The Technology Disputes Law Review: Luxembourg

Overview

i Intellectual property disputes

Luxembourg has a long history of protecting intellectual property (IP) rights, and especially patents, trademarks, designs and copyrights (including software) and related rights.

Luxembourg patents are governed by the Law of 20 July 1992 on patents, as amended. A Luxembourg patent provides protection for a maximum of 20 years. Luxembourg patents are granted for inventions that are new, involve an inventive step, are likely to have an industrial application and are not excluded from patentability (as is the case for computer programs). Computer programs may, however, be indirectly covered by a patent. Luxembourg patents must be filed with the Intellectual Property Office of the Luxembourg Ministry of Economy.

Copyrights and related rights are governed by the Law of 18 April 2001 on copyright, related rights and databases, as amended (the Copyright Law). This Law protects works of a literary or artistic nature of any kind, including databases and computer programs, in principle for 70 years from the death of the author. Copyright protection applies to the structure of databases that possess a level of creativity or originality in the arrangement of content and constitute their authors' own intellectual creation. Copyright protection does not extend to the contents of the database. Producers of a database also have a specific right (sui generis right) when they show a substantial investment (qualitatively or quantitatively, or both) in the obtaining, verification or presentation of the contents of the database.2

The look and feel of the graphical interface of a piece of software, an application or a website can be protected by copyright if they are original (i.e., bear their author's personality) and can also be protected as a registered design. In Luxembourg, registered designs are protected at Benelux level in compliance with the Benelux Convention on Intellectual Property of 16 May 2006, as amended (the Benelux Convention) or as a Community design at EU level. A design protects the appearance of a product (features, shapes, lines, contours, ornamentations, etc.). It must be new and have an individual character. A design gives the right holder an exclusive right for a period of five years, which can be extended for four consecutive periods up to a maximum total of 25 years.

It is also possible to register as a trademark the logos, icons or other distinctive signs used for an interface and contributing to its look and feel. As with designs, there are no Luxembourg-specific trademarks. Trademarks are protected either through Benelux trademarks, which are governed by the Benelux Convention and administered by the Benelux Office for Intellectual Property, or EU trademarks. A Benelux trademark covers the entire territory of the Netherlands, Belgium and Luxembourg and is valid for 10 years from the date of filing of the application. It can be renewed indefinitely for further periods of 10 years.

The Law of 22 May 2009 on the enforcement of intellectual property rights (the Enforcement Law), implementing Directive 2004/48/EC of 29 April 2004, has harmonised the civil procedures open to IP right owners to protect their rights, as well as the compensation they may receive as damages in cases of infringement, thus clearly facilitating the fight against IP rights infringements.

Most technology disputes consist in copyright infringement (use of software without permission or in violation of the terms of the licence granted).

Additionally, a law on trade secrets entered into force in Luxembourg on 26 June 2019 (the Trade Secrets Law), implementing Directive (EU) 2016/943 on the protection of undisclosed know-how and business information against their unlawful acquisition, use and disclosure. This Law lays down rules on protection against the unlawful acquisition, use and disclosure of trade secrets. Confidential information can also be protected under Luxembourg law through:

  1. civil liability (unfair competition or passing off);
  2. contractual liability (breach of a non-disclosure agreement or confidentiality clause); and
  3. criminal law (disclosure of trade secret by an employee or director).

ii System development and service delivery disputes

Disputes regarding system development and service delivery are quite frequent in Luxembourg. These are usually complex cases, requiring the assistance of a lawyer with specialised knowledge of information technology (IT) law. They are often settled amicably, to avoid reputational risk.

Difficulties frequently arise from the fact that the contractual framework for an IT project is not well thought out beforehand. It is, however, of utmost importance to establish at all levels of the service or system each party's undertakings (i.e., who does what and how) and to anticipate the risks (e.g., who is responsible in the event of difficulties, how to get out of the contract and what the applicable penalties are). Also, given that the Grand Duchy of Luxembourg operates in a very international context, determining in advance which jurisdictions will be competent in the event of litigation can prove decisive.

This is particularly true for maintenance contracts. To avoid any uncertainty or risk of inconsistency, maintenance must be negotiated during the discussions on the development contract or the licence agreement. The ability and willingness of the service provider to maintain the software should be taken into account by the client in the selection of the service provider. Similarly, the terms and conditions of maintenance (e.g., the possibility of benefiting from new versions) may influence the conditions (in particular the price) of the development or licence.

The service level agreement (SLA) should be written in such a way that it allows for the effective management of the service and reduces conflict areas by eliminating unrealistic expectations. In this respect, note that in the event of contractual non-performance by the service provider (e.g., refusal to carry out maintenance), the client may have the service provider ordered to carry out maintenance under contractual penalty payment terms, or be authorised by the judge to have the software maintained by another service provider at the expense of the first. A key point here is the access to the software source code, which should ideally be put under escrow in the hands of a third party.

Indeed, if not regulated contractually, access to the source code can be difficult to negotiate in the event of a dispute – and this is frequently a source of dispute. This is why it is strongly advised to stipulate in the contract that the client can access the source code in the event of a contractual breach by the supplier or in the event that the supplier faces insolvency proceedings. To this end, the use of an escrow clause is highly recommended.

iii Data processing disputes

Data protection litigation is relatively recent in Luxembourg and coincides with the entry into force of the EU General Data Protection Regulation (GDPR).3 In fact, previously, the Luxembourg supervisory data protection authority (CNPD) was very cautious about imposing sanctions. Since the adoption of the GDPR and the reinforcement of the sanctioning powers of the European data protection supervisory authorities, the CNPD has acquired greater human resources and it initiated several audit campaigns in 2018 relating to the function of data protection officer and to video surveillance and geolocation. Eight decisions imposing administrative fines were taken in June and July 2021. The amount of the fines is low (on average around €2,000, with a maximum of €18,000) compared to other jurisdictions.

This increase in the CNPD's investigative and sanctioning activities has led to increased litigation before the administrative courts, and more litigation is expected in the coming years.

iv Other disputes

Where the claimant does not hold any IP right on which to base its action (for example, to defend an underlying concept or idea), a technology dispute may be tackled through either unfair competition or passing-off legislation.

Other disputes that are quite frequent consist in defamation and other offences committed via the internet or social media.

Finally, a large number of Luxembourg entities have entered into cloud computing contracts (infrastructure as a service (or IaaS), platform as a service (or PaaS), and software as a service (or SaaS)) to manage their IT infrastructures. These complex contracts require compliance with both civil contract law and the GDPR and, where applicable, with specific regulations applying to the financial sector, also with high security standards. Like other countries, the Grand Duchy of Luxembourg is not immune to cyberattacks of all kinds, and disputes may arise in this context in the event of breaches of information systems security.

Year in review

As mentioned above, 2021 marked an important turning point in terms of data protection, with the CNPD continuing the audits started 2018 and, in its most recent actions, the imposition of its first GDPR-related administrative fines. Furthermore, the increase in the CNPD's investigative and sanctioning activities has led to an increase in litigation before the administrative courts, and more litigation is expected in the coming years. Among ongoing litigation is the case launched in January 2021 by Noyb, the data protection defence platform launched by Mr Max Schrems, against two CNPD decisions concerning two American companies, RocketReach and Apollo.

In 2020, we also witnessed a sharp increase in cyberattacks, some of which really tested the information security systems of the local IT service providers, causing difficulties in terms of data availability. Litigation is therefore expected in 2021. In general, strengthening the cybersecurity ecosystem is one of the government's priorities as this is considered to be the keystone of a trusted digital economy for the country. As the Minister of the Economy, Mr Franz Fayot, pointed out in 2020, cybersecurity is not an individual challenge, but a collective challenge and above all a shared responsibility.

Claims and remedies

The following civil remedies and compensatory measures are applicable in Luxembourg in cases of IP infringement (non-contractual claims or based on a contractual breach):

  1. cessation of the infringement, subject to a recurring penalty;
  2. civil damages to compensate the loss suffered, including the seizure of any counterfeiting goods and infringing material and their delivery to the right holder;
  3. corrective measures, such as recall and definitive removal from the channels of commerce of the infringing goods, or destruction of the materials and instruments that have been used primarily in the creation or manufacture of such goods, at the expense of the infringer;
  4. publication and posting of the judgment, at the infringer's expense;
  5. in the case of bad faith on the part of the infringer, the transfer to the right holder of all or part of the profit made in relation to the infringement; and
  6. in the case of bad faith on the part of the infringer, the transfer to the right holder of the infringing goods and materials.

When assessing the amount of damages to be awarded, Luxembourg courts apply the compensation criteria stated by law. In particular, regarding IP rights, the Enforcement Law provides criteria for the calculation of damages in infringement matters. When setting the damages, the court shall:

  1. consider all appropriate aspects, such as the negative economic consequences that the injured party has suffered, including lost profits, any unfair profits made by the infringer and, in appropriate cases, elements other than economic factors, such as moral prejudice caused to the right holder by the infringement; and
  2. alternatively, in appropriate cases, set the damages as a lump sum on the basis of elements such as at least the amount of royalties or fees that would have been due if the infringer had requested authorisation to use the IP right in question.

The burden of proof of the loss suffered by the plaintiff as a result of the infringement lies with the plaintiff and it can be very difficult for the right holder to provide evidence of this kind. For this reason, Luxembourg judges often prefer to award the right holder a lump sum covering an estimation of the negative economic consequences that the right holder has reasonably been found to have suffered. Luxembourg judges are not following EU and French case law, according to which the standard royalty rate for trademark licensing is almost always increased and sometimes doubled to take account of the fact that the infringer has not negotiated a licence with the IP right owner. (See also Section V.)

The amount of damages is therefore usually very modest and the decisions are not very detailed regarding how this is calculated. Punitive damages are not allowed under Luxembourg law.

In addition, copyright infringement can give rise to criminal sanctions. In fact, in Luxembourg, copyright infringement is considered both a criminal offence and a civil law violation and the Copyright Law outlines specific provisions regarding both. As a criminal offence, copyright infringement is punishable if the violation of the rights of the author of a protected work is malicious or fraudulent. Infringers may be held liable to a fine of €251 to €250,000. These amounts may be doubled where the offender is a legal entity.

Under the Trade Secrets Law, trade secret holders can obtain the cessation or prohibition of use or disclosure of their trade secrets, as well as the removal or destruction of infringing goods on the market, and damages, which are calculated according to the same method as for IP infringement.

Contractual breaches also give rise to the allocation of damages. It is up to the claimant to provide relevant evidence to the court to allow it to determine the amount to be allotted. As a rule, the damage suffered by the plaintiff must be the direct and immediate consequence of the breach. The amount of the damages may be determined contractually in advance by the parties. Contractual penalty provisions of this kind are duly enforceable in business-to-business (B2B) relationships. However, to avoid abuses, the Luxembourg Civil Code provides that such provisions may be reviewed by the judge in two different situations:

  1. when the amount of the penalty is manifestly excessive or derisory in relation to the damage suffered, the judge may intervene to reduce or increase the amount; and
  2. in the event of partial non-performance of the obligation, the judge may intervene to modify the amount of the lump-sum compensation in proportion to the obligation performed.

Finally, it should be noted that it is common practice, in both contractual and non-contractual proceedings, to request the court to order that damages are accompanied by a daily penalty payment.

Courts and procedures

Luxembourg is divided into two judicial districts, Diekirch and Luxembourg City. There are three lower courts (i.e., justices of the peace), located in Esch-sur-Alzette, Luxembourg City and Diekirch, which deal mainly with civil and commercial matters for claims up to €15,000 and which also have exclusive jurisdiction for specific matters such as employment or leaseholds. There are two district courts, located in Diekirch and Luxembourg City, which deal with civil and commercial claims exceeding €15,000 or when the amount of the claim cannot be determined or when a claim is not subject to any other specific jurisdiction.

As an exception, patent and design infringement proceedings are exclusively heard by Luxembourg City District Court, whatever the value of the claim. EU trademark infringement proceedings and actions based on the Trade Secrets Law are also heard exclusively by this court.

Competence for copyright and related rights and Benelux trademark infringement actions vests with either the lower courts, for claims up to €15,000, or the district courts, for claims exceeding €15,000 or when the amount of the claim cannot be determined. The same rules apply to unfair competition, passing off and contractual claims, unless the parties have agreed contractually on another jurisdiction.

Hearings take place before a single judge in the lower courts whereas a college of three judges presides over hearings in the district courts. Interim remedy procedures are generally held before a single judge, as are summary proceedings.

Although there are no specialist courts or judges for technology disputes (including for IP matters), cases regarding technology disputes are generally allocated to the same specific chamber of the Luxembourg City District Court.

The Enforcement Law provides for summary procedures, which are applicable to all IP rights and allow the IP right holder to request from the president of the district court the following interim remedies:

  1. an interim injunction against the alleged infringer to stop presumed infringing activities and, where applicable, subject to a penalty payment;
  2. the precautionary seizure or delivery up of presumed infringing goods and, in some cases, of movable and immovable property of the alleged infringer (including blocking its bank accounts); and
  3. continuation of the activity, subject to the lodging of guarantees intended to ensure compensation of the patent holder.

An interlocutory injunction may also be issued, under the same conditions, against an intermediary whose services are being used by a third party to infringe an IP right.

These provisional measures are revoked and cease to have effect if the claimant does not bring, within one month, proceedings leading to a decision on the merits of the case before the competent judicial authority.

Similar provisional measures are set out by the Enforcement Law. Furthermore, the trade secret holder may also request from the president of the district court any of the following provisional and precautionary measures against the alleged infringer:

  1. the cessation of or, as the case may be, the prohibition of the use or disclosure of the trade secret on a provisional basis;
  2. the prohibition of the production, offering, placing on the market or use of infringing goods, or the importation, export or storage of infringing goods for those purposes; and
  3. the seizure or delivery up of the suspected infringing goods, including imported goods, to prevent their entry into, or circulation on, the market.

As an alternative, the district court can make the continuation of the alleged unlawful use of a trade secret subject to the lodging of guarantees intended to ensure the compensation of the trade secret holder.

The length of a proceeding depends on the complexity of the matter, but the estimated time to obtain a first-level decision is six months to one year for commercial matters (oral proceedings) and one and a half years to two and a half years for civil matters (written proceedings). In practice, because of the complexity of technology matters, and the fact that judges do not have specialised knowledge, these are undertaken as written rather than oral proceedings.

The following limitation periods for bringing an action apply:

  1. 10 years for all obligations originating in the course of trade;4 or
  2. 30 years in all cases where a shorter period is not provided for.5

Evidence and witnesses

Luxembourg is a civil law country, with no real equivalent to the pretrial discovery proceedings known in common law countries. Furthermore, under Luxembourg civil law, as a rule, the burden of proof lies with the claimant (except in counterclaims or defence arguments), which has to offer evidence to support its case. This rule applies to both contractual and non-contractual claims. In contrast, in criminal cases, police officers are in charge of recording criminal law offences, searching for the perpetrators and gathering evidence.

In principle, any form of proof is admissible, but it must not have been obtained through illegal or unfair means. The judge may reject as inadmissible any document or element that has not been fairly and legally collected, such as evidence in breach of the principle of confidentiality of correspondence as set out by the Law of 11 August 1982 on privacy, or evidence from illegal video surveillance, in breach of the GDPR. Furthermore, use of such evidence would in turn put the claimant at risk of being held liable. It is therefore very important to ascertain, particularly prior to conducting a forensic IT investigation, what the associated risks would be, in order to take preventive measures to help mitigate these risks.

According to the adversarial principle, each party must disclose its evidence in due time and voluntarily to the opposing party and to the courts before the pleading (oral proceedings) and, in any case, prior to the closure of the proceeding (written proceedings). Various types of evidence are admissible (written documents, testimonials, presumptions, confessions, declarations under oath) and can be either written or oral, excluding correspondence between clients and their lawyers and between lawyers, unless the correspondence is marked as official.

For technical matters, third-party experts can be appointed by the court on its own initiative or at the request of one of the parties. When an expert is requested by a party, the claimant is responsible for organising the provision of expertise and has to incur the associated costs. The adverse party will of course be ordered to reimburse the amounts paid by the other party if the other party succeeds in its claims. The role of the expert is to provide, in a simple statement, specialist advice or expertise, a technical explanation or a clarification of the situation before the court. The appointment of an expert cannot override a failure of the claimant to provide evidence required of the claimant, and is only intended to supplement the evidence at the claimant's disposal. For example, the appointment of an expert to calculate the damage suffered by the IP right owner is rarely accepted by Luxembourg courts for that reason: it is up to the IP right owner to prove the infringement (if necessary, by requesting measures to preserve evidence prior to initiating proceedings – see below).

However, note that when the court considers that the infringement is established, the infringer or any third party (including any intermediary whose services are being used by a third party to infringe IP rights) can, upon the request of the right holder, be ordered to disclose any relevant information as to the origin and distribution networks of the goods or services that infringe an IP right (the right to information). Also, the court may, under certain circumstances and even in pretrial proceedings (summary proceedings), order the production of specific pieces of evidence in possession of the opposing party or a third party. This rule only applies insofar as IP rights over software are concerned.

Additionally, the Enforcement Law provides for measures to preserve evidence available to IP right holders. Under certain circumstances, before initiating proceedings on the merits of the case, right holders may request the president of the district court to order a detailed description of any goods, element, document or process likely to establish the presumed infringement, its origin, destination and scope, as well as the materials and implements used to produce or distribute the infringing goods. The court may also order the physical seizure of these goods, materials and implements or issue a restraint order regarding the sequestration of the income and benefits stemming from the alleged infringement. For such an order to be granted, right holders need to present reasonable evidence that their IP rights are being infringed or are about to be infringed.

Finally, under the Trade Secrets Law, trade secret holders can, in the course of legal proceedings, apply to the Luxembourg courts for protective measures to prevent the disclosure or use of trade secrets.

The Luxembourg City District Court may, upon a duly reasoned application by a party or on its own initiative, take the specific measures necessary to preserve the confidentiality of any trade secret or alleged trade secret used or referred to in the course of legal proceedings relating to the unlawful obtaining, use or disclosure of a business secret. These measures shall include, at least, the possibility of:

  1. restricting access to any document containing trade secrets or alleged trade secrets submitted by the parties or third parties, in whole or in part, to a limited number of persons;
  2. restricting access to hearings when trade secrets or alleged trade secrets may be disclosed, and restricting the corresponding record or transcript of those hearings to a limited number of persons; and
  3. making available to any person other than those comprising the limited number of persons referred to above a non-confidential version of any judicial decision, in which the passages containing trade secrets have been removed or redacted.

The number of persons referred to above shall be no more than is necessary to ensure that the parties to the proceedings have the right to an effective remedy and access to an impartial tribunal and shall include, at least, one natural person for each party and the lawyer of each party or other representatives of those parties to the court proceedings.

When deciding on the measures referred to above and assessing their proportionality, the court shall take into account the need to ensure the right to an effective remedy and to a fair trial, the legitimate interests of the parties and, where appropriate, of third parties, and any potential harm to either of the parties, and, where appropriate, to third parties, resulting from the granting or rejection of the measures.

Any person who fails or refuses to comply with the ordered measure shall be liable to a civil fine of between €251 and €45,000.

Enforcement

As a rule, judgments are directly enforceable after the original judgment has been served upon the opposing party by a bailiff, at the request of the successful party, and after the set period for launching an appeal expires. To obtain a ruling in relation to any enforcement difficulties, the claimant will have to take the case back to the court that delivered the judgment. If the opposing party does not comply with the judgment and refuses to pay the damages awarded, the winning party can initiate bank account seizures and freeze the losing party's assets.

Alternative dispute resolution

According to Luxembourg civil procedural rules, judges shall encourage the parties to settle claims amicably. That being said, in Luxembourg the main alternative dispute resolution mechanism for civil and commercial B2B matters is arbitration. Mediation or the consumer ombudsman service can also prove effective tools in the resolution of disputes between consumers and professionals.

Arbitration is not commonly used in technology disputes, except in international matters of a certain importance. Furthermore, it has been noted that while in the past ad hoc arbitration has been used more often than institutional arbitration, parties nowadays seem to resort increasingly to institutional arbitration in their arbitration clauses.

Outlook and conclusions

With the largest number of Tier IV data centres in Europe (20 per cent of the world's certified Tier IV data centres), and with high standards in both data protection and information security, Luxembourg tends to be seen as a strong data vault in Europe. Over the past years, Luxembourg has also multiplied the initiatives to develop the technology start-up ecosystem, especially in the fintech sectors, and to reinforce confidence in the country's digital framework. For several years, the Luxembourg police have had a specialised cybercrime unit, which has proved efficient and obtained significant results. Luxembourg also has strong expertise in encryption techniques and a protective legal framework in this respect. Under this framework, there is no legal obligation to escrow the keys needed to decrypt encrypted data, which means that such data may only be accessible to the client: this offers a guarantee of confidentiality and control over the data. Also, Luxembourg offers protection in the event of bankruptcy of cloud providers. The law provides clients with a right to claim back intangible and non-fungible movable assets from a bankrupt cloud company. In the financial sector, Luxembourg recently (in May 2021) increased its security standards by making the European Banking Authority guidelines on outsourcing agreements binding for all financial sectors, including IT providers acting for clients in the banking and financial sector. The number of technology disputes before the courts has tended to increase over the years and we can thus expect judges to become more and more knowledgeable in this area.

Footnotes

1 Claire Leonelli is a partner and Claire Denoual is a counsel at /c law.

2 Articles 67 to 70 of the Copyright Law.

3 Regulation (EU) 2016/679 of the European parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

4 Article 189 of the Luxembourg Commercial Code.

5 Article 2262 of the Luxembourg Civil Code.

Get unlimited access to all The Law Reviews content