Oversight of the intelligence service
Since January 1, 2016, the State Intelligence Service has been headed by Doris Woltz (see CV). The SRE comprises four internal divisions: Intelligence, Administration, Technical, and National Security Authority.
Professionalism and legal security
The challenge today for the SRE is to provide efficient prevention while ensuring a high degree of protection for individuals and their privacy. To safeguard the legal security of both Luxembourg's residents and its intelligence professionals, the current legislation has strengthened supervision of the agency through an oversight system with four components, three 'upstream' and one 'downstream':
Political: A ministerial intelligence committee, currently comprising three members of the government (Prime Minister and two Deputy Prime Ministers), sets the country's overall intelligence policy, determines the general priorities of the SRE's activities, which it monitors on an ongoing basis. The director reports to the ministerial committee once a month.
Administrative: The government appoints a representative to the SRE holding a 'Top Secret' security clearance to monitor its internal functioning and report regularly to the minister responsible for the agency. Nothing can be kept secret from the government's representative, who has individual powers of investigation and oversight within the SRE. However, the representative is not involved in day-to-day operations, which remain the sole responsibility of the director.
Judicial: A special committee consists of three senior judges, the president of the Supreme Court of Justice, the president of the Administrative Court and the president of the District Court of Luxembourg. Operational methods and techniques, such as the use of intrusion technology and surveillance of all kinds of communication, must be supported by the special committee before being authorised by the ministerial committee.
Parliamentary: The activities of the SRE are subject to supervision by a special parliamentary committee, consisting of representatives of political and technical groups designated by them. (Regulation of the Chamber of Deputies, coordinated text up to date on 16 January 2018 (annex 2))
At present, this oversight is exercised on a monthly basis. The director of the SRE reports to the parliamentary oversight committee at least once every quarter about all SRE activities. The committee is informed every six months about surveillance and communication monitoring measures, and may, at its own initiative, request oversight of specific aspects of the SRE's activities.
Processing personal data
The director is responsible for the processing of personal data in the course of the SRE's activities. According to article 10 of the law of July 5, 2016 on the reorganisation of the Service de renseignement de l'État, the director appoints a data protection officer, whose responsibility is to ensure compliance with the law of August 1, 2018 on the protection of natural persons with regard to the processing of personal data in the scope of criminal matters and national security, as well as the implementation of the SRE's security measures for processing such data.
The supervisory authority established under Article 3 of the law of August 1, 2018 on the creation of the National Commission for Data Protection and the overall data protection regime has the power to check and verify whether the SRE is respecting the legal requirements under Article 39 of the law of August 1, 2018 on the protection of natural persons with regard to the processing of personal data in the scope of criminal matters and national security.
Article 13 of the before mentioned law regulates the right of access of the data subject, who has a right to obtain confirmation whether or not the SRE is processing personal data concerning him. According to Article 14, the controller may restrict, fully or partially, the right of access of the data subject, if it is necessary in particular to protect national security. Furthermore, data subjects have a right to request the rectification or deletion of personal data concerning them, or the restriction of processing (Article 15).
To do so, they should contact:
Service de Renseignement de l'État
B.P. 467
L-2014 Luxembourg
Data protection officer: sre_dpo@me.etat.lu
In the event that an individual believes the handling of personal data concerning them contravenes the requirements of the law of August 1, 2018 on the protection of natural persons with regard to the processing of personal data in the scope of criminal matters and national security, they may lodge a complaint with the National Data Protection Commission (Article 44 (1)).
Financial supervision
Luxembourg's Court of Auditors conducts periodic checks on the SRE's financial management.