12.5.2012   

EN

Official Journal of the European Union

C 137/1

1.

On 19 December 2011, the Commission adopted a Proposal for a Directive of the European Parliament and of the Council amending Directive 2005/36/EC on the recognition of professional qualifications and Regulation […] on administrative cooperation through the Internal Market Information System (3). The Proposal was sent to the EDPS for consultation on the same date.

2.

Before the adoption of the Proposal, the EDPS was given the possibility to provide informal comments. Many of these comments have been taken into account in the Proposal. As a result, the data protections safeguards in the Proposal have been significantly strengthened.

3.

The EDPS welcomes the fact that he is also formally consulted by the Commission and that a reference to this Opinion is proposed to be included in the preamble of the instrument to be adopted.

4.

The objective of the Proposal is to modernize and amend the existing text of Directive 2005/36/EC (the ‘Professional Qualifications Directive’). To achieve this objective, the Commission also proposes that the references to provisions of the revised Professional Qualifications Directive be amended in relevant parts of Regulation […] on administrative cooperation through the Internal Market Information System (‘IMI Regulation’) (4).

5.

From the data protection perspective, the two key aspects of the Proposal are (i) the introduction of an alert system (Article 56a) and (ii) the introduction on a voluntary basis of a European Professional Card (Articles 4a, b, c, d and e) (5). The processing of personal data in both cases is foreseen to take place via the Internal Market Information System (‘IMI’).

6.

Alerts are issued, in principle, after a decision has been made by a competent authority or a court in a Member State prohibiting an individual from pursuing his or her professional activities in its territory (6). Alerts can be issued concerning any professional subject to the Professional Qualifications Directive including professionals who have not applied for a European Professional Card. After being issued, alerts are stored in IMI and all Member States and the Commission have access to them.

7.

The introduction of a European Professional Card involves the creation and storage of an information file in IMI on the professionals who voluntarily subscribed to the card (the ‘IMI-file’). The information in the IMI-file is accessible by the professional, as well as by the ‘host’ and the ‘home’ Member States. At any time the professional can request the deletion, blocking or rectification of information in the IMI-file.

8.

The alert data and some of the data in the IMI file include information on offences or administrative sanctions, and as such, require heightened protection under Article 8(5) of Directive 95/46/EC and Article 10(5) of Regulation (EC) No 45/2001. The alert system may affect the right to data protection of a large number of individuals of different professional groups in all Member States, including medical practitioners, whether or not they actually pursue or intend to pursue their activities outside their home countries.

9.

Further, the Proposal also raises important issues on how the alert system and the repository function will develop in IMI in the future. This is a horizontal issue also relevant for administrative cooperation in other policy areas.

10.

The EDPS welcomes the efforts made in the Proposal to address data protection concerns. The EDPS also welcomes the fact that the use of an existing information system, IMI, is proposed for the administrative cooperation, which already offers, at the practical level, a number of data protection safeguards. Nevertheless, important concerns remain, mainly relating to the alert system.

11.

To address these concerns, the EDPS recommends that the Proposal specify unambiguously in which concrete cases alerts can be sent, more clearly define what type of personal data can be included in alerts, and limit the processing to the minimum that is necessary, taking into account proportionality and balancing of rights and interests. In particular, the Proposal should:

12.

Article 56a introduces two — to some extent different — alert systems for two different categories of professionals:

13.

The EDPS takes note of the establishment of a limited alert system at the European level to exchange information among the competent authorities concerned about professionals who have been prohibited from pursuing their professions in a Member State, for important public interests, such as in professions where human life, health and safety (as well as animal welfare) are paramount, or in other professions in situations where this is justified to prevent serious damage to the health and safety or to the environment.

14.

However, the EDPS considers that the alert systems must remain proportionate.

15.

In this respect the EDPS welcomes the improvements in the text following his informal comments. These improvements — although they still require further clarifications — appear to aim at limiting the alerts to professionals who have been prohibited from pursuing their professions by a decision of a competent authority and appear to exclude the possibilities of sending alerts based on mere suspicions or complaints against a professional if this is not supported by clear evidence and has not lead to a formal decision of the competent authority or a court prohibiting the individual from pursuing his or her activities. This may help ensure legal certainty and may help respect the presumption of innocence.

16.

In addition to recommending further clarifications on the conditions under which alerts can be sent and on the content of the alerts, the main remaining concerns of the EDPS relate to retention periods. The provisions on accuracy and updating of alerts, as well as on recipients could also benefit from further improvements. Finally, confidentiality obligations should also be explicitly set forth in the Directive.

17.

One of the key remaining concern of the EDPS about the alert system relates to the very nature of the alert system. The issue is whether the alerts foreseen under the Proposal would:

18.

As noted in our Opinion on the IMI Proposal (8), ‘it is one thing to use an alert as a communication tool to alert competent authorities of a particular wrongdoing or suspicion, and quite another to store this alert in a database for an extended or even undefined period of time’.

19.

The EDPS is concerned that the proposed Article 56a(5) leaves it to the Commission to identify — in delegated acts — how long alerts will remain in IMI. The EDPS recommends that these key provisions that define the very nature of the proposed alert system, and therefore, constitute essential elements, be set forth in the text of the proposed Directive itself.

20.

From the data protection point of view, it would be preferable if all alerts introduced in the system were to be deleted after a pre-determined, reasonably short period to be counted as of the time of sending the alert. This period should be sufficiently long (e.g. six months) so as to allow the competent authorities receiving an alert to ask follow-up questions via IMI and decide whether to take any specific action within their competence based on the information received. However, the period should not be longer than what is strictly necessary for this purpose.

21.

Alternatively, if the need for long-term retention is clearly justified, the EDPS recommends that the Proposal should, at a minimum, clearly require that the issuing authority deletes an alert immediately after the prohibition originating the alert is no longer in effect (for instance as the result of an appeal or because the prohibition was limited in time). It should also be avoided that an alert would unnecessarily apply for an indefinite period of time, perhaps even beyond retirement or death of the professional concerned.

22.

The EDPS welcomes the clarifications already made in the draft with regard to the content of the alerts. Further clarification, however, would still be necessary to ensure there is no ambiguity that the content of alerts under Article 56a(1) are clearly limited to (i) the personal data necessary to identify the professional concerned, (ii) the fact whether the professional has been prohibited from pursuing his/her professional activity, (iii) whether the prohibition is provisional (pending an appeal procedure) or definitive, (iv) for what period the prohibition applies and (v) the identity of the competent authority issuing the decision (indicating also the country in which the decision was issued).

23.

The EDPS further recommends that the Proposal expressly clarify that the alerts should contain no more specific information regarding the circumstances and reasons for the prohibition. In this respect, the EDPS notes that follow-up questions may be asked via the usual bilateral information exchanges when obtaining such additional information is necessary. IMI may also be used to provide additional generic information to case handlers regarding national procedures, to assist them making sense of information based on a different country's national procedures.

24.

In order to ensure legal certainty, it is essential to unambiguously clarify the conditions of sending alerts under Article 56a(2). The current wording refers to ‘gaining actual knowledge of any conduct, specific acts or circumstances which is related to such activity and which could cause serious damage to the health or safety of persons or to the environment in another Member State’. These provisions, in themselves, are not sufficiently clear and leave an excessively large margin of manoeuvre to case handlers to decide whether to send an alert.

25.

Importantly, it is not clear from the wording ‘actual knowledge’ whether a reasonable suspicion of some type of wrongdoing or other event is all that is required, or whether the facts will have to be fully investigated and established, in some type of administrative procedure, before an alert can be sent.

26.

The revised version of the Proposal refers to a reference to the decision of the competent authority prohibiting the professional from pursuing the professional activities. This is a significant improvement compared to previous drafts and — in our reading — appears to suggest that alerts can only be sent if a prohibition is already in place against the professional concerned based on a decision of the competent authority concerned.

27.

The text should, however, be further improved by unambiguously clarifying the requirement that the alert must be based on a prior decision by a court or a competent authority prohibiting a professional to pursue his or her professional activity. This should ensure legal certainty and prevent any misinterpretation.

28.

It should also be clarified, as in Article 56a(1), that the content of the alerts should be clearly limited to (i) the personal data necessary to identify the professional concerned, (ii) the fact whether the professional has been prohibited from pursuing his/her professional activity (iii) whether the prohibition is provisional (pending an appeal procedure) or definitive, (iv) for what period the prohibition applies and (v) the identity of the competent authority issuing the decision (indicating also the country in which the decision was issued).

29.

Article 56a(2) requires that alerts are to be sent to ‘other Member States concerned and the Commission’. The EDPS recommends that the text be modified to read that alerts are to be sent to ‘competent authorities in other Member States concerned and the Commission’. This formulation with ‘competent authorities’ is already used in Article 56a(1) with respect to alerts under that paragraph (9).

30.

The EDPS also recommends that the Proposal clearly require a periodic review by the uploading competent authority whether alerts are up-to-date, as well as prompt correction and withdrawal of alerts if the information they contain is no longer accurate, or needs to be updated. It would also be useful to ensure that the fact that a professional has appealed against an ‘alert’ under Article 56a(4), or has requested correction, blocking or deletion of the alert, be recorded in the alert information (for example, via sending an update on the alert) (10).

31.

The EDPS is aware that Member States laws and practices vary as to the extent how information regarding disciplinary action or criminal sanctions against medical or other professionals is shared among competent authorities, other organizations (such as hospitals) concerned, and the wider public. In a small number of countries, black-lists for certain professions are publicly available on the internet for anyone to consult. Others take a different approach and allow the public to consult only white-lists, that is, lists of professionals authorized to practice.

32.

So long as such different practices and national laws co-exist, the EDPS recommends that the Directive place an obligation of confidentiality on all competent authorities concerned regarding the alert data that they receive from another Member State, unless the data were made public in accordance with the law of the sending Member State.

33.

The EDPS welcomes the fact that following his informal comments, the Commission has significantly improved the clarity, legal certainty and data protection safeguards set forth in Article 4a of the Proposal.

34.

The remaining concerns of the EDPS relate to Article 4e(1) of the Proposal, which requires the ‘competent authorities of the home and host Member States’ to ‘update in a timely manner the corresponding IMI file with information regarding disciplinary action or criminal sanctions taken or any other serious specific circumstances which are likely to have consequences for the pursuit of activities of the holder of the European Professional Card under this Directive’.

35.

Article 4e(1) complements the existing provisions in Article 56(2), which already allows for bilateral exchanges under the same conditions. In particular, the existing 56(2) requires that ‘the competent authorities of the host and home Member States shall exchange information regarding disciplinary action or criminal sanctions taken or any other serious, specific circumstances which are likely to have consequences for the pursuit of activities under this Directive’.

36.

The EDPS has three main concerns regarding these provisions:

37.

First, both these provisions leave a large margin of manoeuvre to case handlers to decide whether to update the IMI file. For the reasons described when commenting on the lack of clarity of the conditions under which alerts under Article 56a(2) can be sent, it would be desirable here also if further clarifications were made. The EDPS would welcome at least a requirement that these updates should be made ‘without prejudice to the presumption of innocence’ (11). A more satisfactory solution would be for the Directive to require (as with respect to Article 56a(2) alerts discussed above) that any updates must be based on a prior decision by a court or a competent authority prohibiting a professional to pursue his or her professional activity. This should ensure legal certainty and prevent any misinterpretation.

38.

It should also be clarified, as for Article 56a alerts, that the content of the update should be limited to (i) the fact whether the professional has been prohibited from pursuing his/her professional activity (ii) whether the prohibition is provisional (pending an appeal procedure) or definitive, (iii) for what period the prohibition applies and (iv) the identity of the competent authority issuing the decision (indicating also the country in which the decision was issued). It should be avoided to provide further details such as whether the prohibition is a result of a criminal conviction or a disciplinary measure and what offences were committed. If an authority concerned requires such information in a specific case, it can always request such additional information in a bilateral information exchange (via IMI but outside of the IMI-file).

39.

Second, unlike bilateral information exchanges under the existing provision in Article 56(2), which are currently only retained in the IMI system for sixth months after the case closure, the IMI file is designed to stay in IMI for a potentially long period of time. Therefore, adequate provisions should also be made to ensure that any references to disciplinary actions or criminal sanctions taken or any other serious specific circumstances will be deleted from the IMI file in a timely manner once access to that information is no longer required.

40.

The proposed reference to deletion when ‘no longer required’ is helpful but — in our view — not sufficient to ensure consistency and legal certainty. The EDPS therefore recommends that the Proposal specify a sufficiently short retention period for the information exchanged. For the reasons explained above when discussing retention periods for alerts, it would be preferable if this information remained in IMI only as long as this is necessary for the recipient authority to take appropriate action (for example, a six-months period to take investigatory or enforcement action).

41.

Alternatively, if legislators opt for ‘long-term’ storage in the IMI-file of the prohibition, the EDPS recommends that the Proposal should, at a minimum, clearly require that the issuing authority deletes any reference to the prohibition once the prohibition is no longer in effect (for instance, as the result of an appeal or because the prohibition was limited in time).

42.

In the long term, if and when the use of Professional Cards and IMI will become widespread (this can happen for some or for all regulated professions subject to the alert system), the EDPS recommends that the Commission undertake a review of whether the Article 56a alert systems are still necessary and whether they cannot be replaced by a more limited, and thus, from the data protection point of view less intrusive, system. At such time, it can be considered, for example, whether, instead of alerts to be sent to all Member States, the information sharing can be limited to competent authorities in home and host Member States, which have access to the Professional Card and the IMI-file of the professional concerned.

43.

Finally, the EDPS further recommends that the EDPS and the Article 29 Working Party where national data protection authorities are also represented be consulted before the adoption of delegated acts referred to in Article 56a(5) and of any other delegated acts adopted under Article 58 which may have an impact on data protection. A data protection impact assessment should precede such consultation (12).

44.

The EDPS takes note of the establishment of a limited alert system at the European level to exchange information about professionals who have been prohibited from pursuing their professions in a Member State, where this is justified for important public interests.

45.

However, the EDPS considers that the alert systems must remain proportionate.

46.

The EDPS recommends, in particular, that:

47.

With regard to the European Professional Card and the related ‘IMI-file’, the EDPS recommends further clarifications on the conditions under which information concerning disciplinary action or criminal sanctions or any other serious specific circumstances must be included in the file, and the content of the information to be included, and also recommends clear limitation on the retention periods.

48.

Further, the EDPS recommends that in the long term, if and when the use of Professional Cards and IMI will become widespread, the Commission undertake a review of whether the Article 56a alert systems are still necessary and whether they cannot be replaced by a more limited, and thus, from the data protection point of view, less intrusive, system.

49.

Finally, the EDPS further recommends that the EDPS and Article 29 Working Party where national data protection authorities are also represented be consulted before the adoption of delegated acts referred to in Article 56a(5) and of any other delegated acts adopted under Article 58 which may have an impact on data protection. A data protection impact assessment should precede such consultation.