3.12.2008   

EN

Official Journal of the European Union

C 308/1

1.

The proposal for a Regulation of the European Parliament and of the Council on European Statistics (hereinafter ‘the proposal’) was sent by the Commission to the EDPS for consultation, in accordance with Article 28(2) of Regulation (EC) No 45/2001, on 17 October 2007. In view of the mandatory character of Article 28(2) of Regulation (EC) No 45/2001, the EDPS welcomes the explicit reference to this consultation in the preamble of the proposal.

2.

On 5 September 2007, the EDPS delivered an Opinion on the proposal for a Regulation of the European Parliament and of the Council on Community statistics on public health and health and safety at work (COM(2007) 46 final) (hereinafter ‘Opinion on health statistics’) (1). This proposal had strong ties with the current more general proposal, as the former was developed against a legal background which is subject to modifications today. Therefore, as was underlined in the opinion on health statistics, under point 10, a close link exists between these two initiatives.

3.

Prior to the adoption of the Opinion on health statistics, a meeting held between the EDPS and Eurostat representatives led to the conclusion that ‘a common review of the processes put in place in Eurostat when dealing with individual records for statistical purposes should be conducted and may lead to the need for prior-checking’. It was also decided that ‘this common review should consist of the analysis of the minimum data set required for each processing operation and an analysis of the processing operations implemented in Eurostat’. Both elements were included in the conclusion of the above mentioned Opinion. The EDPS is currently working together with Eurostat's services in order to conduct this common review (2).

4.

Moreover, on 20 December 2007, the EDPS provided comments to the LIBE committee of the European Parliament on the Proposal for a Regulation on Population and Housing Censuses (3). Although not formally consulted by the European Commission on the proposal, the EDPS underlined the relevance of data protection in that context. He also reiterated his concerns about the crucial importance of correctly defining the legal framework in which statistical data are processed and the need for clarifications of certain definitions.

5.

Finally, the EDPS, as member of the Article 29 Working Party, actively participated in the preparation of the opinion on the concept of personal data (4), which also analyses certain aspects pertaining to statistical data.

6.

According to the explanatory memorandum, the proposal aims to revise the existing basic legal framework governing the production of statistics at European level with a view to adapting it to the current reality and also to improving it to meet future developments and challenges. In the view of the Commission, European Statistics constitute an essential contribution to building the information capacity required to sustain EU strategic objectives and the underlying policies and supporting instruments.

7.

Furthermore, the Commission states that there are also calls for a certain degree of flexibility in the statistical confidentiality regime to allow controlled access to detailed statistical data without compromising the high level of protection that confidential statistical data require. The exchange of confidential data within the European Statistical System (ESS) and the rules for access to such data for research purposes are essential elements in this regard and require modernisation of the current legal requirements.

8.

Article 285 of the Treaty establishing the European Community lays down the legal basis of statistical activities at European level. This Article sets out requirements relating to the production of Community statistics and, as underlined in its paragraph 2, requires ‘conform[ity] to [standards of] impartiality, reliability, objectivity, scientific independence, cost-effectiveness and statistical confidentiality’. The current proposal puts forward several modifications to the existing legal framework, for instance by the improvement of statistical governance or the consolidation of the activities of the European Statistical System (EES), as well as by the introduction of more flexibility in the current rules on statistical confidentiality whilst preserving a high level of data protection (5).

9.

As to the goals of the proposal, it aims to simplify the existing legal framework for the production and dissemination of statistics at European level, in particular through consolidating into one single instrument a number of separate texts of Community statistical legislation. This existing legal framework to be repealed, is composed of the following legislative acts:

10.

The proposal seeks to maintain the implementing measures set out in Commission Regulation (EC) No 831/2002 of 17 May 2002 implementing Council Regulation (EC) No 322/97 on Community Statistics concerning access to confidential data for scientific purposes (9) and Commission Decision 2004/452/EC of 29 April 2004 laying down a list of bodies whose researchers may access confidential data for scientific purposes (10).

11.

Moreover, since it is important to ensure close cooperation and appropriate coordination between the ESS and the European System of Central Banks (ESCB), the current proposal shall apply without prejudice to Council Regulation (EC) No 2533/98 of 23 November 1998 concerning the collection of statistical information by the European Central Bank (11). However, as Eurostat is undergoing a common review of data processing, the results found should also be applicable to the situation of the ECB.

12.

The EDPS will focus his analysis on the elements of the proposal which may have an impact on the protection of personal data.

13.

Recital 18 states that ‘(t)he right to respect for private and family life and to the protection of personal data, as set out in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union should be ensured’.

14.

Moreover, Recital 19 of the proposal states that ‘this Regulation (“proposal”) ensures the protection of individuals as regards the processing of personal data and specifies, as far as European Statistics are concerned, the rules laid down in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and in Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data’.

15.

The EDPS welcomes these two recitals in that they confirm that data protection is an important element to be considered when dealing with statistical data. However, the EDPS would favour, in Recital 18, the use of a more positive wording, similar to the one used in Recital 19, therefore amending it as follows: ‘This Regulation ensures the right …’.

16.

The EDPS also welcomes the development of a ‘European Approach to Statistics’, as developed in Recitals 12 and 13. Part of this approach consists in determining the authorities producing the statistics. Actually, although European statistics are usually based on national data produced by national statistical authorities, they may also be produced from non-published national contributions, from subsets of national contributions and from European statistical surveys or by harmonised concepts or methods. From a data protection point of view, it is important to determine the authority which is in control of the data used in producing the statistics. Indeed, this body shall bear the responsibilities attached to the status of data controller according to Directive 95/46/EC, including in relation to the right of information, the rights of access and rectification of the data subjects, and the right to know the recipients of the data (in this case Eurostat is a recipient of the data), whenever these rights are applicable.

17.

In his Opinion on health statistics, the EDPS analysed the parallelism between the concept of confidential data and the one of personal data. He concluded that statistical confidentiality and data protection, although presenting similarities in wordings, cover two different concepts (12). The EDPS underlined the possibility of confusion between the two notions and the need to clearly address the differences between data protection and statistical confidentiality.

18.

As regards the statistical principles, the EDPS would like to specifically address Article 2(1)(e) of the proposal, which defines the principle of statistical confidentiality. First, the EDPS sees that, unlike in Regulation (EC) No 322/97, the expression ‘statistical units’ is being replaced by the one of ‘statistical data subjects’. The definition is further defined in Article 3(7).

19.

The EDPS does not agree with the change of definition, for the same reason as he underlined in his Opinion on health statistics the need to clearly understand the differences of concepts in the respective domains. The concept of ‘data subject’ is an important notion of Directive 95/46/EC when defining ‘personal data’ and this notion relates exclusively to natural persons. However, the definition of statistical confidentiality relates not only to natural persons, but also to households, economic operators and other undertakings. Therefore, the EDPS suggests that the proposal should keep the notion of statistical units, because, in this case, both natural persons and households, economic operators and other undertakings are covered in a way that does not create confusion with the data protection legal framework.

20.

The EDPS welcomes the formulation of Article 5, which foresees the publication of a list of the other national authorities designated by Member States on the website of the Commission (Eurostat). This list will foster transparency on the authorities competent to provide Eurostat with relevant data on statistical units.

21.

Article 10 of the proposal is entirely dedicated to the level of quality which is expected when statistical data are produced. It lists quality dimensions which must be respected. The proposal states that in applying these quality dimensions, the modalities (sic), structure and periodicity of quality reports provided for in sectoral legislation shall be defined by the Commission in accordance with the regulatory procedure referred to in Article 27(2) of the same proposal. The EDPS would like to stress that Article 4 of Regulation (EC) No 45/2001 defines principles relating to data quality. The EDPS believes that Eurostat should take these principles into account when, according to paragraph 3 of Article 10 of the proposal, it shall assess the quality of data that Member States transmit to it. Therefore, the EDPS suggests the following modification to the second sentence of paragraph 3: ‘The Commission (Eurostat) shall assess the quality of data transmitted, also in view of data protection requirements , and publish the reports’.

22.

Furthermore, Article 10(2) foresees the application of these quality dimensions to data covered by sectoral legislation in specific statistical domains. In the case that such sectoral legislation would be adopted, Article 10(2) states that the modalities, structure and periodicity of quality reports provided for in sectoral legislation shall be defined by the Commission. The EDPS wants to remind that he expects to be consulted on the sectoral legislation which could be adopted on statistics by the Commission in order to analyse its compliance with Regulation (EC) No 45/2001.

23.

Regarding dissemination, the EDPS agrees with Article 18 of the proposal allowing dissemination of statistical data through anonymised records. However, the EDPS would like to draw the attention to the general concept of ‘anonymisation’.

24.

When considering anonymity from a data protection point of view, account should be taken of the interpretation of the Article 29 Working Party in its opinion on the concept of personal data (13). In its view, based on Directive 95/46/EC, anonymised data is any information relating to a natural person where the person cannot be identified, whether by the data controller or by any other person, taking account of all the means likely reasonably to be used either by the controller or by any other person to identify that individual. Anonymised data would be anonymous data which previously referred to an identifiable person, no longer identifiable.

25.

In his Opinion on health statistics, the EDPS already underlined that although the notion would, from a data protection point of view, cover data that are no longer identifiable, from a statistical point of view, anonymous data are data for which no direct identification is possible. This definition implies that the possibility of indirect identification would still qualify the data concerned as anonymous from a statistical point of view, but not necessarily from a data protection point of view.

26.

Therefore, in order to avoid any confusion between the two interpretations, the EDPS would propose to amend Article 18 of the proposal as follows: ‘Individual data may be disseminated in the form of a public use file consisting of anonymised records which have been prepared in such a way that the statistical unit cannot be identified, either directly or indirectly , when account is taken of all relevant means that might reasonably be used by a third party’. This clarification should avoid any uncertainty regarding the data which may be made available for public use.

27.

Article 20 sets the general rule on transmission of confidential data between national authorities and between national authorities and the Commission, as well as sets the rules on the exchange of confidential data for statistical purposes between the ESS and the ESCB. Article 20(1) of the proposal states that these transmissions are necessary for the development, production or dissemination of European Statistics, justifying the planned transfers. The EDPS considers that such transfers taking place between Eurostat and the national authorities and between Eurostat and the ECB comply with the conditions of necessity provided for in Articles 7 and 8 of Regulation (EC) No 45/2001. Moreover, the EDPS supports the sentence of Article 20(1) which foresees that ‘any further transmission must be explicitly authorised by the national authority that collected the data’. Besides, in its opinion on the proposal, the ECB (14) suggested some amendments to Article 20 in order to reflect the legal basis of its competences in processing statistical data and on the exchange of confidential data for statistical purposes between the ESS and the ECB. The EDPS agrees with the drafting modifications of the proposal made by the ECB.

28.

Although Article 22 introduces the possibility of granting access to confidential data under certain conditions to be established, the EDPS would like to remind that the release of the data sets to researchers is governed by Regulation (EC) No 831/2002, which is not repealed by the current proposal (see Recital 29 of the proposal). Therefore, besides compliance with Regulation (EC) No 45/2001 the specific rules established in the above mentioned Commission Regulation regarding access to anonymised microdata for scientific purposes will have to be taken into consideration by any modalities, rules and conditions for access established by the Commission.

29.

The EDPS welcomes the proposal for a Regulation on European statistics. This Regulation would give a firm and general legal basis to the development, production and dissemination of statistics at a European level.

30.

However, the EDPS would like to stress the following points: