9.2.2012   

EN

Official Journal of the European Union

C 35/10

1.

On 18 May 2011, the Commission adopted a package of legislative instruments on the protection of the victims of crime. The legislative package includes a proposal for a Directive establishing minimum standards on the rights, support and protection of victims of crime (the ‘proposed Directive’) and a proposal for a Regulation on mutual recognition of protection measures in civil matters (the ‘proposed Regulation’) (3). Both proposals are accompanied by a Commission communication on strengthening victims' rights in the EU (4).

2.

The EDPS was not consulted under Article 28(2) of Regulation (EC) No 45/2001, despite the fact that the legislative initiative was included in the EDPS Inventory of priorities for legislative consultation (5). The present Opinion is therefore based on Article 41(2) of the same Regulation. The EDPS recommends that a reference to this Opinion is included in the preamble of the instruments adopted.

3.

The EDPS welcomes the policy objectives of the legislative package, which, in line with the Stockholm programme and its Action Plan, are to strengthen the rights of victims of crime and to ensure that their need for protection, support and access to justice is met (6).

4.

The proposed Directive is intended to replace Council Framework Decision 2001/220/JHA on the standing of victims in criminal proceedings (7). It lays down common minimum rules on the rights, support and protection of the victims of crime. In particular, the proposed Directive aims to ensure that victims are treated with respect, that the special needs of vulnerable victims are taken into account, that victims receive adequate support and information, and that they can participate in proceedings (8).

5.

The proposed Regulation aims to ensure that victims who benefit from a protection measure in a civil matter in one of the Member States are provided with the same level of protection should they move to another Member State, without having to go through a separate procedure (9). This measure complements the proposal for a Directive on the European Protection Order (the ‘EPO initiative’), dealing with the mutual recognition of protection measures taken in criminal matters. The EPO initiative, on which the EDPS issued an Opinion in October 2010 (10), is currently being discussed in the European Parliament and the Council.

6.

The protection of privacy and personal data plays a central role in the area of freedom, security and justice, as laid out in the Stockholm programme, and in particular in the context of judicial cooperation in criminal matters. In October 2010, the EDPS issued an Opinion on the EPO initiative, highlighting the need for a consistent data protection regime with regard to initiatives in the field of judicial cooperation in criminal matters (11). On this occasion, the EDPS stressed that the processing of data in the field of judicial cooperation in criminal matters is characterised by the particular sensitivity of the data involved and by the effects that the related processing may have on data subjects (12). It is therefore necessary to pay due attention to data protection aspects connected to initiatives in this area and introduce adequate rules and safeguards where necessary.

7.

According to the EDPS, the respect for privacy and personal data constitutes an essential element of the victim protection that the proposed instruments are intended to ensure. The present Opinion will therefore focus on the privacy-related aspects of the proposals and put forward ideas to improve or strengthen victim protection.

8.

Various provisions of the proposed Directive deal directly or indirectly with privacy and data protection (13). Generally speaking, the EDPS welcomes these provisions, as they are aimed at preserving victims' privacy. Nevertheless, he finds that the standards of protection could be in some instances strengthened and clarified, without prejudicing their nature as minimum standards.

9.

The EDPS' comments will focus mainly on the following aspects: (i) Article 23 of the proposed Directive dealing with the right to protection of privacy and relations with media; (ii) victims' rights of information and access to their own personal data; and (iii) the protection of the confidentiality of communications between the victim and victim support services. These aspects will be discussed in the following subsections.

10.

The main substantive provision of the proposed Directive dealing with privacy is Article 23 entitled ‘Right to protection of privacy’. Article 23(1) states that ‘Member States shall ensure that judicial authorities may adopt during the court proceedings, appropriate measures to protect the privacy and photographic images of victims and their family members’. The EDPS has various observations on this provision.

11.

Firstly, Article 23(1) does not cover the full right to protection of privacy of the victims of crime. The provision is much more limited in scope as it simply provides for the power of ‘judicial authorities’ to issue protective measures ‘during the court proceedings’. However, the protection of privacy should not only be guaranteed ‘during the court proceedings’, but also during the investigation and pre-trial phase. More generally, privacy should be ensured where necessary from the first contact with the competent authorities and also after the termination of court proceedings.

12.

In this respect, it is worth noting that several international instruments have adopted a more ambitious approach compared to Article 23(1). The Council of Europe Recommendation Rec(2006) 8 on assistance to crime victims, for instance, provides that ‘States should take appropriate steps to avoid as far as possible impinging on the private and family life of victims as well as to protect personal data of the victims, in particular during the investigation and prosecution’ (emphasis added) (14). Other instruments contain similar provisions (15).

13.

In view of the above, the EDPS recommends adding to Article 23 a first paragraph stating in more general terms that Member States shall guarantee as far as possible the protection of victims’ private and family life as well as the protection of victims’ personal data from the first contact with the official authorities and after the conclusion of criminal proceedings. Furthermore, the current Article 23(1) should be modified so as to enable judicial authorities to issue protective measures also ‘during criminal investigation’.

14.

Secondly, Article 23(1) does not contain any indication about the content of the specific measures that may be adopted by judicial authorities to preserve the victim's right to privacy. The EDPS understands the intention to leave Member States the maximum degree of flexibility in this area. However, greater precision may be helpful. In particular, the proposal could provide a list of minimum measures which judicial authorities may adopt, in accordance with national law, in order to protect the privacy of the victim (16). This may include for example the following categories of measures:

15.

Thirdly, Article 23 does not contain any provision guaranteeing the confidentiality of the information held by public authorities. In this regard, the Council of Europe Recommendation Rec(2006) 8 cited above again provides useful examples. At point 11, the Recommendation provides that States should require all agencies in contact with victims to adopt clear standards by which they may only disclose to a third party information received from or relating to a victim, under the condition that the victim has explicitly consented to such disclosure, or that there is a legal requirement or authorisation to do so. The EDPS urges the legislator to include a similar provision in the proposed Directive.

16.

The second paragraph of Article 23 provides that ‘Member States shall encourage the media to pursue self-regulatory measures in order to protect victims' privacy, personal integrity and personal data.’ Here, also, the proposal has adopted a minimalistic approach, by simply referring to the instrument of self-regulation.

17.

The EDPS understands the reasons for adopting a cautious attitude with regard to this subject and generally agrees with the Commission's approach. The relationship between media and privacy is extremely delicate and complex. It is also an area where, within the boundaries set out by the EU Charter of Fundamental Rights and the European Convention on Human Rights, different traditions and cultural differences across Member States may play an important role. This approach would also appear consistent with the present data protection framework (Article 9 of Directive 95/46/EC), which leaves quite some leeway to Member States in relation to the processing of data carried out for journalistic purposes or for the purpose of artistic or literary expression (17).

18.

As to self-regulation, the EDPS is convinced that this instrument can play an important role in reconciling privacy and freedom of expression. Furthermore, Article 23(2) mirrors the approach taken by Recommendation Rec(2006) 8 which also provides that states should encourage the media to adopt and respect self-regulation measures in order to protect privacy and personal data of the victims (18). Self-regulatory instruments may also act in combination with national framework provisions, but these provisions should be compatible with ECHR case law on Article 10 of the European Convention on Human Rights (19).

19.

The EDPS notes that Article 3 of the proposed Directive, dealing with the right to receive information from the first contact with a competent authority, does not mention information relating to data protection. In order to ensure adequate protection of their personal data, victims should receive at appropriate times all the information necessary to enable them to fully understand how their personal data will be processed.

20.

The EDPS therefore recommends adding to Article 3 an additional provision specifying that victims should be provided with the information concerning the further processing of his/her personal data in conformity with Article 10 of Directive 95/46/EC. In addition, the legislator could consider including rules on victims’ access to their personal data, while preserving the legitimate interests relating to criminal investigation and prosecution.

21.

The proposed Directive recognises the right of crime victims to receive support from the moment the crime takes place, throughout criminal proceedings and after such proceedings depending on victims’ needs (20). Certain categories of victims, such as victims of sexual violence, gender, racial hatred or other bias crimes, or victims of terrorism, may require specialist support services (21), including psychological support. In these cases, the communications between the victim and the professionals providing support services should be adequately protected from disclosure. If this is not done, the victim may be discouraged from communicating freely with his/her counsellor. Thus the EDPS welcomes the requirement in Article 7 that victim support services must be ‘confidential’. However, the scope and the consequences of such confidentiality do need to be clarified.

22.

In particular, the proposed Directive does not specify whether the communications of the victims with providers of support services should be deemed ‘privileged’, in the sense that their disclosure in the course of court proceedings is excluded or otherwise restricted. This would normally be the case where the provider of support services is a healthcare professional subject to the obligation of professional secrecy. However, one could imagine cases where support is not provided by such professionals. In these situations, it is doubtful whether the victim would be protected from disclosure.

23.

The EDPS therefore recommends specifying that the victim of these particular crimes should have the right to refuse disclosure in any judicial or administrative proceedings of confidential communications with a support service provider and that such communications may be disclosed by a third party only with his/her consent. This should normally be the case also in any criminal proceedings, without prejudice to legitimate and well-founded interests relating to investigation or prosecution (i.e. collection by judicial authorities of indispensable evidence).

24.

As already mentioned, the proposed Regulation complements the EPO initiative concerning mutual recognition of protection measures in criminal matters. Since the proposed Regulation concerns judicial cooperation in civil matters having cross-border implications (22), its application falls within the scope of the former first pillar and therefore also within the scope of Directive 95/46/EC (23). This was not the case for the EPO initiative.

25.

The EDPS therefore recommends that a reference to Directive 95/46/EC is included at least in the recitals of the proposal, stating that personal data processed under the regulation should be protected in accordance with the national laws implementing Directive 95/46/EC.

26.

According to Article 5 of the proposed Regulation, a party who wishes to invoke a protection order in another Member State shall provide the competent authorities with a certificate. The certificate shall be issued in accordance with the standard form set out in the Annex to the proposed Regulation. The Annex contains personal data of both the protected person and the person causing the risk, such as their identity and whereabouts, and a description of the protection measure. The EDPS recognises that the personal data included in the certificate as required in the Annex are in principle adequate, relevant and not excessive for the purposes for which they have been collected.

27.

However, it is not sufficiently clear from the proposal which personal data of the protected person will be communicated to the person causing the risk, in particular pursuant to Article 13 (24). In this respect, the EDPS considers that the person causing the risk should receive only those personal data that are strictly necessary for the execution of the measure. In addition, the communication in question should, as far as possible, avoid disclosing the address or other contact details concerning the protected person (25). Such a limitation should be specified in the text of Article 13.

28.

The EDPS welcomes the policy objectives of the two proposals under consideration and generally shares the approach of the Commission. Nevertheless, he finds that the protection of privacy and personal data of the victims in the proposed Directive could be in some instances strengthened and clarified.

29.

With regard to the proposed Directive on the rights, support and protection of victims of crime, the EDPS advises the legislator to:

30.

With regard to the proposed Regulation on mutual recognition of protection measures in civil matters, the EDPS advises the legislator to: