29.1.2013   

EN

Official Journal of the European Union

C 27/4

1.

On 21 March 2012, the Commission adopted:

2.

The two related proposals were sent to the EDPS for consultation on 26 March 2012.

3.

The EDPS welcomes the fact that the Commission consulted him formally after the proposals were adopted and that this Opinion is referred to in the preamble of the Posting of Workers proposal. However, he regrets that he was not given the opportunity to provide informal comments before the draft proposals were adopted.

4.

The objective of the Posting of Workers proposal is to improve, enhance and reinforce the way in which Directive 96/71/EC concerning the posting of workers in the framework of the provision of services (Posting of Workers Directive (3)) is implemented, applied and enforced in practice across the European Union. The proposal aims to achieve this by establishing a general common framework for better and more uniform implementation, application and enforcement of the Directive, including measures to prevent any circumvention or abuse of the rules (4).

5.

The objective of the Collective Action proposal is to clarify the general principles and applicable rules at EU level with respect to the exercise of the fundamental right to take collective action within the context of the freedom to provide services and the freedom of establishment (5).

6.

While it is not the main objective of either of the two proposals to process personal data, at least one of the proposals — the Posting of Workers proposal — requires the processing of a significant amount of personal data. As will be shown below, these personal data may relate to the posted workers as well as to individuals acting on behalf of the posting undertakings such as their corporate officers, management, company representatives, or employees. In addition, the posting undertakings themselves may also be natural persons. If so, their personal data may also be processed. Some of the data processed may be sensitive (6): in particular, data on suspected circumvention or abuse of the rules may be exchanged among competent authorities.

7.

From the data protection perspective, the three most relevant provisions of the Posting of Workers proposal are

8.

The processing of personal data in all three cases is foreseen to take place via the Internal Market Information system (IMI) (7).

9.

As to the Collective Action proposal, the alert mechanism foreseen in Article 4 appears to allow the exchange of personal data, possibly including sensitive data (information about participation in strikes or similar collective action (8)). However, as will be noted in Section 4 below, the exchange of personal data appears not to be the legislative intention and, therefore, any concerns can presumably be addressed by a simple clarification that no sensitive personal data shall be contained in these alerts.

32.

The EDPS welcomes that the Posting of Workers proposal addresses data protection concerns. The EDPS also welcomes the fact that the use of an existing information system, IMI, is proposed for the administrative cooperation, which already offers, at the practical level, a number of data protection safeguards, and for which specific safeguards are expected to be adopted soon under the IMI Regulation.

33.

To address any remaining data protection concerns, the EDPS provides the following recommendations.

34.

As a general comment, the EDPS recommends that the reference to the applicable data protection framework should be set forth in a substantive provision rather than in a recital and should be further nuanced by reference to ‘national rules which implement’ Directive 95/46/EC.

35.

On bilateral information exchanges under the Posting of Workers proposal (Article 6(2)), the EDPS recommends that the permissible purposes of information exchange should be more clearly specified in the proposal. In particular, the phrase ‘possible cases of unlawful transnational activities’ should be deleted and the provision should be redrafted to ensure that any exchange of personal data is only possible for the purposes of ‘investigation of any abuses of applicable rules on the posting of workers’ (or other necessary purposes clearly specified in the proposal).

36.

On access to registers of service providers by competent authorities of other Member States (Article 6(6)), the EDPS recommends that the proposal should more clearly specify what registers are actually concerned. This Article should not, in particular, be used as a legal basis to allow access to registers established in some Member States where posting undertakings need to declare, among other things, certain personal data relating to their posted employees.

37.

In addition, if and when interconnection of registers is planned as a common European project in this area as well, data protection safeguards must be carefully considered at the European level.

38.

With regard to the alert system on possible irregularities (Article 7(2)), the EDPS recommends that the proposal:

39.

On the Collective Action proposal, Article 4 should clarify that no sensitive personal data shall be contained in these alerts.