Litigation – RJ Gaito Law Firm

Litigation Speed Read: Luxembourg Arbitration Reform

admin — Thu, 18 May 2023 20:46:16 +0000

GENERAL GUIDING PRINCIPLES:

On 25th April 2023, a law came into force that reforms the Luxembourg New Civil Procedure Code in relation to arbitration (the “Law”). The Law aims to modernize and enhance the internal Luxembourg arbitration legal framework with a view to making Luxembourg a more attractive jurisdiction for international arbitration and relieving the pressure on the local Luxembourg courts.

The law mainly adapts the UNCITRAL model law and latest developments in French and Belgian law. Consistent with the UNCITRAL approach, the law reflects the understanding that parties to an arbitration agreement have made a conscious decision in favor of the finality and expediency of the arbitral process. Consequently, annulment of an arbitral award in the Luxembourg Court of Appeal is now restricted to procedural irregularities, violation of the right of defense and the public order.

The salient points of the Law are the following:

Jurisdiction. The arbitral tribunal has the power to determine questions of jurisdiction including but not limited to the existence and validity of the arbitration agreement. Where a matter is subject to an arbitration agreement, the Luxembourg courts may only accept jurisdiction where the arbitration agreement is null and void because the subject matter is not arbitrable or for any other reason the arbitration agreement is manifestly null and void.
Arbitration Agreements. Liberal interpretation of arbitration agreements with no need for a separate arbitration agreement; an arbitration clause would suffice; the parties to the arbitration agreement are very much free to regulate the place of the arbitration seat, number of arbitrators and arbitration procedures.
With the objective of bringing efficiency to the legal process, and in the absence of contractual terms, the Law set a maximum time limit of six months to complete the arbitration proceedings although, it should be noted that, an extension to that period is possible in certain instances. In addition, the default number of the arbitral tribunal is three arbitrators.
Powers and procedures of the arbitral tribunal. Other than attachment orders (“saisie-arrêt) that may only be granted by the Luxembourg courts, the arbitral tribunal can grant interim and provisional measures.
Supporting judge. The Law creates a new dedicated role for a supporting judge (“juge d’appui”), who can resolve procedural difficulties in arbitration subject to the jurisdiction of the Luxembourg court. It should be noted that the judge’s jurisdiction is limited to cases where: “(i) where the seat of arbitration is Luxembourg, (ii) cases where the parties have submitted their arbitration to Luxembourg procedural, (iii) the parties have expressly given jurisdiction to the Luxembourg courts to hear disputes relating to the arbitration proceedings, or (iv) where there is a significant link between the dispute and the Grand Duchy of Luxembourg.”
Annulment and request for setting aside of an arbitral award. In the interest of creating efficiency in the judicial proceedings, set-aside proceedings are only possible in the Luxembourg Court of Appeal and limited to the following grounds: (i) wrongful determination by the tribunal of itself as having or not having jurisdiction, (ii) improper constitution of the tribunal, (iii) failure by the tribunal to comply with its assigned task, (iv) award contrary to public order (v) unreasoned award (can be waived by the parties), or (vi) violation of defence rights.
Request for revisions and withdrawals of awards. A request for reexamination of the arbitral award can be made to the arbitral tribunal in cases of: (i) fraud, (ii) withholding of crucial evidence, (iii) awards obtained based on false documentation, or (iv) awards based on testimonies which were adjudicated as false.
It should be noted that any subsequent revision application needs to be litigated by the arbitral tribunal, and where the tribunal cannot be reconvened, brought before the Luxembourg Court of Appeal.
It is also worth noting that a request for annulment and an appeal decision upholding enforcement does not have suspensive effect. However, the Court of Appeal, ruling as in summary proceedings, may stop or adjust the enforcement of the award if such enforcement is likely to seriously prejudice the rights of one of the parties.
Foreign arbitral awards. Foreign awards may not be set-aside in Luxembourg but at their seat of arbitration. Such awards are enforceable in Luxembourg subject to the so-called “exequatur” procedure and may only be challenged based on limited grounds.

Our take and practical considerations:

Considering the prominence of the Luxembourg financial market and the extensive use of Luxembourg vehicles, the Law provides an enhanced framework and certainty for international transactions. Whereas, in the past, parties have tended to have agree on Luxembourg to govern the substantial contractual obligation but chose a legal seat of arbitration outside Luxembourg, there is now scope to reconsider this approach and choose Luxembourg as well for the seat of arbitration. In addition, the established Luxembourg practice of enforcing agreements in accordance with their terms as well as the possibility to conduct the arbitration proceedings in English, makes the seat of the arbitration in Luxembourg an ever more coherent choice.
We advise parties choosing arbitration to draft clear and detailed arbitration clauses and to avoid use of implied terms in order to avoid creating grounds to contest the meaning of the clause causing delays and uncertainty in the arbitration process.
Finally, in the parliamentary preparatory work, the Luxembourg Chamber of Commerce (2021) went one step further in proposing the introduction of a state court adjudicating in English, stating that this will give the impetus for Luxembourg to become a prominent place for arbitration. This, in our view, will catapult Luxembourg law to be a force to be reckoned with in the financial and legal market.

Our experience:
RJ Gaito is celebrating 12 years in business; our firm has acted for and against major corporations, entrepreneurs, as well as private clients in the various jurisdictional levels of the Luxembourg courts system commencing in the lower courts up to the Luxembourg Supreme Court (“la cour de cassation”), including current proceedings now pending with ICSID.

Our firm has obtained freezing orders over various asset classes, acted in emergency proceedings, and enforced foreign judgments in Luxembourg. We assisted equity investors, debtors and creditors in complex distressed debt matters and, over the years, we were successful in multi-million Euro/United States Dollar recoveries for creditors and equity investors.

Ronnen J. Gaito	Gwendoline Bella
gaito@rjgaito.com	gwendoline@rjgaito.com

40 rue Glesener
L-1630 LUXEMBOURG

Tel. (352) 20 600 333
Fax. (352) 20 600 334
Mob. (352) 621 32 37 34
e-mail: info@rjgaito.com
https://www.rjgaito.com

Luxembourg Data Protection Commission vigorously enforces GDPR

admin — Sat, 27 Nov 2021 16:58:15 +0000

Introduction:

Article 37 of GDPR requires the appointment of a Data Protection Officer (“DPO”). The appointment of a DPO is a critical compliance requirement and recent decisions of the Luxembourg Data Protection Commission (a.k.a the “CNPD”) illustrate the implications of a failure to appoint a DPO, as well as the failure to adhere to GDPR’s prerequisites relating to the DPO’s function.

In addition, we note that use of video surveillance and geolocation technologies is another area that is subject to GDPR constraints. The use of such technologies requires an understanding of the lawfulness and conditions for compliance with GDPR.

We would like to bring to your attention four recent decisions of the CNPD published on November 2, 2021, relating to the implementation and enforcement of GDPR.

Three CNPD decisions were rendered following a deliberate and concerted investigation campaign carried out by the CNPD since 2018 in respect of the position and role of the DPO, as well as the importance of its integration into the organizational fabric of a company.

A fourth decision relates to the setting up of video surveillance and geolocation systems.

We note that the decisions taken are detailed and reasoned legal opinions that cite the legal basis for these decisions. These decisions serve as future guidance to organizations in the implementation of GDPR. The CNPD’s decisions imposed a range of sanctions ranging from warnings to fines. The fines ranged from EUR 3,500 to 18,000. In this context, we note that the CNPD applies GDPR strictly and will not hesitate to impose severe penalties.

The CNPD adapts the sanctions to the factual circumstances and takes into account the approach and collaborative attitude of the audited entity during the investigation.

It should be noted that the basis for a decision is taken on the findings at the outset of the investigation. Any subsequent corrective measures taken by the audited entity may be considered in determining the sanctions imposed.

The cases in detail:

Decision n ° 38 FR 2021 issued on October 15, 2021

The CNPD reiterated that:

the identity of the DPO must be provided to the CNPD;
the DPO will have all the resources necessary to enable it to carry out his mission, and these resources must be provided to the DPO by the entity;
the DPO needs to be involved in all decisions relating to data protection and exercise a real control mission; and
the DPO will require specific qualifications to be able to hold this position.

Sanction: administrative fine of € 18,000 and an order to comply.

Decision n ° 37 FR 2021 issued on October 13, 2021

The CNPD reiterated that:

the identity of the DPO must be provided to the CNPD; and
the independence of the DPO must be guaranteed, and in particular, to ensure that there is no conflict of interest.

Sanction: during the investigation, voluntary compliance measures were undertaken; only a call of legal reminder was made by the CNPD.

Decision n ° 36 FR 2021 issued on October 13, 2021

The CNPD reiterated that:

the DPO has to be appointed based on professional qualifications;
three years of professional experience in the field of data protection were deemed sufficient in the particular circumstances;
the DPO must be involved in all decisions relating to data protection and exercise real control over decisions; and
the entity concerned is required to introduce a formal data protection control plan.

Sanction: the CNPD issued an administrative fine of € 13,200.

CCTV Decision n ° 35 FR 2021 issued on October 13, 2021

The audited entity had installed CCTV cameras within the company and geolocation systems in part of its fleet of vehicles.
The CNPD reiterated the principle of “data minimization” in terms of video surveillance. This principle implies only strictly required data can be collected.
To this end, before installing a video surveillance system, the data controller must define, in a precise manner, the purpose(s) it wishes to achieve by using such a system.
The CNPD reiterated that an employee must not be subject to permanent surveillance, especially during their hours of rest.
In the same order, the CNPD reiterated that the cameras intended to monitor an access point (entrance and exit, doorstep, porch, door, awning, hall, etc.) must have a limited field of vision.
Clear and complete information must be provided in areas of surveillance (not a mere post sign).
Information for employees on geolocation must be complete, clear and individualized (a mere post sign in the car is insufficient).

Fine: the CNPD imposed a fine of € 5,300 and orders to comply.

Contact:

Ronnen Gaito gaito@rjgaito.com
Gwendoline Bella gwendoline@rjgaito.com

40 rue Glesener
L-1630 Luxembourg

Tél. (352) 20 600 333
Fax. (352) 20 600 334
Mob. (352) 621 32 37 34

e-mail: info@rjgaito.com

https://rjgaito.com/

Data Protection and Cyber Update – September 2020

admin — Fri, 02 Jul 2021 16:09:02 +0000

The Business of Data – International data transfers

Highlights:

The Court of Justice of the European Union (CJEU) on July 16, 2020, delivered its latest judgment in Max Schrems’ case against Facebook Ireland Ltd. and Data Protection Commissioner (Ireland) (Max Schrems II). In a landmark decision, the CJEU struck down the European Union United States of America (EU-US) Privacy Shield scheme as a mechanism allowing US commercial companies to transfer and store EU personal data in the US.

The CJEU validated the Standard Contractual Clauses (SCCs) which Facebook had been using, however, it invalidated the Privacy Shield and the “adequacy decision” of the European Commission’s decision (EU) 2016/1250 of July 2016, relating to the Privacy Shield mechanism.

The CJEU decision makes EU-US data transfer contentious and, consequently, requires scrutiny of any data transfer from the EU to any third country, irrespective of the implementation of the SCC or a so-called EU “adequacy decision”.

The judgment provided critical guidance for transfer of data of EU data subjects outside the EU.

General Guiding Principles:

The SCCs, as a mechanism for maintaining General Data Protection Regulation (GDPR) compliance, is valid but they do not in themselves validate data transfers. The prevailing and critical element for a valid transfer of data is whether the third country provides, in a continuous manner, adequate safeguards to EU data subjects. This essentially means protection which is equivalent to that guaranteed by the EU. In this context, judicial redress for data subjects in the third country is an essential element to consider.
Even where the SCCs are implemented, the analysis that should be undertaken is whether any third country provides adequate protection for personal data and data subject. Any such analysis must consider actionable judicial redress for data subjects that is of critical importance.
SCCs and “adequacy” decisions are no longer a compliance guarantee with EU GDPR.

Recommendations:

Parties should consider if they are using data importers that are relying on the EU-US Privacy Shield for validating data transfers and consider how to strengthen their data transfer mechanisms.
Data exporters and importers now need to assess the level of data protection in the data recipient’s country and to suspend transfers if deemed inadequate. Failure to do so could result in legal liabilities.
Data protection authorities need to assess whether transfers to third countries provide adequate protection.
Any laws or practices in third countries that could detract from the SCCs contractual guarantees of adequate protection should indicate that such country’s approach to data protection is incompatible with GDPR. Countries that use extensive surveillance practices should be of particular concern.
Organizations should consider resorting to European Economic Area (EEA) service providers for data processing services.

Background

When Personal data is transferred outside the EEA, special safeguards are foreseen to ensure that the protections travel with the data. The 2016 GDPR reform offers a toolkit of mechanisms to transfer data to third countries in the form of the EU Commission adequacy decision mechanism, binding corporate rules, as well as derogations for specific situations.

One such scheme was the Privacy Shield put in place for EU-US data transfers which received a so called “adequacy decision” by virtue of the EU Commission implementing decision (EU) 2016/1250. Notwithstanding that the adequacy decision, by its decision rendered on July 16, 2020, the CJEU invalidates the Privacy Shield.

Under the Privacy Shield, US companies wishing to process EU personal data were required to be registered under the Privacy Shield list, each year explaining which data they are collecting and how they apply the Privacy Shield principles.

In Schrems II, the CJEU determined that the US is not providing an equivalent level of protection for data subjects, and more specifically, because of access and use of the transferred data by US public authorities.

The key considerations that the CJEU applied to invalidate the Privacy Shield was on the basis that under US law there are insufficient guarantees to data subjects and that it was lacking judicial redress and actionable rights before courts for non US persons against the US authorities.

In Schrems II, the CJEU recognized SCCs as valid, being another transfer safeguard for international data transfer, however, only to the extent that data is transferred to a jurisdiction which offers equivalent protection to the one granted within the EU.

The implementation of SCCs is now insufficient to ensure the lawfulness of the transfer under the GDPR and it is necessary to analyse and ensure a level of protection substantially equivalent to that guaranteed within the Union.

Resulting legal uncertainty

It is our view that transfer of data to the US, based exclusively on the Privacy Shield, is currently not permissible and supplementing existing SCCs is a task entailing a highly uncertain outcome.

The European Data Protection Board (EDPB) is now working to determine which kind of supplementary measures can be taken to ensure the necessary protections for achieving the required EU standard.

We note that, the EDPB’s position (FAQ taken of July 23, 2020), is that the CJEU assessment applies, notwithstanding an adequacy decision or the implementation of binding corporate rules. The EDPB reiterates the view that, the exporters and importers of data are responsible for analysing the adequacy of protection in that third country of destination to enable the data importer to comply with the standard data protection clauses or the binding corporate rule, before transferring personal data to that third country.

Therefore the exporters and importers of data are responsible for illegal or otherwise invalid data transfers and consequently it is essential to make an analysis of the situation and to ensure that the third country offers an equivalent level of protection.

Henceforth, the transfer of data from EU to US can no longer be justified and legitimate by the Privacy Shield.

Each transfer made on that basis is illegal and the controller or processor, in their capacity as importers or exporters of data, must find another way to comply with GDPR.

Where do matters stand now?

The CJEU argued that its judgment does not create a legal vacuum and makes reference to Article 49 of GDPR, whereby in the absence of an adequacy decision or appropriate safeguards, certain exemptions permit data transfers where the data subjects have given their consent, and those transfers are necessary for the conclusion or performance of a contract between the data subject and the controller.

In its FAQ adopted on July 23, 2020, the EDPB underlined that, recourse to the Article 49 exemptions shall remain for occasional transfers and could not be a permanent basis for validating recurring transfers.

In the light of the EDPB response, we believe that Schrems II has created significant legal uncertainties for EU-US data transfers, as well as is the case of other non-EEA countries.

Download the PDF Article

WWL nominates Ronnen J Gaito as an M&A Thought Leader for 2020

admin — Thu, 10 Dec 2020 16:09:59 +0000

Ronnen Gaito is singled out by peers as a key name in Luxembourg’s M&A market

Biography

Ronnen J Gaito is the founder of the law firm of RJ Gaito (2011), and the Luxembourg chapter chair of the international section of the New York State Bar Association.

Ronnen’s practice focuses on advising clients on private equity and venture capital transactions; mergers and acquisitions; joint ventures; corporate finance (debt and equity offering); fund formation; corporate governance matters; and post-transaction, cross -border dispute resolution and litigation.

Ronnen’s most recent experience has involved extensive negotiations of Series A and Series B financing for founders and venture capital firms; international group reorganisations for the purpose of optimising exit strategies and IPOs’ debt facilities; and negotiations of complex technology licensing agreements. He provides extensive Luxembourg law advice for major international law firms.

In addition to Ronnen’s extensive Luxembourg law experience, he has acquired global international deal experiencee as a senior corporate counsel at SES (the world’s largest satellite operator), and as corporate mergers and acquisitions counsel at Novartis International.

Ronnen’s practice includes extensive experience of delivery of international legal opinions for equity and debt issuances, and secured and unsecured debt transactions. He is a frequent panel speaker on international legal opinion practice.

Ronnen has been recognised by many publications as a leading transactional lawyer. In 2018 and 2019 Global Law Expert named Ronnen’s firm Private Equity and Joint Venture Law Firm of the Year for Luxembourg.

Read WWL Article on Ronnen J Gaito