour of the day. With secured transaction, lenders, including Luxembourg lenders, are highly sensitive to the borrower’s repayment capacity and quality of the collateral. Debt documents are increasingly demanding, and a high degree of collateral and parent guarantees are needed. Lenders are more weary of ‘liability management’ exercises and inter-lender competition and tightening covenants, and attempt to ensure tighter segregation of their collateral.

In addition, the market requires elaborate covenants and contractual protections for creditors, which can help them identify issues with a company’s balance sheet before it runs into serious problems. Lenders are not satisfied with a single point of enforcement and require collateral at many levels of the structure.

We are also seeing more and more fintech companies enter the private debt space generally targeting smaller SMEs including sole traders. In those instances, loans are typically smaller in size and unsecured.

Since June 2024, the ECB has been engaged in cutting rates and it is likely to stimulate the availability of credit and, more generally, deal activity.

From a tax perspective, the main issues facing private equity transactions are the ATAD rules, and for larger deals, the Pillar Two rules.

The ATAD rules relating to the tax deductibility of interest seek to restrict tax deduction by reference to the yardstick of a business’s earnings before interest, taxes, depreciation and amortisation. Therefore, if a deal is debt funded and interest on that debt is being incurred by the business acquired by PE, you might have a situation where interest is not deductible against profits, but the corresponding interest income (for the borrower) is being taxed in the hands of the investors. This does have the effect of there being careful consideration as to the amount of debt that is used to acquire a target.

The second strand of the enacted ATAD rules with an effect on PE concerns hybrid situations. This relates to situations where a debt instrument or an entity within the overall investment structure (from the investor down to the target group) receives a different treatment from different taxing jurisdictions.

For example, whether the terms and conditions of the debt make it appear to be a debt or more like equity in nature, or whether an entity is viewed as being a flow-through for tax purposes.

Since a consistent approach by each country’s tax system does not exist, when it comes to debt the lending country might treat what is legally a debt as equity, and the borrower may treat it as debt. This means that interest is treated as interest by the borrower, which is generally tax deductible, but the lender may treat it as an equity return, resulting in a more beneficial tax treatment.

The rules relating to entities target similar issues. These new rules mean that a lot more work needs to go into assessing whether there is an unintended breach; for example, resulting from the nature and location of establishment of investors – that is, there is no ‘motive test’ that can be used to say that no tax benefit was being sought, and the breach of the rules is just an accident of the composition of the investor population.

The Pillar Two rules seek to apply a global minimum tax of 15 per cent on enterprises operating in more than one jurisdiction. The rules add yet another layer of complexity to an already complicated interplay of national tax rules in the jurisdictions in which a target business operates. Importantly, the rules are based on the financial statements of a group, not their tax-adjusted profits, so it is vital that groups consider what is disclosed in their consolidated accounts (eg, tax losses should be disclosed otherwise they may be ignored for determining whether a group has paid sufficient tax in a particular jurisdiction).

The incumbent government is vocally in favour of private equity, which it sees as one of the pillars of growth for the country. We have seen Luxembourg grow as a location for investment funds over the years, and it has been for many years the second largest location for investment funds globally, after the United States. Historically, this position was based on retail funds, but now the alternative funds sector is similar in size to the retail sector in terms of assets under management.

The government has positively encouraged the growth of middle-office, and where possible front-office, functions in the country, building on the back-office functions that historically took place here. This has resulted in a number of key global players locating significant functions in Luxembourg.

Given the fact that there are a limited number of publicly traded companies in Luxembourg shareholder activism is not a prominent issue in Luxembourg and derivative suites or proxy wars are uncommon. In general, dissenting shareholder rights are limited and in this respect we recommend that investors conduct thorough due diligence and carefully negotiate their shareholder rights in the company’s articles, shareholders’ agreement or the relevant fund documents.

In our experience, the level of exits is currently quite low compared to pre-pandemic years. The profound impact of tightened monetary policies has had an impact on exits. However, 2025 has demonstrated an uptick in exit activity and helped PE to make progress on the existing backlog of maturing companies.

Bearing in mind that the Luxembourg market tends to serve an international deal structuring platform and, unlike larger economies where significant private equity transactions take place, our data and experience show that exits are primarily effected via traditional acquisitions or otherwise trade sales, and leveraged M&A or public listings are the exception.

A recent transaction was the the acquisition by Montagu, a leading PE fund, of Multifonds, a global provider of investment accounting and transfer agency software, in a carve-out transaction.

Another recent transaction was Luxembourg’s satellite operator SES’s acquisition of rival operator Intelsat for US$3.1 billion. It represents a further consolidation in the satellite industry and Luxembourg’s determination to remain a leading player in the space industry.

Other recent transactions underpin the high interest that the Luxembourg banking sector continues to attract despite significant regulatory headwinds and increased compliance requirements. Among these transactions are Banque Havilland selling its institutional banking business to Banco Inversis, which belongs to Spain’s Banca March with a strategy of supporting Spanish and Latin American clients in Luxembourg, as well as the merger of Fideuram Bank Luxembourg (a wholly owned subsidiary of Intesa Sanpaolo) with Compagnie de Banque Privée Quilvest.

These transactions signify the resilience of the banking sector and its long-term prospects as an international banking sector.

Depending on the type of sponsor, investors have had the upper hand for a while, with the proliferation of new fund sponsors on the market. But over time this has been exacerbated to some degree as investors, given market conditions over the past couple of years, seem to be considering at much more length where they choose to deploy their money. According to S&P Global, following three years of consecutive drops in fundraising activity, the first half of 2025 exhibited an improvement in global fundraising, following a drop in recent years in the setup of new funds formation, the improved M&A and exit conditions is anticipated to improve the fund formation environment. Larger investors are also looking more and more to directly invest in deals rather than allocating commitments to funds. The challenges of the past three years resulted in fundraising cycles’ lengthening, with first closings being pushed back in some cases. There is a lot of pressure on the management fees or priority profit share that PE firms can include in the fund terms. The days of 2 per cent as standard are long gone.

Typically, the process entails the general partner (GP) or the fund sponsors defining the terms and conditions of the fund, planning for the most adequate fund structure, meeting with the investors and negotiating funding commitments, preparing for due diligence and ultimately negotiating the fund’s limited partnership agreement, and, if relevant, drafting the fund’s offering memorandum and closing.

In a Luxembourg context, the critical decisions are determining the most suitable structure and the vehicle selection. The significant factors that the fund promoters will usually have to determine are whether to establish the fund as unregulated vehicles, either as unregulated Luxembourg limited partnerships (LPs) or a corporate form of partnership customarily used for the funds that are characterised as a ‘sub-threshold fund’ or LPs appointing an alternative investment fund manager (AIFM) or, alternatively, as reserved alternative investment funds. These are only a few possible structures, but given the many other options and variations available, there are numerous permutations available depending on the particular circumstances, which clearly marks Luxembourg out as a unique and complete private equity fund ecosystem.

Other key terms we regard as industry standard are those related to governance of the fund that relate to GP removal, key person removal, most favoured nation clauses and fee clawbacks. Post-Brexit, we have seen a tendency to move away from standard English law as the governing law and relying on Luxembourg law with an arbitration clause of use of the Luxembourg courts. In this context, given that the documents are usually in English, we put a particular emphasis on the mechanism for enforcement of the provisions so that tribunals can provide the parties with the expected remedies.

Supervision of private equity sponsors is very much harmonised by EU legislation, and sponsors are subject to a whole plethora of legislation the most prominent of which are the Alternative Investment Fund Managers Directive (AIFMD), securities marketing regulations, the Markets in Financial Investments Directive and, since 2021, disclosures that are required under the Sustainable Finance Regulation as well as extra-statutory guidelines such as those issued by the European Securities and Market Authority.

The marketing and pre-marketing of funds as well as on going reporting obligations are supervised and enforced by the Luxembourg Financial Sector Supervisory Commission (CSSF). The CSSF is positioned as one of the leading financial regulators both within the European Union and internationally, closely monitoring and supervising the sponsors and players in the Luxembourg market, and issues guidelines for managing and conducting activities in the Luxembourg market. The CSSF seems determined to preserve Luxembourg’s stellar reputation and continuously monitors the compliance obligations by all actors in the Luxembourg financial market.

Concrete examples of such supervision relate to pre-marketing of funds by AIFMs in which the CSSF strictly enforces the AIFMD rules on pre-marketing and emphasises the need for a notification letter when conducting such activities. Reporting under Annex IV in respect of article 3(3) of the AIFMD for sub-threshold funds is also strictly supervised and therefore the sub-threshold has the effect of imposing a significant reporting and risk analysis burden on many sponsors and actors.

The AIFMD has been in force in domestic law since 2013, and Luxembourg was one of first member states to adapt to the directive’s requirements, so the effects of the directive have already been felt for a decade and much could be discussed about its effects in general in a Luxembourg context. This regulatory framework has facilitated cross border business
with its passporting regime and harmonisation throughout the European Union; however, it needs to be vigilantly observed by market players. The requirement to appoint an external AIFM has introduced obligations for service providers such as the engagement of depositories, risk management functions and auditors, some of which may be questionable in the context of professional investors.

Inevitably regulation entails a cost and therefore it has increased the cost of doing business, specifically cross-border business. AIFs are not only faced with the higher costs but also with increased administrative burden. In addition, professional investors, which would usually require less protection, who wish to invest in AIFs on their own initiative are now required to observe the regulatory framework. Consequently, the European Union had to find innovative solutions and invigorate a potentially stifled high-growth investment environment. This produced the EuVECA and ELTIF for investment in small and medium-sized enterprises in the European Union, which have thereby somewhat mitigated the effects of the AIFM.

The draft third anti-tax avoidance directive, which would target the use of what are described as ‘shell companies’, has been abandoned due to political pressure from various member states who viewed the proposal as over-reach. It seems likely that a watered-down measure may be introduced as part of the Directives on Administrative Cooperation (DAC) between member states programme.

Nonetheless, being able to demonstrate an economic and commercial rationale for the existence of companies within a structure remains highly relevant. Connected to this is the announcement of the introduction of a new law regarding the tax treatment for individuals resident in Luxembourg who receive carried interest. There are no details available at present as the legislative process is at an early stage, but it is expected that carried interest will be subject to tax at a much lower rate than regular employment income.

A more immediate consideration is the implementation of the Pillar Two rules, or Global Anti-Base Erosion rules (GloBE). These rules, which have been adopted by over 130 countries, seek to impose a global minimum tax rate of 15 per cent at a jurisdictional level. The rules are complex (and we will not seek to detail them here) and rather than trying to accommodate the disparate tax rules around the globe, they use an accounts-based approach to determine whether a particular jurisdiction’s profits have been under-taxed. The US publicly pushed back on these proposals with potential retaliatory measures, but eventually reached an agreement with the G7 on the Pillar Two measures, which effectively means that the measures would not apply to US companies. It is not clear how the rest of the countries that had or were in the process of implementing Pillar Two will react, since the US/G7 agreement effectively carves out the principal targets of Pillar Two (ie large technology companies).

In broad terms, the directive targets the oft-discussed subject of ‘substance’ – that is, the level of business rationale and presence of a particular company in the jurisdiction in which it is established. There are various tests to consider, but broadly speaking a company must have its own decision makers, who are not entirely drawn from unrelated businesses (third-party service providers), and should have their own premises in the territory they are in.

Failing the various tests could result in the loss of the benefit of other European directives, such as the Parent-Subsidiary Directive and the Interest and Royalties Directive.

It remains to be seen how this will play out in practice, because each directive only provides a ‘minimum standard’, and each country will interpret the rules laid down in the directive according to their own legislative traditions and can choose to impose more draconian rules than are required by the directive.

However, private equity firms are already reacting to the directive, because in assessing the tests in the directive, it is necessary to look to the previous two years to make that assessment. Work is already being done to benchmark firms’ adherence to the rules, as they might be interpreted currently, but this is in the absence of any transposition legislation from member states and no official interpretation of the transposition laws.

A more immediate consideration is the implementation of the Pillar Two rules, or Global Anti-Base Erosion rules (GloBE). These rules, which have been adopted by over 130 countries, seek to impose a global minimum tax rate of 15 per cent at a jurisdictional level. The rules are complex (and we will not seek to detail them here), and rather than trying to accommodate the disparate tax rules around the globe they use an accounts based approach to determine whether a particular jurisdiction’s profits have been under-taxed.

Since November of of 2023, Luxembourg has a new government that is very pro-business with the next prime minister likely to be Luc Frieden, a highly qualified and experienced politician, statesman and former finance minister, who understands the world of private equity and its importance to Luxembourg. The party to which he belongs, and who leads the government coalition, is generally considered to be economically more liberal than their coalition partners, who formerly led the country’s governing coalition for nearly 10 years. We are likely to see a pragmatic business environment that will promote the Luxembourg private equity sector and cross border business being transacted via Luxembourg. While Luxembourg’s neighbours are experiencing an economic down turn and therefore are increasing taxes, Luxembourg is likely to maintain its fiscal stability and budgetary discipline and consequently remain an AAA jurisdiction.

Private credit funds will remain an opportunistic approach taken by private equity to deploy their fund resources in the wake of the void left by traditional credit institutions.

A major development recently is the move by private equity promoters to expand their potential investor base. Traditionally this has been composed primarily of institutional and specialist investors, including endowments and ultra-high net worth individuals. However, there have been recent moves to expand this traditional investor base to more ‘retail’ type investors, who would have historically found the potential returns particularly attractive, but would not have had any means of accessing this area of the market. This ‘retailisation’ of a historically closed market clearly entails the consideration of many areas of complexity to be able to offer these products to this section of the investor population, while safeguarding the investors’ interests.

We see green energy, private and environmental, social and governance strategies as a major area of interest of PE funds supporting global growth of expanding energy companies, alternative assets and credit portfolios, tech driven by AI and cybersecurity, healthcare and e-commerce driven investments will also be the subject matter of opportunistic deals.

However, industry leaders such as Bain & Company foresee the fundraising environment outlooks as challenging and requiring private equity firms to adjust to a new environment that is nimbler and investor focus and, needless to say, track record will be a key consideration. Bain & Company have indicated that 2025 has demonstrated an improved fundraising data; however, with political instability, protracted war in Ukraine and US tariff disrupting global trade, we are not yet out of the woods.

With the support of Clarus Risk (www.clarusrisk.com).

The Inside Track

WHAT FACTORS MAKE PRIVATE EQUITY PRACTICE IN YOUR JURISDICTION UNIQUE ?

Luxembourg is one the world’s leading jurisdictions for structuring private equity and venture capital funds; it provides a complete and closed-ended ecosystem for structuring those investments without the need for the use of other jurisdictions. The jurisdiction provides an unparalleled choice of legal vehicles that enable cross-border deal structuring, complemented by a banking and digital payments infrastructure.

The political stability of Luxembourg, the professionalism of its regulators and local service providers are determining factors in its success as a private equity hub.

According to the Luxembourg Private Equity and Venture Capital Association and the CSSF (as of June 2024), the Luxembourg market hosts more than 300 authorised AIFMs and management companies and 685 registered AIFMs having a total of €1.3 trillion of private equity, infrastructure and debt assets under management, as well as a large number of depositories and professional services firms. This concentration of services and expertise in one location creates an outstanding ecosystem for fund and asset management.

When choosing counsel for complex matters, it is important to understand whether the firm can:

  • demonstrate experience in a cross-border environment;
  • think strategically about the client’s business and offer the most appropriately tailored solution for that particular client, including, but not limited to, non-legal issues, the most important of which are the client’s banking facilities and international payment infrastructure; and
  • understand if the same counsel can defend the tax and legal structure that it has put in place in an international context.

In the current environment, we have been confronted with the need to coordinate multiple jurisdictions for tax and legal matters and bring into play our entire capabilities in tax, corporate structuring and governance, M&A, venture capital, venture debt and project debt financing, banking relationships and international arbitration, including, but not limited to, investor state arbitration taking place before the International Centre for Settlement of Investment Disputes tribunal at the World Bank.

PROFILES

About

Ronnen J Gaito is the founder of the law firm of RJ Gaito SARL (2011). He is a member of the Luxembourg Bar, a solicitor in England and Wales, a New York attorney and the Luxembourg chapter chair of the international section of the New York State Bar Association. Ronnen’s practice focuses on advising clients on structuring Luxembourg investment vehicles, private equity and venture capital transactions, mergers and acquisitions, joint ventures, corporate finance (debt and equity offering), fund formation, corporate governance matters as well as post-transaction cross-border dispute resolution and litigation. Ronnen’s most recent experience has involved extensive structuring of worldwide investment structures for renewable energy firms and preparation of their international debt financing and private equity acquisition. In addition, his work has extended to group reorganisations for the purpose of optimising exit strategies and initial public offerings (IPOs), debt facilities and negotiations of complex technology licensing agreements. He provides extensive Luxembourg law advice for major international law firms.

Martin Hollywood has over 29 years’ experience working in the area of international tax gained within a Big Four environment, focusing mainly on alternative investment funds. He has advised many of the largest global private equity players on the market, advising on the structuring of investment funds and holding platforms, and on the various stages through the life-cycle of a fund, from the structuring of investment acquisition – including management incentive programmes, co-investment and participation by business founders – through the holding period, including liquidity events, refinancing, emergency financing and partial disposals – to the final exit, whether through a sale to a secondary PE buyer, a strategic investor or by way of IPO. Martin is the tax director at RJ Gaito, where he continues to be involved in the structuring of transactions.

Our experience:
RJ Gaito is celebrating 14 years in business; our firm has acted for and against major corporations, entrepreneurs, as well as private clients in the various jurisdictional levels of the Luxembourg courts system commencing in the lower courts up to the Luxembourg Supreme Court (“la cour de cassation”), including current proceedings now pending with ICSID.

Our firm has obtained freezing orders over various asset classes, acted in emergency proceedings, and enforced foreign judgments in Luxembourg. We assisted equity investors, debtors and creditors in complex distressed debt matters and, over the years, we were successful in multi-million Euro/United States Dollar recoveries for creditors and equity investors.

Ronnen J. Gaito Martin Hollywood
gaito@rjgaito.com martin@rjgaito.com
40 rue Glesener
L-1630 LUXEMBOURG

Tel. (352) 20 600 333
Fax. (352) 20 600 334
Mob. (352) 621 32 37 34
e-mail: info@rjgaito.com
https://www.rjgaito.com

]]> Unprecedented €746,000,000 Amazon fine for GDPR breaches confirmed by the Luxembourg Administrative Court https://rjgaito.com/fines-and-penalties-imposed-on-amazon/ Mon, 14 Apr 2025 16:54:20 +0000 https://rjgaito.com/?p=2125

April 15th, 2025

Luxembourg Administrative Court confirms an unprecedented €746,000,000 and a daily penalty of €746,000 inflicted on Amazon by Luxembourg’s national data protection authority.

An Examination of GDPR Enforcement and Due Process

Introduction. In a significant legal battle concerning data protection and regulatory compliance, Amazon Europe Core Europe SARL (Amazon) has challenged the decision of the Luxembourg National Commission for Data Protection (CNPD) following a substantial fine imposed for alleged violations of the General Data Protection Regulation (GDPR). This article delves into the intricacies of the case, highlighting the legal arguments presented, the court’s reasoning, and the broader implications for data protection enforcement.

Background. The case emanates from a complaint lodged in May 2018 by the French advocacy association, La Quadrature du Net (LQDN) with the Commission Nationale de l’Informatique et des Libertés (CNIL) in France in relation to Amazon’s processing of personal data practices. In the context of the European cooperation governed by Articles 60 and 62 of GDPR, the Luxembourg CNPD was identified as the lead supervisory authority competent in accordance with article 56 of GDPR.

The CNPD undertook an analysis of Amazon’s compliance with GDPR in respect of gathering information via “cookies” to determine the relevant advertising based of its customers’ interest.

On 15 July 2021, the CNPD issued a decision against Amazon, imposing a fine of €746,000,000 for breaches of various GDPR provisions while requiring it to take corrective measures within 6 months of notifications, subject to a daily penalty of €746,000. Subsequently, Amazon lodged an appeal with the administrative court on 15 October 2021, seeking both the annulment of the CNPD’s decision and a suspension of its enforcement pending the appeal’s outcome.

CNPD’s Findings. Primarily, Amazon’s practices were failing to comply with the most basic principle of GDPR being a lawful basis for processing of personal data under article 6 of GDPR; furthermore, failures to comply with transparency obligations, and violations of data subjects’ rights, particularly Articles 12 to 17, and 21 of the GDPR. The CNPD rejected Amazon’s use of article 6(1)(f) of GDPR being based on a “legitimate interests pursued by the controller or by a third party” as a lawful basis for processing.

Amazon failings. Transparency, complexity, impact on individuals, inadequacy of corrective measures.

Severity of Breaches: The CNPD emphasized the seriousness and duration of the breaches in its analysis, asserting that the violations persisted from at least May 25, 2015, until the start of the investigation. It also highlighted that the number of affected data subjects and the potential harm they could suffer were significant factors justifying the sanctions imposed.

In 2019, Amazon created a substantial number of advertising profiles as follows:

  1. 560,300,000 active European advertising profiles linked to terminal equipment associated with an authenticated visits to an Amazon site, with an additional 317,900,000 profiles that have been inactive for 9 months.
  2. 1,591,000,000 active profiles relating to non-authenticated visits to an Amazon site, with an additional 979,300,000 profiles that have been inactive for 9 months.
  3. 5,786,600,000 active profiles established based on unauthenticated terminal equipment that has not visited an Amazon site visit, with 7,813,900,000 profiles that have been inactive for 9 months.

Justification of Sanctions: The CNPD defended the imposition of a substantial fine, arguing that it was necessary to ensure compliance and deter future violations. The CNPD contended that the fine was effective, dissuasive, and proportionate based on the criteria established in Article 83 of the GDPR.

Quantum. Under GDPR (Article 83(4)) Amazon was exposed to a maximum of 4% of its worldwide turnover of its United State Parent, however the CNPD chose to impose a fine corresponding to 0.24% of the said turnover. We note that 0.24% corresponds to the current lower range of registration tax (droit d’enregistrement) for certain Luxembourg transactions.

Amazon’s Due Process Arguments. In its defense, and surprisingly, Amazon heavily relied on due process arguments rather than tackling the challenges that the CNPD posed to its “cookies” practices.

Amazon argued that the fines imposed by the CNPD were criminal in nature, thus entitling them to procedural guarantees under Article 6 of the European Convention on Human Rights (ECHR) and Article 47 of the Charter of Fundamental Rights of the European Union. They contended that the CNPD had failed to provide a fair trial, citing procedural flaws and insufficient reasoning in the CNPD’s decision.

Specifically, Amazon pointed out that the sanctions imposed under Article 83 of the GDPR are of general application, apply to any controller, and require a finding of guilt and liability. They noted that the amount of the fine was substantial (€746 million), and they argued that this fine represented a severe penalty, which reinforced their claim that the sanctions should be viewed as criminal.

In the context of arguing that the fines imposed by the CNPD were criminal in nature, which would require the associated procedural guarantees, including the principle of culpability, Amazon contended that the concept of culpability necessitates determining the degree of culpability—whether it was intentional, reckless, or negligent. Amazon asserted that conduct that does not reach the threshold of negligence should not serve as the basis for a criminal fine. Furthermore, Amazon maintained that the CNPD’s decision did not establish that it had culpably infringed the GDPR.

Amazon went on to claim that the administrative procedure lacked objectivity and impartiality, asserting that the CNPD’s structure created a conflict of interest, given that the same body conducted investigations and made adjudications. Additionally, the plaintiff criticized the CNPD for failing to allow access to crucial documents from other supervisory authorities, which they argued hindered their ability to defend against the allegations effectively.

Astonishingly, Amazon challenged the composition of the CNPD’s panel by arguing that one of the commissioners, had served beyond the maximum legal term of 12 years, which violated the provisions set out in the Law of 1st August 2018. Amazon contended that due to this unlawful duration of office, the panel was not competent to take the disputed decision, rendering the decision itself unlawful. They framed this situation as a “usurpation of power,” indicating that decisions made by a person whose term had expired would be considered void or non-existent.

Amazon further asserted that the independence of the CNPD was compromised because a commissioner serving beyond the legal limit undermined the institution’s integrity and independence, which is essential for ensuring fair and impartial adjudication. They cited that the irregularity in the composition of the panel violated their rights to a fair trial and defense.

Amazon’s defenses to it GDPR breaches.

The Luxembourg court recalled the CJEU’s ruling in Fashion ID (C-40/17) three cumulative conditions for being able to rely on “legitimate interest” (article 6(1)(f) of GDPR) as a lawful basis for data processing and notably i) the pursuit of a legitimate interest by the controller or by the third party or parties to whom the data is disclosed, ii) the necessity of the processing of personal data for the realization of the legitimate interest pursued, and iii) the condition that the fundamental rights and freedoms of the data subject do not prevail.

Legitimate interest. Amazon put forward four legitimate interests: (i) Amazon’s own interest in providing useful and tailored advertising to its customers enabling them to browse the vast catalog, (ii) the interest of brands, manufacturers, vendors and other businesses relying on the plaintiff to advertise their products online, (iii) the interest of website publishers relying on the plaintiff to generate revenue from the sale of their advertising space to advertisers and other interested buyers and finally (iv) the interest of the European community at large, materialized, according to Amazon, by the growth of the Internet economy in the European Union. It should be noted that the CNPD refused to take that final element into account.

Necessity. Amazon argued that it adopted multiple protection measures that determine that “there would have been no less intrusive means of achieving its legitimate interest effectively” and notably the following technical and organizational measures were undertaken: (i) opt-out option, (ii) pseudonymization of personal data, (iii) accessible information notices (iv) restrictions on the processing of personal data revealing certain categories of personal data (inter alia race, ethnic origin, political opinions), (v) “short storage” periods of a maximum of 13 months (vi) restrictions on contracts concluded with third parties, and (vii) a ceiling on the frequency with which a person would be exposed to a given advertisement.

Amazon further criticized the CNPD that it failed to take due account of the fact that it would have used only the minimum amount of data for its processing activity in the context of behavioral advertising; arguing that it eliminated over 99% of the available information on its customers’ purchasing behavior and integrated only the remaining percentage into the pseudonymized profiles.

With respect to “cookies” on third-party websites, Amazon argued that “as of December 2020, 99.5% of “cookies” displays by it on third-party websites would concern customers who had given their consent, so that for these advertisements, the company would no longer rely, as a legal basis for personal data processing, on the concept of legitimate interest within the meaning of Article 6(1)(f) of the GDPR.”

Court Findings. The administrative court examined the admissibility of the appeal and the substantive arguments raised by Amazon. The court noted that the CNPD had sufficient grounds for its decision and that the imposition of a fine was legally justified under the GDPR. It was also found that the CNPD had adequately explained the reasoning behind the fine, which was deemed proportionate and necessary given the extent of the violations. Amazon was not successful in any of its arguments.

The court did not accept Amazon’s claim that the penalty imposed by the CNPD was a criminal sanction. It concluded that the nature of the violations and the penalties under the GDPR were administrative in nature, which meant that the CNPD was not classified as a judicial body under Article 6 of the ECHR. The court found that while the penalties could be severe, they were consistent with administrative enforcement rather than criminal law. It emphasized that the CNPD had the discretion to impose fines and that such administrative fines do not necessarily carry the same procedural guarantees as criminal penalties. The court also noted that the CNPD’s actions were within the framework of the GDPR and Luxembourg law, which allows for such administrative penalties without requiring the same guarantees as criminal law.

The court ultimately dismissed the Amazon’s plea regarding the breach of principles of due process and the right to a fair trial. It noted that Amazon had been given ample opportunity to present its case and that the CNPD’s decision had met the necessary legal standards of reasoning.

The court found that Amazon acted negligently in breach of several articles of the GDPR, specifically Articles 6, 12 to 17, and 21. The court noted that the breaches were duly established and indicated that the company had not adopted sufficient corrective measures to comply with the requirements of the GDPR.

Court’s attitude towards Amazon mitigating protective measures.

Pseudonymization. The court found that pseudonymization did not sufficiently mitigate the breaches that were established against Amazon. The court emphasized that the breaches of the GDPR were serious, affecting a large number of individuals and persisting over several years, which outweighed the mitigating circumstances presented by Amazon.

Opt-out mechanism. Did not fully comply with the requirements of Article 21 of the GDPR. Specifically, the court noted several criticisms regarding the mechanism:

  1. Limited Scope: The opt-out mechanism did not cover certain treatments, such as personalized recommendations. It was pointed out that individuals wishing to stop the processing of their personal data for personalized recommendations had to take additional steps beyond simply opting out of behavioral advertising.
  2. Accessibility: The court mentioned that the accessibility of the opt-out mechanism via the “AdChoices” icon was inadequate, as the icon was small and did not provide clear information about the possibility of accessing the web page to exercise the right to object.
  3. Retention of Choices: The court highlighted that the opt-out mechanism did not retain the choices made by the data subjects effectively. If a data subject exercised their right to opt-out and then logged in from a new device or after deleting cookies, the preferences page would revert to indicating that they wished to receive behavioral associated advertising.
  4. Delay in Data Deletion: The court also pointed out that the company did not delete personal data as soon as possible following the opt-out exercise, which is a requirement outlined in Article 17 of the GDPR.

Overall, the court concluded that the opt-out mechanism was insufficient and did not meet the established requirements.

Information received from third parties’ website. The court found that the Amazon failed to comply with its obligations under Articles 12 to 14 of the GDPR, specifically regarding transparency and providing information to data subjects. The court noted that Amazon’s notices did not adequately inform data subjects about the categories of third parties receiving data or the specific details of those third parties. For example, it was held that the references to third parties were too vague, stating merely that personal data were transmitted to “advertisers, publishers, social networks, search engines, ad publishing companies” which did not meet the requirement for specificity as outlined in the GDPR.

Moreover, the court emphasized that Amazon’s notices did not clearly indicate the sources of demographic data collected from third parties, failing to provide sufficient detail regarding the types of data and the third parties involved. This lack of specificity in informing data subjects about third-party involvement and the nature of data collection was a crucial factor in the court’s conclusion that Amazon did not meet its transparency obligations under the GDPR.

Limitation on retention period. The court dismissed Amazon’s argument regarding the limitation on the retention period for personal data. It stated that Amazon did not assert, and that it did establish that it deletes the personal data at issue as soon as possible following the exercise of the opt-out by the person whose data was collected and processed. The court noted that the company’s explanations were limited to arguing that such deletion would have no tangible impact on the data subjects and that it would no longer provide personalized behavioral advertising once the right to object had been exercised, which was deemed irrelevant concerning the right to erasure. Consequently, the court found that the breach of Article 17 of the GDPR still existed at that time.

In its assessment of Amazon’s practices, the court noted that, with regard to the nature, volume and retention period of the personal data collected and processed by the applicant, Amazon has failed to establish the necessity of the processing of the said personal data, as carried out by it in practice, in the context of its behavioral advertising or otherwise “cookies” practices.

Quantum. The court upheld the fine imposed on Amazon by the CNPD, declaring that the main action brought by amazon was unjustified. The court found that the CNPD had properly established the breaches of the GDPR and that the fine of €746,000,000 was effective, proportionate, and dissuasive.

The court rejected Amazon’s claims that the fine was disproportionate and emphasized that the CNPD had taken into consideration all relevant factors set out in Article 83(2) of the GDPR when determining the amount of the fine. It noted that the breaches had affected a significant number of individuals over several years and that the fine was within the permissible limits set by the GDPR.

Furthermore, the court found that Amazon had acted negligently in relation to the processing of personal data and that the CNPD’s decision to impose the fine was justified. The court also dismissed Amazon’s arguments regarding the need for additional reasoning related to the fine and the daily penalty payments associated with corrective measures.

Our take. Notwithstanding Amazon’s extensive attempts to use procedural tactics to thwart the CNPD’s fine, the most bizarre of which, in our view, was the use of the ECHR, Amazon failed to establish the basic premise of GDPR being the need to have a lawful basis for processing of personal data. Amazon could have easily resorted to “consent” as a lawful basis for processing but chose not to; in this respect, we take the view, that Amazon was not just “negligent” (using the court’s words), it was reckless in that it took risk with its approach to what constitutes a lawful basis of processing and stretched the definition to a breaking point practices. Historically, Amazon built a significant customer base by way of “cookies” and third party “cookies”, third-party web referrals which generate significant traffic to its site(s). Amazon failed to adapt to a post GDPR world where enforcement was stricter with more draconian measures available to data protection authorities to enforce data privacy and deter misconduct. In this context, we note that in our newsletter of October 2018 we highlighted the high potential for litigation following the implementation of GDPR.

The Luxembourg’s court’s affirmation of the CNPD’s authority to impose significant fines reflects a robust commitment to upholding data protection standards in the EU. After lengthy proceedings that lasted close to 4 years amazon was defeated on all grounds.

Furthermore, although the Luxembourg Administrative Court responded thoroughly to procedural fairness and due process arguments, Amazon ought to have “read the writing on the wall” following the €35,000,000 fine imposed on it by the CNIL and focus its efforts on a revised compliance program.

Amazon indicated its desire to appeal the case, and the administrative court approved suspending the imposed fine, we take the view that, unless Amazon can demonstrate a lawful basis for processing, its appeal is unlikely to be successful.

Conclusion. The legal dispute between Amazon and the CNPD illustrates the ongoing tension between commercial objectives and the strict framework of GDPR compliance. The case provides a good illustration of the strict and rigorous analysis that data controllers need to undertake prior to processing personal data. In addition, the case highlights the current challenges of using the digital advertising technology of “cookies” personalization use cases depend on third-party cookies. If a user opts out of this tracking application, e-commerce actors lose the ability to track them across platforms, and subsequently, deliver tailored ads. The current trend in the market is to abolish third-party cookies so e-commerce actors will no longer be able to track users across different websites.

]]> RJ Gaito and Ben Ami, Bigon & Co advises Solaer Renewable Energies Ltd on their international expansion and Project Financing https://rjgaito.com/rj-gaito-and-ben-ami-bigon-co-advises-solaer-renewable-energies-ltd-on-their-international-expansion-and-financing/ Wed, 17 Aug 2022 09:58:26 +0000 https://rjgaito.com/?p=1845

Luxembourg law firm RJ Gaito, Israeli tax law firm – Ben Ami, Bigon & Co (@Ben Ami, Bigon & Co) and Martin Hollywood (@Martin Hollywood) of PWC advised Solaer Renewable Energies Ltd (@Solaer renewable energy Ltd) on the implementation of their Luxembourg and international project finance platform.

Following the implementation of the investment platform, RJ Gaito acted for Resolar SARL in the conclusion of a credit facility with KommunalKredit Austria AG for the financing of Solaer’s projects in Italy, Spain and Chile.

The transactions were led by partner Ronnen J. Gaito (corporate M&A, reorganization, and financing), Senior Counsel, Harry Ghillemyn (financing) and Valerie Herriot (corporate and finance).

Gilad Ben Ami (@Gilad Ben Ami) and Ran Bigon (@Ran Bigon) of Ben Ami, Bigon & Co, in Israel, and Martin Hollywood of PWC in Luxembourg led the tax matters.

In Spain, Alvaro Mateo Sixto, leading the team with Juan Pérez, Inés López Seco of Gómez-Acebo & Pombo (Corporate, M&A and financing).

Toni de Weest Prat and Jordi Ruis of Broseta for Spanish tax aspects.

In Italy, Marzio Cianci, leading the team with Benedetta Frizzi and Bernasconi Tommaso.

In Chile, Benjamín Pérez of Guerrero Olivos.

Ronnen J. Gaito, Gilad Ben-Ami and Ran Bigon commented “We are delighted to have been able to advise on these highly sophisticated transactions which reflect our firms’ capabilities in tax, M&A, cross border group reorganizations and finance practices. This matter is a further demonstration of our sophisticated international practices and our ability to support our clients’ international growth.”

Alon Segev, CEO of Solaer, commented “I thank the RJ Gaito and the Ben Ami, Bigon & Co teams for their outstanding work, they brought to our team exceptional cross-border capabilities and provided us with a turn-key solution for supporting our international growth.”

About Solaer Renewable Energies – https://www.solaer.co.il/

Solaer Renewable Energies Ltd is an Israel-based renewable energy project builder and operator. The company initiates, builds and operates currently solar systems in Israel, Spain Italy and Chile with a project pipeline of 3,800 MW.

]]> Best Wishes 2022 https://rjgaito.com/best-wishes-2022/ Tue, 04 Jan 2022 16:58:39 +0000 https://quizzical-clarke.77-68-21-77.plesk.page/?p=974

RJ Gaito Law Firm LogoBest Wishes 2022

We are pleased to be celebrating our 11th year in business. Although 2021 has been another year dominated by the global pandemic, we have been able to execute interesting work relating to the structuring of international investment platforms, corporate reorganizations, venture capital transactions and advise on stock option plans. We were equally successful in our litigation practice, and we obtained favorable outcomes for our clients in settlements and in the Luxembourg courts. In June 2021, we secured a favorable judgement for a global software player in the Luxembourg Supreme Court (cour de cassation).

2021 continued the trend of significant global compliance obligations with the vigorous enforcement of GDPR and ever more rigorous anti-money laundering laws, and complex tax compliance obligations.
 In 2021, we were pleased to have received transactional practice recognition from Who’s Who Legal. This is client and peer recognition for the breadth of our private equity, venture capital practice and experience in the technology sector.

We wish you all a healthy, prosperous, and peaceful 2022.

RJ Gaito WWL Awards 2021

]]> Luxembourg Data Protection Commission vigorously enforces GDPR https://rjgaito.com/luxembourg-data-protection-commission-vigorously-enforces-gdpr/ Sat, 27 Nov 2021 16:58:15 +0000 https://quizzical-clarke.77-68-21-77.plesk.page/?p=972

Introduction:

Article 37 of GDPR requires the appointment of a Data Protection Officer (“DPO”). The appointment of a DPO is a critical compliance requirement and recent decisions of the Luxembourg Data Protection Commission (a.k.a the “CNPD”) illustrate the implications of a failure to appoint a DPO, as well as the failure to adhere to GDPR’s prerequisites relating to the DPO’s function.

In addition, we note that use of video surveillance and geolocation technologies is another area that is subject to GDPR constraints. The use of such technologies requires an understanding of the lawfulness and conditions for compliance with GDPR.

We would like to bring to your attention four recent decisions of the CNPD published on November 2, 2021, relating to the implementation and enforcement of GDPR.

Three CNPD decisions were rendered following a deliberate and concerted investigation campaign carried out by the CNPD since 2018 in respect of the position and role of the DPO, as well as the importance of its integration into the organizational fabric of a company.

A fourth decision relates to the setting up of video surveillance and geolocation systems.

We note that the decisions taken are detailed and reasoned legal opinions that cite the legal basis for these decisions. These decisions serve as future guidance to organizations in the implementation of GDPR. The CNPD’s decisions imposed a range of sanctions ranging from warnings to fines. The fines ranged from EUR 3,500 to 18,000. In this context, we note that the CNPD applies GDPR strictly and will not hesitate to impose severe penalties.

The CNPD adapts the sanctions to the factual circumstances and takes into account the approach and collaborative attitude of the audited entity during the investigation.

It should be noted that the basis for a decision is taken on the findings at the outset of the investigation. Any subsequent corrective measures taken by the audited entity may be considered in determining the sanctions imposed.

The cases in detail:

Decision n ° 38 FR 2021 issued on October 15, 2021

The CNPD reiterated that:

  • the identity of the DPO must be provided to the CNPD;
  • the DPO will have all the resources necessary to enable it to carry out his mission, and these resources must be provided to the DPO by the entity;
  • the DPO needs to be involved in all decisions relating to data protection and exercise a real control mission; and
  • the DPO will require specific qualifications to be able to hold this position.

Sanction: administrative fine of € 18,000 and an order to comply.

Decision n ° 37 FR 2021 issued on October 13, 2021

The CNPD reiterated that:

  • the identity of the DPO must be provided to the CNPD; and
  • the independence of the DPO must be guaranteed, and in particular, to ensure that there is no conflict of interest.

Sanction: during the investigation, voluntary compliance measures were undertaken; only a call of legal reminder was made by the CNPD.

Decision n ° 36 FR 2021 issued on October 13, 2021

The CNPD reiterated that:

  • the DPO has to be appointed based on professional qualifications;
  • three years of professional experience in the field of data protection were deemed sufficient in the particular circumstances;
  • the DPO must be involved in all decisions relating to data protection and exercise real control over decisions; and
  • the entity concerned is required to introduce a formal data protection control plan.

Sanction: the CNPD issued an administrative fine of € 13,200.

CCTV Decision n ° 35 FR 2021 issued on October 13, 2021

  • The audited entity had installed CCTV cameras within the company and geolocation systems in part of its fleet of vehicles.
    The CNPD reiterated the principle of “data minimization” in terms of video surveillance. This principle implies only strictly required data can be collected.
    To this end, before installing a video surveillance system, the data controller must define, in a precise manner, the purpose(s) it wishes to achieve by using such a system.
  • The CNPD reiterated that an employee must not be subject to permanent surveillance, especially during their hours of rest.
  • In the same order, the CNPD reiterated that the cameras intended to monitor an access point (entrance and exit, doorstep, porch, door, awning, hall, etc.) must have a limited field of vision.
  • Clear and complete information must be provided in areas of surveillance (not a mere post sign).
  • Information for employees on geolocation must be complete, clear and individualized (a mere post sign in the car is insufficient).

Fine: the CNPD imposed a fine of € 5,300 and orders to comply.

Contact:

Ronnen Gaito        gaito@rjgaito.com
Gwendoline Bella   gwendoline@rjgaito.com

40 rue Glesener
L-1630 Luxembourg

Tél. (352) 20 600 333
Fax. (352) 20 600 334
Mob. (352) 621 32 37 34

e-mail: info@rjgaito.com

https://rjgaito.com/

]]> Litigation Speed Read: Luxembourg Litigation Reform https://rjgaito.com/luxembourg-litigation-reform/ Fri, 02 Jul 2021 16:56:28 +0000 https://quizzical-clarke.77-68-21-77.plesk.page/?p=968

GENERAL GUIDING PRINCIPLES:

  • Modernization of the Luxembourg civil and commercial judicial rules.
  • Revaluations of the court thresholds.  The lower courts (“juge de paix”) have jurisdiction in civil and commercial cases for up to EUR 15,000.
  • Restrictions on appeal.  All judgments below EUR 2,000 are non-appealable.
  • Procedural changes.  Appeals from the lower courts will follow the rules of commercial procedures, that is to say oral pleadings will take place without a need for being represented by a fully qualified member of the Luxembourg Bar.
  • Debt recovery for uncontested debt.  The deadline for opposing uncontested debt claims (“ordonnance de paiement”) is extend to 30 days and, thereafter, a judgment is deemed to be fully enforceable, however, subject to an appeal (for judgments over EUR 2,000).
  • Written court procedures in the District Court (“Tribunal d’arrondissement”).
    • Simplified pre-trial proceedings.  For matters below EUR 100,000 where there are only two parties, i.e. plaintiff and defendant, in principle, strict time limits will apply and only in exceptional circumstances the judge could approve a single, one-time, extension for submission of written pleadings.
    • Pleadings’ contents.  The first written submission must contain the jurisdictional objections and case for non-admissibility.  In addition, unless unknown at the date of the notification of the first written submission, counterclaims have to be set in that first written submission. Note that the pre-trial judge has jurisdiction over these jurisdictional objections.
    • Oral pleadings in a written procedure.  Oral pleadings are no longer obligatory, unless one party requests a final oral submission.
  • Written court procedures for the District Court and Court of Appeal.  An obligation to provide a synthesis of the pleadings restating all the means and facts of the case in the final written submission, and a failure to state any such facts or means deems them to be considered as waived.  Note that this rule does not apply to the simplified pre-trial procedure mentioned above.
  • Harmonization of time limits for appearance.  Defendants in civil commercial matters have 15 days to appear after the notifications of proceedings by the plaintiff.  Note that additional time limits apply to foreign defendants.
  • Summary judgment.  Summary judgments are now fully executable, however, at the risk of the creditor if the decision is reversed.
  • Introduction of new procedures.
    • Introduction of a procedure for error and omissions rectification by an introduction of a summons (“Requête”) or by order of the judge.
    • Introduction of a procedure for interpretation of the judgment.  This procedure is reserved for a judgment that lacks clarity and is introduced by way of a summons (“Requête”) or by order of the judge.

Practical implication and considerations:

• We take the view that it is an attempt to increase the efficiency of the Luxembourg courts by setting limits on small claims and claims from EUR 15,000 to 100,000, and thereby relieving the pressure of the various jurisdictions and thus providing the time resources required for larger cases.  It remains to be seen if this will be the result.

• We believe that the measures introduced for written synthesis at the end of the proceedings render the procedure more technical and entail more risks in terms of completion of technical requirements for written procedure and, consequently, the cost of litigation may increase.

• Although an appeal from the lower courts can now be handled by a non-lawyer, the technical challenges of an appeal remain the same and, therefore, engaging an experienced counsel is recommended.

Our experience:

RJ Gaito is celebrating 10 years in business, our firm has acted for and against major corporations, entrepreneurs, as well as private clients in the various jurisdictional degrees of the Luxembourg courts system commencing in the lower courts up to the Luxembourg Supreme Court (“la cour de cassation”).

Our firm has obtained freezing orders over various asset classes, acted in emergency proceedings and enforced foreign judgments in Luxembourg.  We assisted equity investors, debtors and creditors in complex distressed debt matters and, over the years, we were successful in multi-million Euro/United States Dollar recoveries for creditors and equity investors.

Contact:

Ronnen Gaito        gaito@rjgaito.com
Gwendoline Bella   gwendoline@rjgaito.com

40 rue Glesener
L-1630 Luxembourg

Tél. (352) 20 600 333
Fax. (352) 20 600 334
Mob. (352) 621 32 37 34

e-mail: info@rjgaito.com

https://www.rjgaito.com/

]]> Data Protection and Cyber Update – September 2020 https://rjgaito.com/data-protection-cyber-update/ Fri, 02 Jul 2021 16:09:02 +0000 https://quizzical-clarke.77-68-21-77.plesk.page/?p=931

The Business of Data – International data transfers

Highlights:

The Court of Justice of the European Union (CJEU) on July 16, 2020, delivered its latest judgment in Max Schrems’ case against Facebook Ireland Ltd. and Data Protection Commissioner (Ireland) (Max Schrems II). In a landmark decision, the CJEU struck down the European Union United States of America (EU-US) Privacy Shield scheme as a mechanism allowing US commercial companies to transfer and store EU personal data in the US.

The CJEU validated the Standard Contractual Clauses (SCCs) which Facebook had been using, however, it invalidated the Privacy Shield and the “adequacy decision” of the European Commission’s decision (EU) 2016/1250 of July 2016, relating to the Privacy Shield mechanism.

The CJEU decision makes EU-US data transfer contentious and, consequently, requires scrutiny of any data transfer from the EU to any third country, irrespective of the implementation of the SCC or a so-called EU “adequacy decision”.

The judgment provided critical guidance for transfer of data of EU data subjects outside the EU.

big data and GDPR

General Guiding Principles:

  • The SCCs, as a mechanism for maintaining General Data Protection Regulation (GDPR) compliance, is valid but they do not in themselves validate data transfers. The prevailing and critical element for a valid transfer of data is whether the third country provides, in a continuous manner, adequate safeguards to EU data subjects. This essentially means protection which is equivalent to that guaranteed by the EU. In this context, judicial redress for data subjects in the third country is an essential element to consider.
  • Even where the SCCs are implemented, the analysis that should be undertaken is whether any third country provides adequate protection for personal data and data subject. Any such analysis must consider actionable judicial redress for data subjects that is of critical importance.
  • SCCs and “adequacy” decisions are no longer a compliance guarantee with EU GDPR.

Recommendations:

  • Parties should consider if they are using data importers that are relying on the EU-US Privacy Shield for validating data transfers and consider how to strengthen their data transfer mechanisms.
  • Data exporters and importers now need to assess the level of data protection in the data recipient’s country and to suspend transfers if deemed inadequate. Failure to do so could result in legal liabilities.
  • Data protection authorities need to assess whether transfers to third countries provide adequate protection.
  • Any laws or practices in third countries that could detract from the SCCs contractual guarantees of adequate protection should indicate that such country’s approach to data protection is incompatible with GDPR. Countries that use extensive surveillance practices should be of particular concern.
  • Organizations should consider resorting to European Economic Area (EEA) service providers for data processing services.

Background

When Personal data is transferred outside the EEA, special safeguards are foreseen to ensure that the protections travel with the data. The 2016 GDPR reform offers a toolkit of mechanisms to transfer data to third countries in the form of the EU Commission adequacy decision mechanism, binding corporate rules, as well as derogations for specific situations.

One such scheme was the Privacy Shield put in place for EU-US data transfers which received a so called “adequacy decision” by virtue of the EU Commission implementing decision (EU) 2016/1250. Notwithstanding that the adequacy decision, by its decision rendered on July 16, 2020, the CJEU invalidates the Privacy Shield.

Under the Privacy Shield, US companies wishing to process EU personal data were required to be registered under the Privacy Shield list, each year explaining which data they are collecting and how they apply the Privacy Shield principles.

In Schrems II, the CJEU determined that the US is not providing an equivalent level of protection for data subjects, and more specifically, because of access and use of the transferred data by US public authorities.

The key considerations that the CJEU applied to invalidate the Privacy Shield was on the basis that under US law there are insufficient guarantees to data subjects and that it was lacking judicial redress and actionable rights before courts for non US persons against the US authorities.

In Schrems II, the CJEU recognized SCCs as valid, being another transfer safeguard for international data transfer, however, only to the extent that data is transferred to a jurisdiction which offers equivalent protection to the one granted within the EU.

The implementation of SCCs is now insufficient to ensure the lawfulness of the transfer under the GDPR and it is necessary to analyse and ensure a level of protection substantially equivalent to that guaranteed within the Union.

Resulting legal uncertainty

It is our view that transfer of data to the US, based exclusively on the Privacy Shield, is currently not permissible and supplementing existing SCCs is a task entailing a highly uncertain outcome.

The European Data Protection Board (EDPB) is now working to determine which kind of supplementary measures can be taken to ensure the necessary protections for achieving the required EU standard.

We note that, the EDPB’s position (FAQ taken of July 23, 2020), is that the CJEU assessment applies, notwithstanding an adequacy decision or the implementation of binding corporate rules. The EDPB reiterates the view that, the exporters and importers of data are responsible for analysing the adequacy of protection in that third country of destination to enable the data importer to comply with the standard data protection clauses or the binding corporate rule, before transferring personal data to that third country.

Therefore the exporters and importers of data are responsible for illegal or otherwise invalid data transfers and consequently it is essential to make an analysis of the situation and to ensure that the third country offers an equivalent level of protection.

Henceforth, the transfer of data from EU to US can no longer be justified and legitimate by the Privacy Shield.

Each transfer made on that basis is illegal and the controller or processor, in their capacity as importers or exporters of data, must find another way to comply with GDPR.

Where do matters stand now?

The CJEU argued that its judgment does not create a legal vacuum and makes reference to Article 49 of GDPR, whereby in the absence of an adequacy decision or appropriate safeguards, certain exemptions permit data transfers where the data subjects have given their consent, and those transfers are necessary for the conclusion or performance of a contract between the data subject and the controller.

In its FAQ adopted on July 23, 2020, the EDPB underlined that, recourse to the Article 49 exemptions shall remain for occasional transfers and could not be a permanent basis for validating recurring transfers.

In the light of the EDPB response, we believe that Schrems II has created significant legal uncertainties for EU-US data transfers, as well as is the case of other non-EEA countries.

Download the PDF Article
]]> BREXIT and implications on recognition and execution of UK judgements in Luxembourg https://rjgaito.com/brexit-implications-luxembourg/ Tue, 18 May 2021 16:55:19 +0000 https://quizzical-clarke.77-68-21-77.plesk.page/?p=966

Overview

Within the framework of European Union (EU) Regulations, the recognition and the execution of judicial decisions rendered by the courts of the EU Member States was greatly simplified.

Pursuant to Regulation (EU) No 1215/2012 of the European Parliament and of the Council of 12 December 2012, on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters “a judgment given in a Member State shall be recognized in the other Member States without any special procedure being required”  (Article 36), as well as without further formality being required.

Furthermore, by application of articles 39 and 40 of the Regulation, an EU Member State’s judgment is enforceable by operation of law and is applicable for the purpose of protective measures.

Enforcement of United Kingdom (UK) judgments in Luxembourg post BREXIT

On 31 December 2020, the UK departed from the EU without having received the required consent to its accession to the Lugano Convention of 2007.  The Lugano Convention regulates both international jurisdiction and the recognition and enforcement of foreign judgments in civil and commercial matters.

On 8 April 2020, the UK applied to accede to the 2007 Lugano Convention in its own right.  However, in a recent communication to the EU Parliament and to the Council of the EU of 4 May 2021, the EU Commission is recommending to reject the application of the UK to accession of the Lugano Convention and that the UK should be treated as third countries via the application of the 2019 Hague Convention.

In that case, the UK is and will be treated in Luxembourg as a third-country jurisdiction and, therefore, an enforcement of a UK judgment will require the application of the so-called “exequatur” procedure.  Such a procedure would require a final and non-appealable judgment representing a so-called “title” to be introduced to the Luxembourg District Court (“tribunal d’arrondissement”).  It should be noted that the Luxembourg courts may refuse to execute a foreign judgment if it is contrary to Luxembourg International Public Order (“ordre public”).

From a practical perspective, to enforce a foreign judgment in Luxembourg, the applicant has to serve a summons (“assignation en exequatur”) on the defendant in proceedings requiring the services of a lawyer being a member of the Luxembourg Bar.

The procedure requires the involvement of the Luxembourg State Prosecution which has the right to oppose the execution of a foreign judgment on the ground of “ordre public”.

The procedure takes place in a written form, meaning that it is undertaken by exchange of written pleadings which means that it is lengthy and cumbersome. In addition, like any other Luxembourg judgment rendered in the District Court, it is appealable. Thus, the procedure may last for many months.

Our Take

It is obvious that, a failure of the UK to accede to the Lugano Convention will make the procedure for recognition and execution of UK judgments in Luxembourg cumbersome, more costly, lengthier and could result in legal uncertainty.

In international agreements and, more specifically, in international transactions’ practice, English law and English courts are amongst the most popular choices for lawyers and the business community.  Therefore, in light of the recent Commission communication, the attractiveness of English law may be significantly diminished.

We are of the view that Luxembourg law could provide an attractive alternative as a choice of law and venue given that the legal framework is solid, the Luxembourg judiciary being non-interventionist by its nature and the enforcement of contracts in accordance with their terms.  In recent years, we have witnessed a tendency towards Luxembourg law; one such example was the recent decision by the European Stability Mechanism to issue euro denominated bonds and bills under Luxembourg law rather than under English law.

Contact:

Ronnen Gaito         gaito@rjgaito.com
Gwendoline Bella   gwendoline@rjgaito.com

40 rue Glesener
L-1630 Luxembourg

Tél. (352) 20 600 333
Fax. (352) 20 600 334

https://quizzical-clarke.77-68-21-77.plesk.page

Download Article

]]> Listen to our podcast on EU General Data Protection Regulation (GDPR) and China’s newly issued draft Personal Information Protection Law (PIPL). https://rjgaito.com/personal-information-protection-law/ Thu, 08 Apr 2021 16:53:48 +0000 https://quizzical-clarke.77-68-21-77.plesk.page/?p=955

Episode 41: All about the GDPR & PIPL

EU has its General Data Protection Regulation (GDPR) since 2016 and China issued the draft Personal Information Protection Law (PIPL) – what do the 2 have in common?

Which companies should take careful notice of this and how? In this episode I found my co-partner Zach Lichtblau in Shanghai and Mr. Ronnen Gaito in Luxembourg willing to discuss this heavy topic in a relatively light conversation. Ronnen explains how in the EU companies were affected in their daily management by the GDPR, what you should take into consideration with cross border transfers and how it was implemented and executed and Zach compares that with the expectations of the PIPL in China.

Ronnen’s firm is RJ Gaito Law Firm and Zach’s is Bonnard Lawson International Law Firm & Equasia.

]]> WWL nominates Ronnen J Gaito as an M&A Thought Leader for 2020 https://rjgaito.com/wwl-rjgaito-thought-leader/ Thu, 10 Dec 2020 16:09:59 +0000 https://quizzical-clarke.77-68-21-77.plesk.page/?p=935

Ronnen Gaito is singled out by peers as a key name in Luxembourg’s M&A market

Biography

Ronnen J Gaito is the founder of the law firm of RJ Gaito (2011), and the Luxembourg chapter chair of the international section of the New York State Bar Association.

Ronnen’s practice focuses on advising clients on private equity and venture capital transactions; mergers and acquisitions; joint ventures; corporate finance (debt and equity offering); fund formation; corporate governance matters; and post-transaction, cross -border dispute resolution and litigation.

Ronnen’s most recent experience has involved extensive negotiations of Series A and Series B financing for founders and venture capital firms; international group reorganisations for the purpose of optimising exit strategies and IPOs’ debt facilities; and negotiations of complex technology licensing agreements. He provides extensive Luxembourg law advice for major international law firms.

In addition to Ronnen’s extensive Luxembourg law experience, he has acquired global international deal experiencee as a senior corporate counsel at SES (the world’s largest satellite operator), and as corporate mergers and acquisitions counsel at Novartis International.

Ronnen’s practice includes extensive experience of delivery of international legal opinions for equity and debt issuances, and secured and unsecured debt transactions. He is a frequent panel speaker on international legal opinion practice.

Ronnen has been recognised by many publications as a leading transactional lawyer. In 2018 and 2019 Global Law Expert named Ronnen’s firm Private Equity and Joint Venture Law Firm of the Year for Luxembourg.

Read WWL Article on Ronnen J Gaito

 

]]>