Once-Only

The Council of State has flagged legal problems with the so-called Once-Only bill, tabled two years ago by Digitalisation Minister Stephanie Obertin. The bill is designed to make the exchange of digital data between state administrations possible, so that citizens no longer have to supply the same information again and again. The idea is good. The legal framework is not.[1]

The Council of State's opinion, published last Friday, identifies a collision between the bill and the European GDPR. The legal text allows for a relatively free flow of data between public entities. GDPR requires data to be kept to a minimum, collected, consulted, or passed on only where a specific reason has been established. If every administration can share citizens' data with every other without a tighter legal framework, that principle is undermined.[1]

What the Council of State wants

The Council of State says the bill does not spell out clearly enough which public entities can exchange which data with which others, and in which cases. The legal text suggests this should be dealt with through protocols or Grand Ducal regulations. For the Council of State, that is not enough. It must be spelled out in law.[1]

The Council also proposes that data-sharing should initially be limited to central state administrations, leaving municipalities out for now. The text is too broad as written. Starting smaller would reduce the risk of data flowing further than anyone intended.[1]

The familiar frustration

The bill exists because of a familiar frustration. As a private individual or a company, you often have to supply the same information again and again, whether with the state or with municipalities, all of which takes time. Once-Only is meant to make life simpler. The Council of State is not arguing against the principle. It is arguing that the implementation, as drafted, would make life simpler on one side by creating legal exposure on the other.[1]

There is a parallel with the national building code, which aims to replace 100 municipal regulations with one national framework. Both reforms are about reducing fragmentation. Both run into the same question: who controls the data, who controls the rules, and what happens when something goes wrong. The Council of State is asking the right questions. The bill can be salvaged, but it will need to be narrower, clearer, and more explicit about who can share what with whom.[1]