Communications: overview on regulation and outsourcing in Luxembourg

This Q&A is a guide on communications regulation and outsourcing law in Luxembourg gives a high level overview of communications law, including authorisation and licensing, universal service obligations, spectrum use, access and interconnection, data protection and security, price regulation, subscriber management, and outsourcing and telecommunications.

The telecommunications market

1. Give a brief overview of the structure of the telecommunications market in your jurisdiction. Briefly set out any major recent developments, such as mergers and acquisitions, restructurings and insolvencies.

Market structure

The telecom sector generated more than EUR542 million of annual revenue in Luxembourg, and continues to create jobs, with more than 2,000 persons working in this sector (source: 2016 annual report issued by Luxembourg’s telecommunications regulation authority). There are more than 100 companies (including many foreign companies not established in Luxembourg) providing different types of electronic communication services in Luxembourg.

Telecom operators continue to invest strongly in infrastructures. On average this is around 25-30% of their revenue (147 million euros in 2016).

Ultra-high speed internet (download speeds of at least 30Mbps) is rapidly replacing high speed internet. At the end of 2016, the level of users of ultra-high speed internet was 53.7% (44% at the end of 2015). Ultra-high speed downloads of 100Mbps or more represented 18.98% of internet access in Luxembourg in 2017.

Four dominant mobile operators (which have been awarded 4G licences) provide mobile telecommunication services in Luxembourg: Post Telecom (formerly Entreprise des Postes et Télécommunications (EPT)), Tango, Orange, and Join Experience.

Recent developments

Usage of voice telephony service falls on fixed lines and tends to stagnate on mobile networks (except the volume of data which increases on mobile networks).

Indeed, the volume of mobile data increases rapidly (+42% in 2016) and with the new EU “roam like at home” rules entered into force in 2017, it can be anticipated that this trend will continue.

One of the most significant facts is the constant (and relatively rapid) growth of ultra-high speed internet access, and in particular the access to fibre optic, which coverage exceeded 51% of Luxembourg housing in 2016.

Another recent trend is that most of the major telecom operators now provide TV services by making multi-service offers (TV, Internet, mobile and fixed telephony services).

Luxembourg Institute of Regulators (ILR), which regulates electronic communication services providers, published its first annual report on mediation service. In 2015, it had to deal with 98 requests, among which 75 were dealing with electronic communication services issues.

Restrictions on foreign ownership

2. Are there any restrictions on foreign companies entering the telecommunications market in your jurisdiction?

There are no foreign ownership restrictions on the provision of telecommunications services.

Regulatory framework – Legislation and regulatory authorities

3. Give a brief overview of the regulatory framework for telecommunications in your jurisdiction. Which authorities regulate telecommunications services in your jurisdiction? Is there a separate regulator for competition law issues in this sector?

Regulatory framework

The telecommunications sector is regulated by the law of 27 February 2011 on electronic communications networks and services (Telecom Act) which implemented the new EU regulatory framework based on:
• Directive 2009/140/EC amending Directive 2002/21/EC on a common regulatory framework for electronic communications networks and services (Electronic Communications Framework Directive) and Directive 2002/19/EC on access to, and interconnection of, electronic communications networks and associated facilities (Access Directive) and Directive 2002/20/EC on the authorisation of electronic communications networks and services (Authorisation Directive).

• Directive 2009/136/EC on consumer protection and users’ rights in relation to the processing of personal data and the protection of privacy in electronic communications (Citizens’ Rights Directive).

The Telecom Act repealed the law of 30 May 2005 on electronic communications networks and services, whose main objectives had been the creation of a competitive environment, the setting of minimum standards of service in electronic communications, protection of consumers’ rights, and regulation of access to electronic communications networks.

To the best of the authors’ knowledge, as of today, no changes are anticipated to the Telecom Act.

The Telecom Act has been slightly modified by a law dated 7 June 2017, which introduces an obligation  for the service providers to identify the purchasers of pre-paid services prior to providing the service.

Specific measures relating to the processing of personal data in the electronic communications sector are regulated by the modified law of 30 May 2005 (Act on Privacy and Electronic Communications). This law implemented:

• Directive 2002/58/EC on the protection of privacy in the electronic communications sector (E-Privacy Directive).

• Directive 2006/24/EC on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks (Data Retention Directive).

• Directive 2009/136/EC on consumer protection and users’ rights in relation to the processing of personal data and the protection of privacy in electronic communications (Citizens’ Rights Directive), amending the E-Privacy Directive.

The Act on Privacy and Electronic Communications is to be amended very soon on the specific issue of data retention periods, further to the decision of the EU Court of Justice dated 8 April 2014 that rendered the Data Retention Directive invalid. However, the draft law which was laid before the Luxembourgish Parliament on 7 January 2015 is currently suspended due to recent developments at a European level.

Regulatory authorities

Telecommunications services are regulated by the Luxembourg Institute of Regulators.

The law of 21 March 1997 had created the Luxembourg Institute of Telecommunications. This was later renamed by the law of 30 May 2005 on electronic communications networks and services as the Luxembourg Institute of Regulators (InstitutLuxembourgeois de Régulation) (ILR).

The ILR’s function is to regulate economic sectors, companies and telecommunications operators (law of 30 May 2005 on organisation of the Luxembourg Institute of Regulation).

Competition law issues in the telecommunications sector are regulated by the Competition Council, an independent administrative authority whose purpose is to ensure free competition and the proper functioning of markets.

The Competition Council was created by the law of 17 May 2004 on competition. It was later reorganised by the law of 23 October 2011 on competition, becoming the sole competent authority with investigative and decision-making powers.

Authorisation and licences

4. What notification, authorisation and licences are required to provide telecommunications services? What is the licence application procedure and fee?

Licences for telecommunication services are not necessary under the Telecom Act. A notification must be filed with the Luxembourg Institute of Regulators (ILR) at least 20 days before the initiation of a telecommunications service (Article 8, Telecom Act). The notification must include a description of the electronic communication networks or services, and the launch date of the activities.

All notified entities that provide telecommunications services must pay an administrative fee, including a flat fee of EUR2,500 and an additional variable fee based on the annual turnover (0.65% in 2016). Companies of minor importance (that is, with fewer than 500 final users and a global annual turnover on electronic communication services of less than EUR600,000) are exempt from payment of the administrative fee. “Company of minor importance” status is granted by the ILR on special request of the relevant company, including all the necessary justifications.

Companies declared of “major importance” by the ILR are subject to a supplementary annual fee of EUR5,000 per market. An administrative fee of EUR500 may be charged for updating the public registry.

A compensation fee may be charged in the case of a negative balance regarding all the expenses incurred by the ILR during the previous year, to be apportioned among all notified companies in proportion to the amount of their annual fee.

5. How long does a telecommunications licence typically last and what are the usual conditions attached to it? Can conditions be varied? Are licences available for public inspection?

Licences are not needed under the Telecom Act; prior notification must be filed with the Luxembourg Institute of Regulators (ILR) (see Question 4). The notification is effective for an unlimited period of time. However, notified companies must reply in good time to requests sent by the ILR from time to time.

Penalties for non-compliance

6. What are the consequences of non-compliance with the telecommunications regulations?

Companies that do not comply with the Telecom Act may be liable to pay an administrative fine of up to EUR1 million (Article 88, Telecom Act). This amount may be doubled in the case of repeated violation.
This administrative fine imposed by the Luxembourg Institute of Regulators (ILR) can be accompanied or replaced by any of:
• A warning.
• A finding of blame.
• A prohibition from performing certain operations or providing certain services.
• A temporary suspension of one or more managers of the company.

Appeals

 7. Can decisions of the regulators be appealed and on what grounds?

An appeal can be made in the administrative tribunal against decisions of the Luxembourg Institute of Regulators (ILR), within two months of the ILR decision.

Universal service obligations

 8. Is the incumbent provider or other large providers with significant market power subject to specific regulations? Do universal service obligations apply? Are there provisions for the structural separation of a network?

If the Luxembourg Institute of Regulators (ILR) finds a market in the electronic communications sector not to be competitive, it can impose specific obligations on significant market power operators (Article 20, Telecom Act).

On access or interconnection market, such obligations can include (Article 28, Telecom Act):

• Transparency requirements.
• Non-discrimination.
• Accounting separation.
• Compliance with requests for access to network elements.
• Obligations related to costs recovery and price controls.

Where an operator has significant market power on access or interconnection market, it must apply equivalent conditions to any notified company providing equivalent services (Article 30, Telecom Act). It must also provide to this company services and information under the same conditions, and with the same quality as it provides for its own services or those of its subsidiaries or partners.

Article 48 et seq. of the Telecom Act provides for the right of any final user to have access to a universal service, including:
• The right to be granted access to the public telephone network and to benefit from telephone services.
• Providing public pay phones and other access points to publicly available telephone services.
• Publishing and distributing a telephone directory and the provision of telephone information services. These ancillary rights are further detailed in the Telecom Act.

General conditions

9. What general conditions apply to telecommunications services? Which other regulations must be complied with?

Confidentiality requirement

Providers of electronic communication services must comply, under Article 4 of the Telecom Act, with the principle of confidentiality of correspondence. Accordingly, providers must ensure the confidentiality of the communications exchanged by electronic communication means.

This principle is detailed in Article 4 of the Act on Privacy and Electronic Communications, under which each service provider or operator must ensure the confidentiality of communications, and of the traffic data relating to communications, carried out by means of a public communications network and publicly available electronic communications services.

Security requirement
Providers of public communications networks or electronic communications services available to the public must take the necessary technical and organisational measures to appropriately manage risk to the security of networks and services, or to ensure the integrity of their networks (Articles 45 and 46, Telecom Act).

In the case of a personal data breach, the provider of publicly available electronic communications services must, without undue delay, notify the Luxembourg Institute of Regulators (ILR) and the Luxembourg data protection authority.

Transparency requirements

Providers of public electronic communications networks or electronic communications services to the public must publish transparent, comparable, adequate and updated information regarding prices and tariffs, fees, terms and conditions of access to the services they provide to final users. Such information must be published in a clear, comprehensive and easily accessible manner.

Spectrum use

10. Which authorities allocate spectrum use and how is it managed?

Use and attributions of frequencies are the responsibility of the Luxembourg Institute of Regulators (ILR). Only the ILR can allocate a frequency and proceed with the registration of this.

11. Can spectrum use be traded or sublicensed?

A licensed spectrum cannot be traded or sublicensed.

Infrastructure and network management

12. Do communications providers have any powers to place their equipment on third party sites?

A distinction must be made between public areas and private properties.
Any notified company has a right of way on public areas (Article 37, Telecom Act). This right extends to both access to infrastructure and technical facilities and their implementation and installation.

However, the installation of infrastructure and associated resources must be done in the least harmful way for the public areas concerned, and must preserve environmental and aesthetic attributes.

When a notified company wishes to establish its infrastructure and associated resources on private properties, it must conclude an agreement with the property owner (Article 42, Telecom Act). This agreement must include a provision allowing the possible sharing of infrastructure and resources associated with another notified company.

Access and interconnection

13. Does access to infrastructure and a network have to be given to other providers?

Notified companies are in principle free to negotiate between themselves and with companies notified in other EU member states, agreements on technical and commercial arrangements for access and/or interconnection (Article 22, Telecom Act).
Further, where an operator has significant market power, it must apply equivalent conditions to any notified company providing equivalent services. It must provide to such a company services and information under the same conditions and of the same quality as its own services or those of its subsidiaries or partners.

14. Is the interconnection of networks required? Are interconnection prices regulated and how are interconnection disputes resolved?

Interconnection issues are dealt with in Title IV of the Telecom Act. The Luxembourg Institute of Regulators (ILR) can intervene at the specific request of one of the parties in any dispute among operators.
A decision of the ILR, on the submitted litigation, is taken within four months from the date of the intervention request. The ILR, after a market analysis, can impose on significant market power operators several obligations on interconnection and cost-oriented prices (Article 28, Telecom Act).

Data protection and security

15. What data protection or consumer privacy regulations apply to the telecommunications sector, including both generally applicable and sector-specific laws? Are communications providers required to retain communications data? If yes, which data and for how long? What are the penalties for breach of these regulations?

Specific data protection issues relating to the telecommunications sectors are regulated by the Act on Privacy and Electronic Communications. The general framework is regulated by the modified law of 2 August 2002 on the protection of persons with regard to the processing of personal data. This general framework will soon be amended when the Regulation (EU) 2016/679 (General Data Protection  Regulation – the GDPR) enters into force as of 25 May 2018. A draft law was laid before the Luxembourgish Parliament on 12 September 2017 with the purpose of implementing the GDPR.

Under Articles 5 and 8 of the Act on Privacy and Electronic Communications, providers of electronic communications services processing traffic data and location data must retain such data for a period of six months from the date of its communication.

Traffic and location data that must be retained include user ID (the unique identifier allocated to persons when they subscribe to or register with an internet access service or internet communications service) and IP address.

The data must be disclosed to the judicial authorities, solely with a view to enabling information to be made available, for the purposes of the investigation, detection and prosecution of criminal offences (with a prison sentence of at least one year).

The Act on Privacy and Electronic Communications is expected to be amended, further to the decision of the EU Court of Justice in 2014 declaring Directive 2006/24/EC on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks (Data Retention Directive) to be invalid.

16. What are the rules relating to the interception of calls? How and on what grounds can government authorities require disclosure of communications data? What are the penalties for breach of these rules?

Article 4 of the Act on Privacy and Electronic Communications enumerates a limited number of exceptions where operators must assist authorities on the interception of telecommunications messages.

The interception of messages can be ordered by a court on the grounds of a threat to state security, national defence, public security, or for crime prevention and investigation of criminal offences (Articles 88(1) and 88(4), Code of Criminal Investigation).

Regulation 14/184/ILR of 15 December 2014 on lawful interception of telecommunications and implementing the above provisions provides details on the conditions where providers must allow access to judicial authorities. This regulation is expected to be amended soon in order to implement the measures included in a law dated 5 July 2016 which has reorganised the state intelligence service and which extends surveillance powers, including surveillance and control of telcommunications.

17. Are there any network or data security obligations imposed on communications providers?

Providers of public communications networks or electronic communications services available to the public must take the necessary technical and organisational measures to appropriately manage risk to the security of networks and services or to ensure the integrity of their networks (Articles 45 and 46, Telecom Act).

The implementation of security measures must be appropriate to the risks faced. In particular, security measures must be taken to prevent or minimise the impact of security incidents on users and interconnected networks.

In the case of a personal data breach, the provider of publicly available electronic communications services must, without undue delay, notify the Luxembourg Institute of Regulators (ILR) and the data protection authority (CNPD). A “personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed in connection with the provision of a publicly available electronic communications service.

When the personal data breach is likely to adversely affect the personal data or privacy of a subscriber or individual, the provider must also notify the subscriber or individual of the breach without undue delay.

Price regulation

18. How are prices and charges regulated?

Mobile telecommunications retail tariffs are not currently regulated.

The Luxembourg Institute of Regulators (ILR) can, in accordance with Article 28(1)(e) of the Telecom Act, impose obligations relating to cost recovery and price controls. In situations where a market analysis indicates that a lack of effective competition means that the operator concerned might maintain prices at an excessively high level, or apply a price squeeze, to the detriment of end-users, these can include obligations:
• For cost orientation of prices.
• Concerning cost accounting systems.
• For the provision of specific types of interconnection and/or access.

The ILR must take into account the investment made by the operator and allow a reasonable rate of return on adequate capital employed, taking into account the risks involved.

The ILR has established tools intended to implement such obligations relating to cost recovery and price controls. The ILR can use different methods to calculate the costs for providing an efficient service.

All cost recovery mechanisms or pricing methodologies that are imposed by the ILR must promote economic efficiency, sustainable competition and maximise consumer benefits (Article 33, Telecom Act). In this regard, the ILR may also take into account the current prices on comparable competitive markets.
The ILR can request the operator to provide full justification for its prices, and if necessary, require it to modify them.

Telephone number and subscriber management

19. How are telephone numbers allocated and managed in your jurisdiction?

The Luxembourg Institute of Regulators (ILR) is in charge of organising a national numbering plan and implementing numbering rules in accordance with Article 47 of the Telecom Act.

Regulation 14/174/ILR of 14 July 2014 details the numbering rules, the national numbering plan and the fees related to numbering resources.
The national numbering plan addresses not only telephone numbers but also other numbering and addressing resources necessary for the operation of telecommunications networks and services. This plan describes the purpose to be achieved in the future.
Numbering resources can be allocated to notified companies and to end-users in accordance with relevant rules.

20. Does access have to be provided to certain services, such as the emergency services and directory enquiries?

Notified companies providing a publicly available telephone service must guarantee the end users access free of charge to emergency services (112 and 113) and caller location information where it is technically feasible (Regulation 14/174/ILR of 14 July 2014).

In compliance with data protection regulations, a telephone directory (universal directory) including all subscribers to phone services accessible to the public must be published and available to end-users.

Such a universal directory, in printed or electronic form, must be approved by the Luxembourg Institute of Regulators (ILR), and is part of the universal service.

21. Are there regulations relating to specific consumer services, such as acquiring and transferring subscribers, number portability, complaint handling, and nuisance and silent calls?

Any user of a mobile or fixed telephone number has the right to keep his/her telephone number.

The ILR Regulations provide a description of the procedure to follow for mobile number portability (Regulation 14/174/ILR of 14 July 2014) and for fixed number portability (Regulation 16/204/ILR of 1 April 2016).

According to this, in the event of changing operator or service provider, any user of a mobile telephone number has the right to keep the telephone number granted by the operator or service provider. This also applies to users of prepaid services. This is mandatory for all operators and service providers.

The ILR has a mediation service that proposes solutions to disputes between a consumer and his operator. Mediation requests can be addressed to the ILR by consumers, provided that there is no complaint introduced before a court.

A subscriber claiming to be a victim of malicious calls can request identification of the calling or connected line and the repeated calls, reported as malicious, which have been made or identified on the basis of one single call number or one connection (Article 7(8), Act on Privacy and Electronic Communications).

22. Are consumer telecommunications contracts subject to specific regulations?

A company that provides a connection to a public electronic communications network and/or electronic communications services must publish (Article 72, Telecom Act):
• Transparent, comparable, adequate and up-to-date information on applicable prices and tariffs.
• Any charges due on the termination of a contract.
• Information on standard terms and conditions, in respect of access and use of their services provided to end-users and consumers.

Such information must be published in a clear, comprehensive and easily accessible form. The Luxembourg Institute of Regulators (ILR) can specify additional requirements regarding the form in which such information is to be published.

Article 73 of the Telecom Act provides additional specific provisions relating to information that must be included in contracts concluded by customers with companies that provide connection to a public electronic communications network, including:
• The identification and address of the company.
• Details of the service provided.
• Price details.
• Duration of the contract.
• Security measures taken by the company.

23. Are there restrictions on the use of Voice over IP technology in your jurisdiction?

The Telecom Act does not specifically mention Voice over IP (VoIP) services.
Except in specific circumstances, providers of VoIP services in principle are exempt from the obligation to file a notification to the Luxembourg Institute of Regulators (ILR), and accordingly exempt also from the application of the Telecom Act.

24. Are there regulations relating to the maintenance of net neutrality in your jurisdiction?

Net neutrality is not specifically regulated under Luxembourg law.

Outsourcing and telecommunications

25. Are there specific regulations for the outsourcing of telecommunications services or the management of these services?

Outsourcing of telecommunications is not specifically regulated under Luxembourg law.

However, IT outsourcing in the financial sector is regulated by Articles 29-3 and 29-4 of the modified law of 5 April 1993 on the financial sector. The law distinguishes between primary IT systems operators of the financial sector (Article 29-3) and secondary IT systems and communication networks operators of the financial sector (Article 29-4). These operators are considered a Support Professional of the Financial Sector (Support PFS) and are under the supervision of the regulator of the financial sector (Commission de Surveillance du Secteur Financier) (CSSF).

IT outsourcing may also be regulated by the modified law of 2 August 2002 on the protection of persons with regard to the processing of personal data.
The common legal provisions applicable to any contractual relationship, in particular provisions of the Civil Code, apply to outsourcing projects.

26. Briefly set out the current trends in outsourcing transactions in the telecommunications sector.

Suppliers of outsourcing services tend to provide a global managed services’ solution, which may include:
• Management of the local network (including leasing of equipment and maintenance of the network).
• Management of the IT infrastructure (such infrastructure may be located either on customers’ premises, on suppliers’ data centres, or in private infrastructure).
• Unified telephone system solutions.
• Security solutions.

Suppliers of these managed services are generally under the supervision of the regulator of the financial sector (CSSF) and registered as a Support Professional of the Financial Sector (Support PFS).

27. Who are the key providers of outsourced telecommunications?

Post Telecom, the incumbent operator in most of the identified markets, has developed its managed services’ solution with the entity Post Telecom PSF, which is a Support Professional of the Financial Sector (Support PFS).

A number of alternative operators also provide managed services, such as Telkea or Telindus Telecom, which are both Support PFS.

28. What are the current technologies influencing or affecting outsourcing by telecommunications operators?

The development of data centres in Luxembourg influences and affects IT and telecom outsourcing. Luxembourg has positioned itself as a leading data centre marketplace in Europe with a modern data centre infrastructure with low latency connections to all of the major European internet hubs. There are some 20 data centres in operation on the Luxembourg territory (floor space of over 40,000 square metres) including 7 Tier-IV data centres (30% of the Tier-IV data centres in Europe).
Most data centres are recent constructions, and offer Tier-IV or Tier-III service with premium carrier-neutral facilities and advanced managed services on request. Some of the data centres are designed to be energy-efficient and are based on green energy concepts.

29. From a contractual perspective, what are the key issues in a typical telecommunications outsourcing transaction in your jurisdiction?

The key issues in IT and telecom outsourcing transactions include:
• Security obligations to ensure that suppliers have in place appropriate security and organisational measures to prevent unauthorised access, fraud or theft of data, and procedures that manage possible security and data breach.
• Confidentiality obligations, to ensure that suppliers keep secret the information in connection with the provision of their services. A Support Professional of the Financial Sector (Support PFS) may also be subject to professional secrecy.
• Data protection and data integrity obligations to ensure that data is not altered or destroyed in an unauthorised manner.
• Support processes should in particular include incident management processes to restore normal service operations.
• Reliability obligations, to ensure that the organisation and the technical means are reliable and secured.
• Reversibility obligations, to ensure that customers can reverse the outsourcing of services, to either perform these themselves, or outsource performance of the services to another third party service provider.
• Disaster tolerance obligations, to ensure that a copy of the complete technical infrastructure is maintained, accessible and available for immediate use at a second site.

Online resources
Legilux
Wwww.legilux.public.lu
Description. This is the legal government portal of the Grand Duchy of Luxembourg. Legilux is a service edited by the Luxembourg Government. It includes all Luxembourg official legal resources and is updated daily. There are no English-language translations of these resources.

Link to the article