26.4.2007   

EN

Official Journal of the European Union

C 91/1

1.

The Proposal for a Regulation amending Regulation (EC) No 1073/1999 of the European Parliament and the Council of 25 May 1999 concerning investigations conducted by OLAF (3) (hereinafter ‘the Proposal’) contains revisions to most of the articles of Regulation (EC) No 1073/1999 (4). This Regulation sets forth the operational rules to be followed by those involved in OLAF investigations and, as such, it constitutes the legal basis for OLAF's operational activities.

2.

The Proposal was sent by the Commission to the EDPS on 15 September 2006. The EDPS understands this communication as a request to advise Community institutions and bodies, as foreseen in Article 28(2) of Regulation (EC) No 45/2001 of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (hereinafter Regulation (EC) No 45/2001). In view of the mandatory character of Article 28(2) of Regulation (EC) No 45/2001, the EDPS welcomes the explicit reference to this consultation in the preamble of the Proposal.

3.

The comments made in this Opinion apply mutatis mutandis to the Proposal for a Council Regulation amending Council Regulation (Euratom) No 1074/1999 of 25 May 1999 concerning investigations conducted by the European Anti-Fraud Office (OLAF) (5).

4.

The EDPS deems it important to deliver an opinion on this Proposal in the light of its impact on individuals' rights to data protection and privacy. Taking into account that the Proposal sets forth new rules to be followed by OLAF to conduct investigations of alleged illegal activities, it is essential to ensure that in doing so, the data protection and privacy rights of the persons implicated in such investigations, suspected infringers and also staff members and other individuals who provide information to OLAF, are properly guaranteed. This is even more important given the particularly sensitive type of information that OLAF may potentially collect, which includes data relating to suspected offences, offences, criminal convictions, health data as well as information that would serve to exclude individuals from a right, benefit or contract insofar as such information represents a particular risk to the rights and freedoms of the data subjects.

5.

The proposed amendments to Regulation (EC) No 1073/1999 respond to different goals and objectives (6). For example, some amendments aim at improving the effectiveness and efficiency of OLAF investigations, for example, to ensure that OLAF's powers of investigation cover economic operators in Member States receiving Community funds. Others intend to facilitate the exchange of information about suspected wrongdoings between OLAF and the various institutions concerned, at both EU and national level. (7) Finally, some of the proposed amendments seek to guarantee the rights of the persons implicated in an investigation, including their right to data protection and privacy and make procedural guarantees stronger.

6.

The EDPS agrees with the significance of the goals and objectives pursued by the proposed amendments and, to this extent, he welcomes the Proposal. The EDPS particularly values the procedural guarantees afforded to individuals under the Proposal. This is particularly true regarding the possibility of suspected individuals to request an opinion from the Review Adviser as to whether the procedural guarantees were respected during the investigation. The EDPS is also pleased with the amendments that aim to provide more information to whistleblowers and informers. From the perspective of the protection of individuals' rights to the protection of their personal data and privacy, the EDPS considers that on the whole the Proposal contains improvements vis-à-vis the current situation. For example, the EDPS welcomes the recognition of the application of several data protection rights during the investigations such as the right of the suspected person to be informed of the investigation and have his/her views known.

7.

However, despite the overall positive impression, the EDPS considers that from the point of view of the protection of personal data, the Proposal could be further improved, without jeopardising the objectives that it pursues. In particular, the EDPS is concerned that the Proposal may be deemed as a lex specialis regulating the processing of personal data collected in the scope of OLAF investigations, which would take precedent over the application of the general data protection framework contained in Regulation (EC) No 45/2001. This is particularly worrisome considering that the data protection standards contained in the Proposal are lower than those contained in Regulation (EC) No 45/2001, and this without any apparent justification.

8.

In order to avoid this outcome, the following section provides an analysis of the Proposal which, on the one hand, describes its shortcomings and, on the other hand, suggests specific ways to address them. Obviously, the scope of this analysis is limited to the provisions having an impact on personal data protection, particularly Article 1, section (5), (6) and (7) pursuant to which Articles 7a, 8 and 8a are added or amended.

9.

The data quality principle, which is recognised in Article 4 of Regulation (EC) No 45/2001, encompasses various specific aspects. In particular, pursuant to this principle, personal data must be accurate, it must conform to the objective reality and it must also be complete and updated. Second, data must not be excessive and it must be adequate so that there is a link between the information and the purpose for which it is intended to be used. The Proposal incorporates the data quality principle through Article 1, section (1) pursuant to which Article 7a1 is added which requires OLAF to seek evidence for and against the person concerned.

10.

The EDPS welcomes the inclusion of the obligation to seek evidence for and against the person concerned because it affects the accuracy and the completeness of the data being processed, thus contributing to the compliance with the principle of data quality, and hence increasing the overall data protection safeguards in the context of OLAF investigations.

11.

Pursuant to this right, those who collect personal data are required to inform individuals to whom the data refers of the fact that their data are being collected and processed. Individuals are further entitled to be informed of, inter alia, the purposes of the processing, the recipients of the data and the specific rights that individuals, as data subjects, are entitled to. The obligation to give information about the processing of one's data is to ensure the fairness of the processing of individual's personal information and is, at the same time, an indispensable safeguard for the rights of individuals. The Proposal recognises this right in Article 1, section (1) pursuant to which Article 7a2, first paragraph is added and Article 1, section (7) pursuant to which Article 8a is added.

12.

The EDPS welcomes the inclusion of Articles 7a.2 first paragraph and 8a, insofar as they contribute to the respect for the data protection right of information set forth in Article 11 and 12 of Regulation (EC) No 45/2001, in the specific context of investigations performed by OLAF.

13.

In addition to setting forth the right to be informed of the processing of one's personal information, Articles 11 and 12, which apply respectively to the situations where information on an individual is collected directly from that individual or from third parties, lay down the information that must necessarily be given to individuals so that they are in a position to have accurate and full information about the existence of a processing operation that concerns them. This information includes among others the purposes for which the data will be used, potential recipients of the data and the existence of the right of access to the data.

14.

Unfortunately neither Article 7a2 first paragraph nor Article 8a contain similar information requirements as Article 11 and 12 of Regulation (EC) No 45/2001, thus failing to specify what information is to be given to individuals in order to ensure the fairness of the processing. The EDPS considers that Articles 7a2 first paragraph and 8a should be consistent with Articles 11 and 12 of Regulation (EC) No 45/2001. To this end, the EDPS suggests including in Articles 7a2 first paragraph and 8a an express reference to the application of Articles 11 and 12 of Regulation (EC) No 45/2001.

15.

The EDPS considers that failure to include a reference to Articles 11 and 12 will create an unclear legal situation. Indeed, the Proposal would create a legal framework regulating the right of information in the context of OLAF investigations that would differ from the general framework set forth by Articles 11 and 12 of Regulation (EC) No 45/2001. Unfortunately, such a framework would provide less data protection safeguards than the general one. The EDPS fails to see any reason to justify this unfortunate outcome.

16.

Articles 7a2 and 8a second paragraph of the Proposal foresee an exception to their application if giving the information would prejudice the performance of the investigation. Pursuant to the exception, the Director General of OLAF is entitled to defer the fulfilment of the obligation to ask the person implicated to make his views known.

17.

The EDPS notes that the possibility of limiting the provision of information in certain specific cases is in line with Article 20 of Regulation (EC) No 45/2001 which provides for certain restrictions to this right, including when doing so is necessary to safeguard (i) the prevention and investigation of criminal offences, (ii) economic or financial interest of a Member State or of the European Communities, as well as (iii) the protection of the data subject or of the right and freedoms of others.

18.

The EDPS notes that under Article 20 of Regulation (EC) No 45/2001, the limitation to the right of information is accompanied by various data protection safeguards. In particular, Article 20.3 establishes that if a restriction is imposed, the data subject shall be informed of the principal reasons and on his or her right to have recourse to the European Data Protection Supervisor. Providing such information may be deferred if providing the information would harm the investigation.

19.

However, in the Proposal the provisions that set forth restrictions to the right of information are not accompanied by the data protection safeguards foreseen in Article 20 of Regulation (EC) No 45/2001. Thus, in the context of OLAF investigations, limitations to the right of information are provided without the safeguards that would apply under the general data protection framework, which the EDPS finds inappropriate. To resolve this situation the EDPS suggests that the limitation to the right of information of Articles 7a2 second paragraph and 8a be linked to the guarantees of Article 20 Regulation (EC) No 45/2001.

20.

The right of access gives individuals the possibility to learn whether and what type of information relating to them is being processed. The Proposal recognises this right in Article 1, section (1) pursuant to which Articles 7a2, second paragraph and 7a3 are added.

21.

The above amendments, i.e. Articles 7a2, second paragraph and 7a3 set up the right of the individual suspected of wrongdoing to be informed on all matters concerning him. More specifically, they establish how this right will be exercised in the context of OLAF investigations. Firstly, it will be provided on completion of an investigation, i.e. at the end of the investigation. Secondly, it will be provided through a summary of the matters regarding the individual. In addition, access will also be provided through a record of the interview with the suspected individual.

22.

The EDPS welcomes the inclusion of Articles 7a2 second paragraph and 7a3 insofar as they specify in the context of OLAF investigations the data protection right of access set forth by Article 13 of Regulation (EC) No 45/2001. However, the EDPS considers that there is room for improvement in the way this right is recognised in the Proposal. The EDPS is concerned that the right of access, as drafted in the Proposal, is inferior to the same right under Regulation (EC) No 45/2001.

23.

Under Regulation (EC) No 45/2001 as a matter of general principle, individuals are entitled to exercise the right of access to their personal data, unless one of the specific situations of Article 20 of Regulation (EC) No 45/2001, referred above, justifying a restriction to such right, arise. In such a case, access can be restricted until the circumstances change.

24.

The EDPS observes that the Proposal does not recognise the application of the right of access as a matter of general principle. Instead, the Proposal foresees the application of the right of access in certain procedural stages and in respect to certain documents. To some extent, it can be said that under the Proposal, the right of access has both temporal and material limitations.

25.

Indeed under Article 7a2 second paragraph access can be obtained only on completion of an investigation, when the individual is given a summary of the matters that concern him/her and when an interview with the individual and OLAF has taken place and a record of an interview has been drafted. Outside these two stages of the procedure, as a general rule, there is no access to personal information. Regarding the material to which access is granted, the EDPS sees that under the Proposal, access is only possible regarding the summary of the matters concerning the individual and the record of the interview ex Article 7a2 second paragraph and Article 7a.3 respectively. Access does not apply to any other information that may be held about the individual, such as copies of documents, e-mails, telephone records, etc.

26.

The EDPS agrees with the Proposal that access to personal information is relevant in the two procedural steps and regarding the two documents specified by the Proposal and welcomes the Proposal's recognition of such right in these circumstances. However, the EDPS considers that as a matter of general principle, the Proposal should also recognise the existence of a right of access beyond the two cases explicitly mentioned by the Proposal.

27.

The EDPS is aware that there may be some opposition to the idea of recognising the right of access, as a general rule, in the course of an investigation. However, the EDPS recalls that if in certain investigation cases there is a need to safeguard the confidentiality of the investigation, pursuant to Article 20 of Regulation (EC) No 45/2001, OLAF will be able to defer access. Indeed, OLAF can rely on Article 20 to defer access for example in order to safeguard the prevention and investigation of criminal and other offences. Thus, granting the right of access as a matter of general principle does not prevent ad hoc limitations to such rights, when the reasons outlined above occur.

28.

In light of the above, and in order to ensure that an effective right of access in the course of an investigation exists which also recognises potential limitations to it, the EDPS suggests adding in the Proposal a clear reference to the individual's right of access to their personal data contained in OLAF's investigation file. In particular, the EDPS considers that a paragraph along the following lines should be inserted between the first and second paragraph of Article 7a.2: ‘Any person implicated in an investigation has the right to access personal data related to him/her which are gathered in the course of the investigation. Such right(s) may be subject to the limitations foreseen in Article 20 of Regulation (EC) No 45/2001’.

29.

This paragraph would set forth, as a general principle, the application of the right of access. As a result, not only consistency would be achieved but also individuals concerned by OLAF investigations would not be subject to a less benevolent regime as far as access to personal data is concerned.

30.

The right of access is a prius to the right of rectification. Once individuals have had the opportunity to access their data and verify the accuracy and the lawfulness of the processing, the right of rectification enables them to require rectification of any incomplete or inaccurate information.

31.

Under the Proposal, the right of rectification is regulated together with the right of access. Both Article 1, section (1) pursuant to which Articles 7a2 second paragraph and 7a3 are added refer to the possibility of the suspected infringer to have his views known.

32.

The EDPS notes that, stricto sensu, the Proposal does not provide for a right to rectify as such. Instead, the Proposal provides for a right to ‘have the views known’and ‘approve or add observations’(in both instances regarding personal information). The EDPS considers that such privileges are equivalent to the right of rectification and that they are in line with Article 14 of Regulation (EC) No 45/2001 which sets forth the legal framework for the right to rectify inaccurate information. The EDPS considers that in the context of OLAF investigations it is not possible to provide individuals with the possibility to simply ‘rectify ’the information that they deem as incomplete or inaccurate, obviously because in many cases, ascertaining whether the information is inaccurate will be the subject of the investigation. This is why in this context the right of rectification can be provided, as the Proposal does, by allowing the individual to have his views known and by allowing him to provide comments regarding the personal information at stake.

33.

In addition to the above, the EDPS considers that the same comments made above regarding the way the Proposal regulates the right of access, apply mutatis mutandis to the right of rectification. Indeed, under the Proposal, the right of rectification has the same shortcomings that were described above regarding the right of access: the Proposal does not recognise the right to rectify as a matter of general principle. Instead, the right of rectification is unduly confined to the summary of the allegations and the report that follows an interview.

34.

The EDPS considers that the Proposal should recognise the right of rectification as a general right, not like a partial one. To this end, the EDPS suggests inserting a provision in the proposal recognising the application of the right of rectification. In particular, after the sentence ‘Any person implicated in an investigation has at any time the right to access personal data related to him/her gathered in the course of the investigation ’the following should be added: ‘and to make his views known on whether the personal data are inaccurate or incomplete’. The EDPS recalls that by applying Article 20 of Regulation (EC) No 45/2001, OLAF may still be able to limit the right of rectification in order to safeguard the prevention, investigation, detection and prosecution of criminal offences.

35.

Article 7a2, 3rd paragraph foresees the possibility of excluding the application of the right of access and rectification. As it was mentioned regarding the limitation to the right of information, such limitations should be accompanied by the safeguards that apply in the context of Article 20 of Regulation (EC) No 45/2001. To this end, the EDPS suggests that the limitation of the application of such rights under the Proposal is linked to an express reference to Article 20.

36.

The Proposal provides for exchanges of personal data within the European Institutions and with Member States authorities. In fact, one of the goals of the Proposal is to enhance the exchange of information among OLAF and authorities at both EU and Member State levels.

37.

In this regard, the EDPS would like to stress that these exchanges should be allowed only to the extent that is necessary to the specific case in order to meet the goals pursued by the investigation. Furthermore, in accordance with Article 7 of Regulation (EC) No 45/2001, the EDPS reminds that the recipient of the data shall process them only for the purposes for which they were transmitted.

38.

The Proposal does not provide for exchanges of personal data with third countries, or for international cooperation. However, in this context, one may assume that such cooperation may take place. In this regard, the EDPS would like to stress that these exchanges should be allowed only if the third country ensures an adequate level of protection of personal data or if the transfer falls within the scope of one of the derogations laid down by Article 9.6 of Regulation (EC) No 45/2001. Furthermore, the EDPS recalls that the same rules apply regarding the exchanges of information between OLAF and EU institutions and bodies that are not Community bodies such as EUROPOL or EUROJUST. In such cases, the EDPS hopes that appropriate legislation will be passed recognising the adequacy of the data protection framework that governs such institutions, which would facilitate the transfers of information to them ex Article 9.2 of Regulation (EC) No 45/2001. Alternatively, new legislation could be passed deeming their data protection regime as equivalent to that of Community bodies and institutions, ex Article 7 of Regulation (EC) No 45/2001, which would also have the effect of removing the restriction to transfer data to such institutions.

39.

The Proposal has amended Article 8.3 to include an express reference to the application of Regulation (EC) No 45/2001. The EDPS welcomes the amendment of Article 8(3), insofar as it confirms that whenever the Proposal does not specify how the data protection requirements apply in the context of OLAF investigations, the Regulation (EC) No 45/2001 will apply as default.

40.

However, the EDPS considers that Article 8.3 on its own, i.e. without the amendments suggested in this Opinion, is not sufficient to ensure a level of protection of personal data at least equal to that provided under Regulation (EC) No 45/2001. Article 8.3 by itself is not enough because it could be understood that it is only relevant whenever the Proposal does not specify how the data protection requirements apply in the context of OLAF investigations. However, when the Proposal does specify how the data protection requirements apply and in doing so lays down a less protective data protection regime, then such unsatisfactory regime could be considered to take precedent over the general data protection embodied in Regulation (EC) No 45/2001. The specific amendments suggested above for concrete references to Regulation 45/2001 aim to avoid such risks of interpretation

41.

The EDPS fully agrees with the Proposal that for the sake of greater transparency it is necessary to ensure an adequate degree of information for whistleblowers, and welcomes the obligation in the Proposal to provide informers with information as to whether or not to open an investigation.

42.

The EDPS recommends the respect for the confidentiality of the identity of whistleblowers during OLAF investigations and in the later stages. To this end, the EDPS is of the view that it would be appropriate for this Proposal to include a new paragraph guaranteeing the confidentiality of whistleblowers. The present guarantees (Commission Communication SEC/2004/151/2) do not seem enough from a legal point of view. The EDPS notes that such provision would be in line with the Opinion of the Article 29 Data Protection Working Party that deals with the application of EU data protection rules to internal whistleblowing schemes (8).

43.

The EDPS welcomes this Proposal insofar as it makes more explicit the procedural guarantees of individuals concerned by OLAF investigations, including the protection of personal data of such individuals.

44.

From the perspective of the protection of individuals' rights to the protection of their personal data and privacy, the EDPS considers that for the most part the Proposal contains improvements vis-à-vis the current legal framework. Examples of improvements include Articles 7a2 first paragraph and 8a as they contribute to the respect of the right of information and Articles 7a2 second paragraph and 7a.3 which confirm the application of the partial right of access and rectification in the context of OLAF investigations.

45.

In addition, the EDPS welcomes the Proposal's recognition that Regulation (EC) No 45/2001 applies to all data processing activities carried out in the context of OLAF investigations, as it will contribute to ensuring a consistent and homogeneous application of the rules regarding the protection of individuals' fundamental rights and freedoms with regard to the processing of personal information.

46.

Although the EDPS is appreciative of the amendments aimed at boosting procedural and data protection rights outlined above, he is concerned by the fact that most of the proposed amendments do not reach the minimum data protection standards contained in Regulation (EC) No 45/2001. The EDPS is concerned that if the Proposal could be deemed to take precedent over the application of the general data protection framework contained in Regulation (EC) No 45/2001, this would entail an unacceptable watering down of the data protection standards in the context of OLAF investigations. In the EDPS's opinion this is particularly worrisome in the light of the sensitive nature of the type of data that may be collected in the framework of OLAF investigations. In order to avoid this outcome, the EDPS requests the Community legislator to take into account the following issues and make the related amendments in the Proposal in order to address them:

47.

Providing information to individuals to ensure fair processing constitutes an indispensable safeguard which should not be unduly compromised, as the Proposal does. To avoid it, the Proposal should be amended as follows:

48.

Providing access to personal information so that individuals can learn whether data concerning them is being processed constitutes a basic pillar for the respect of the personal data. To ensure effective access rights, the Proposal should be amended as follows:

49.

The right to rectify inaccurate or incomplete information is a natural consequence of the right of access to personal information, and as such, it constitutes a cornerstone of the protection of the right to personal data. Restrictions to the right of rectification should only be provided to the extent that they are permitted under Regulation (EC) No 45/2001. The Proposal contains additional restrictions that should be avoided as follows:

50.

In addition to the above, the EDPS is of the view that it would be appropriate for this Proposal to include a new paragraph guaranteeing the confidentiality of whistleblowers.

26.4.2007   

EN

Official Journal of the European Union

C 91/9

1.

On 19 December 2005, the EDPS issued an opinion (3) on the Proposal of the Commission for a Council Framework Decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters. In this opinion, he underlined the importance of the proposal as an effective instrument for the protection of personal data in the area covered by Title VI of the EU-Treaty. Such an instrument should not only respect the principles of data protection as laid down in the Council of Europe Convention No 108 (4) and more specifically in directive 95/46/EC, but also provide for an additional set of rules taking into account the specific nature of the area of law enforcement. For the EDPS it is essential that the framework decision covers all processing of police and judicial data, even if they are not transmitted or made available by competent authorities of other Member States. Consistency of the protection of personal data is essential, regardless of where, by whom or for which purpose they are processed. The EDPS has made several proposals to improve the level of protection.

2.

On 27 September 2006, the European Parliament adopted a legislative resolution on the Commission proposal. In general terms, the resolution has the same objectives as the opinion of the EDPS: support for the proposal in general and amendments aiming to enhance the level of protection afforded by the Framework Decision.

3.

The Commission proposal is currently being discussed within Council. The Council is reportedly (5) making progress and is modifying essential elements of the text of the proposal. A serious effort is being made by the Council Presidency to make even more significant progress. It aims at reaching a common approach on the main elements by December 2006.

4.

The EDPS welcomes that the Council is giving much attention to this important proposal. However, he is concerned about the direction of the developments. The texts currently being discussed within Council do not incorporate the amendments proposed by the European Parliament, nor the opinions of the EDPS and of the Conference of European Data Protection Authorities. On the contrary, in quite a few cases provisions in the Commission proposal, offering safeguards to the citizens, are deleted or substantially weakened. As a result, there is a substantial risk that the level of protection will be lower than the level of protection afforded under Directive 95/46/EC or even under the more generally formulated Council of Europe Convention No 108 which is binding on the Member States.

5.

The EDPS notes that also the Libe-committee of the European Parliament has recently voiced its concerns regarding the choices of Council on this proposal for a framework decision.

6.

It is for these reasons that the EDPS now issues a second opinion. This second opinion focuses on some essential concerns and does not repeat all the points made in the opinion of the EDPS in December 2005, which all remain valid.

7.

In the developing area of freedom, security and justice, the exchange of police and judicial information between the Member States is becoming more and more important. Several legal instruments are proposed or have been adopted in order to facilitate this exchange of information. The EDPS underlines once more that in this context a solid legal framework which protects the data subject is needed to ensure that the fundamental rights of citizens are respected. The present (proposal for a) Framework Decision is directly linked to the proposals facilitating this exchange of information.

8.

Although the EDPS recognises the importance of adopting the Framework Decision by Council as soon as possible, he warns that the rapidity of the decision making should not lead to a lowering of the standards of protection. The texts currently discussed within Council raise doubts as to whether the result will be solid enough, so as to give the citizen an effective level of protection. In the present situation, the consequence of the objective of rapidity would appear to be that possibly controversial provisions are deleted or weakened. The lack of time to reach consensus on possibly controversial provisions could result in the quality of the Framework Decision being compromised.

9.

Under these circumstances, the EDPS recommends that Council allows more time for the negotiations in order to achieve a result that offers sufficient protection.

10.

This issue was an essential element of the opinion of December 2005 and was thoroughly discussed afterwards. Common rules on data protection should apply to all data in the area of police and judicial cooperation, and not be limited to cross-border exchanges between Member States. A more limited scope could not afford the appropriate protection, as required by Article 30(1)(b) of the EU-Treaty. This point was underlined on several occasions, also by other stakeholders besides the EDPS.

11.

In his opinion of December 2005, the EDPS stated that a limitation to data that are exchanged with other Member States would make the field of application of the framework decision particularly unsure and uncertain, which would be contrary to its essential objective. At the time of collection or processing of personal data it is unknown as to whether those data will later be relevant for exchange with competent authorities in other Member States.

12.

For this reason, a more limited scope is unworkable and would, if introduced, require difficult and precise distinctions within the databases of law enforcement authorities, only leading to additional complexity and costs for those authorities and moreover harming the legal certainty of individuals.

13.

Two examples can be given to illustrate these consequences. In the first place, additional complexity and costs result from the fact that criminal files are in quite a number of cases composed of data originating from different authorities. The consequence of a limited scope would be that parts of such composed files — the parts containing data originating from authorities in other Member States — would be protected under the framework decision and that other parts would not be protected. In the second place, the legal certainty of individuals would be harmed since — in the case of a more limited scope — data originating from third countries, but not exchanged between Member States would not be covered by the Framework Decision. It goes without saying that the processing of those data entails specific risks to the data subject should there, for instance, be no legal obligation to examine the accuracy of those data. A good example would be the use of ‘no-fly ’lists of third countries for law enforcement purposes in a Member State.

14.

The EDPS underlines once more that a high level of data protection is needed in the area of police and judicial cooperation, an area in which the processing of personal data poses, by its very nature, specific risks for the citizen as has inter alia been recognised by Article 30(1)(b) of the EU-Treaty. Moreover, large discrepancies between data protection in the first and the third pillar would not only affect the citizens' right to protection of personal data, but would also affect the efficiency of law enforcement and the mutual trust between the Member States.

15.

The proposal serves both objectives. It should provide guarantees for the citizen against improper use of his or her personal data. To the affected citizen it is of no importance whether data concerning him or her are processed in the context of an exchange between the Member States or in a purely domestic context. Moreover, it should contribute to the mutual trust between the Member States, as a condition for a successful exchange of information. If common standards are applied to the processing of data this will result in an easier acceptance of data exchanged between the Member States.

16.

The EDPS warns that a limitation of the scope of the Framework Decision to data in the context of an exchange would not fully ensure the building of trust between the authorities of the Member States. Moreover, a limited text does not protect the citizen in an appropriate way. Under those circumstances, the Framework Decision would no longer give an adequate guarantee for the citizen against possible misuse of his or her data by public authorities. In the opinion of the EDPS, this ‘shield-function ’of the legislation is essential, if only to ensure that the European Union respects fundamental rights, in accordance with Article 6 of the EU-Treaty.

17.

Finally, there is a strategic argument in favour of a Framework Decision applicable to all processing. As the recent negotiations with the United States for a new agreement on the processing and transfer of airline passenger data (6) show, solid EU-legislation protecting the citizen in all EU-internal situations would also strengthen the position of the EU in negotiations with third countries. In the absence of such a solid law, it would be rather difficult to insist upon an adequate level of protection in third countries, as a precondition for the transfer of personal data.

18.

Emphasis on data quality. Article 4 of the Commission proposal does not only include the main data quality principles of Directive 95/46/EC but also provides for some specific rules. It contains a distinction between different kinds of data subjects (suspects, convicted people, victims, witnesses, etc.). Data related to them should be treated differently, with specific safeguards, especially with regard to non-suspects. It furthermore contains obligations for the Member States to distinguish data according to their degree of accuracy and reliability. This is an important provision since law enforcement authorities also use soft data based on presumptions, not necessarily on facts. The EDPS regards these provisions as essential safeguards, which should not be deleted from the proposal, nor be made optional.

19.

Data processing and purpose limitation. In the opinion of December 2005, the EDPS analysed the need for better legal provisions on the further use of data that have been collected by an authority for a specific purpose. Presently, the concerns of the EDPS regarding Article 5 relate mainly to his view that, whilst on the one hand (further) processing of data for wider purposes needs to be allowed, on the other hand the law must provide for precise conditions for this processing, in order to protect the data subject. The EDPS warns against solutions that leave the matter fully to the discretion of national law or that do not limit the conditions for further processing in conformity with Directive 95/46/EC and Council of Europe Convention No 108 (7). As to the processing of special categories of data: this is dealt with under Directive 95/46/EC and Convention No 108, in a general prohibition with exceptions (8). The EDPS is concerned that in the Framework Decision the general prohibition will be deleted and that — by doing so — the exception becomes the rule. Such a solution would not only be inconsistent with Directive 95/46/EC, but would also not be in line with Convention 108.

20.

Exchange of data with other authorities and private parties. The Commission proposal contains limitations and specific safeguards for the exchange of information with other authorities besides police and judicial authorities, private parties and authorities of third countries. The EDPS underlines the importance of such specific provisions for the following reasons. In the first place, exchange of information with those ‘third parties ’entails specific risks (security breaches, further processing for different purposes, etc.). In the second place, involvement of third parties in law enforcement and in the processing of law enforcement information is becoming more commonplace. Directive 2006/24/EC on data retention (9), the agreement on PNR-data with the United States and the so called Swift-case (10) are good examples. In the third place, the PNR-judgement of the European Court of Justice of 30 May 2006 (11) raises serious doubts on the protection of personal data collected by private parties for commercial purposes and later on processed for law enforcement purposes.

21.

As to the transfer to and from other — public or private — parties within the EU, it is important that the proposal deals with the matter in a precise way and offers solutions consistent with Directive 95/46/EC. Those solutions must ensure that the consequences of the pillar structure — in particular the uncertainty about the delimitation of both pillars as far as the exchange of personal data between law enforcement authorities and other parties is concerned — will not harm the effectiveness of the protection.

22.

As to the transfer of data to and from third countries, the Commission proposal provides for an adequacy decision by the Commission. If this would not be acceptable in Council, the result would be that each Member State will decide about adequacy on its own or, even worse, transfer the data without examining the level of protection in the third country. The absence of a harmonised system for the exchange of personal data with third countries could also:

The EDPS considers it essential that mechanisms ensuring common standards and coordinated decisions on adequacy be put in place, also in order to comply with Council of Europe Convention No 108 (in particular its Article 12) (12). The text of the Framework Decision should provide for such mechanisms.

23.

The EDPS understands that several Member States question the legal basis for the inclusion of a provision on the exchange of personal data with third countries, in cases whereby those data are not received from or made available by the competent authority of another Member State. According to the EDPS, there are no grounds for questioning this legal basis. The examples elaborated in the Opinion of December 2005 as well as the arguments mentioned in the previous paragraph demonstrate the direct link of this exchange with third countries with the police and judicial cooperation under Article 29 of the EU-Treaty. A provision on the exchange of personal data with third countries must be seen as an additional and necessary provision in order to achieve the objectives of Article 29 EU in conjunction with Article 6 EU, in particular a closer cooperation of police forces with respect for fundamental rights.

24.

Data subjects' rights. The data subject has a right to be informed about the processing of personal data concerning him or her. This right is linked to the principle of fair and lawful processing of personal data which in itself is respected by the Framework Decision and is moreover protected under Council of Europe Convention No 108, in particular its Articles 5(a) and 8. An essential element of this right is that this information should be given by the data controller ex officio. Since the data subject normally does not know and can not know that information concerning him or her is being processed, it would be contrary to the nature of this right to require a request from the data subject. Of course this right to be informed is subject to exceptions and it is clear that these exceptions can play an important role in the area of law enforcement since information on criminal investigations could prejudice the investigation itself. However, any solution making the right to information dependent on a request by the data subject would not be acceptable and not be compatible with Council of Europe Convention No 108.

25.

The EDPS underlines that the position of the data protection authorities should be consistent with the position afforded to them under Directive 95/46/EC. This position is all the more important in this area of police and judicial cooperation. The cooperation between law enforcement authorities in order to effectively combat terrorism and other serious crime requires processing of quite often sensitive personal data and requires exceptions to the rights of the data subjects (see, for instance the previous point, on the right to be informed).

26.

The EDPS points in the first place to the need for an effective supervision and inspection by the authorities of the processing of personal data within the scope of this framework decision, especially when personal data are exchanged amongst the Member States in the area of police cooperation. In the second place, the advisory role of the authorities should be ensured, within the national jurisdiction as well as within the institutionalised network of data protection authorities, the Working Party of authorities (under the directive known as the ‘Article 29-Working Party’). The input by data protection authorities is needed, in order to enhance the consistency of the protection under this instrument with the protection under Directive 95/46/EC, to ensure compliance with the legal obligations and to fully achieve harmonisation between the Member States, also on a practical level.

27.

Article 24 of the Commission proposal contains detailed rules on security, comparable to the rules included in the Europol-convention. The EDPS warns against the deletion of these rules from the proposal. A harmonised level of security is an important tool to enhance trust, for the data subject as well as between the authorities of the Member States.

28.

In his opinion of December 2005, the EDPS recommended that specific safeguards should be put in place with respect to the processing of certain specific categories of data, such as biometric data and DNA-profiles. In the area of law enforcement, the use of these categories of data is becoming more and more important, whereas this use can entail specific risks for the data subject. Common rules are needed. The EDPS regrets that this recommendation has not been taken into consideration by Council, at least not visibly. The EDPS urges the Commission and the Council to adopt a proposal on this matter, whether related to the principle of availability or not.

29.

The EDPS recommends that the Council allows more time for the negotiations, so as to achieve a result that offers sufficient protection. Although the EDPS recognises the importance of adopting the Framework Decision by Council in the short term, he warns that the rapidity of the decision making should not lead to a lowering of the standards of protection.

30.

Consistency of the protection is essential, independent of where, by whom or for which purpose personal data are processed. The EDPS urges the Council to respect a level of protection that is not lower than the level of protection afforded under Directive 95/46/EC or even under the more generally formulated Council of Europe Convention No 108 which is binding upon the Member States.

31.

Common rules on data protection should apply to all data in the area of police and judicial cooperation, and not be limited to cross-border exchanges between Member States. This opinion contains arguments showing that a more limited scope is unworkable which would, if introduced, lead to additional complexity and costs for authorities and harm the legal certainty of individuals.

32.

Other concerns of the EDPS are:

26.4.2007   

EN

Official Journal of the European Union

C 91/15

1.

The proposal for a Regulation of the European Parliament and of the Council laying down the procedure for implementing Regulation (EC) No 883/2004 of the European Parliament and the Council of 29 April 2004 on the coordination of social security systems (3) was sent by the Commission to the EDPS for consultation, in accordance with Article 28(2) of Regulation 45/2001/EC (hereinafter ‘the Proposal’). According to the EDPS, the present opinion should be mentioned in the preamble of the Regulation.

2.

The formal consultation from the Commission follows the contacts between the EDPS secretariat and the services of the relevant DG of the Commission (DG EMPL), in the framework of the EDPS inventory exercise 2007 (4). Indeed, this Proposal is one of those proposals, within DG EMPL portfolio, that present a high interest for the EDPS. Furthermore, the EDPS contributed to a hearing organised by the European Parliament on 23 November 2006, by giving some preliminary remarks on the Proposal. In this context, the EDPS welcomes this consultation and expects to be timely consulted in the future with regard to other Commission proposals relating to the protection of personal data in the social security and employment sectors, in particular those mentioned in his inventory.

3.

The Proposal lays down the procedure for implementing Regulation (EC) No 883/2004 of the European Parliament and of the Council of 29 April 2004 on the coordination of social security systems. Indeed, the new rules on coordination in the latter Regulation cannot be applied until the current Proposal, laying down the corresponding implementing measures, has been adopted (5). Therefore, the Proposal shall be assessed in conjunction with the basic regulation on which it is based. With regard to this point, it should also be noted that the EDPS has not given his opinion on Regulation 883/2004, since the corresponding Commission proposal was adopted on 12 February 1999 (6), before Regulation 45/2001/EC had entered into force.

4.

The objective of the Proposal is to modernise and simplify the existing rules, by strengthening cooperation between social security institutions and improving the methods of data exchange between social security institutions.

5.

The Proposal has a wide scope, both as to the citizens concerned and the areas covered. On one hand, it covers all EU citizens who are insured under national legislation (therefore, including non-employed persons), provided there are trans-border elements. On the other hand, it applies to a vast range of areas in social security: sickness benefits; maternity and equivalent paternity benefits; invalidity benefits; old-age pensions; survivor's pensions; benefits in respect of accidents at work and occupational diseases; death grants; unemployment benefits; early retirement pensions; family benefits.

6.

The EDPS welcomes this Proposal to the extent that it aims at favouring the free movement of citizens and improving the standard of living and conditions of employment of EU citizens moving within the Union.

7.

Provisions on exchange of personal data between national administrations competent for social security constitute a major part of the Proposal. Indeed, social security could not exist without the processing of different kinds of personal data, in many cases of a sensitive nature. Furthermore, exchange of personal data relating to social security between different Member States is a natural consequence of a European Union whereby citizens are increasingly making use of their right to freedom of movement.

8.

However, it is also essential that this increased exchange of personal data between national administrations of Member States, while providing better conditions for free movement of people, also ensures a high level of protection of personal data, thereby guaranteeing one of the EU fundamental rights. In this context, the EDPS is glad to note that also the European Economic and Social Committee (‘EESC’), in its opinion of 26 October 2006 on the Proposal, pointed out the need to ensure adequate protection of personal data, especially in consideration of the sometimes sensitive nature of the data at stake (7).

9.

The EDPS has been consulted on the proposal for an implementing Regulation. However, as mentioned above, the implementing Regulation cannot be assessed separately from Regulation (EC) No 883/2004, which lays down the basic principle of the coordination of social security systems, also with regard to the protection of personal data. Therefore, the EDPS will take into account in his opinion the framework laid down by the latter Regulation. Nevertheless, the EDPS will focus his advice on those issues for which the legislator of the implementing regulation still has a margin of manoeuvre.

10.

Furthermore, the EDPS notes that the Proposal, besides having a broad scope, is also very complex, since it lays down detailed, and sometimes technical, provisions on the different circumstances, mechanisms and limitations in the coordination of social security systems. Therefore, in analysing the Proposal, the EDPS will not deal individually with all the provisions, but will adopt an horizontal approach, by focussing on principles of data protection that are particularly relevant to the Proposal.

11.

Under this approach, this opinion aims at ensuring compliance with data protection legislation but also efficiency of the proposed measures, by anticipating and addressing issues that may arise at the time of implementation in national legal systems. In this opinion the EDPS will first define the relevant data protection legal framework and then deal with the application of relevant data protection principles to the Proposal. In the conclusions, the EDPS will highlight his main findings and recommendations.

12.

In the context of the Proposal, personal data of insured persons will usually be processed by competent national authorities, and will thus fall within the scope of national laws implementing Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and the free movement of such data (‘the Directive’). In the more limited number of cases in which personal data of insured persons will be processed by Community institutions, they will be subject to Regulation (EC) No 45/2001 (8) on the protection of individuals with regard to the processing of personal data and on the free movement of such data. This would be, for example, the case where personal data relating to EU staff is processed (9). Therefore, the current legal framework on data protection provides for a harmonized level of protection throughout the EU.

13.

The current Proposal will rely on this harmonised framework. However, national legislations implementing the Directive are not fully uniform and some divergences may still exist between national data protection laws. It is therefore of great importance that the legislator takes this into account, in order to ensure that the proposed measures fully comply with this framework and cope with these possible differences.

14.

Furthermore, the increased trans-border exchange of data will call for a better coordination of national provisions on protection of personal data. In this respect, the EDPS welcomes Article 77 of Regulation 883/2004. This provision explicitly states that personal data processed by virtue of the Regulation, as well as its implementing rules, shall be transmitted in accordance with Community provisions on protection of personal data.

15.

Article 77 of Regulation 883/2004 also provides guidance on the applicable national data protection law in case of transmissions of data between competent authorities of different Member States, by stating that the communication of personal data from one Member State to another one shall be subject to the data protection legislation of the former, the transmitting Member State. On the contrary, any communication from the receiving Member State, as well as the storage, alteration and destruction of the received data shall be subject to the data protection legislation of the receiving Member State. This provision is in line with the provision on national law applicable laid down by Article 4 of the Directive.

16.

In the Proposal, a reference to the Community provisions on the protection of personal data is made in Recital 3 as well as in Article 3(2). While recital 3 broadly states that persons concerned must benefit from all of the guarantees provided by Community provisions on the protection of personal data, Article 3(2) specifically refers to the exercise of the rights to access and rectification of one's own personal data.

17.

The EDPS agrees on the need — for a legal instrument implementing enhanced processing and transmissions of personal data — to clearly and explicitly recall the applicable data protection framework. In this perspective, the EDPS recommends that a general reference to the Community provisions on the protection of personal data is not only laid down in the Recitals, but is also explicitly made in its provisions (for example, in Article 3). This general provision would not exclude that other provisions, like those currently laid down in Article 3(2), can further address more specific issues relating to the concrete application of data protection principles in the framework of coordination of social security systems (see further, points 36-38).

18.

One of the basic principles of data protection law is that personal data shall only be processed for the purpose for which they were collected or for a compatible purpose (Article 6.1.b of the Directive). The Proposal does not include any general provision on purpose limitation (10). However, the general approach of the Proposal is that personal data collected for one of the social security purposes (pension, invalidity benefit, unemployment, etc) will be processed and further transmitted to other Member States' authorities for the same purpose. Therefore, most processing operations laid down by the Proposal will concern personal data processed for the same purpose or a compatible one. This will be also the case of processing of personal data in the framework of the transmission of data for recovery of claims or benefits not due (Article 73).

19.

However, in other circumstances, such as in the case of cooperation between tax authorities (Recital 14), social security data might be necessary also for purposes other than social security. In this case, exceptions to the principle of purpose limitation could be justified by virtue of Article 13 of the Directive, in specific circumstances and provided that they are necessary and based on legislative measures, either at national or Community level. In this context, the legislator might consider whether to specifically refer in the Proposal to the conditions under which social security data may be processed for a different purpose.

20.

Against this background, the EDPS considers that the Proposal respects the basic data protection provisions on purpose limitation. Furthermore, the EDPS notes that the prohibition to use personal data for purposes other than social security arises from the applicable data protection legislation, which would allow for exceptions to this general principle only under specific and strict conditions.

21.

According to data protection principles, personal data shall be adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed (Article 6.1.c of the Directive). In the context of social security systems, this means that only a necessary and proportionate set of data shall be transmitted in each circumstance.

22.

This principle is correctly enshrined in Article 2.1 of the Proposal, which lays down an obligation for Member States' institutions to share with each other all data necessary for establishing and determining the rights and obligations of insured persons. In this context, the EDPS highlights that the assessment of the necessary sets of personal data may vary slightly according to the kind of benefit at stake. For example, the kind of personal information needed for sickness benefits will be different from information needed for old-age pensions. The information transmitted by Member States' authorities should not go beyond what is necessary for the insured person's rights or obligations at stake in the specific case.

23.

Proportionality should also apply with regard to the number of competent bodies having access to data as well as to the modalities and length of storage of personal data. Only relevant authorities and institutions shall have access to social security data, and these data shall be stored — in a form that permits identification of the data subject — for no longer than it is necessary for the purpose for which they are processed (Article 6.1.e of the Directive).

24.

With regard to the number of authorities and institutions having access to the personal data of insured persons, Article 83 of the Proposal will create a public database, listing the relevant bodies for each Member State. It should be also noted that the Proposal leaves flexibility for Member States to decide whether personal data shall be transmitted through a central point of access in a Member State or directly to the relevant authority or institution (Article 2.3). Furthermore, in each Member State there might be many designated bodies, some of which may operate at a regional level.

25.

With regard to the storage period of personal data, the EDPS notes that in the context of social security, the proportionality test may lead to very different results, depending on the area of social security covered. For example, processing of personal data relating to sickness benefits will usually be necessary for a shorter period of time than in the case of pensions, which are benefits likely to be provided for a longer period. Period of storage of personal data would also depend on the kind of body that processes them. For example, in the case of central points of access, this would mean that personal data would be deleted as soon as they have been further transmitted to the competent body. In any case, it should be clear that personal data shall be deleted or anonymized as soon as they are no longer necessary for the purpose for which they were collected or processed.

26.

In the light of these considerations, the EDPS highlights that in such a complex system, whereby personal data are processed and further transmitted through an asymmetric network of bodies, special attention should be paid to ensure that personal data are processed by the competent authorities, for a proportionate period of time, and that duplications of databases are avoided. The EDPS believes that the database laid down by Article 83 will help ensuring that necessary personal data are transmitted only to the relevant authorities in each specific case. However, further clarifications on the modalities of transmitting and storing the data could be added to the current Proposal, as the Commission has already done in other proposals (11). In this context, the EDPS believes that a certain harmonization of storage periods would not only protect citizens' right to protection of personal data, but would also enhance the efficiency of the coordination between national administrations of different Member States.

27.

The Proposal establishes a variety of mechanisms, according to which personal data relating to insured persons are transferred between competent bodies of different Member States. These exchanges of personal data may be divided in two broad categories: those made on the basis of the request of the concerned person; and those carried out ex officio, usually between third parties (competent bodies, employers), without any specific request by the concerned person. In many cases, relevant bodies will process and transmit sensitive data, in particular data relating to health conditions.

28.

All these processing activities shall comply with the conditions for processing personal data laid down in the Directive: competent national bodies and employers may process personal data only on the basis of the consent of the person concerned or some other legitimate basis, such as compliance with a legal obligation or performance of a task carried out in the public interest or in the exercise of official authority (Article 7.a, 7.c and 7.e of the Directive). Stricter conditions apply to sensitive data, i.e. personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health or sex life (Article 8 of the Directive).

29.

Against this background, the EDPS points out that the provisions of the Proposal may well be considered as laying down a legal obligation — pursuant to Article 7.c of the Directive — to process and transmit social security data, insofar as this obligation is specific. Therefore, in those cases where the Proposal lays down a clear obligation to process personal data, the processing operations by competent national bodies and employers could be based on Article 7(c) of the Directive. On the contrary, where this legal obligation is not laid down directly by the Proposal, the processing of personal data shall be based either on a national (non-harmonised) specific legal obligation or on a different legal ground.

30.

Article 7.e of the Directive allows processing of personal data when it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed. This would be the case where the relevant body processes data on the basis of its tasks or official authority stemming from a general — national or Community — legal provision rather than on the basis of a specific legal obligation. In this case, the right to object is applicable pursuant to Article 14.a of the Directive.

31.

The use of consent as a legal ground, pursuant to Article 7.a of the Directive, has a more limited scope with regard to processing of personal data by public authorities or in employment relationships, since consent can be deemed to be free — pursuant to Article 2.h of the Directive — only if there are viable alternatives for the person concerned.

32.

With regard to processing of sensitive data (Article 8 of the Directive), considerations similar to those made in the previous paragraphs shall apply. The EDPS considers that obligations stemming from employment law (Article 8.2.b of the Directive), further exceptions (Article 8.4) or consent (Article 8.2.a) might constitute relevant legal grounds for processing sensitive social security data. In this case, specific safeguards — such as technical compartmentalization measures — might be necessary.

33.

In the light of the aforementioned considerations, he EDPS points out that the more this Proposal clearly lays down specific legal obligations for competent bodies and employers to process personal data, the easier and more efficient its implementation in the Member States will be, with regard to compliance with national data protection laws stemming from the Directive. Therefore the EDPS, without entering into the details of the various specific mechanisms laid down by the Proposal, recommends the EU legislator to ensure that each and every proposed mechanism of processing and transmission of personal data is clearly based on a specific legal obligation directly laid down by the Proposal or on other legitimate grounds for processing pursuant to Articles 7 and 8 of the Directive.

34.

Adequately informing data subjects about the processing of their personal data and about their rights is essential, as laid down in Section IV of Directive 95/46. This is even more important when personal data are processed by many authorities in different Member States and therefore data subjects might run the risk of loosing sight of who is processing their personal data, for which purposes, and how to enforce their rights.

35.

With regard to this issue, the EDPS strongly supports a proactive approach: providing data subjects with exhaustive and timely information, with a view to clarifying both the use of the information collected and their rights. In this respect, the EDPS not only endorses the call made by the EESC (12) to raise awareness between all potential users of the Regulation, but also calls on the legislator to add an explicit reference in the Proposal to the need to provide concerned persons with specific and adequate information on processing of their personal data. This could be done by amending Article 19 (Provision of information to insured persons) in order to ensure that the necessary information is provided to insured persons.

36.

Data subjects' rights are particularly relevant in the context of social security systems, since they allow persons concerned to keep control over their (sensitive) data, to ensure their accuracy and to check the information on the basis of which important decisions are taken and benefits are granted. This is particularly relevant in a trans-border context, where the margin of error in transmitting personal data is likely to be higher by virtue of the necessity of translating the information. It is also worth mentioning that the enhanced accuracy of information resulting from the enforcement of data subjects' rights benefits not only the concerned persons but also relevant social security bodies.

37.

The EDPS warmly welcomes Article 3.2 of the Proposal, which states that Member States shall guarantee that the persons concerned have the right to access personal data and the right to rectify them, in accordance with Community provisions on protection of personal data. However, the EDPS suggests supplementing this provision with a broader reference to all data subjects' rights, including the right to object (Article 14 of Directive 95/46) and the safeguards concerning automated individual decisions (Article 15 of Directive 95/46).

38.

In addition, the EDPS recommends that the Proposal duly take into account the need to facilitate the effective exercise of data subjects' rights in a trans-border context. Indeed, concerned persons will have to enforce their rights in a situation in which their personal data come from different authorities of two or more countries. Therefore, it would be desirable that in such cases data subjects' rights could also be exercised directly through the relevant authority which receives personal data from other Member States. This would mean that the competent authority which is in direct contact with the insured person would be called upon to act as a one-stop-shop not only with regard to social security benefits, but also with regard to all personal data processed in connection with those benefits. An insured person would then be able to exercise his or her data subjects' rights through the competent authority irrespective of the origin of the data. Therefore, the EDPS invites the legislator to consider this possibility, also in the light of the examples already provided in other Commission proposals (13).

39.

In the Proposal, security in processing of data is of specific relevance in relation to the more widespread use of electronic tools by public administrations of different Member States. Furthermore, the transmission in most cases will involve sensitive data, and as also pointed out by the EESC, is therefore even more important ‘to ensure that these data are properly secure and cannot fall into the wrong hands’ (14).

40.

In this regard, the EDPS welcomes Article 4 of the Proposal, which states that the transmission of data between relevant bodies ‘shall be carried out by electronic means under a common secure framework that can guarantee the confidentiality and protection of exchanges of data’. However, the EDPS stresses that this ‘common secure framework’, to be defined by the Administrative Commission for the Coordination of Social Systems (15), should duly take into account the recommendations issued by the IDABC programme (16) (Interoperable Delivery of European e-Government Services to public Administrations, Businesses and Citizens) relating to Community data protection provisions, and in particular those relating to the security of processing (Article 17 of the Directive). In this perspective, the EDPS also recommends that expert advisers in data protection and security are duly involved in the relevant works of this Administrative Commission

41.

The EDPS welcomes this proposal to the extent that it aims at favouring the free movement of citizens and improving the standard of living and conditions of employment of EU citizens moving within the Union. Indeed, coordination of social security systems could not exist without the processing and the transmission of different kinds of personal data, in many cases of a sensitive nature.

42.

However, it is also essential that this increased exchange of personal data between national administrations of Member States, while providing better conditions for free movement of people, also ensures a high level of protection of personal data, thereby guaranteeing one of the EU fundamental rights.

43.

The Proposal will rely on the harmonised data protection framework laid down by Community provisions on protection of personal data, and in particular by Directive 95/46/EC and national implementing laws. The EDPS is glad that the applicability of this data protection framework is recalled by both the basic Regulation 883/2004 and by the Proposal. However, specific issues relating to the application of data protection principles in the framework of coordination of social security systems should be further and explicitly addressed.

44.

With regard to the purpose limitation principle, the EDPS considers that the Proposal respects the basic data protection provisions on purpose limitation. Furthermore, the EDPS notes that the prohibition to use personal data for purposes other than social security is not explicitly laid down in the Proposal but arises from the applicable data protection legislation, which would allow for exceptions to this general principle only in specific circumstances and under strict conditions. In this context, the legislator might consider whether to specifically refer in the Proposal to the conditions under which social security data may be processed for a different purpose.

45.

With regard to proportionality in data processed, competent bodies and storage periods, the EDPS highlights that in such a complex system, whereby personal data are processed and further transmitted through an asymmetric network of bodies, special attention should be paid to ensure that personal data are processed by the competent authorities, for a proportionate period of time, and that duplications of databases are avoided. In this context, further clarifications on the modalities of transmitting and storing the data could be added to the Proposal.

46.

With regard to legal grounds for processing personal data, the EDPS, without entering into the details of the various specific mechanisms laid down by the Proposal, recommends the EU legislator to ensure that each and every proposed mechanism of processing and transmission of personal data is clearly based on a specific legal obligation directly laid down by the Proposal or on other legitimate grounds for processing pursuant to Articles 7 and 8 of the Directive.

47.

With regard to information to insured persons, the EDPS recommends adding an explicit reference in the Proposal to the need to provide concerned persons with specific and adequate information on processing of their personal data.

48.

With regard to data subjects' rights, the EDPS warmly welcomes Article 3.2 of the Proposal and suggests supplementing this provision with a broader reference to all data subjects' rights, including the right to and the safeguards concerning automated individual decisions. Furthermore, the EDPS invites the legislator to facilitate the effective exercise of data subjects' rights in a trans-border context by providing that the competent authority which is in direct contact with the insured person should act as a one-stop-shop not only with regard to social security benefits, but also with regard to all data processed in connection with those benefits.

49.

With regard to security measures, the EDPS recommends that the ‘common secure framework ’for the transmission of data laid down by Article 4 of the Proposal duly take into account relevant recommendations on data protection and security of processing. In this context, expert advisers in data protection and security should be duly involved in the relevant works of the competent Administrative Commission.

26.4.2007   

EN

Official Journal of the European Union

C 91/24

—

from the Europa competition website (http://ec.europa.eu/comm/competition/mergers/cases/). This website provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes,

—

in electronic form on the EUR-Lex website under document number 32007M4577. EUR-Lex is the on-line access to European law. (http://eur-lex.europa.eu)

26.4.2007   

EN

Official Journal of the European Union

C 91/24

—

from the Europa competition website (http://ec.europa.eu/comm/competition/mergers/cases/). This website provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes,

—

in electronic form on the EUR-Lex website under document number 32007M4594. EUR-Lex is the on-line access to European law. (http://eur-lex.europa.eu)

26.4.2007   

EN

Official Journal of the European Union

C 91/25

26.4.2007   

EN

Official Journal of the European Union

C 91/26

26.4.2007   

EN

Official Journal of the European Union

C 91/27

—

Investment in agricultural holdings: maximum 40 % and maximum EUR 400 000 over three marketing years

—

Support for advice to individual holdings in connection with management systems: maximum 80 % and maximum EUR 2 000

—

Land consolidation: maximum 90 %

—

Cost of establishing producer groups: maximum 60 %, but in total not more than EUR 400 000 per group over five years.

—

Investment in agricultural holdings (‘Agrarinvestitionsförderungsprogramm (AFP)’)

In order to support agriculture which is competitive, sustainable and environment-friendly, takes proper account of animal welfare and is multifunctional, aid can be granted to promote investment in agricultural undertakings for the primary production of agricultural products. The interests of consumers, the development of rural areas and the preservation of biodiversity are to be taken into account just as much as the improvement of living, working and production conditions

The measure is based on Article 4 (investment in agricultural holdings).

—

Support for advice to individual holdings in connection with management systems (AFP)

Support will be granted for advice to individual holdings which goes beyond routine advice and which relates to the application of documentation systems. The measure is intended to help farmers comply with the standards of modern agriculture with its emphasis on quality, and in particular with the requirements under Articles 4 and 5 of and Annexes III and IV to Regulation (EC) No 1782/2003 (cross-compliance). The advisory services will be provided by public and private bodies which must be approved by the Länder. The records from the documentation systems form the basis for the holding-based advice. The measure is in principle open to all aid recipients and is paid to the advisory bodies as a contribution

The measure is based on Article 15 (provision of technical assistance in the agricultural sector)

—

Land consolidation (principles for promoting integrated rural development (promoting reorganisation of rural land ownership))

The objective of support is to reorganise rural land ownership and the arrangement of rural areas in order to improve agricultural structures in procedures under the Law on land consolidation and the Law on agricultural adjustment, including measures to ensure a sustainably efficient natural balance and plans for voluntary exchange of use. Procedural costs arising are eligible for support

The measure is based on Article 13 (aid for land consolidation).

—

Cost of establishing producer groups (principles for promoting market structure improvement (formation of groups))

The assistance is aimed at supporting the establishment and working of groups and improving the competitiveness of firms involved in processing and marketing agricultural products, thereby contributing to ensuring sales or creating profit advantages at producer level

The assistance helps to adapt the collection, processing and marketing of agricultural products to market requirements with regard to the nature, quantity and quality of the products on offer

The promotion of groups is based on Article 9 (aid for producer groups).

Provincie Noord-Brabant

Brabantlaan 1

Postbus 90151

5200 MC 's-Hertogenbosch

Nederland

Provincie Limburg

Limburglaan 10

Postbus 5700

6202 MA Maastricht

Nederland

—

Paragraph 1.2: EUR 3 000 000 for the 2007-13 period;

—

Paragraph 1.4: EUR 60 000 for the 2007-13 period;

—

Paragraph 1.5: EUR 1 250 000 for the 2007-13 period;

—

Paragraph 1.9: EUR 4 500 000 for the 2007-13 period;

—

Paragraph 6.1: EUR 3 000 000 for the 2007-13 period;

—

Paragraph 6.4: EUR 1 200 000 for the 2007-13 period.

—

Paragraph 1.2: a maximum of 60 % of the eligible costs, up to a maximum of EUR 1,2 million per planned site, in accordance with Articles 4(2)(e), 4(4)(a) and 4(4)(c);

—

Paragraph 1.9: a maximum of 60 % of the eligible costs, in accordance with Articles 4(2)(e), 4(4)(a) and 4(4)(c);

—

Paragraph 6.1: a maximum of 60 % of the eligible costs, in accordance with Articles 4(2)(e), 4(4)(a) and 4(4)(c);

—

Paragraph 1.4: a maximum of 50 % of the eligible costs, up to a maximum of EUR 20 000 per project, in accordance with Articles 4(2)(e), 4(4)(a) and 4(4)(c);

—

Paragraph 1.5: a maximum of 50 % of the eligible costs, up to a maximum of EUR 1,25 million, in accordance with Articles 4(2)(e), 4(4)(a) and 4(4)(c);

—

Paragraph 6.4: a maximum of 50 % of the eligible costs, up to a maximum of EUR 50 000 per project, in accordance with Articles 4(2)(e), 4(4)(a) and 4(4)(c).

—

Paragraph 1.2: aid applies to the costs of feasibility studies and business plans as well as to constructing and improving property in line with the objectives set out in Article 4(3)(a) to (d);

—

Paragraph 1.9: aid applies to the costs of constructing and improving property in line with the objectives set out in Article 4(3)(a) to (d);

—

Paragraph 6.1: aid applies to the costs of constructing and improving property in line with the objectives set out in Article 4(3)(a) to (d);

—

Paragraph 1.4: aid applies to the costs of feasibility studies and business plans focusing on constructing and improving property in line with the objectives set out in Article 4(3)(a) to (d);

—

Paragraph 1.5: aid applies to the costs of feasibility studies and business plans as well as to constructing and improving property in line with the objectives set out in Article 4(3)(a) to (d);

—

Paragraph 6.4: aid applies to the costs of feasibility studies and business plans focusing on improving property in line with the objectives set out in Article 4(3)(a) to (d).

Provincie Limburg

Limburglaan 10

Postbus 5700

6202 MA Maastricht

Nederland

Provincie Limburg

Limburglaan 10

Postbus 5700

6202 MA Maastricht

Nederland

Provincie Limburg

Limburglaan 10

Postbus 5700

6202 MA Maastricht

Nederland

Ministerstvo zemědělství ČR

Těšnov 17

CZ-117 05 Praha 1

Ministerstvo zemědělství ČR

Těšnov 17

CZ-117 05 Praha 1

26.4.2007   

EN

Official Journal of the European Union

C 91/33

26.4.2007   

EN

Official Journal of the European Union

C 91/34

European Commission

Directorate-General for Competition

State Aid Greffe

SPA 3 6/5

B-1049 Brussels

Fax No: (32-2) 296 12 42

—

an annual compensation of GBP 150 million granted to POL for the net public service cost of rural counter coverage (“rural network support”),

—

an aid devoted to back POL's debt to Royal Mail Group plc which had financed POL's balance-sheet deficits up to 31 March 2002 (“debt payment funding”),

—

a rolling working capital loan to POL for over-the-counter cash payments meant to fund the basic postal account.

26.4.2007   

EN

Official Journal of the European Union

C 91/42

1.

On 19 April 2007, the Commission received a notification of a proposed concentration pursuant to Article 4 of Council Regulation (EC) No 139/2004 (1) by which the undertakings International Power plc (‘IPR’, United Kingdom) and Mitsui & Co., Ltd. (‘Mitsui’, Japan) acquire within the meaning of Article 3(1)(b) of the Council Regulation joint control of the undertakings Deeside Power Development Company Limited (‘Deeside’, United Kingdom), Rugeley Power Limited (‘Rugeley’, United Kingdom), International Power IQ Limited (‘Indian Queens’, United Kingdom) and International Power Fuel Company Limited (‘IPFC’, United Kingdom), currently solely controlled by IPR, by way of purchase of shares in a newly created company constituting a joint venture.

2.

The business activities of the undertakings concerned are:

3.

On preliminary examination, the Commission finds that the notified transaction could fall within the scope of Regulation (EC) No 139/2004. However, the final decision on this point is reserved. Pursuant to the Commission Notice on a simplified procedure for treatment of certain concentrations under Council Regulation (EC) No 139/2004 (2) it should be noted that this case is a candidate for treatment under the procedure set out in the Notice.

4.

The Commission invites interested third parties to submit their possible observations on the proposed operation to the Commission.

Observations must reach the Commission not later than 10 days following the date of this publication. Observations can be sent to the Commission by fax ((32-2) 296 43 01 or 296 72 44) or by post, under reference number COMP/M.4654 — IPR/Mitsui (UK electricity generation business), to the following address:

26.4.2007   

EN

Official Journal of the European Union

C 91/43

1.

On 19 April 2007, the Commission received a notification of a proposed concentration pursuant to Article 4 of Council Regulation (EC) No 139/2004 (1) by which the undertaking Bridgepoint Capital Group Ltd. (‘Bridgepoint’, United Kingdom) acquires within the meaning of Article 3(1)(b) of the Council Regulation sole control of the whole of the education division of Wolters Kluwer N.V. (‘WKE’, The Netherlands) by way of purchase of shares.

2.

The business activities of the undertakings concerned are:

3.

On preliminary examination, the Commission finds that the notified transaction could fall within the scope of Regulation (EC) No 139/2004. However, the final decision on this point is reserved. Pursuant to the Commission Notice on a simplified procedure for treatment of certain concentrations under Council Regulation (EC) No 139/2004 (2) it should be noted that this case is a candidate for treatment under the procedure set out in the Notice.

4.

The Commission invites interested third parties to submit their possible observations on the proposed operation to the Commission.

Observations must reach the Commission not later than 10 days following the date of this publication. Observations can be sent to the Commission by fax ((32-2) 296 43 01 or 296 72 44) or by post, under reference number COMP/M.4658 — Bridgepoint Capital/Wolters Kluwer Educational Division, to the following address:

26.4.2007   

EN

Official Journal of the European Union

C 91/44

1.

On 18 April 2007, the Commission received a notification of a proposed concentration pursuant to Article 4 and following a referral pursuant to Article 4(5) of Council Regulation (EC) No 139/2004 (1), by which the undertaking HgCapital Investments Managers Ltd, UK (‘HgCapital’), acquire(s) within the meaning of Article 3(1)(b) of the Council Regulation control of the whole of the undertakings Denton ATD, Inc., USA, Robert Denton, Inc., USA, and Denton COE GmbH, Germany (together ‘Denton’), by way of purchase of shares.

2.

The business activities of the undertakings concerned are:

3.

On preliminary examination, the Commission finds that the notified transaction could fall within the scope of Regulation (EC) No 139/2004. However, the final decision on this point is reserved.

4.

The Commission invites interested third parties to submit their possible observations on the proposed operation to the Commission.

Observations must reach the Commission not later than 10 days following the date of this publication. Observations can be sent to the Commission by fax ((32-2) 296 43 01 or 296 72 44) or by post, under reference number COMP/M.4498 — HgCapital/Denton to the following address: