10.2.2012   

EN

Official Journal of the European Union

C 37/1

1.

On 8 April 2011, the Commission adopted Implementing Regulation (EU) No 404/2011 laying down detailed rules for the implementation of Council Regulation (EC) No 1224/2009 establishing a Community control system for ensuring compliance with the rules of the common fisheries policy (the Implementing Regulation) (3).

2.

The EDPS was not consulted under Article 28(2) of Regulation (EC) No 45/2001, despite the fact that the legislative initiative was included in the EDPS Inventory of priorities for legislative consultation (4). The present Opinion is therefore based on Article 41(2) of the same Regulation.

3.

The objective of Council Regulation (EC) No 1224/2009 of 20 November 2009 establishing a Community control system for ensuring compliance with the rules of the common fisheries policy (the Control Regulation) (5), is to put in place a European system for control, inspection, and enforcement so as to ensure compliance with all the rules of the common fisheries policy.

4.

The Control Regulation obliged the Commission to adopt detailed rules and measures necessary to implement certain of its provisions. The Implementing Regulation establishes such detailed rules with regard to the following areas: general conditions for access to waters and resources (Title II), control of fisheries (Title III), control of marketing (Title IV), surveillance (Title V), inspection (Title VI), enforcement (Title VII), measures to ensure compliance by Member States (Title VIII), data and information (Title IX) and implementation (Title X).

5.

In March 2009, the EDPS issued an Opinion on the Control Regulation (6). The Opinion highlighted that the proposal involved the processing of various categories of data, which in some cases could be considered personal data. Personal data would normally be processed in all cases where the master or the owner of the vessel or any fisherman or member of the crew is identified or identifiable. On this ground, the EDPS made some recommendations on a few provisions of the proposal.

6.

The EDPS further stressed that several articles of the proposed Regulation referred to a comitology procedure for the adoption of implementing rules and that some of these rules also involved data protection aspects (7). Given the impact that these rules may have on data protection, the EDPS thus recommended the Commission to consult him before these detailed rules were adopted. The Implementing Regulation was adopted last 8 April 2011, but the EDPS was not consulted before the adoption.

7.

The EDPS regrets that the Implementing Regulation was not submitted to him for prior consultation as recommended in the 2009 Opinion. He would like to nonetheless draw the attention of the Commission to a few aspects of the Implementing Regulation liable to raise concerns from a data protection point of view. For this reason, the EDPS has decided to submit this brief Opinion. The EDPS’ comments will focus mainly on the following aspects: (i) monitoring of the activities of the fishing vessels and data protection; (ii) vessels remote monitoring systems; (iii) retention of personal data by the Commission and the competent authorities; and (iv) applicability of Regulation (EC) No 45/2001.

8.

Recital 31 provides that the processing of personal data under the Implementing Regulation is governed by Directive 95/46/EC and Regulation (EC) No 45/2001, ‘in particular as regards the requirements of confidentiality and security of processing, the transfer of personal data from the national systems of Member States to the Commission, the lawfulness of processing, and the rights of data subjects to information, access and rectification of their personal data’. The EDPS welcomes this reference to the applicable data protection legislation.

9.

The activities of the fishing vessels are subject to systematic and detailed monitoring through advanced technological means, including satellite tracking devices and computerised databases (8). The geographical position, course and speed of fishing vessels is regularly monitored by the Vessel Monitoring System (VMS) (9) and, where applicable, the Automatic Identification System (AIS) (10) or the Vessel Detection System (VDS) (11). All these data are systematically cross-checked, analysed and verified through computerised algorithms and automated mechanisms in order to spot inconsistencies or suspected infringements. As Article 145(3) of the Implementing Regulation shows, this processing may resort, as appropriate, in data mining and profiling activities (12).

10.

As long as these data can be linked to identified or identifiable individuals (e.g. the master of the vessel, the owner of the vessel, or the members of the crew), such monitoring involves the processing of personal data. It is therefore important that the control system is well-balanced and that adequate safeguards are put in place and implemented in order to avoid that the rights of the persons involved are unduly restricted. This implies for instance a clear delimitation of the purposes for which the relevant data can be processed, the minimisation of the (personal) data being processed and the establishment of maximum retention periods for the same data. This is especially important in the present case where the processing operations potentially involve data concerning offences or suspected offences, which are likely to be linked to the personal data of the owner and/or the master of the vessel.

11.

Having regard to the scope and scale of the monitoring activities, it appears that the Implementing Regulation does not always successfully strike a balance between the objective of ensuring compliance and the respect for privacy and data protection of the individuals concerned. As the Implementing Regulation has already been adopted, the EDPS considers it important for the Commission to clarify ex post, where possible, the scope and limits of the processing activities and provide for specific safeguards where necessary. This could be achieved, for instance, by adopting general or specific guidance or internal rules aimed at clarifying certain aspects of the processing activities with regard to the protection of personal data or in the framework of prior checks with the EDPS under Article 27 of Regulation (EC) No 45/2001.

12.

The main aspects which in the EDPS’ view require further specification are discussed below.

13.

One of the basic principles of the fundamental right to data protection is that personal data shall be processed only for specified, explicit and legitimate purposes (13). The purpose limitation principle establishes a special responsibility for data controllers but also sets out a requirement for the legislator, by demanding that legislative provisions must not be framed in such a general way as to justify the use of personal data for purposes which are not sufficiently defined. Derogations of the purpose limitation principle are possible, provided that they are necessary and proportionate and that the other requirements set out in Article 52 of the Charter of the Fundamental Rights of the European Union are complied with.

14.

As mentioned, the Control Regulation and the Implementing Regulation provide for the systematic and detailed monitoring of fishing activities by means of VMS, AIS and VDS. Pursuant to Article 12 of the Control Regulation, data from the VMS, AIS and VDS may be transmitted to EU agencies and competent authorities of the Member State engaged in surveillance operations for the purpose of ‘maritime safety and security, border control, protection of the maritime environment and general law enforcement’. Article 27 of the Implementing Regulation further specifies that Member States shall use VMS data ‘for the effective monitoring of the activities of fishing vessels’ and that Member States shall ‘take all necessary measures to ensure that they are used only for official purposes’.

15.

Having regard to the purpose limitation principle, the EDPS considers that Article 12 of the Control Regulation and Article 27 of the Implementing Regulation are too broadly formulated. If not interpreted restrictively, the expressions ‘general law enforcement’, ‘monitoring of the activities of the fishing vessels’ and ‘official purposes’ are likely to cover an overly broad range of processing activities, not even remotely connected with the purposes of the Control Regulation. This open-ended approach raises concerns in connection with the purpose limitation principle.

16.

In light of the above considerations, the EDPS advises the Commission to provide concrete guidance on the interpretation of Article 27 of the Implementing Regulation. The Commission should in particular clarify the meaning, and limit the scope, of VMS, AIS and VDS data processing for ‘general law enforcement’ or other purposes unconnected with the common fisheries policy.

17.

Another fundamental principle of the data protection legislation is that personal data should be kept in a form which permits the identification of data subjects for no longer than necessary for the purposes for which the data were collected (14). This principle is also directly connected with purpose limitation. If personal data are no longer necessary for the initial purpose, the retention of those data is no longer admissible as it would constitute a processing incompatible with the original purpose.

18.

The Implementing Regulation sets a minimum retention period of three years in relation to a number of data. With regard to VMS data, for example, Article 27(2)(a) provides that Member States shall ensure that the relevant data are recorded in a computer readable form and safely stored in computerised databases ‘for at least three years’. Similarly, Article 92(3) provides that data related to the surveillance reports shall be kept available in the database for ‘at least three years’. Moreover, Article 118 establishes that the data from the inspection reports shall be kept available in the database ‘for at least three years’.

19.

In general, the EDPS considers that the storage period should have been established more precisely by setting a maximum period of retention (instead of only a minimum retention period). In any event, he takes the view that the above provisions should be interpreted consistently with Article 6(1)(e) of Directive 95/46/EC and Article 4(1)(e) of Regulation (EC) No 45/2001. This implies that the period of retention of three years should be interpreted in principle as a maximum retention period, unless the necessity to retain the data for a longer period can be adequately demonstrated on the basis of convincing evidence.

20.

Article 164 of the Implementing Regulation governs information exchanges with third countries. Article 164, paragraph 2, in particular deals with information exchanges from a Member State to a third country or a Regional Fisheries Management Organisation under a bilateral agreement with that country or in accordance with the rules of a that Organisation. Article 164, paragraph 3, deals with exchanges of information concerning non-compliance with the rules of the Common Fisheries Policy, from the Commission, or the body designated by it, in the framework of fisheries agreements concluded between the Union and third countries or in the framework of Regional Fisheries Management Organisation or similar arrangements.

21.

While Article 164, paragraph 2, specifies that the information exchange from Member States to third countries shall take place ‘in accordance with EU and national legislation regarding the protection of individuals with regard to the processing of personal data’, paragraph 3 does not contain a similar reference with regard to information exchanges originating from the Commission. Under paragraph 3, the information exchange is made subject only to the consent of the Member State that supplied the information.

22.

In this respect, the EDPS highlights that the communication of personal data from the Commission or other European Institutions or bodies to third countries under Article 164 may take place only if the requirements of Regulation (EC) No 45/2001 and in particular Articles 9 thereof, are complied with.

23.

The Control Regulation and the Implementing Regulation may involve the processing of personal data by the Commission or other EU bodies, thereby triggering the applicability in these cases of Regulation (EC) No 45/2001 to such processing operations. To the extent that these processing operations are likely to present specific risks to the rights and freedoms of data subjects, they shall be subject to prior checking of the EDPS under Article 27 of Regulation (EC) No 45/2001.

24.

In particular, it appears that the processing operations carried out under the Control Regulation and the Implementing Regulation may involve the processing of data related to offences or suspected offences committed by a vessel. These data are likely to be linked with the personal data of the owner or the master of the vessel (or a member of the crew) in connection with the breaches of the applicable rules.

25.

Consequently, the EDPS invites the Commission (and other European bodies concerned) to consider the need for prior checking of the processing operations carried out under the Control Regulation and the Implementing Regulation and submit the necessary notifications further to this assessment (15).

26.

The EDPS regrets that the text of the Implementing Regulation was not notified to him for legislative consultation under Article 28(2) of Regulation (EC) No 45/2001, as recommended in the 2009 Opinion. Although the EDPS welcomes the reference to the applicable data protection legislation in recital 31 of the Implementing Regulation, he finds that certain provisions of this Regulation are liable to raise data protection concerns.

27.

Given that the Implementing Regulation has already been adopted, the EDPS advises the Commission to clarify ex post, where possible, the scope and the limits of the processing activities and provide specific safeguards where necessary. This could be done by adopting general or specific guidance or internal rules or in the framework of prior checks with the EDPS under Article 27 of Regulation (EC) No 45/2001.

28.

In particular, the EDPS advises the Commission and other EU bodies concerned to:

10.2.2012   

EN

Official Journal of the European Union

C 37/6

1.

On 19 July 2011, the Commission adopted a proposal for a Regulation of the European Parliament and of the Council amending Council Regulation (EEC) No 3821/85 on recording equipment in road transport and amending Regulation (EC) No 561/2006 of the European Parliament and the Council (the Proposal) (3). The Proposal is accompanied by a communication entitled ‘Digital Tachograph: Roadmap for future activities’ (the Communication) (4). The Proposal and the Communication were sent to the EDPS for consultation on the same day.

2.

The EDPS had already been consulted informally in the course of April 2011 on an earlier version of the Proposal, on which he provided informal comments on 13 May 2011. The EDPS welcomes the informal consultation which has helped to improve the text from a data protection point of view at an early stage of the drafting process. Some of those comments have been taken into account in the Proposal. The EDPS would welcome reference to this Opinion in the preamble of the Proposal.

3.

The Proposal deals with the installation and use of recording equipment in vehicles used for the carriage of passengers or goods by road to check compliance of professional road transport drivers with social legislation on driving times and rest periods (5).

4.

Since 1985, a tachograph system has been set up for this purpose, based on recording equipment together with tachograph cards (6). The recording equipment records, stores, displays, prints, and provides data output related to driver activities. A tachograph card is a smart card intended for use with the recording equipment; tachograph cards enable the cardholder to be identified by the recording equipment and data to be transferred and stored.

5.

The draft proposal amends the current Regulation (EEC) No 3821/85 on the use of recording equipment in road transport (the Regulation) and updates it in line with current technological developments with a view to improving the use of the digital tachograph compared to analogue versions, and to widening its functionalities so as to create a new type of digital tachograph. The new digital tachograph will be enhanced with the following technological features: (i) it will make use of geolocation equipment to collect certain drivers’ location data automatically; (ii) it will use remote communication facilities to perform remote checks; and (iii) it will have a standardised interface with other Intelligent Transport Systems (ITS) allowing it to become an essential component of a vehicle’s ITS platform (7).

6.

Many issues raised in the Proposal will require further complementary actions which are described in the Communication. The Communication identifies several measures to be initiated by the Commission, notably including updating, by means of delegated acts, the technical specifications of the digital tachograph laid down in Annex IB of the Regulation and upgrading security mechanisms, as well as amending Directive 2006/126/EC on driving licences to merge the professional drivers’ cards used in tachographs with their driving licences.

7.

The use of recording equipment in road transport involves the processing of personal data relating to professional drivers. A large part of the processing relies upon the use of geolocation equipment and remote communication facilities, which are technologies that have considerable impact on individuals’ privacy and data protection.

8.

The Proposal thereby impinges on the privacy of professional drivers in a very visible way, in particular since it allows the constant monitoring of drivers’ whereabouts and introduces the possibility of remote controls by control authorities, who will have constant direct access to the data stored in tachographs. Furthermore, the envisaged merging of the driver card with the driving licence might also affect the current protection afforded to drivers’ data.

9.

It is therefore essential that the processing of data through tachographs within the European Union is done in accordance with the EU data protection framework, as set out in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, Article 16 of the Treaty on the Functioning of the European Union as well as Directive 95/46/EC (8) and Directive 2002/58/EC (9).

10.

It is worth noting that at the time the Regulation was adopted in 1985, there was no comprehensive data protection framework in the EU. The current review of the Regulation is therefore an opportunity to update the Regulation in line with the current data protection regime.

11.

The EDPS particularly welcomes the introduction in the Proposal of a recital and a dedicated provision on data protection (10). The EDPS however notes that these provisions alone do not resolve all data protection issues raised by the different measures put forward in the Proposal. Therefore, additional guarantees should be included in the Proposal and in the complementary measures described in the Communication.

12.

In this Opinion, the EDPS points to several aspects of the Proposal which require further consideration from a data protection standpoint. The EDPS will focus in particular on the following issues, which will be examined in turn in Section II below:

13.

The EDPS welcomes the insertion of a dedicated provision on data protection in Article 34 of the Proposal. Article 34 clearly underlines the responsibility of owners of vehicles and/or transport undertakings, as data controllers, to comply with applicable data protection law. Amongst other things, this will require them to inform professional drivers about the processing of their data in tachographs, grant drivers access to their data and rectify incorrect or incomplete data. The EDPS underlines that such information about the processing must be complete for all the processing activities undertaken, and he therefore welcomes the fact that Article 5(6) of the Proposal requires data controllers to inform drivers specifically about the possibility of remote control by control authorities. The EDPS further emphasises that data controllers must notify the processing to the supervisory authorities as provided for in Articles 18 to 20 of Directive 95/46/EC.

14.

This provision also puts particular emphasis on the duty of Member States and independent supervisory authorities to ensure that the processing of personal data in tachographs used in road transport is done in accordance with applicable data protection law. This will require that Member States adopt specific measures with respect to the use of specific technologies, such as Global Navigation Satellite System (GNSS), remote communications and ITS interfaces, or as concerns the electronic exchange of information on driver cards and storage of records by transport undertakings. Whenever possible, data protection authorities in the Member States should be consulted before the adoption of such measures, in order to develop frames that are compatible with applicable data protection requirements.

15.

The EDPS welcomes the fact that the concept of privacy by design is embedded in the Proposal by providing that recording equipment must be ‘designed in such a way as to ensure privacy’. The EDPS emphasises that from an early stage of digital tachograph design, this should be privacy- and data protection-friendly. These privacy-friendly measures should be appropriately reflected in the update of specifications contained in Annex IB.

16.

However, as underlined in paragraph 11 above, Article 34 and recital 15 of the Proposal alone do not tackle all data protection concerns linked to the use of tachographs. Therefore, the EDPS highlights in this Opinion the additional measures necessary to guarantee a satisfactory level of data protection in tachographs.

17.

The EDPS considers that the security requirements for the digital tachograph, contained in several parts of the Proposal and in Article 15, are insufficiently developed in the Proposal. Furthermore, the EDPS underlines that the Proposal introduces the use of many technologies so as to create a ‘new digital tachograph’, for which the current Annex IB is outdated and contains neither relevant specifications nor appropriate security measures.

18.

The EDPS underlines that industry might suffer from the unclear legal framework resulting from the adoption of an updated Regulation introducing many technological changes whose technical specifications will not be detailed in the existing, outdated annexes. There is therefore a risk that privacy-unfriendly measures and frameworks are developed by industry until the specifications are updated, and this risk will exist for as long as the review process of these annexes is taking place, i.e. until end of 2014.

19.

The EDPS strongly recommends that the introduction of any technological update (GNSS, remote communication, ITS) in tachographs is duly supported by carrying out privacy impact assessments to evaluate the privacy risks raised by the use of these technologies.

20.

The EDPS furthermore recommends inserting in the Proposal a dedicated article on the level of security to be achieved at all stages of development and use of tachographs (not only in the design and installation phases but also, and rather importantly, during their use). This article should emphasise the following:

21.

To promote good data protection practices, it would be helpful that the EDPS and the Article 29 Working Party of Data Protection Authorities were included in the list of participants at the Tachograph Forum foreseen in Article 41 of the Proposal.

22.

The Proposal lacks precision and certainty regarding many modalities of the processing, which should however be clarified to ensure that these measures respect the proportionality principle set out in Article 6(1)(c) of Directive 95/46/EC. This notably concerns the types of data processed and recorded in tachographs and through use of geolocation equipment, the period of time such data may be kept and which recipients are allowed access to which data, in particular regarding the use of remote communications.

23.

Many of the data processing details are currently set out in Annex IB of the Regulation, which is no longer up to date and will later be subject to review by means of delegated acts of the Commission. There is therefore no legal certainty about whether the processing envisaged will meet the conditions of proportionality, since many measures are left to be decided later on in regulatory committees. Furthermore, there is a risk that during the time taken to update the annexes, industry will develop its own schemes, which may lead to possible discrepancies.

24.

The EDPS does not support such an approach and recommends clarifying in the Proposal itself the general modalities of the processing, only leaving the precise details to be dealt with in annexes. The EDPS regrets that the Proposal no longer describes the categories of data to be collected and recorded in the digital tachographs, although this was clearly specified in Article 5 of the earlier version of the Proposal communicated to the EDPS (e.g. movement and speed of the vehicle, time measurement, location of starting and ending of the driver’s daily working period, identity of the driver, activity of the driver, events and faults). Article 34(3) of the Proposal now only provides that ‘only data strictly necessary for the purpose of the processing shall be processed’ without specifying the types of data that will be processed.

25.

The EDPS strongly recommends describing the general modalities of the processing in the text of the Regulation, which, contrary to the adoption of annexes, would be approved through the ordinary legislative procedure. This approach would help bring more legal certainty to professional drivers, which in turn would reinforce the valid use of the data in court.

26.

The EDPS underlines that appropriate consideration should also be given to the proportionality principle when modifying Annex IB in line with technological developments. He strongly recommends that the EDPS is duly consulted during updating of Annex IB of the Regulation. The EDPS believes that this update should take place as soon as possible to ensure that harmonised technical specifications are embedded in tachographs by industry.

27.

The EDPS notes that according to recital 5 of the Proposal, the recording of geolocation data is justified to support control officers during controls. In view of the purpose limitation principle set out in Article 6(1)(b) of Directive 95/46/EC, the EDPS emphasises that the location data recorded on tachographs should not be used for any other incompatible purpose.

28.

Although only two specific pieces of location data would be recorded according to Article 4 of the Proposal (identification of the starting and ending place of the daily work period), the EDPS understands that the use of geolocation equipment will enable constant positioning of the vehicle, and thus of the driver. This could be done for several purposes, for example to monitor speed and direction, to check if the vehicle is moving or not, etc. In view of Article 4 of the Proposal and the purpose limitation principle, the EDPS underlines that such uses would not be allowed. The EDPS emphasises that the installation and use of devices for the direct and principal purpose of allowing employers to monitor remotely and in real time the actions or whereabouts of their employees should not be permitted.

29.

Access to the data stored in the recording equipment may be granted at all times to (i) control authorities for control checks, and (ii) the relevant undertaking so it can comply with its legal obligations, in particular as set out in Articles 28 and 29 of the Proposal. The EDPS welcomes the fact that restrictive access rights to the data have been defined according to user type and/or identity.

30.

Pursuant to recital 6, remote communications for control purposes are justified to facilitate targeted roadside checks and to reduce the administrative burden created by random checks on transport undertakings. The EDPS understands the convenience of introducing such a measure but recalls that adequate safeguards must be implemented in view of the privacy risks of such continuous remote access to the information stored in the recording equipment.

31.

In this respect, the EDPS notes with satisfaction that Article 5 of the Proposal provides a number of important safeguards, in particular that: (i) such remote access is restricted only to the competent control authorities; (ii) the scope of the data exchanged with control authorities shall be limited to those strictly necessary for targeted roadside checks; (iii) there is a clearly defined short retention period of two hours of the data gathered during remote checks; (iv) information about the possibility of remote controls shall be provided to drivers by the owner or holder of the vehicle; and (v) appropriate security measures must be implemented to ensure data integrity and authentication.

32.

The EDPS however considers that it is not sufficiently clear which data can be exchanged through remote communications. To ensure that the amount of data communicated to control authorities is not excessive, the EDPS recommends formulating Article 5(3) differently. Instead of listing data that will not be communicated, he suggests that Article 5(3) provides for an exhaustive list of the data which may be communicated.

33.

With respect to sanctions, the EDPS also stresses that a remote control should not lead to automatic fines or penalties for the driver or undertaking. Since actual remote control is done without the knowledge of the person concerned, appropriate steps must be taken before any decision is reached. The remote control therefore should be seen as a preliminary measure which may lead to an in-depth control in the presence of the driver, should control officers have detected any anomalies in the preliminary phase.

34.

The Communication from the Commission indicates that a number of third countries apply the principles of the road transport regulations and the tachograph regulation. In the current version of the Proposal, there is no indication of any international exchange of tachograph data. It should be clarified in the Proposal whether any cross-border exchanges of data are contemplated with third country authorities, in which case appropriate data protection safeguards will be required to ensure that an adequate level of protection is guaranteed when data are transferred to these third countries, in compliance with Articles 25 and 26 of Directive 95/46/EC.

35.

Making tachographs an essential component of Intelligent Transport Systems raises a number of privacy and data protection issues, which were underlined by the EDPS in his Opinion on the ITS Directive (11).

36.

The further processing of data recorded or produced by the tachograph for use in intelligent transport systems applications should only take place if the further processing is not incompatible with the original purpose of collection. This must be assessed on a case-by-case basis.

37.

Data controllers must ensure that the further processing of tachograph data for use in an ITS application is done according to one of the legal bases listed in Article 7 of Directive 95/46/EC. The EDPS underlines that amongst all the legal bases available, consent of drivers may be difficult to rely upon, considering the employment context within which the processing operations take place. Drivers might be pressed by their employer to use certain ITS applications for which they would therefore not have given their truly free consent (12).

38.

As a consequence, the EDPS suggests modifying Article 6(2) of the Proposal to state that ‘vehicles (…) shall be fitted with recording equipment equipped with a harmonised interface allowing the data recorded or produced to be used for intelligent transport systems applications. Further use of the data recorded in tachographs shall only be allowed provided that the driver has freely agreed to such further processing and that all other requirements of Article 6 of the Directive 95/46/EC are met’.

39.

The EDPS furthermore emphasises that all data recorded or produced by the tachograph should not be automatically accessible for use in other ITS applications but only those that would be strictly necessary for the processing in that ITS application. This should be emphasised in Article 6(3) of the Proposal. The EDPS recommends that a specific privacy assessment is conducted for each application to determine which data are strictly necessary for the processing and the time limit during which such data should be kept.

40.

Article 27 envisages merging the functionalities of driver cards with driving licences. Considering the potential amount of information recorded about driver activities, the driver card is more than a simple identity card certifying that the person is a professional driver. It is therefore more intrusive from a data protection viewpoint since it is aimed at monitoring a person's compliance with social regulations in the field of road transport.

41.

The integration of this card with the driving licence raises data protection concerns, in particular in view of the purpose limitation principle and of the proportionality principle. Furthermore, the necessity and benefit of integrating the driver card into the driving licence have not been sufficiently demonstrated. In particular, it is not proven how such integration would be the best way to help fight fraud and misuse of driver cards. The EDPS recommends that this integration should only be envisaged after a privacy and security impact assessment has been carried out. This should be clearly mentioned in Article 27 of the Proposal.

42.

Furthermore, such integration will require amending Directive 2006/126/EC on driving licences, a proposal for which shall be put forward by the Commission. Considering the data protection aspects raised by such amendments, the EDPS underlines that he wishes to be duly consulted on this proposal.

43.

Information on driver cards will be exchanged electronically through national electronic registers before driver cards are issued to check that the applicant does not already hold such a card. This exchange of information will be done through an existing system, TACHOnet. Article 26 provides the legal basis for such an electronic exchange of information. The EDPS welcomes the fact that the specific personal data recorded in these registers are clearly spelled out in Article 26 of the Proposal, as well as their retention period and the authorised recipients of the data. The EDPS emphasises that all the general modalities of the processing in TACHOnet should be described in this Article and that only purely technical specifications shall be adopted by means of implementing acts.

44.

The EDPS notes that the role of the Commission in the interconnection of the electronic registers lacks sufficient clarity. He emphasises that this role should be further clarified in the proposed implementing acts. He further stresses that whenever this role would involve the processing of personal data by the Commission, such processing should respect Regulation (EC) No 45/2001.

45.

The EDPS welcomes being consulted on a Proposal which impinges on the privacy of professional drivers in a very visible manner. He particularly welcomes the fact that a dedicated provision on data protection is provided for in the Proposal. The EDPS notes however that this provision alone cannot tackle all the data protection issues raised by the measures put forward in the Proposal. Additional guarantees are therefore required in the Proposal and in the complementary measures described in the Communication.

46.

The EDPS considers that the general modalities of the processing in tachographs should be set out in the Proposal itself and not in annexes to the Regulation. The main aspects of the processing should be described in the Proposal itself, such as the types of data recorded in tachographs and through geolocation equipment, the recipients, and the time periods for retention. The annexes of the Regulation should only provide purely technical details of general principles that have been set out in the Regulation itself.

47.

Furthermore, the EDPS notes that the existing annexes are outdated, which might lead to discrepancies in how tachographs are developed by industry. The Proposal introduces many technological updates, for which no relevant technical specifications are set out in the existing annexes to the Regulation. There is a risk that privacy-unfriendly frameworks will be developed by industry for as long as the update of the annexes to the Regulation is pending. The EDPS urges the Commission to update the annexes of the Regulation as soon as possible.

48.

The EDPS recommends introducing the following amendments in the Proposal:

49.

The EDPS calls on Member States to consult data protection supervisory authorities before adopting national measures for tachographs, in particular those measures on the use of geolocation equipment, remote communications, ITS interfaces and TACHOnet.

50.

To ensure appropriate consideration of data protection requirements in further complementary actions by the Commission, the EDPS wishes to be included in the list of participants in the Tachograph Forum and to be consulted on the update of Annex IB and on the Proposal to amend Directive 2001/126/EC on driving licences.

10.2.2012   

EN

Official Journal of the European Union

C 37/14

10.2.2012   

EN

Official Journal of the European Union

C 37/16

10.2.2012   

EN

Official Journal of the European Union

C 37/20

10.2.2012   

EN

Official Journal of the European Union

C 37/21

OJ C 264 of 8.9.2011

OJ C 189 of 29.6.2011

OJ C 140 of 11.5.2011

OJ C 121 of 19.4.2011

OJ C 94 of 26.3.2011

OJ C 88 of 19.3.2011

10.2.2012   

EN

Official Journal of the European Union

C 37/22

10.2.2012   

EN

Official Journal of the European Union

C 37/23

10.2.2012   

EN

Official Journal of the European Union

C 37/26

European Court of Auditors

Unit ‘Audit: Production of Reports’

12, rue Alcide de Gasperi

1615 Luxembourg

LUXEMBOURG

Tel. +352 4398-1

E-mail: euraud@eca.europa.eu

10.2.2012   

EN

Official Journal of the European Union

C 37/27

—

provide access to higher education for students including those from disadvantaged groups,

—

facilitate cooperation on recognition of studies and qualifications,

—

contribute to the improvement of the quality of higher education through the promotion of internationalisation, and harmonisation of programmes and curricula within participating institutions,

—

enhance the international cooperation capacity of HEIs in African, Caribbean and Pacific countries,

—

promote cooperation between sending and hosting institutions,

—

enable students, academics and staff to benefit linguistically, culturally and professionally from the experience gained in the context of mobility to another country,

—

enhance, in the medium-term, the political, cultural, educational and economical links between the participating countries.

Education, Audiovisual and Culture Executive Agency

Call for proposals EACEA/11/12 — ‘INTRA-ACP academic mobility scheme’

Attn Mr Joachim FRONIA

BOUR 02/29

Avenue du Bourget/Bourgetlaan 1

1140 Bruxelles/Brussel

BELGIQUE/BELGIË

10.2.2012   

EN

Official Journal of the European Union

C 37/30

European Commission

Directorate-General for Agriculture and Rural Development

Directorate M2 — Competition

Rue de la Loi/Wetstraat 120, 5/94A

1049 Bruxelles/Brussel

BELGIQUE/BELGIË

Fax +32 22967672

—

the Italian authorities have let it be known that they intend to place the grant equivalent of the deferral of payment under the de minimis regime provided for in Commission Regulation (EC) No 1535/2007 of 20 December 2007 on the application of Articles 87 and 88 of the EC Treaty to de minimis aid in the sector of agricultural production (1); however, at this stage, the Commission has doubts about the applicability of that Regulation to this particular case because no details have been provided by the Italian authorities as regards compliance with the individual and national aid ceilings provided for in the Regulation; also, the Regulation forbids the grant of de minimis aid which raises the State aid above the permitted maximum, which the deferral appears to do at this stage,

—

therefore, at this stage, the Commission can only conclude that there is an element of aid which is not justified by any of the information provided by the Italian authorities so far in the light of the rules on State aid in the agriculture sector (Community guidelines for State aid in the agriculture and forestry sector 2007 to 2013 (2)),

—

the deferral is in breach of the Council Decision in that one of its conditions (the equal size of instalments) is no longer met; the deferral thus transforms the entire system of staggered payments into new aid which, at this stage, does not appear to be justified by any of the provisions in the guidelines referred to above.