6.11.2012   

EN

Official Journal of the European Union

C 336/1

6.11.2012   

EN

Official Journal of the European Union

C 336/2

6.11.2012   

EN

Official Journal of the European Union

C 336/3

6.11.2012   

EN

Official Journal of the European Union

C 336/4

1.

On 30 November 2011, the Commission adopted a proposal concerning amendments to Directive 2006/43/EC on statutory audits (1). The amendments to Directive 2006/43/EC concern the approval and registration of auditors and audit firms, the principles regarding professional ethics, professional secrecy, independence and reporting as well as the associated supervision rules. On the same date, the Commission adopted a proposal for a regulation on statutory audit of public-interest entities (2), which lays down the conditions for carrying out such audits (hereinafter ‘the proposed regulation’). These proposals were sent to the EDPS for consultation on 6 December 2011.

2.

The EDPS welcomes the fact that he is consulted by the Commission and recommends that a reference to this Opinion is included in the preamble of the directive. A reference to the EDPS consultation has already been included in the preamble of the proposed regulation.

3.

In this Opinion, the EDPS addresses issues relating to Directive 2006/43/EC which go beyond what is covered by the proposed amendments. He emphasises the potential data protection implications of the Directive itself (3). The analysis presented in this Opinion is directly relevant for the application of the existing legislation and for other pending and possible future proposals containing similar provisions, such as those discussed in the EDPS Opinions on the legislative package on the revision of the banking legislation, credit rating agencies, markets in financial instruments (MiFID/MiFIR) and market abuse (4). Therefore, the EDPS recommends reading this Opinion in close conjunction with his Opinions of 10 February 2012 on the abovementioned initiatives.

4.

The Commission considers audit firms as contributing players to the financial crisis, and seeks to address the role auditors played in the crisis — or indeed the role they should have played. The Commission also states that robust audit is key to re-establishing trust and market confidence.

5.

The Commission mentions that it is also important to stress that auditors are entrusted by law to conduct statutory audits of the financial statements of companies which enjoy limited liability and/or are authorised to provide services in the financial sector. This entrustment responds to the fulfilment of a societal role in offering an opinion on the truth and fairness of the financial statements of those companies.

6.

Finally, according to the Commission, the financial crisis has highlighted weaknesses in the statutory audit especially with regard to public-interest entities (PIE). These are entities which are of significant public interest because of their business, their size, their number of employees or their corporate status, or because they have a wide range of stakeholders.

7.

In order to address these concerns, the Commission has published a proposal to amend Directive 2006/43/EC on statutory audits, which concerns the approval and registration of auditors and audit firms, the principles regarding professional ethics, professional secrecy, independence and reporting as well as the associated supervision rules. The Commission has also proposed a new regulation on statutory audit of public-interest entities laying down the conditions for carrying out such audits.

8.

The Commission proposes that Directive 2006/43/EC shall apply to situations not covered by the proposed regulation. Therefore, it is important to introduce a clear separation between the two legal texts. This means that the current provisions in Directive 2006/43/EC that only relate to the performance of a statutory audit on the annual and consolidated financial statements of the public-interest entities are moved to and, as appropriate, amended in the proposed regulation.

9.

The implementation and application of the legal framework for statutory audits may in certain cases affect the rights of individuals relating to the processing of their personal data. Directive 2006/43/EC in its current and amended form and the proposed regulation contain provisions which may have data protection implications for the individuals concerned.

46.

The EDPS welcomes the attention specifically paid to data protection in the proposed regulation but identified some scope for further improvement.

47.

The EDPS makes the following recommendations:

6.11.2012   

EN

Official Journal of the European Union

C 336/7

1.

On 28 March 2012, the Commission adopted a Communication titled ‘Tackling Crime in our Digital Age: Establishing a European Cybercrime Centre’ (1).

2.

The EDPS notes that the Council published its conclusions on the establishment of a European Cybercrime Centre on 7 and 8 June 2012 (2). The Council endorses the goals of the Communication, supports the establishment of the Centre (also referred to as ‘EC3’) within Europol and the use of the existing structures to cross-work with other crime areas, confirms that the EC3 should serve as a focal point in the fight against cybercrime, and that the EC3 will cooperate closely with relevant agencies and actors at international level, and calls the Commission in consultation with Europol to further elaborate the scope of the specific tasks that will be required to make the EC3 operational by 2013. However, the conclusions do not refer to the importance of fundamental rights, and in particular, to data protection in the establishment of the EC3.

3.

Before the adoption of the Commission Communication, the EDPS was given the possibility to provide informal comments on the draft communication. In its informal comments, the EDPS emphasised that data protection is an essential aspect to be taken into consideration in the set-up of the European Cybercrime Centre (hereafter ‘EC3’). Unfortunately, the Communication did not take into account the comments made at informal stage. Moreover, the Council conclusions ask to ensure that the Centre will be operational already by next year. This is why data protection should be taken into consideration in the next steps that will be taken already on a very short term.

4.

This Opinion addresses the importance of data protection when setting up the EC3, and provides specific suggestions that could be taken into consideration in the course of the set-up of the terms of reference for the EC3 and in the legislative revision of the Europol legal framework. Acting on his own initiative, the EDPS has therefore adopted the current Opinion based on Article 41(2) of Regulation (EC) No 45/2001.

5.

In its Communication, the Commission indicates the intention to create a European Cybercrime Centre as priority of the Internal Security Strategy (3).

6.

The Communication non-exhaustively lists several strands of cybercrime which the EC3 is supposed to focus on: cybercrimes committed by organised crime groups, particularly those generating large criminal profits such as online fraud, cybercrimes which cause serious harm to their victims, such as online child sexual exploitation, and cybercrimes seriously affecting critical information communication technology (ICT) systems in the Union.

7.

In terms of the Centre's work, the Communication lists four main tasks (4):

8.

The information processed by the EC3 will be gathered from the widest array of public, private and open sources, enriching available police data, and it would concern cybercrime activities, methods and suspects. The EC3 will also collaborate directly with other European agencies and bodies. This will happen via the participation of these entities in the EC3's Programme Board and also through operational cooperation where relevant.

9.

The Commission proposes that the EC3 would be the natural interface to Europol's cybercrime activities and other international police cybercrime units. The EC3 should also, in partnership with Interpol and other strategic partners around the globe, strive to improve coordinated responses in the fight against cybercrime.

10.

In practical terms, the Commission proposes to create this EC3 as part of Europol. The EC3 will be part of Europol  (5) and, therefore, it will be placed under the legal regime of Europol (6).

11.

According to the European Commission (7), the main novelties that the proposed EC3 will bring to Europol's current activities will be: (i) increased resources to more efficiently gather information from various sources; (ii) exchange of information with partners beyond the law enforcement community (mainly from the private sector).

12.

The EDPS seeks in this Opinion to:

13.

The Opinion is organised as follows: part 2.1 elaborates why data protection is an essential element in the creation of the EC3. Part 2.2 deals with the compatibility of the goals set for the EC3 in the Communication with Europol's legal mandate. Part 2.3 deals with the cooperation with private sector and international partners.

50.

The EDPS regards the fight against cybercrime as a cornerstone in building security and safety in the digital space and generating the required trust. The EDPS notes that compliance with data protection regimes should be regarded as an integral part of the fight against cybercrime and not as a deterrent of its effectiveness.

51.

The Communication refers to the establishment of a new European Cybercrime Centre within Europol while a Europol Cybercrime Centre has already been in existence for a number of years. The EDPS would welcome if more clarity is provided concerning the new capacities and the activities that will distinguish the new EC3 from the existing Europol Cybercrime Centre.

52.

The EDPS advises that the competences of the EC3 should be clearly defined and not just laid out by referring to the concept of ‘computer crime’ included in current Europol's legislation. Also, the definition of the competences and data protection safeguards of the EC3 should be part of the review of the Europol legislation. Until the new Europol legislation becomes applicable, the EDPS recommends that the Commission sets forth such competences and data protection safeguards in the terms of reference for the Centre. These could include:

53.

The EDPS considers that the exchanges of personal data of the EC3 with the widest array of public, private and open source actors imply specific data protection risks as they will often involve the processing of data collected for commercial purposes and international data transfers. These risks are addressed by the current Europol Decision which establishes that, in general, Europol should not exchange data directly with the private sector, and with specific international organisations only in very concrete circumstances.

54.

Against this background, and given the importance of these two activities for the EC3, the EDPS recommends that appropriate data protection safeguards should be provided in compliance with the existing provisions in the Europol Decision. These safeguards should be embedded in the terms of reference to be elaborated by the implementation team for the EC3 (and later in the revised Europol legal framework) and should in no event result in a lower level of data protection.

6.11.2012   

EN

Official Journal of the European Union

C 336/10

1.

On 30 April 2012, the Commission adopted a proposal concerning a recast of Council Regulation (EC) No 1104/2008 of October 2008 on Migration from the Schengen Information System (SIS) to the second generation Schengen Information System (SIS II) (1) (‘the proposal’).

2.

The EDPS already issued an Opinion on the three proposals setting up the second generation Schengen Information System on 19 October 2005 (2). At the time, the EDPS focused his analysis on the need to limit access rights and retention periods, as well as the need to supply information to data subjects. He also pointed out that the new functionality of links between records must not lead to an extension of access rights. On the technical design of SIS II, he recommended improvements of the security measures and cautioned against the use of national copies.

3.

The EDPS takes note of the Council conclusions on migration to SIS II (3). The Council invited, inter alia, Member States to:

4.

Before the adoption of the present Commission proposal, the EDPS was given the possibility to provide informal comments on the draft proposal. In these comments, the EDPS expressed his concerns on different aspects of the migration that in his view should be clarified. Unfortunately, the adopted text did not take into account the comments made during the informal stage and has therefore not provided the required clarifications.

61.

Migration of the data contained in SIS to SIS II is an operation likely to involve specific risks from the point of view of data protection. While the EDPS welcomes the efforts made to ensure that this migration will happen fully in accordance with the law, he has some recommendations to make to further improve the proposal.

62.

The EDPS particularly welcomes that under the new provisions, the legal framework for SIS II enters into force once the first Member State has successfully completed the switchover. This is relevant as under the old legislation, the SIS II legal framework would only have come into force once all Member States have completed the migration to SIS II, which would have created legal ambiguity particularly with regard to new functions.

63.

This approach has to be also assessed from the point of view of supervision. In the view of the EDPS, it will result in a transfer of responsibilities during the migration that could have negative effects and impinge on the safeguards that supervision provides at the moment when it is needed most. Therefore, the EDPS recommends that the coordinated supervision mechanism should be applicable from the start of the migration. The recast should provide for this approach.

64.

The EDPS is of the opinion that essential aspects of the migration should be further clarified in the text of the Regulation and not left for other instruments such as the migration plan. In particular, this concerns:

65.

The EDPS recommends that the Regulation should strengthen the testing obligations by clarifying:

66.

Preventive security measures are especially welcomed, and the EDPS recommends introducing in the text of the recast a specific provision requiring the Commission and the Member States to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the migration and also by the specific nature of the personal data to be processed, based on the requirements of Article 22 of Regulation (EC) No 45/2001.

6.11.2012   

EN

Official Journal of the European Union

C 336/13

1.

On 7 March 2012, the Commission adopted a proposal for a regulation of the European Parliament and of the Council on improving securities settlement in the European Union and on central securities depositories (CSDs) and amending Directive 98/26/EC (‘the proposal’). This proposal was sent to the EDPS for consultation on the same day.

2.

The EDPS welcomes the fact that he is consulted by the Commission and recommends that references to this Opinion are included in the preambles of the proposed regulation.

3.

The proposal contains provisions which may in certain cases have data protection implications for the individuals concerned such as the investigative powers of the competent authorities, the exchange of information, the keeping of records, the outsourcing of activities, the publication of sanctions and the reporting of breaches.

4.

There are comparable provisions to the ones referred to in this Opinion in several pending and possible future proposals, such as those discussed in the EDPS Opinions on the European Venture Capital Funds and the European Social Entrepreneurship Funds (1), the legislative package on the revision of the banking legislation, credit rating agencies, markets in financial instruments (MiFID/MiFIR) and market abuse (2). Therefore, the EDPS recommends reading this Opinion in close conjunction with his Opinions on the abovementioned initiatives.

5.

Any trade in securities on or off a trading venue is followed by a post-trade flow of processes, leading to the settlement of the trade, which means the delivery of securities to the buyer against the delivery of cash to the seller. CSDs are key institutions that enable settlement by operating so-called securities settlement systems. They are the institutions which facilitate the transactions concluded on the markets. CSDs also ensure the initial recording and the central maintenance of securities accounts that record how many securities have been issued by whom and each change in the holding of those securities.

6.

While generally safe and efficient within national borders, CSDs combine and communicate less safely across borders, which means that an investor faces higher risks and costs when making a cross-border investment. The absence of an efficient single internal market for settlements also raises other important concerns such as the limitation of security issuers' access to CSDs, different national licensing regimes and rules for CSDs across the EU, and limited competition between different national CSDs. These barriers result in a very fragmented market while cross-border transactions in Europe continue to increase and CSDs become increasingly interconnected.

7.

The proposal aims at addressing these problems by introducing an obligation to represent all transferable securities in book entry form and to record these in CSDs before trading them on regulated venues, harmonising settlement periods and settlement discipline regimes across the EU, and introducing a common set of rules addressing the risks of CSDs' operations and services.

8.

The proposal will complete the regulatory framework for securities market infrastructures, alongside the Directive 2004/39/EC on markets in financial instruments (MiFID) for trading venues, and the proposal for a regulation on derivative transactions (EMIR) for central counterparties.

48.

The EDPS welcomes the attention specifically paid to data protection in the proposal.

49.

The EDPS makes the following recommendations:

6.11.2012   

EN

Official Journal of the European Union

C 336/15

1.

On 2 May 2012, the Commission published its Communication on a ‘European Strategy for a Better Internet for Children’ (1) (hereafter ‘the Communication’).

2.

Before the adoption of this Communication, the EDPS was given the opportunity to provide informal comments. The EDPS welcomes that some of his informal comments have been taken into account in the Communication. In view of the importance of the subject, the EDPS would still like to submit this Opinion at his own initiative.

3.

The objective of the Communication is to develop a strategy to enhance the protection of children online. The Communication is placed in the context of the EU Agenda for the Rights of the Child (2), the Digital Agenda for Europe (3), and the Council conclusions on the protection of children in the digital world (4).

4.

The Communication is centred on four main pillars:

5.

The Communication outlines a number of actions to be taken by industry, the Member States and the Commission, respectively. It covers issues such as parental controls, privacy settings, age ratings, reporting tools, hotlines, and cooperation between industry, hotlines and law enforcement bodies.

6.

The EDPS fully supports initiatives aimed at strengthening the protection of children on the Internet and at improving the means to fight against abuse of children online (5). In two previous Opinions, the EDPS has underlined the importance of the protection and safety of children online in a data protection perspective (6). He welcomes that this has been recognised in the Communication.

7.

The growing use of the digital environment by children and the constant evolution of that environment pose new data protection and privacy risks, which are exposed in point 1.2.3 of the Communication. Such risks include, amongst others, misuse of their personal data, the unwanted dissemination of their personal profile on social networking sites, their growing use of geo-location services, their being increasingly directly subject to advertising campaigns and to serious crimes such as child abuse. These are particular risks that must be addressed in a manner appropriate to the specificity and vulnerability of the category of individuals at risk.

8.

The EDPS welcomes that the actions envisaged in the Communication should respect the current data protection framework (including Directive 95/46/EC and Directive 2002/58/EC (7) on e-privacy), the e-Commerce Directive 2000/31/EC (8) and the Charter of Fundamental Rights of the EU, and that it also takes into account the proposed new data protection framework (9). The EDPS stresses that all measures to be deployed further to the Communication should be consistent with this framework.

9.

This Opinion highlights the specific data protection issues that are raised by the measures foreseen in the Communication, which must be properly addressed by all the relevant addressees of the Communication, i.e. the Commission, the Member States and industry, where applicable. In particular, Chapter II underlines the specific means which can help enhance the protection and safety of children online from a data protection perspective. In Chapter III, the Opinion highlights some data protection issues that need to be addressed for the implementation of measures aimed at fighting against sexual abuse and sexual exploitation of children on the Internet, in particular concerning the use of reporting tools and the cooperation between industry, law enforcement and hotlines.

49.

The EDPS supports the Communication's initiatives to make the Internet safer for children, and in the fight against sexual abuse and sexual exploitation of children. In particular, he welcomes the recognition of data protection as a key element for ensuring the protection of children on the Internet and for empowering them to enjoy its benefits in safety.

50.

The EDPS underlines that data protection requirements should be appropriately considered by industry, Member States and the Commission when implementing initiatives aimed at enhancing children's safety online, in particular:

51.

The initiatives highlighted in the Communication in respect of fighting against sexual abuse and sexual exploitation of children raise a number of data protection issues, which must be carefully considered by all stakeholders in their respective field of action:

6.11.2012   

EN

Official Journal of the European Union

C 336/18

6.11.2012   

EN

Official Journal of the European Union

C 336/19

6.11.2012   

EN

Official Journal of the European Union

C 336/20

1.

On 23 October 2012, the Commission received a notification of a proposed concentration pursuant to Article 4 of Council Regulation (EC) No 139/2004 (1) by which Advent International Corporation (NL) acquires within the meaning of Article 3(1)(b) of the Merger Regulation control of the whole of Mediq N.V. (NL) by way of public bid announced on 24 September 2012.

2.

The business activities of the undertakings concerned are:

3.

On preliminary examination, the Commission finds that the notified transaction could fall within the scope of the EC Merger Regulation. However, the final decision on this point is reserved. Pursuant to the Commission Notice on a simplified procedure for treatment of certain concentrations under the EC Merger Regulation (2) it should be noted that this case is a candidate for treatment under the procedure set out in the Notice.

4.

The Commission invites interested third parties to submit their possible observations on the proposed operation to the Commission.

Observations must reach the Commission not later than 10 days following the date of this publication. Observations can be sent to the Commission by fax (+32 22964301), by email to COMP-MERGER-REGISTRY@ec.europa.eu or by post, under reference number COMP/M.6762 — Advent International Corporation/Mediq, to the following address:

6.11.2012   

EN

Official Journal of the European Union

C 336/21

1.

On 24 October 2012, the Commission received a notification of a proposed concentration pursuant to Article 4 and following a referral pursuant to Article 4(5) of Council Regulation (EC) No 139/2004 (1) by which the undertakings REWE Touristik GmbH (Germany) belonging to REWE Group and Ferid NASR (Czech Republic) acquire within the meaning of Article 3(1)(b) of the Merger Regulation joint control of the undertaking EXIM Holding SA (Czech Republic) by way of purchase of shares.

2.

The business activities of the undertakings concerned are:

3.

On preliminary examination, the Commission finds that the notified transaction could fall within the scope the EC Merger Regulation. However, the final decision on this point is reserved.

4.

The Commission invites interested third parties to submit their possible observations on the proposed operation to the Commission.

Observations must reach the Commission not later than 10 days following the date of this publication. Observations can be sent to the Commission by fax (+32 22964301), by e-mail to COMP-MERGER-REGISTRY@ec.europa.eu or by post, under reference number COMP/M.6704 — REWE Touristik GmbH/Ferid NASR/EXIM Holding SA, to the following address: