27.10.2007   

EN

Official Journal of the European Union

C 255/1

1.

On 7 March 2007, the Communication from the Commission to the European Parliament and the Council on the follow-up of the Work Programme for better implementation of the Data Protection Directive (3) was sent by the Commission to the EDPS. In accordance with Article 41 of Regulation (EC) No 45/2001, the EDPS presents this opinion.

2.

The Communication reiterates the importance of Directive 95/46/EC (4) as a milestone in the protection of personal data and discusses the Directive and its implementation in three chapters: the past, the present and the future. The central conclusion of the Communication is that the Directive should not be amended. The implementation of the Directive should be further improved by means of other policy instruments, most of them with a non binding nature.

3.

This opinion of the EDPS follows the structure of the communication. More importantly, the EDPS shares the central conclusion of the Commission that the Directive should not be amended.

4.

However, the EDPS takes this position also for pragmatic reasons. The points of departure for the EDPS are as follows:

5.

These points of departure are essential since one has to keep in mind that the Directive operates in a dynamic context. In the first place, the European Union is changing: the free flow of information between the Member States — and between the Member States and third countries — has become more important and will become an even more important reality. In the second place, society is changing. The information society is evolving and has more and more characteristics of a surveillance society (5). This implies an increasing need for effective protection of personal data to deal with these new realities in a fully satisfactory way.

6.

In his assessment of the communication, the EDPS will address in particular the following perspectives that are relevant in respect of these changes:

7.

The First report on the implementation of the Data Protection Directive of 15 May 2003 contained a Work Programme for better implementation of the data protection Directive, with a list of 10 initiatives to be carried out in 2003 and 2004. The Communication describes how each of these actions has been implemented.

8.

On the basis of the analysis of the work conducted under the Work Programme, the Communication draws a positive assessment of the improvements achieved in the implementation of the Directive. The assessment of the Commission, as summarized in the headings of Chapter II (‘the present’) of the Communication, basically states that: implementation has improved, even though some Member States have not yet implemented properly; some divergences still exist, but they mostly fall within the margin of manoeuvre provided for by the Directive and in any case they do not pose a real problem to the internal market. Legal solutions laid down in the Directive have proved to be substantially appropriate to guarantee the fundamental right to data protection, while coping with evolution in technology and requirements imposed by public interests.

9.

The EDPS shares the main lines of this positive assessment. In particular, the EDPS recognizes the considerable work conducted in the field of transborder data flows: findings of adequate protection in respect of third countries, new standard contractual clauses, the adoption of binding corporate rules, the reflection on a more uniform interpretation of Article 26(1) of the Directive and the improvement in notifications under Article 26(2) all go in the direction of facilitating international transfers of personal data. However, the case law of the Court of Justice (6) has shown that work still has to be done in this crucial area, in order to cope with developments in both technological and law enforcement fields.

10.

The Communication also shows that enforcement and awareness raising are key issues in promoting a better implementation, and that they could be further exploited. Furthermore, exchange of best practices and harmonization in the area of notifications and information provisions represent successful precedents for cutting red tape and reducing costs for firms.

11.

In addition, the analysis of the past confirms that improvements cannot be achieved without the involvement of a broad range of stakeholders. The Commission, data protection authorities and the Member States are central actors in most of the actions conducted. However, the role of private parties has an increasing importance, especially when it comes to the promotion of self-regulation and European Codes of Conducts, or to the development of Privacy Enhancing Technologies.

12.

There are several reasons for supporting the conclusion of the Commission, that, under the present circumstances and in the short term, no proposal should be envisaged for modification of the Directive.

13.

The Commission basically gives two reasons in support of the conclusion. Firstly, the potential of the Directive has not been used to its full extent. Considerable improvements in the implementation of the Directive in the jurisdictions of the Member States are still possible. Secondly, it states that although the Directive leaves a margin of manoeuvre for the Member States, there is no evidence that divergences within this margin pose real problems to the internal market.

14.

On the basis of these two reasons, the Commission formulates its conclusion in the following way. It explains what the Directive should do, with emphasis on ensuring trust, and then states that the Directive sets a benchmark, is technologically neutral and continues to provide solid and appropriate responses (7).

15.

The EDPS welcomes the way in which this conclusion is worded, but is of the opinion that this conclusion could be further reinforced by building it on two additional grounds:

16.

The fundamental right of natural persons to the protection of their personal data is recognised in Article 8 of the Charter of the Fundamental Rights of the Union and inter alia laid down in the Council of Europe Convention 108 of 28 January 1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data. In essence, the Directive is a framework containing the main elements of the protection of this fundamental right, by giving substance and amplifying the rights and freedoms included in the Convention (8).

17.

A fundamental right aims to protect a citizen under all circumstances in a democratic society. The main elements of such a fundamental right should not easily be changed because of developments in society or of the political preferences of ruling governments. For instance, threats to society by terrorist organisations may lead to a different outcome in specific cases because more important interferences might be needed in a person's fundamental right, but may never affect the essential elements of the right itself nor deprive or unduly restrict a private person in the exercise of the right.

18.

The second characteristic of the Directive is that it envisages the promotion of the free flow of information in the internal market. Also this second objective can be considered as fundamental, within an ever more developing internal market without internal borders. Harmonisation of essential provisions of national law is one of the main instruments to ensure the establishment and functioning of this internal market. It gives substance to the mutual trust between the Member States in each others national legal systems. Also for these reasons changes should be duly considered. Changes could affect mutual trust.

19.

A third characteristic of the Directive is that it must be seen as a general framework upon which specific legal instruments build. These specific instruments include implementing measures of the general framework as well as specific frameworks for specific sectors. The Directive on privacy and electronic communications, 2002/58/EC (9), is such a specific framework. Where possible, changing developments in society should lead to changes of implementing measures or specific legal frameworks, not of the general framework on which they build.

20.

According to the EDPS, the conclusion not to change the Directive now is also the logical consequence of general principles of good administration and legislative policy. Legislative proposals — regardless whether they imply new areas of Community action or amend existing legislative arrangements — should only be submitted if the necessity and proportionality are sufficiently demonstrated. No legislative proposal should be submitted if the same result could be achieved by using other, less far-reaching tools.

21.

Under the present circumstances, the necessity and proportionality of a modification of the Directive have not been demonstrated. The EDPS recalls that the Directive provides for a general framework for data protection under Community law. It must ensure on the one hand protection of the rights and freedoms of individuals, notably the right to privacy, with regard to the processing of personal data and on the other hand the free flow of personal data within the internal market.

22.

Such a general framework should not be amended until it has been fully implemented in the Member States, unless there are clear indications that the objectives of the Directive could not be met under the present framework. In the view of the EDPS, the Commission has — under the present circumstances — adequately substantiated that the potential of the Directive has not been used to its full extent (see Chapter III of this opinion). Equally, there is no evidence that the objectives could not be met under the present framework.

23.

It must be ensured also in future that the principles of data protection will offer effective protection to natural persons, keeping in mind the dynamic context in which the Directive operates (see point 5 of this opinion) and the perspectives of point 6 of this opinion: improvement of the implementation, interaction with technology, global privacy and jurisdiction, data protection and law enforcement, and a Reform Treaty. This need for full application of the data protection principles sets the standards for future changes of the Directive. The EDPS recalls once more that in the longer term changes of the Directive seem unavoidable.

24.

As far as the substance of any future measures is concerned, the EDPS provides already at this stage some elements which he considers essential in any future system for data protection within the European Union. These elements include:

25.

The Communication mentions — in relation to the challenges of new technologies — the ongoing review of Directive 2002/58/EC and the possible need for more specific rules to address data protection issues raised by new technologies such as the Internet and RFID (10). The EDPS welcomes this review and further actions, although according to the EDPS they should not solely be related to technological developments, but should take into account the dynamic context in its entirety and in a long term perspective also involve the Directive 95/46/EC. Moreover, more focus is needed in this context. Unfortunately, the Communication has an open end:

The EDPS suggests that the Commission specifies these elements.

26.

Any future change must be preceded by full implementation of the present provisions of the Directive. Full implementation starts with compliance with the legal requirements of the Directive. The Communication mentions (11) that some Member States have failed to incorporate a number of important provisions of the Directive and points in this respect in particular at provisions for independence of supervisory authorities. It is the task of the Commission to monitor the compliance and where it considers this appropriate use its powers under Article 226 EC.

27.

The Communication envisages an interpretative communication on some provisions, in particular those provisions that may lead to formal infringement procedures pursuant to Article 226 EC.

28.

In addition, the Directive introduces other mechanisms for the improvement of the implementation. In particular, the tasks of the Article 29 Working Party, listed in Article 30 of the Directive, are designed for this purpose. They are meant to stimulate the implementation in the Member States on a high and harmonised level of data protection beyond what is strictly needed to fulfil the obligations of the Directive. Whilst exercising this role, the Working Party has over the years produced a large number of opinions and other documents.

29.

In the view of the EDPS, full implementation of the Directive includes these two elements:

The EDPS emphasises that both elements should be clearly distinguished, because of the different legal consequences, as well as the related responsibilities. As a rule of thumb: the Commission should take full responsibility for the first element, whereas the Working Party should be the primary actor as far as the second element is concerned.

30.

Another, more precise distinction to be made relates to the tools available to achieve better implementation of the Directive. These include:

31.

The EDPS suggests to the Commission that it clearly indicates how it will use these different tools when it elaborates its policies on the basis of the present Communication. The Commission should in that context also clearly distinguish its own responsibilities and the responsibilities of the Working Party. Apart from that, it goes without saying that a good cooperation between the Commission and the Working Party is under all circumstances a condition for success.

32.

Point of departure is that the provisions of the Directive are formulated in a technologically neutral way. The Communication links the emphasis on technological neutrality to a number of technological developments, such as the Internet, access services provided in third countries, RFID and the combination of sound and image data with automatic recognition. It distinguishes two types of actions. Firstly, specific guidance as to the application of data protection principles in a changing technological environment with an important role of the Working Party and its Internet Task Force (13). Secondly, sector specific legislation could be proposed, by the Commission itself.

33.

The EDPS welcomes this approach as an important first step. In the longer term however, other and more fundamental steps might be needed. The occasion of this Communication could be used as the start of such a long term approach. The EDPS suggests starting, as a follow up of the present Communication, the discussion on this approach. As possible elements of such an approach, the following points can be mentioned.

34.

In the first place, interaction with technologies works in two ways. On the one hand, new developing technologies may call for modifications of the legal framework for data protection. On the other hand, the need for effective protection of the personal data of individuals may require new limitations or appropriate safeguards on the use of certain technologies, an even further reaching consequence. However, new technologies could also be used effectively and relied upon in a privacy enhancing way.

35.

In the second place, some specific limits may be needed if new technologies are used by governmental institutions in the exercise of their public tasks. The discussions on interoperability and access that are taking place in the area of freedom, security and justice relating to the implementation of the Hague Program, are a good example (14).

36.

In the third place, there is a tendency towards a much wider use of biometric material, such as — but not only — DNA-material. The specific challenges of the use of personal data extracted from this material might have consequences for the laws on data protection.

37.

In the fourth place, it has to be acknowledged that society itself is changing and acquires more and more elements of a surveillance society (15). A fundamental debate is needed on this development. In such a debate central questions would be whether this development is unavoidable, whether it is the task of the European legislator to interfere in this development and to impose limits on this development, whether and how the European legislator could take effective measures, etc.

38.

The perspective of global privacy and jurisdiction plays a limited role within the Communication. The only intention in this context is that the Commission will continue to monitor and contribute to international forums, to ensure coherence of Member States' commitments with their obligations under the Directive. Apart from that, the Communication enumerates a number of activities executed for the simplification of the requirements for international transfers (see Chapter III of this opinion).

39.

The EDPS regrets that this perspective has not been given a more prominent role in the Communication.

40.

Presently, Chapter IV of the Directive (Articles 25 and 26) introduces a special regime for transfer of data to third countries, on top of the general rules on data protection. This special regime has been elaborated over the years, with the intention of striking a fair balance between the protection of the individuals whose data are to be transferred to third countries with, inter alia, the imperatives of international trade and the reality of global telecommunications networks. The Commission and the Working Party (16), but also for instance the International Chamber of Commerce, have invested much effort in making this system work, through adequacy findings, standard contractual clauses, binding corporate rules, etc.

41.

For the applicability of the system to Internet, the judgement of the Court of Justice in Lindqvist  (17) has been of specific importance. The Court points at the ubiquitous nature of information on Internet and decides that the loading of data onto an internet page as such, even if those data are thereby made accessible to persons in third countries with the technical means to access them, does not qualify as a transfer to a third country.

42.

This system, a logical and necessary consequence of the territorial limitations of the European Union, will not provide full protection to the European data subject in a networked society where physical borders lose importance (see, examples mentioned in point 6 of this opinion): the information on Internet has an ubiquitous nature, but the jurisdiction of the European legislator is not ubiquitous.

43.

The challenge will be to find practical solutions that reconcile the need for protection of the European data subjects with the territorial limitations of the European Union and its Member States. The EDPS — in his comments on the Commission communication on a Strategy on the External Dimension of the Area of Freedom, Security and Justice — has already encouraged the Commission to take a proactive role in promoting the protection of personal data at international level, by supporting bilateral and multilateral approaches with third countries and cooperation with other international organisations (18).

44.

Such practical solutions include:

45.

None of these solutions are new. However, a vision is needed on how to effectively use these methods in the most effective way and how to make sure that data protection standards — that in the European Union are qualified as fundamental rights — will also be effective in a global networked society. The EDPS invites the Commission to start developing such a vision, together with most relevant stakeholders.

46.

The Communication pays extensive attention to requirements imposed by public interests, especially for security. It explains Article 3(2) of the Directive and the interpretation given by the Court of Justice to this provision in the PNR-Judgment (19), as well as Article 13 of the Directive, inter alia related to the case law of the European Court of Human Rights. The Communication furthermore stresses that when the Commission strikes the balance between measures to ensure security and non negotiable fundamental rights, it makes sure that personal data are protected as guaranteed by Article 8 ECHR. This point of departure also applies to the transatlantic dialogue with the United States of America.

47.

According to the EDPS, it is important that the Commission reiterates in such a clear manner the obligations of the Union under Article 6 of the EU Treaty to respect fundamental rights, as guaranteed by the ECHR. This statement is even more important now the European Council has decided that, under the Reform Treaty, the Charter of the fundamental rights of the European Union should have legally binding value. Article 8 of the Charter specifies everyone's right to protection of personal data concerning him or her.

48.

It is common knowledge that the demands of law enforcement to increasingly use personal data for the combat of crime — not to mention the fight against terrorism — run the risk of lowering the level of protection of the citizen, even below a level that is guaranteed by Article 8 ECHR and/or the Council of Europe Convention No 108 (20). These concerns were a main element of the third opinion of the EDPS on the Proposal for a Council Framework Decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters, issued on 27 April 2007.

49.

It is in this context essential that the standard of protection provided for by the Directive be taken as a basis for the protection of the citizen, also in relation to demands of law enforcement. The ECHR and Convention 108 provide for a minimal level of protection, but do not provide for the necessary precision. Over and above that, additional measures were needed to provide for appropriate protection for the citizen. This need was one of the driving factors of the adoption in 1995 of the Directive (21).

50.

It is equally essential that this standard of protection is effectively guaranteed in all situations where personal data are processed for law enforcement purposes. Although this communication does not deal with data processing in the third pillar, it rightly addresses the situation where data collected (and processed) for commercial purposes are used for law enforcement purposes. A situation, which is becoming more usual since police work relies more and more on the availability of information in possession of third parties. Directive 2006/24/EC (22) can be seen as the best illustration of this trend: this directive obliges providers of electronic communications to (longer) store data they have collected (and stored) for commercial purposes, for purposes of law enforcement. According to the EDPS, it should be fully ensured that personal data collected and processed within the scope of application of the Directive are properly protected when used for public interest purposes, and in particular for security or fight against terrorism. In some cases however, the latter purposes may fall beyond the scope of the Directive.

51.

These observations lead to the following suggestions to the Commission:

52.

In the Communication, the Commission touches upon the — enormous — impact of the Constitutional Treaty on the field of data protection. Indeed, the Treaty — which is now the Reform Treaty — will be of crucial importance in this field. The Treaty will be the end of the pillar structure, the provision on data protection (currently Article 286 EC) will be clarified and the Charter on the Fundamental Rights of the Union, which includes in its Article 8 a provision on data protection, will become a binding instrument.

53.

The mandate for the Intergovernmental Conference (IGC) pays specific attention to data protection. Point 19(f) basically states three things. Firstly, the general rules on data protection will be without prejudice to specific rules adopted in the CFSP Title (the current second pillar); secondly, a declaration will be adopted on data protection in the areas of police and judicial cooperation in criminal matters (the current third pillar) and thirdly, specific entries in the relevant Protocols will be adopted on the position of individual Member States (this element is mainly related to the specific position of the United Kingdom as regards police and judicial cooperation in criminal matters).

54.

It is the second element (the declaration) that will need clarification in the IGC. The consequences of the end of the pillar structure and the possible applicability of the Directive on police and judicial cooperation in criminal matters have to be duly considered, so as to ensure the widest possible application of the data protection principles contained in the Directive. This is not the place for further details on this issue. The EDPS has presented suggestions for the declaration in a letter to the Presidency of the IGC (25).

55.

The Communication refers to a series of tools and actions that can be used for a better implementation of the Directive in the future. The EDPS wishes to comment on them, while also exploring other additional instruments not mentioned in the Communication.

56.

In certain cases, specific legislative action at EU level may be necessary. In particular, sectoral legislation may prove to be necessary in order to adapt the Directive's principles to issues raised by some technologies, as it was in the case of the directives on privacy in the telecommunication sector. The use of specific legislation should be carefully considered in domains such as the use of RFID technologies.

57.

The most powerful instrument mentioned in the Communication is the infringement procedure. The Communication identifies one specific area of concern, namely the independence of data protection authorities and their powers, and only mentions in general terms other areas. The EDPS shares the view that infringement procedures are an essential and unavoidable instrument, if Member States do not provide for a full implementation of the Directive, especially taking into account that almost nine years have elapsed since the deadline for implementation of the Directive and that the structured dialogue laid down in the Work Programme has already taken place. However, as of today, no case of infringement of Directive 95/46 has yet been brought before the Court of Justice.

58.

A comparative analysis of all cases where wrong or incomplete transposition is suspected (26), as well as an interpretative communication may certainly improve the coherence of the Commission's role as guardian of the Treaties. However, the preparation of these instruments, that might require a certain amount of time and effort, should not delay infringement procedures in those areas where an incorrect transposition or practice has already been clearly identified by the Commission.

59.

Therefore, the EDPS encourages the Commission to pursue a better implementation of the Directive through infringement procedures, where necessary. In this context, the EDPS will make use of his powers of intervention before the Court of Justice in order to intervene, where appropriate, in infringement procedures relating to the implementation of Directive 95/46 or to other legal instruments in the area of the protection of personal data.

60.

The Communication also refers to an interpretative communication on some provisions in which the Commission will clarify its understanding of provisions of the Directive, whose implementation is found to be problematic and may thus lead to infringement procedures. The EDPS welcomes that in this context the Commission will take into account the work on interpretation conducted by the Working Party. Indeed, it is essential that the position of the Working Party is duly taken into account when drafting the upcoming interpretative communication and that the Working Party is properly consulted, with a view to bringing in its experience in the application of the Directive at national level.

61.

Furthermore, the EDPS confirms his availability to advise the Commission in all matters relating to the protection of personal data. This also applies to those instruments, such as Commission communications, that are not binding but are still aimed at defining the Commission policy in the area of the protection of personal data. In the case of communications, for this advisory role to be effective, the consultation of the EDPS should take place before the interpretative communication is adopted (27). The advisory role of both the WP 29 and the EDPS will provide added value to this communication, while preserving the independence of the Commission in deciding autonomously about formally opening infringement procedures relating to the implementation of the Directive.

62.

The EDPS welcomes that the communication will deal only with a limited number of Articles, thus allowing focusing on more sensitive issues. In this perspective, the EDPS draws the Commission's attention to the following issues, which deserve special attention in the interpretative communication:

63.

Other, non binding instruments should proactively develop compliance with data protection principles, particularly in new technological environments. These measures should build on the concept of ‘privacy by design’, ensuring that the architecture of new technologies is developed and constructed by taking properly into account the principles of data protection. The promotion of privacy-compliant technological products should be a crucial element in a context in which ubiquitous computing is fast developing.

64.

Closely linked is the necessity to extend the gamut of stakeholders in the enforcement of data protection law. On the one hand, the EDPS strongly supports the fundamental role of data protection authorities in enforcing the principles of the Directive, making full use of their powers as well as of the scope for coordination within the Article 29 Working Party. A more effective enforcement of the Directive is also one of the objectives of the ‘London initiative’.

65.

On the other hand, the EDPS stresses the desirability of promoting private enforcement of data protection principles through self-regulation and competition. Industry should be encouraged to implement data protection principles and compete in developing privacy-compliant products and services as a way of expanding its position on the market by better addressing the expectations of privacy-aware consumers. In this context a good example can be found in Privacy seals, that could be attached to products and services that have undergone a certification procedure (29).

66.

The EDPS would also like to draw the Commission's attention to other tools that, though not mentioned by the Communication, could prove to be useful for a better implementation of the Directive. Examples of such tools that would help data protection authorities in better enforcing data protection law are:

67.

As a last point, the EDPS refers to other instruments that are not mentioned in the Communication, but could be either considered for a future change of the Directive or included in other horizontal legislation, in particular:

68.

Different institutional actors have responsibilities relating to the implementation of the Directive. The supervisory authorities in the Member States are under Article 28 of the Directive responsible for the monitoring of the application of the national provisions transposing the Directive in the Member States. Article 29 introduces the Working Party of supervisory authorities whilst Article 30 enumerates its tasks. Under Article 31 a committee of representatives from the Governments of the Member States assists the Commission in relation to implementing measures on Community level (a comitology-committee).

69.

The need for better defining the responsibilities of the different actors exists in particular in relation to (the activities of) the Working Party. Article 30(1) lists four tasks of the Working Party which can be summarized as examining the application of the Directive on the national level with a view to uniformity and giving opinions on developments on Community level: the level of protection, legislative proposals and codes of conduct. This list shows the wide responsibility of the Working Party in the area of data protection, which is furthermore illustrated by the documents produced by the Working Party over the years.

70.

According to the Communication, the Working Party ‘is a key element in ensuring better and more coherent implementation.’ The EDPS fully subscribes this statement, but also deems it necessary to clarify some specific elements of the responsibilities.

71.

Firstly, the Communication urges for improvement of the contribution of the Working Party, since the national authorities should strive to adapt their national practice to the common line (30). The EDPS welcomes the intention of this statement, but warns for a confusion of responsibilities. It is the task of the Commission under Article 211 EC to monitor the compliance in the Member States, including the compliance by the supervisory authorities. The Working Party as an independent advisor can not be held responsible for the application by the national authorities of its opinions.

72.

Secondly, the Commission must be aware of its different roles in the Working Party, since it is not only a Member of the Working Party, but also provides its secretariat. In the exercise of the second role as secretariat, it must support the Working Party in a way that it can do its work in an independent manner. This basically means two things: the Commission must provide the necessary resources and the secretariat must work under the instructions of the Working Party and its Chairman as to the content and the scope of the Working Party's activities, as well as the nature of its output. More in general, the activities of the Commission in the fulfilment of its other duties under EC law should not impinge on its availability as a secretariat.

73.

Thirdly, although the choice of priorities of the Working Party is the discretion of the Working Party itself, the Commission could indicate what it expects from the Working Party and how it considers that the available resources can at best be used.

74.

Fourthly, the EDPS regrets that the Communication does not give clear indications on the division of roles between the Commission and the Working Party. He invites the Commission to present a paper to the Working Party in which such indications are given. The EDPS has the following suggestions for issues to be included in this paper:

75.

The EDPS shares the central conclusion of the Commission that the Directive should not be amended in the short term. This conclusion could be reinforced by building it also on the nature of the Directive and on the legislative policy of the Union.

76.

The points of departure for the EDPS are as follows:

77.

The main elements for future change include:

78.

The EDPS suggests that the Commission specifies: a timeline for the activities of Chapter III of the Communication; a deadline for a subsequent report on the application of the Directive; terms of reference to measure the realisation of the activities foreseen; indications on the way to proceed in the longer term.

79.

The EDPS welcomes the approach on technology as an important first step and suggests starting the discussion on a long term approach, including inter alia a fundamental debate on the development of a surveillance society. He also welcomes the ongoing review of Directive 2002/58/EC and the possible need for more specific rules to address data protection issues raised by new technologies such as the Internet and RFID. These actions should take into account the dynamic context in its entirety and in a long term perspective also involve the Directive 95/46/EC.

80.

The EDPS regrets that the perspective of global privacy and jurisdiction plays a limited role in the Communication and asks for practical solutions that reconcile the need for protection of the European data subjects with the territorial limitations of the European Union and its Member States, such as: the further development of a Global Framework for data protection; the further development of the special regime for transfer of data to third countries; international agreements on jurisdiction or similar agreements with third countries; investing in mechanisms for global compliance, such as the use of binding corporate rules by multinational companies.

The EDPS invites the Commission to start developing a vision on this perspective, together with most relevant stakeholders.

81.

On law enforcement, the EDPS has the following suggestions to the Commission:

82.

Full implementation of the Directive means (1) that it be ensured that the Member States fully comply with their obligations under European law and (2) that other, non binding tools, that could be instrumental to a high and harmonised level of data protection be fully used. The EDPS asks from the Commission to clearly indicate how it will use the different instruments and how it distinguishes its own responsibilities from those of the Working Party.

83.

As to those instruments:

84.

The EDPS invites the Commission to present a paper to the Working Party giving clear indications on the division of roles between the Commission and the Working Party, including the following issues:

85.

The consequences of the Reform Treaty have to be duly considered, so as to ensure the widest possible application of the data protection principles contained in the Directive. The EDPS has presented suggestions in a letter to the Presidency of the IGC.

27.10.2007   

EN

Official Journal of the European Union

C 255/13

1.

The Proposal for a Council Decision establishing the European Police Office (Europol) was sent by the Commission to the EDPS for advice, in accordance with Article 28(2) of Regulation (EC) No 45/2001/EC. According to the EDPS, the present opinion should be mentioned in the preamble of the Framework Decision (3).

2.

The objective of the proposal is not a major change in the mandate or the activities of Europol, but mainly to provide Europol with a new and more flexible legal basis. In 1995, Europol was created on the basis of a Convention between Member States, as meant in Article K.6 EU (now: Article 34) (4). The disadvantage of such Conventions in terms of flexibility and effectiveness is the need for ratification by all the Member States, which as recent experience shows can take several years. As the Explanatory Memorandum of the present proposal shows, the three protocols amending the Europol Convention, adopted in 2000, 2002 and 2003 had not yet entered into force by the end of 2006 (5).

3.

However, the proposal also contains substantive changes, so as to further improve Europol's functioning. It extends the mandate of Europol and it contains several new provisions, aiming to further facilitate the work of Europol. In this perspective, the exchange of data between Europol and others (such as bodies of the European Community/European Union, authorities of Member States and third countries) becomes a more prominent issue. The proposal stipulates that Europol shall make every effort to ensure the interoperability between the data processing systems of Europol and the systems of the Member States and of bodies of the European Community/European Union (Article 10(5) of the proposal). It furthermore provides for direct access by national units to the system of Europol.

4.

Furthermore, the position of Europol as a body under Title VI of the Treaty of the European Union (third pillar) has consequences for the applicable data protection law since Regulation (EC) No 45/2001 only applies to processing carried out in the exercise of activities falling within the scope of Community law and therefore does in principle not apply to processing operations by Europol. Chapter V of the proposal contains specific rules on data protection and data security, that can be considered as lex specialis providing for additional rules on top of a lex generalis, a general legal framework on data protection. However, this general legal framework for the third pillar has not yet been adopted (see further points 37-40).

5.

A final point that has to be mentioned is that some other changes will bring the position of Europol more in line with other bodies of the European Union, established under the Treaty establishing the European Community. Although this does not fundamentally change the position of Europol, it can be seen as a first, encouraging development. Europol will be financed from the Community budget and the Staff of Europol will come within the scope of the Community Staff Regulations. This strengthens the control of the European Parliament (because of its position in the budgetary procedure) and of the European Court of Justice (in disputes on the budget and on Staff matters). The EDPS will have competences with regard to the processing of personal data related to Community Staff (see further point 47).

6.

This opinion will successively deal with the substantive changes (meant under point 3), the applicable laws on data protection (under point 4) and the growing similarities between Europol and Community bodies (under point 5).

7.

The opinion will pay specific attention to the increasing importance of the exchange of data between Europol and other bodies of the European Union, which in most cases fall under the supervision of the EDPS. In this context, Articles 22, 25 and 48 of the proposal can be specifically mentioned. The complexity of this issue leads to concerns both with regard to the principle of purpose limitation and with regard to applicable data protection laws and supervision in cases where different supervisory bodies are competent to supervise the different European bodies, depending on the pillar in which they are based. Another point of concern relates to the interoperability of the Europol Information System with other information systems.

8.

The legislative environment of this proposal is rapidly changing.

9.

In the first place, the present proposal is one of a number of legislative activities in the fields of police and judicial cooperation, aiming to facilitate the possibilities for storage and exchange of personal data for law enforcement purposes. Some of these proposals have been adopted by Council — such as the Council Framework Decision of 18 December 2006 on the exchange of information and intelligence for instance (6), whilst other proposals are still in process.

10.

The guiding principle for these legislative activities is the principle of availability which was introduced as an important new principle of law in the Hague Programme in November 2004. It entails that information needed for the fight against crime should cross the internal borders of the EU without obstacles.

11.

The principle of availability is not sufficient in itself. Additional legislative measures are needed in order to enable police and judicial authorities to effectively exchange information. In some cases, the instrument chosen to facilitate this exchange includes the establishment or improvement of an information system at a European level. The Europol Information System is such a system. The EDPS has addressed basic issues of such systems in respect of the Schengen Information System and will address some of those issues also in respect of the present proposal. Such issues include the conditions for granting access to the system, interlinking and interoperability and the applicable rules on data protection and supervision (7).

12.

Furthermore, the proposal should be examined in the light of the most recent developments, such as the initiative presented by the German presidency of the European Union to transpose the Prüm Treaty into the legal framework of the EU.

13.

In the second place, the framework for data protection in the third pillar — a necessary condition for the exchange of personal data — is (as said before) still not adopted. To the contrary, the negotiations in Council on the Proposal for a Council Framework Decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters have turned out to be rather difficult. The German Presidency of the Council has announced that a new text (8) will be proposed, with some essential differences to the approach taken in the Commission proposal.

14.

In the third place, the proposal is directly related to the developments concerning the Treaty establishing a Constitution for Europe. Article III-276 of the Constitutional Treaty is supposed to be a major step in a process in which on the one hand the role and tasks of Europol are gradually extended and on the other hand Europol is gradually included into the European institutional framework. As stated in the Explanatory Memorandum of the present proposal, this Article incorporates the vision which emerged regarding Europol's future. The present decision takes part of this vision on board, taking into account the uncertainty of whether and when the provisions of the Constitutional Treaty will enter into force.

15.

Articles 4 and 5 and Annex I of the proposal determine the mandate of Europol. This mandate is now extended to criminality which is not strictly related to organised crime and which covers the same list of serious crimes as included in the Council Framework Decision on the European arrest warrant (9). A second extension of the role of Europol is that its databases now will include information and intelligence forwarded by private entities.

16.

As to this first extension, it is a logical step in the development of police cooperation in criminal matters. The EDPS recognises that this results in a better harmonisation of the legal instruments aiming to facilitate the police cooperation. Harmonisation is useful, not only because it improves the conditions for better cooperation, but also because it enhances the legal certainty of the citizen and it enables a more efficient control of the police cooperation, since the scope of all different instruments extends to the same categories of crimes. The EDPS assumes that this extension of the mandate is proposed, taking into account the principle of proportionality.

17.

As to the second extension, this fits within the recent trend in police cooperation in which the use of data collected by private companies for purposes of law enforcement becomes more and more important. The EDPS recognises that there can be a need for such use. In particular for the combat of terrorism and other serious crime, it can be necessary for law enforcement to have access to all relevant information, including information in the hands of private parties (10). However, the nature of information and intelligence coming from private parties requires additional safeguards, inter alia in order to ensure the accuracy of this information since these are personal data that have been collected for commercial purposes in a commercial environment. It should also be ensured that this information has been lawfully collected and processed before forwarding it to Europol, under national legislation implementing Directive 95/46/EC and that access by Europol is only allowed under well defined conditions and limitations: access should only be allowed on a case-by-case basis, for specified purposes and be under judicial control in the Member States (11). The EDPS therefore suggests including such conditions and limitations in the text of the decision.

18.

Article 6 of the Europol Convention takes a restrictive approach on the processing of collected information by Europol. This processing is limited to three components: the Europol Information System, Analysis Work Files and an index system. Article 10(1) of the proposal replaces this approach by a general provision allowing Europol to process information and intelligence in so far as it is necessary to achieve its objectives. However, Article 10(3) of the proposal states that the processing of personal data outside of the Europol Information System and Analysis Work Files is subject to conditions laid down in a decision by Council after consulting the European Parliament. According to the EDPS this provision is drafted in a sufficiently precise way to protect legitimate interests of data subjects. The consultation of data protection authorities before the adoption of such a decision by Council as proposed in point 55 should be added to Article 10(3).

19.

In Article 10(2), the possibility for Europol to ‘process personal data for the purpose of determining whether such data are relevant for its tasks’ seems contrary to the principle of proportionality. This wording is not very precise and encompasses in practice the risk of processing for all kinds of undefined purposes.

20.

The EDPS understands the need for processing of personal data in a stage when their relevance for the carrying out of a task of Europol has not yet been established. However, it should be ensured that processing of personal data whose relevance have not yet been assessed is strictly limited to the purpose of assessing its relevance, that this assessment is carried out within a reasonable amount of time, and that, insofar as the relevance is not checked, the data are not processed for law enforcement purposes. A different solution would not only impinge on data subjects rights, but would also hinder efficiency of law enforcement.

Therefore, in order to comply with the principle of proportionality, the EDPS proposes adding a provision to Article 10(2) laying down the obligation to store data in separate databases until the relevance to a specific task of Europol is established. Furthermore, the amount of time for which these data may be processed must be strictly limited and in any event not last longer than 6 months (12).

21.

According to Article 10(5) of the proposal, every effort shall be made in order to ensure interoperability with the data processing systems in the Member States and with the systems in use by the Community and Union related bodies. This approach reverses the approach of the Europol Convention (Article 6(2)), which prohibits the linking to other automated processing systems.

22.

In his comments on the Communication of the Commission on interoperability of European databases (13), the EDPS opposed the view that interoperability is primarily a technical concept. If databases become technically interoperable — which means that access to and exchange of data is possible — there will be pressure to actually use this possibility. This poses specific risks related to the principle of purpose limitation, because data can easily be used for a different purpose than the purpose of collection. The EDPS insists on applying strict conditions and guarantees, when the interlinking with a database is actually put in place.

23.

The EDPS therefore recommends adding a provision to the proposal requiring that interlinking is only allowed after a decision laying down the conditions and guarantees for this interlinking, in particular with regard to the necessity of the interlinking and the purposes for which the personal data will be used. This decision should be adopted after consulting the EDPS and the Joint Supervisory Body. Such a provision could be related to Article 22 of the proposal on relations with other bodies and agencies.

24.

The EDPS notes with respect to Article 11(1) that the existing restriction of access by a national unit to personal data relating to possible criminals who have not (yet) committed a crime has been deleted. This restriction is now laid down in Article 7(1) of the Convention and restricts the direct access to the details of the identity of the persons concerned.

25.

In the view of the EDPS there is no justification for this substantive modification. To the contrary, these specific safeguards for this category of persons are fully in line with the approach of the Commission-proposal for a Council Framework Decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters. The EDPS recommends providing more safeguards for the access to the data of these persons who have not (yet) committed a crime and in any event not to weaken the protection given under the Europol Convention.

26.

According to the amended text of Article 21(3) of the Europol Convention (14), the need for continued storage of personal data relating to individuals as referred to in Article 10(1) shall be reviewed every year and the review documented. However, Article 20(1) of the proposal only requires review within three years after the input of the data. The EDPS is not convinced that this extra flexibility is needed and therefore recommends inserting an obligation for a yearly review in the proposal. A modification to the proposal is even more important, since the proposal should contain an obligation to review the storage on a regular basis, not only once after three years.

27.

Article 21 is a general provision allowing Europol to gain computerised access and retrieve data from other national and international information systems. This access should be allowed only on a case by case basis, under strict conditions. However, Article 21 allows for access that is much too wide which is not necessary for the tasks of Europol. In this context, the EDPS refers to his opinion of 20 January 2006 on Access to VIS by authorities responsible for internal security (15). The EDPS recommends modifying the text of the proposal accordingly.

28.

It is important to keep in mind that the provision, as far as it concerns the access to national databases, is wider than the communication of information between Europol and national units, which is dealt with inter alia in Article 12(4) of the proposal. This access will not only be subject to the provisions of the present Council Decision, but also be governed by national law on access to and usage of the data. The EDPS welcomes the notion included in Article 21 that the stricter rule shall apply. Moreover, the importance of the communication of personal data between Europol and national databases, including the access by Europol to those national databases, is an additional reason for the adoption of a Council Framework Decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters, offering an adequate level of protection.

29.

Article 24(1) lays down two conditions for communication of data to public authorities of third countries and international organisations: (a) communication may only take place if necessary in individual cases for the combat of crime and (b) on the basis of an international agreement assuring that an adequate level of data protection is afforded by the third body. Article 24(2) allows for derogation in exceptional cases, taking the level of data protection of the receiving body into consideration. The EDPS understands the need of these exceptions, and emphasises the need of a strict application of the exceptions, on a case by case basis in very exceptional situations. The text of Article 24(2) reflects these conditions in a satisfactory way.

30.

Article 29 deals with the right of access to personal data. This is one of the basic rights of the data subject, which is enshrined in Article 8(2) of the Charter of Fundamental Rights for the European Union, and is also guaranteed by the Council of Europe Convention 108 of 28 January 1981 and by Recommendation No R (87) 15 of the Committee of Ministers of the Council of Europe of 17 September 1987. This right is part of the principle of fair and lawful processing of personal data and is designed to protect the essential interests of the data subject. However, the conditions laid down by Article 29 limit this right in a way which is not acceptable in the light of the above.

31.

First of all, Article 29(3) lays down that the request for access — made in a Member State according to Article 29(2) — will be dealt with in accordance with Article 29 and in accordance with the laws and procedures of the Member State in which a request is made. As a result, national law may limit the scope and the substance of the right of access and may impose procedural constraints. This result could be unsatisfactory. For instance, requests for access to personal data can also be made by persons whose data are not processed by Europol. It is essential that the right of access extends to these requests. It therefore must be ensured that national law entailing a more limited right of access does not apply.

32.

According to the EDPS, the reference to national law in Article 29(3) should be deleted and be replaced by harmonised rules on scope, substance and procedure preferably in the Council Framework Decision on the protection of personal data or, where necessary, in the Council Decision.

33.

Furthermore, Article 29(4) lists the grounds for refusal of access to personal data, in case the data subject wants to exercise his right of access to personal data concerning him that are processed by Europol. According to Article 29(4) access shall be denied if such access ‘might jeopardise’ certain specific interests. This wording is much wider than the wording of Article 19(3) of the Europol Convention, which allows refusal of access only ‘if such refusal is necessary to’.

34.

The EDPS recommends maintaining the stricter wording of the text of the Europol Convention. It must also be ensured that the data controller is obliged to state the reasons for refusal, in such a way that the use of this exception can be effectively controlled. This principle is expressly laid down in the Recommendation No R (87) 15 of the Committee of Ministers of the Council of Europe. The wording in the Commission proposal is not acceptable since it does not do justice to the fundamental nature of the right of access. Exceptions to this right can only be accepted if this is necessary in order to protect another fundamental interest, if in other words access would undermine this other interest.

35.

Last but not least, the right of access is strongly limited by the consultation mechanism laid down in Article 29(5). This mechanism makes the access conditional upon consultation of all competent authorities concerned and, with regard to analysis files, also upon consensus of Europol and all Member States participating in the analysis or directly concerned. This mechanism de facto overturns the fundamental nature of the right of access. Access should be granted as a general principle and may be restricted only under specific circumstances. Instead, according to the text of the proposal, access would be granted only after consultation is carried out and consensus is reached.

36.

Europol will be a body of the European Union, but not a Community institution or body as meant in Article 3 of Regulation (EC) No 45/2001. For this reason, the Regulation does not normally apply to processing of personal data by Europol, apart from specific situations. Chapter V of the proposal therefore introduces a data protection regime sui generis, which also relies on an applicable general legal framework on data protection.

37.

The proposal acknowledges the need for a general legal framework on data protection. According to Article 26 of the proposal, as a lex generalis Europol shall apply the principles of the Council Framework Decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters. This reference to the (proposed) Council Framework Decision replaces the reference in Article 14(3) of the Europol Convention to the Council of Europe Convention 108 of 28 January 1981 and Recommendation No R (87) 15 of the Committee of Ministers of the Council of Europe of 17 September 1987.

38.

The EDPS welcomes Article 26 of the proposal. This provision is crucial for the effectiveness of data protection, as well as for reasons of consistency since it facilitates the exchange of personal data which also benefits law enforcement. However, compatibility between the two instruments should be guaranteed which is not self evident bearing in mind that:

Depending on the outcome of the negotiations in Council on this framework decision, probably based on the German proposal, additional safeguards might be needed in the present proposal. This point must be assessed at a later stage, when there is more clarity on the outcome of the negotiations on the Council Framework Decision.

39.

The EDPS emphasises that the present Council Decision should not be adopted before the adoption by Council of a framework on data protection, guaranteeing an appropriate level of data protection in conformity with the conclusions of the EDPS in his two opinions on the Commission proposal for a Council Framework Decision (16).

40.

In this context, the EDPS underlines two specific elements of the Commission proposal for a Council Framework Decision, which are in particular appropriate in enhancing the protection afforded to data subjects in case of processing of their data by Europol. In the first place, the proposal opens up possibilities for distinguishing the processing of data in accordance with their degree of accuracy and reliability. Data based on opinions are distinguished from data based on facts. Such a clear difference between ‘soft data’ and ‘hard data’ is an important method, in order to comply with the data quality principle. In the second place, the proposal provides for a distinction between data of categories of persons, based on their possible involvement in a criminal offence.

41.

This leads to the applicability of Regulation (EC) No 45/2001 to activities of Europol. This Regulation (EC) No 45/2001 does first of all apply with regard to the Staff of Europol which will be dealt with in point 47. Secondly, and this is the subject of Part IV of this opinion, the Regulation will apply to exchanges of data with Community bodies, at least in so far as data are being sent by these bodies to Europol. Important examples of Community bodies are the bodies mentioned in Article 22(1) of the proposal.

42.

One can expect that these bodies will be required to send personal data to Europol quite regularly. In doing so, Community institutions and bodies will be subject to all the obligations laid down by Regulation (EC) No 45/2001, in particular with regard to the lawfulness of processing (Article 5 of the Regulation), prior checking (Article 27) and consultation of the EDPS (Article 28). This raises questions as to the applicability of Articles 7, 8 and 9 of Regulation (EC) No 45/2001. Europol, being ‘other than Community institutions or bodies’ and not subject to Directive 95/46/EC, may well fall under Article 9. In that case, the adequacy of protection afforded by Europol should be assessed under Article 9(2) of Regulation (EC) No 45/2001 in the same way as other international organisations or third countries. This solution would create uncertainty and would moreover not be in conformity with the basic idea in the proposal of bringing the position of Europol more in line with institution and bodies under the EC Treaty. A better solution would be to treat Europol as a Community body as far as it processes data originating from Community bodies. The EDPS suggests adding a paragraph to Article 22 reading as follows: ‘Where personal data are transferred by Community institutions or bodies, Europol shall be regarded as a Community body as meant in Article 7 of Regulation (EC) No 45/2001’.

43.

Special attention has to be given to the exchange of personal data with the European Anti-fraud office (Olaf). Presently, the exchange of information between Europol and Olaf takes place on the basis of an administrative agreement between the two bodies. This agreement provides for the exchange of strategic and technical information, but excludes the exchange of personal data.

44.

The proposal for a Council Decision is of a different nature. Article 22(3) provides for the exchange of information, including personal data, in the same way as data are exchanged between Olaf and authorities of the Member States (17). The purpose of this exchange is limited to fraud, active and passive corruption and money laundering. Both Olaf and Europol shall take account, in each specific case, of the requirements of investigation secrecy and data protection. For Olaf this means in any event, ensuring the level of protection as set out in Regulation (EC) No 45/2001.

45.

Moreover, Article 48 of the proposal lays down that Regulation (EC) No 1073/1999 (18) applies to Europol. Olaf shall have the power to carry out administrative investigations within Europol and shall to that effect have the right of immediate and unannounced access to any information held by Europol (19). According to the EDPS, the scope of this provision is not clear:

46.

However, the provision does not and should not cover investigations on irregularities outside Europol, on which data processed by Europol could shed additional light. The provisions for the exchange of information, including personal data, under Article 22(3) would be sufficient for those cases. The EDPS recommends clarifying the scope of Article 48 of the proposal in this sense.

47.

The Staff of Europol will fall within the scope of the Staff Regulations. In case of processing of data relating to Europol Staff, both the substantive and the supervision rules of Regulation (EC) No 45/2001 should apply, for reasons of consistency and non discrimination. The 12th recital of the proposal mentions the applicability of the Regulation on the processing of personal data, notably as regards personal data related to Europol Staff. According to the EDPS, it is not enough to clarify this notion in the recitals. Recitals of a Community Act are of a non binding nature and shall not contain normative provisions (20). In order to fully ensure the application of Regulation (EC) No 45/2001, a paragraph should be added in the text of the decision itself — for instance in Article 38 — stating that Regulation (EC) No 45/2001 shall apply to processing of personal data relating to the Europol Staff.

48.

The proposal does not aim at a fundamental change of the system of supervision on Europol with a central role for the joint supervisory body. Under the proposed legal framework, the supervisory body will be established in conformity with Article 33 of the proposal. However, some changes in the status and activities of Europol will lead to a limited involvement of the EDPS, apart from his tasks relating to the Europol Staff. For this reason, Article 33(6) of the proposal lays down that the joint supervisory body must cooperate with the EDPS, as well as with other supervisory authorities. This provision mirrors the obligation for the EDPS to cooperate with the joint supervisory body under Article 46(f)(ii) of Regulation (EC) No 45/2001). The EDPS welcomes this provision as a useful instrument promoting a consistent approach on data on supervision throughout the EU, independently of the pillar.

49.

As said before, the present proposal does not foresee any fundamental change of the system of supervision. However, the wider context of this proposal might require more fundamental reflection on the future system of supervision on Europol. Two specific developments can be mentioned. In the first place, Articles 44-47 of Regulation (EC) No 1987/2006 (21) provide for a new structure of supervision on SIS II. In the second place, in the context of the Council Framework Decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters the German Presidency announced that it is considering a new structure for the supervision of European information systems under the third pillar, including Europol.

50.

According to the EDPS, this opinion is not the right occasion to discuss fundamental changes in the system of supervision. The system of supervision on SIS II as a networked system is grounded within the first pillar and would not be appropriate to Europol as a body within the third pillar which entails limited competences of Community institutions, in particular the Commission and the Court of Justice. In the absence of the safeguards under the third pillar, a specific system of supervision will still be needed. For example, Article 31 deals with appeals by individuals. Moreover, the ideas on a new structure for the supervision of European information systems as announced by the German Presidency are still in a very early stage. Finally, the present system functions well.

51.

The EDPS will therefore focus his remarks on his role relating to the exchange of personal data between Europol and other bodies on the level of the European Union. Provisions relating to this exchange are an important new element of the proposal. Article 22(1) mentions Frontex, the European Central Bank, the EMCDDA (22) as well as Olaf. All of these bodies fall within the scope of the supervision by the EDPS. Article 22(2) states that Europol may conclude working arrangements with those bodies which may include the exchange of personal data. As far as Olaf is concerned, this exchange can even take place without working arrangements (Article 22(3)). Also, Article 48 of the proposal — discussed in points 45 and 46 — is relevant in this respect.

52.

It should be ensured that the EDPS can exercise the powers conferred to him under Regulation (EC) No 45/2001, with regard to data communicated by Community bodies. This is all the more important in cases of transfer of personal data where Europol will be regarded as a Community body as meant in Article 7 of Regulation (EC) No 45/2001, as proposed before. This makes the close cooperation with the joint supervisory body under Article 33 even more important.

53.

The EDPS has two additional recommendations to make, with regard to the data subjects' rights relating to those data:

54.

By virtue of the aforementioned considerations, the EDPS should closely cooperate with the joint supervisory body, at least once the arrangements to exchange data with Community bodies will be in place. This is one of the main areas where the mutual obligations to cooperate will become effective.

55.

Article 10(3) provides for a Council Decision determining the conditions for the establishment of certain systems for the processing of personal data by Europol. The EDPS recommends adding the obligation to consult the EDPS and the joint supervisory body before the adoption of such a decision.

56.

Article 22 deals with the relations of Europol with other Community or Union related bodies and agencies. The cooperative relations mentioned in this Article may be implemented through working arrangements and may concern the exchange of personal data. For this reason, the EDPS and the joint supervisory body should be consulted upon the adoption of the arrangements under Article 22, as far as these agreements are relevant to the protection of personal data processed by Community institutions and bodies. The EDPS recommends amending the text of the proposal accordingly.

57.

Article 25(2) states that implementing rules for the exchanges with other Community or Union related bodies and agencies shall be laid down. The EDPS recommends that not only the joint supervisory body, but also the EDPS should be consulted prior to the adoption of such rules, in line with the practice under Community law that Community bodies consult the EDPS under Article 28(1) of Regulation (EC) No 45/2001.

58.

The EDPS welcomes Article 27 that contains a provision on a Data Protection Officer (DPO) who will inter alia have the task of ensuring, in an independent manner, the lawfulness and compliance with the provisions on the processing of personal data. This function has been successfully introduced on the Community level by Regulation (EC) No 45/2001, within Community institutions and bodies. Within Europol, the function of DPO is also being exercised, however without adequate legal basis to date.

59.

For the success of the functioning of the DPO it is essential that his independence is effectively guaranteed by law. For this reason, Article 24 of Regulation (EC) No 45/2001 contains several provisions ensuring this objective. The DPO is appointed for a certain period and can only be dismissed under very exceptional circumstances. He will be provided with the necessary staff and budget. He may not receive instructions in the performance of his duties.

60.

Unfortunately, these provisions are not included in the present proposal, except for the provision on taking instructions. The EDPS therefore strongly recommends including the guarantees concerning the independence of the DPO, such as the special safeguards for the appointment and the dismissal of the DPO, and his independence towards the Management Board. These provisions are necessary to ensure the independence of the DPO. Moreover, these provisions would bring the position of the DPO of Europol more in line with the position of the DPOs within Community institutions. Finally, the EDPS emphasises that Article 27(5) of the proposal that urges the Management Board of Europol to adopt implementing rules on certain aspects of the functioning of the DPO is by nature not appropriate as guarantee for the independence of the DPO. It has to be kept in mind that independence is above all needed towards the management of Europol.

61.

There is one more reason for harmonising the provision of the DPO in the Council decision with Article 24 of Regulation (EC) No 45/2001. With respect of the personal data of the Staff of Europol (see point 47), this Regulation applies, which means that for these matters the DPO of Europol will fall under this Regulation. In any event, a DPO should be appointed in accordance with the requirements of the Regulation.

62.

Furthermore, the EDPS recommends applying the system of prior checking as provided for in Article 27 of Regulation (EC) No 45/2001 for Community bodies to Europol. The system of prior checking has proved to be an effective instrument and plays an essential role in data protection within the Community institutions and bodies.

63.

Finally, it would be useful for the DPO of Europol to participate in the existing DPO-network in the first pillar, even apart of the activities of the DPO in respect of the Staff of Europol. This would further ensure an approach on data protection issues common to the approach taken by the Community bodies and would perfectly conform with the objective formulated in the 16th Recital of the proposal, namely the cooperation with European bodies and agencies ensuring an adequate level of data protection in conformity with Regulation (EC) No 45/2001. The EDPS recommends adding a sentence to the recitals of the proposals in which the objective of this common approach is laid down. Such a sentence could read as follows. ‘In carrying out his tasks, the Data Protection Officer will cooperate with the Data Protection Officers appointed under Community law.’

64.

The EDPS understands the need for a new and more flexible legal basis for Europol, but pays specific attention to the substantive changes, the applicable laws on data protection and the growing similarities between Europol and Community bodies.

65.

As to the substantive changes, the EDPS recommends:

66.

The present Council Decision should not be adopted before the adoption by Council of a framework on data protection, guaranteeing an appropriate level of data protection in conformity with the conclusions of the EDPS in his two opinions on the Commission proposal for a Council Framework Decision. Data based on opinions should be distinguished from data based on facts. A distinction should be made between data of categories of persons, based on their possible involvement in a criminal offence.

67.

The EDPS suggest adding a paragraph to Article 22 reading as follows: ‘Where personal data are transferred by Community institutions or bodies, Europol shall be regarded as a Community body as meant in Article 7 of Regulation (EC) No 45/2001’.

68.

Article 48 of the proposal on investigations by Olaf should not cover investigations on irregularities outside Europol, on which data processed by Europol could shed additional light. The EDPS recommends clarifying the scope of Article 48 of the proposal.

69.

In order to fully ensure the application of Regulation (EC) No 45/2001, a paragraph should be added in the text of the decision stating that Regulation (EC) No 45/2001 shall apply to processing of personal data relating to the Europol Staff.

70.

The scope of two provisions on the rights of the data subjects (Article 30(2) and Article 32(2)) should be extended to data communicated by a Community body supervised by the EDPS, in order to ensure that Europol and this Community body react similarly.

71.

Articles 10(3), 22 and 25(2) should contain (more precise) provision on consultation of data protection authorities.

72.

The EDPS strongly recommends including the guarantees concerning the independence of the DPO, such as the special safeguards for the appointment and the dismissal of the DPO, and his independence towards the Management Board, in conformity with Regulation (EC) No 45/2001.

27.10.2007   

EN

Official Journal of the European Union

C 255/22

27.10.2007   

EN

Official Journal of the European Union

C 255/24

27.10.2007   

EN

Official Journal of the European Union

C 255/31

—

from the Europa competition website (http://ec.europa.eu/comm/competition/mergers/cases/). This website provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes,

—

in electronic form on the EUR-Lex website under document number 32007M4889. EUR-Lex is the on-line access to European law (http://eur-lex.europa.eu).

27.10.2007   

EN

Official Journal of the European Union

C 255/31

—

from the Europa competition website (http://ec.europa.eu/comm/competition/mergers/cases/). This website provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes,

—

in electronic form on the EUR-Lex website under document number 32007M4885. EUR-Lex is the on-line access to European law (http://eur-lex.europa.eu).

27.10.2007   

EN

Official Journal of the European Union

C 255/32

—

from the Europa competition website (http://ec.europa.eu/comm/competition/mergers/cases/). This website provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes,

—

in electronic form on the EUR-Lex website under document number 32007M4836. EUR-Lex is the on-line access to European law (http://eur-lex.europa.eu).

27.10.2007   

EN

Official Journal of the European Union

C 255/32

—

from the Europa competition website (http://ec.europa.eu/comm/competition/mergers/cases/). This website provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes,

—

in electronic form on the EUR-Lex website under document number 32007M4822. EUR-Lex is the on-line access to European law (http://eur-lex.europa.eu).

27.10.2007   

EN

Official Journal of the European Union

C 255/33

27.10.2007   

EN

Official Journal of the European Union

C 255/34

1.

The Advisory Committee agrees with the European Commission's assessment of the product and the geographic area affected by the cartel in the draft decision.

2.

The Advisory Committee agrees with the European Commission's assessment of the facts as an agreement and/or concerted practice within the meaning of Article 81 of the Treaty and Article 53 of the EEA Agreement.

3.

The Advisory Committee agrees with the European Commission's view that the infringement referred to a single and continuous infringement, especially regarding the period after the inspections in March/April 2001.

4.

The Advisory Committee agrees with the European Commission's draft decision as regards the addressees of the decision, specifically with reference to imputation of liability to parent companies of the groups concerned.

5.

The Advisory Committee agrees with the European Commission as regards the assessment of the leniency applications and their ranking.

6.

The Advisory Committee agrees to close the proceedings against FNAS.

7.

The Advisory Committee recommends the publication of its opinion in the Official Journal of the European Union.

27.10.2007   

EN

Official Journal of the European Union

C 255/34

1.

The Advisory Committee agrees with the Commission on the basic amounts of the fines.

2.

The Advisory Committee agrees with the Commission on the increase of the basic amount due to aggravating circumstances.

3.

The Advisory Committee agrees with the Commission on the reduction of the basic amount due to attenuating circumstances.

4.

The Advisory Committee agrees with the Commission on the amounts of reduction of the fine based on the 1996 Commission Notice on the non-imposition or reduction of fines in cartel cases.

5.

The Advisory Committee agrees with the Commission on the final amounts of the fines.

6.

The Advisory Committee recommends the publication of its opinion in the Official Journal of the European Union.

27.10.2007   

EN

Official Journal of the European Union

C 255/35

1.

The representative of the EFTA States agrees with the European Commission's assessment of the product and the geographic area affected by the cartel in the draft decision.

2.

The representative of the EFTA States agrees with the European Commission's assessment of the facts as an agreement and/or concerted practice within the meaning of Article 81 of the Treaty and Article 53 of the EEA Agreement.

3.

The representative of the EFTA States agrees with the European Commission's view that the infringement referred to a single and continuous infringement, especially regarding the period after the inspections in March/April 2001.

4.

The representative of the EFTA States agrees with the European Commission's draft decision as regards the addressees of the decision, specifically with reference to imputation of liability to parent companies of the groups concerned.

5.

The representative of the EFTA States agrees with the European Commission as regards the assessment of the leniency applications and their ranking.

6.

The representative of the EFTA States agrees to close the proceedings against FNAS.

7.

The representative of the EFTA States recommends the publication of its view in the Official Journal of the European Union.

27.10.2007   

EN

Official Journal of the European Union

C 255/36

27.10.2007   

EN

Official Journal of the European Union

C 255/38

—

the technical and human resources that the applicant will assign to the operation of the route,

—

the number, qualifications and assignment of personnel and any recruitments that the applicant proposes to make,

—

the types of aircraft used and, where appropriate, their registration,

—

a copy of the tenderer's air carrier operating licence,

—

if the operating licence was issued by a European Union Member State other than France, the tenderer must also provide the following information:

27.10.2007   

EN

Official Journal of the European Union

C 255/42

—

the technical and human resources that the applicant will assign to the operation of the route,

—

the number, qualifications and assignment of personnel and any recruitments that the applicant proposes to make,

—

the types of aircraft used and, where appropriate, their registration,

—

a copy of the tenderer's air carrier operating licence,

—

if the operating licence was issued by a European Union Member State other than France, the tenderer must also provide the following information:

27.10.2007   

EN

Official Journal of the European Union

C 255/45

1.

On 19 October 2007, the Commission received a notification of a proposed concentration pursuant to Article 4 of Council Regulation (EC) No 139/2004 (1) by which the undertaking The Goldman Sachs Group, Inc. (‘Goldman Sachs’, USA) acquires within the meaning of Article 3(1)(b) of the Council Regulation control of the whole of the undertaking LOMO Group (‘LOMO’, Germany) by way of purchase of securities.

2.

The business activities of the undertakings concerned are:

3.

On preliminary examination, the Commission finds that the notified transaction could fall within the scope of Regulation (EC) No 139/2004. However, the final decision on this point is reserved. Pursuant to the Commission Notice on a simplified procedure for treatment of certain concentrations under Council Regulation (EC) No 139/2004 (2) it should be noted that this case is a candidate for treatment under the procedure set out in the Notice.

4.

The Commission invites interested third parties to submit their possible observations on the proposed operation to the Commission.

Observations must reach the Commission not later than 10 days following the date of this publication. Observations can be sent to the Commission by fax ((32-2) 296 43 01 or 296 72 44) or by post, under reference number COMP/M.4911 — Goldman Sachs/LOMO, to the following address:

27.10.2007   

EN

Official Journal of the European Union

C 255/46

1.

On 22 October 2007, the Commission received a notification of a proposed concentration pursuant to Article 4 of Council Regulation (EC) No 139/2004 (1) by which the undertaking SAP AG (‘SAP’, Germany) acquires within the meaning of Article 3(1)(b) of the Council Regulation control of the whole of the undertaking Business Objects S.A. (‘BO’, France/USA) by way of purchase of shares.

2.

The business activities of the undertakings concerned are:

3.

On preliminary examination, the Commission finds that the notified transaction could fall within the scope of Regulation (EC) No 139/2004. However, the final decision on this point is reserved.

4.

The Commission invites interested third parties to submit their possible observations on the proposed operation to the Commission.

Observations must reach the Commission not later than 10 days following the date of this publication. Observations can be sent to the Commission by fax ((32-2) 296 43 01 or 296 72 44) or by post, under reference number COMP/M.4944 — SAP/Business Objects, to the following address:

27.10.2007   

EN

Official Journal of the European Union

C 255/47

1.

On 19 October 2007, the Commission received a notification of a proposed concentration pursuant to Article 4 of Council Regulation (EC) No 139/2004 (1) by which the undertaking SC-Beteiligungsgesellschaft mbH (SCB, Germany), finally controlled by JP Morgan Chase & Co. (JPMorgan Chase, USA) acquires within the meaning of Article 3(1)(b) of the Council Regulation control of the whole of the undertaking Süd-Chemie AG (Süd-Chemie, Germany) by way of purchase of shares.

2.

The business activities of the undertakings concerned are:

3.

On preliminary examination, the Commission finds that the notified transaction could fall within the scope of Regulation (EC) No 139/2004. However, the final decision on this point is reserved. Pursuant to the Commission Notice on a simplified procedure for treatment of certain concentrations under Council Regulation (EC) No 139/2004 (2) it should be noted that this case is a candidate for treatment under the procedure set out in the Notice.

4.

The Commission invites interested third parties to submit their possible observations on the proposed operation to the Commission.

Observations must reach the Commission not later than 10 days following the date of this publication. Observations can be sent to the Commission by fax ((32-2) 296 43 01 or 296 72 44) or by post, under reference number COMP/M.4899 — SCB/Süd-Chemie, to the following address:

27.10.2007   

EN

Official Journal of the European Union

C 255/48

(1)

Commission Regulation (EC) No 773/2004 of 7 April 2004 relating to the conduct of proceedings by the Commission pursuant to Articles 81 and 82 of the EC Treaty (3) lays down rules concerning the participation of the parties concerned in such proceedings.

(2)

Parties to the proceedings may be prepared to acknowledge their participation in a cartel violating Article 81 of the Treaty and their liability in respect of such participation, if they can reasonably anticipate the Commission's envisaged findings as regards their participation in the infringement and the level of potential fines and agree with those findings. It should be possible for the Commission to disclose to those parties, where appropriate, the objections which it intends to raise against them on the basis of the evidence in the file and the fines that they are likely to incur. Such early disclosure should enable the parties concerned to put forward their views on the objections which the Commission intends to raise against them as well as on their potential liability.

(3)

When the Commission endorses the parties' written settlement submissions in the statement of objections and, in their replies, the parties confirm that the statement of objections corresponds to the contents of their written submissions, the Commission should be able to proceed immediately to the adoption of a decision pursuant to Article 7 and Article 23 of Regulation (EC) No 1/2003 after consultation of the Advisory Committee on Restrictive Practices and Dominant Positions pursuant to Article 14 of Regulation (EC) No 1/2003.

(4)

A settlement procedure should therefore be established in order to enable the Commission to handle cartel cases faster by reaching an agreement with the parties.

(5)

Experience has shown that systematically providing complainants with a non-confidential version of the statement of objections can have negative consequences as regards the willingness of the parties to the proceedings to cooperate with the Commission. While complainants should continue to be closely associated with the proceedings and be informed of and able to provide their views on the nature and subject matter of the procedure in writing, it should be for the Commission to determine how such written information should be given in a particular case.

(6)

Regulation (EC) No 773/2004 should therefore be amended accordingly,

1.

Article 2, paragraph 1 is replaced by the following

‘1.   The Commission may decide to initiate proceedings with a view to adopting a decision pursuant to Chapter III of Regulation (EC) No 1/2003 at any point in time, but no later than the date on which it issues a preliminary assessment as referred to in Article 9(1) of that Regulation, a statement of objections or a request for the parties to express their interest in engaging in settlement discussions, or the date on which a notice pursuant to Article 27(4) of that Regulation is published, whichever is the earlier.’

2.

In Article 6, paragraph 1 is replaced by the following:

‘1.   Where the Commission issues a statement of objections relating to a matter in respect of which it has received a complaint, it shall inform the complainant in writing of the nature and subject matter of the procedure and set a time-limit within which the complainant may make known its views in writing. The Commission may also provide the complainant with a copy of the non-confidential version of the statement of objections.’

3.

In Article 10, paragraph 1 is replaced by the following:

‘1.   The Commission shall inform the parties concerned of the objections raised against them. The statement of objections shall be notified in writing to each of the parties against whom objections are raised.’

4.

The following Article 10a is inserted:

‘Article 10a

Settlement procedure in cartel cases

1.   After the initiation of proceedings pursuant to Article 11(6) of Regulation (EC) No 1/2003, the Commission may set a time-limit within which the parties may indicate in writing that they are prepared to engage in settlement discussions with a view to possibly introducing settlement submissions. The Commission shall not be obliged to take into account replies received after the expiry of that time-limit.

If two or more parties belonging to the same undertaking indicate that they are willing to engage in settlement discussions pursuant to the first subparagraph, those parties shall appoint a joint representation to engage in discussions with the Commission on their behalf.

2.   The Commission may inform the parties willing to introduce settlement submissions of:

Should settlement discussions progress to a stage in which the above mentioned information has been disclosed upon request or made available to the parties otherwise, the Commission may set a time-limit within which the parties may commit to follow the settlement procedure by introducing written settlement submissions reflecting the results of the settlement discussions and acknowledging their participation in an infringement of Article 81 of the Treaty as well as their liability. The Commission shall not be obliged to take into account written settlement submissions received after the expiry of that time-limit.

3.   When the statement of objections notified to the parties endorses the contents of their written settlement submissions, the written reply to the statement of objections by the parties concerned shall, within a time-limit set by the Commission, confirm that the statement of objections addressed to them corresponds to the contents of their written settlement submissions. The Commission may then proceed immediately to the adoption of a decision pursuant to Article 7 and Article 23 of Regulation (EC) No 1/2003 after consultation of the Advisory Committee on Restrictive Practices and Dominant Positions pursuant to Article 14 of Regulation (EC) No 1/2003.’

5.

Article 11(1) is replaced by the following:

‘1.   The Commission shall give the parties to whom it addresses a statement of objections the opportunity to be heard before consulting the Advisory Committee referred to in Article 14(1) of Regulation (EC) No 1/2003’

6.

Article 12 is replaced by the following:

‘1.   The Commission shall give the parties to whom it addresses a statement of objections the opportunity to develop their arguments at an oral hearing, if they so request in their written submissions.’

‘2.   However, when introducing their written settlement submissions the parties shall confirm to the Commission that they would only require having the opportunity to develop their arguments at an oral hearing, if the statement of objections does not endorse the contents of their written settlement submissions.’

7.

In Article 15, the following paragraph 1a is added:

‘1a.   After the initiation of proceedings pursuant to Article 11(6) of Regulation (EC) No 1/2003, the Commission shall disclose, where appropriate, the evidence supporting the envisaged objections to parties willing to introduce settlement submissions in order to enable them to do so. In view thereof, when introducing their settlement submissions the parties shall confirm to the Commission that they will only require access to the file after the receipt of the statement of objections, if the statement of objections does not endorse the contents of their written settlement submissions.’

8.

Article 17(1) and Article 17(3) are replaced by the following:

‘1.   In setting the time-limits provided for in Article 3(3), Article 4(3), Article 6(1), Article 7(1), Article 10(2), Article 10a(1), Article 10a(2), Article 10a(3) and Article 16(3), the Commission shall have regard both to the time required for preparation of the submission and to the urgency of the case.’

‘3.   The time-limits referred to in Article 3(3), Article 4(3), Article 10a(1), Article 10a(2) and Article 16(3) shall be at least two weeks. The time-limit referred to in Article 10a(3) shall be at least one week.’

27.10.2007   

EN

Official Journal of the European Union

C 255/51

1.

This Notice sets out the framework for rewarding cooperation in the conduct of proceedings commenced in view of the application of Article 81 of the EC Treaty (1) to cartel cases. The settlement procedure may allow the Commission to handle more cases with the same resources, thereby fostering the public interest in the Commission's delivery of effective and timely punishment, while increasing overall deterrence. The cooperation covered by this Notice is different from the voluntary production of evidence to trigger or advance the Commission's investigation, which is covered by the Commission Notice on Immunity from fines and reduction of fines in cartel cases (2) (the Leniency Notice). Provided that the cooperation offered by an undertaking qualifies under both Commission Notices, it can be cumulatively rewarded accordingly (3).

2.

When parties to the proceedings are prepared to acknowledge their participation in a cartel violating Article 81 of the EC Treaty and their liability therefore, they may also contribute to expediting the proceedings leading to the adoption of the corresponding decision pursuant to Article 7 and Article 23 of Council Regulation (EC) No 1/2003 of 16 December 2002 on the implementation of the rules on competition laid down in Articles 81 and 82 of the Treaty (4) in the way and with the safeguards specified in this Notice. Whilst the Commission, as the investigative authority and the guardian of the Treaty empowered to adopt enforcement decisions subject to judicial control by the Community Courts, does not negotiate the question of the existence of an infringement of Community law and the appropriate sanction, it can reward the cooperation described in this Notice.

3.

Commission Regulation (EC) No 773/2004 of 7 April 2004 relating to the conduct of proceedings by the Commission pursuant to Articles 81 and 82 of the EC Treaty (5) lays down the core practical rules concerning the conduct of proceedings in antitrust cases including those applicable in the variant for settlement. In this regard, Regulation (EC) No 773/2004 bestows on the Commission the discretion whether to explore the settlement procedure or not in cartel cases, while ensuring that the choice of the settlement procedure cannot be imposed on the parties.

4.

Effective enforcement of Community competition law is compatible with full respect of the parties' rights of defence, which constitutes a fundamental principle of Community law to be respected in all circumstances, and in particular in antitrust procedures which may give rise to penalties. It follows that the rules established to conduct the Commission proceedings to enforce Article 81 of the EC Treaty should ensure that the undertakings and associations of undertakings concerned are afforded the opportunity effectively to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the Commission (6), throughout the administrative procedure.

5.

The Commission retains a broad margin of discretion to determine which cases may be suitable to explore the parties' interest to engage in settlement discussions, as well as to decide to engage in them or discontinue them or to definitely settle. In this regard, account may be taken of the probability of reaching a common understanding regarding the scope of the potential objections with the parties involved within a reasonable timeframe, in view of factors such as number of parties involved, foreseeable conflicting positions on the attribution of liability, extent of contestation of the facts. Additionally, the prospect of achieving procedural efficiencies in view of the progress made overall in the settlement procedure will be considered. Other concerns such as setting a possible precedent might apply. The Commission may only engage in settlement discussions upon the written request of the parties concerned.

6.

While parties to the proceedings do not have a right to settle, should the Commission consider that a case may, in principle, be suitable for settlement, it will explore the interest in settlement of all parties to the same proceedings.

7.

The parties to the proceedings and their legal representatives may not disclose to any other undertaking or third party in any jurisdiction the content of the discussions or of the documents which they have had access to in view of settlement, unless they have a prior explicit authorization by the Commission. Any breach in this regard may lead the Commission to disregard the undertaking's request to follow the settlement procedure and may constitute an aggravating circumstance within the meaning of point 28 of the Commission Guidelines on the method of setting fines imposed pursuant to Article 23(2)(a) of Regulation (EC) No 1/2003 (7) (the Guidelines on fines).

8.

Where the Commission contemplates the adoption of a decision pursuant to Article 7 and/or Article 23 of Regulation (EC) No 1/2003, it is required in advance to identify and recognize as parties to the proceedings the legal persons on whom a penalty may be imposed for an infringement of Article 81 of the EC Treaty.

9.

To this end, the initiation of proceedings pursuant to Article 11(6) of Regulation (EC) No 1/2003 in view of adopting such a decision can take place at any point in time, but no later than the date on which the Commission issues a statement of objections against the parties concerned. Article 2(1) of Regulation (EC) No 773/2004 further specifies that, should the Commission consider it suitable to explore the parties' interest in engaging in settlement discussions, it will initiate proceedings no later than the date on which it either issues a statement of objections or requests the parties to express in writing their interest to engage in settlement discussions, whichever is the earlier.

10.

After the initiation of proceedings pursuant to Article 11(6) of Regulation (EC) No 1/2003, the Commission is solely competent to apply Article 81 of the EC Treaty to the case in point (8).

11.

Should the Commission consider it suitable to explore the parties' interest to engage in settlement discussions, it will set a time-limit of no less than two weeks pursuant to Articles 10a(1) and 17(3) of Regulation (EC) No 773/2004 within which parties to the same proceedings should declare in writing whether they envisage engaging in settlement discussions in view of possibly introducing settlement submissions at a later stage.

12.

All parties to the proceedings which belong to the same undertaking and envisage the possibility of introducing a settlement submission and requesting to engage in settlement discussions may appoint joint representatives duly empowered to act on their behalf at any point in time, but must do it no later than the end of the time-limit referred to in point 11.

13.

The Commission may disregard any application for immunity from fines or reduction of fines under the Leniency Notice on the ground that it has been submitted after the expiry of the time-limit referred to in point11.

14.

Should some of the parties to the proceedings request settlement discussions and comply with the requirements referred to in points 11 and 12, the Commission may decide to pursue the settlement procedure by means of bilateral contacts between the Commission Directorate General for Competition and the settlement candidates.

15.

The Commission retains discretion to determine throughout the procedure on the appropriateness and the pace of the bilateral settlement discussions with each undertaking. In line with Article 10a(2) of Regulation (EC) No 773/2004 (9), this includes determining, in view of the progress made overall in the settlement procedure, the order and sequence of the bilateral settlement discussions as well as the timing of the disclosure of information, including the evidence in the Commission file used to establish the envisaged objections and the potential fine (10). Information will be disclosed in a timely manner as settlement discussions progress

16.

Such an early disclosure in the context of settlement discussions pursuant to Article 10a(2) and Article 15(1a) of Regulation (EC) No 773/2004 will allow the parties to be informed of the essential elements taken into consideration so far, such as the facts alleged, the classification of those facts, the gravity and duration of the alleged cartel, the attribution of liability, an estimation of the range of likely fines (11), as well as the evidence used to establish the potential objections (12). This will enable the parties effectively to assert their views on the potential objections against them and will allow them to make an informed decision on whether or not to settle.

17.

When the progress made during the settlement discussions leads to a common understanding regarding the scope of the potential objections and the estimation of the range of likely fines to be imposed by the Commission, the Commission may grant a final time-limit of at least XXX working days for an undertaking to introduce a final written settlement submission pursuant to Articles 10a(2) and 17(3) of Regulation (EC) No 773/2004. The time-limit can be extended following a reasoned request. Before granting such time-limit, the parties will be entitled to have the information specified in point 16 disclosed to them upon request. Upon reasoned request by a party, the Commission services will also grant it access to non-confidential versions of any accessible document listed in the case file at that point in time, in so far as they consider it justified for the purpose of enabling the party to ascertain its position regarding any other aspect of the cartel and provided that the procedural efficiencies referred to in point 5 are not jeopardized (13).

18.

The parties may call upon the Hearing Officer at any time during the settlement procedure in relation to issues that might arise relating to due process. The Hearing Officer's duty is to ensure that the effective exercise of the rights of defence is respected in competition proceedings.

19.

Should the parties concerned fail to introduce a settlement submission, then the procedure leading to the final decision in their regard will follow the general provisions in Articles 10(2), 12(1) and 15(1) of Regulation (EC) No 773/2004, instead of those regulating the settlement procedure.

20.

Parties opting for a settlement procedure must introduce a formal request to settle in the form of a written settlement submission. The written settlement submission provided for in Article 10a(2) of Regulation (EC) No 773/2004 should contain:

21.

The acknowledgments and confirmations provided by the parties in view of settlement constitute the expression of their commitment to cooperate in the expeditious handling of the case following the settlement procedure. However, those acknowledgments and confirmations are conditional upon the Commission meeting their settlement request, including the anticipated maximum amount of the fine.

22.

Therefore, written settlement requests cannot be revoked unilaterally by the parties who have provided them unless the Commission does not meet the settlement requests by endorsing the written settlement submissions first in a statement of objections and ultimately, in a final decision (see in this regard points 27 and 29). The statement of objections would be deemed to have endorsed the written settlement submissions if it reflects their contents as regards the description of the cartel and the undertaking's involvement therein and the legal qualification thereof. Additionally, for a final decision to be deemed to have endorsed the written settlement submissions, it should also impose a fine which does not exceed the maximum amount indicated therein.

23.

Pursuant to Article 10(1) of Regulation (EC) No 773/2004, the notification of a written statement of objections to each of the parties against whom objections are raised is a mandatory preparatory step before adopting any final decision (15). Therefore, the Commission will issue a statement of objections also in a settlement procedure (16).

24.

For the parties' rights of defence to be exercised effectively, the Commission should hear their views on the objections against them and supporting evidence before adopting a final decision and take them into account by amending its preliminary analysis, where appropriate (17). The Commission must be able not only to accept or reject the parties' relevant arguments expressed during the administrative procedure, but also to make its own analysis of the matters put forward by them in order to either abandon such objections as have been shown to be unfounded or to supplement and reassess its arguments both in fact and in law in support of the objections which it maintains (18).

25.

By introducing a formal settlement request in the form of a written settlement submission prior to the notification of the statement of objections, the parties concerned enable the Commission to effectively take their views into account (19) already when drafting the statement of objections, rather than only before the consultation of the Advisory Committee on Restrictive Practices and Dominant Positions (hereinafter the ‘Advisory Committee’) or before the adoption of the final decision (20). Accordingly, the statement of objections notified to the parties may draw on the contents of the settlement submissions, where appropriate, and the amount of the potential fine may be reviewed downwards in light thereof (21).

26.

Should the statement of objections endorse the parties' settlement submissions, the parties concerned should within a time-limit of at least one week set by the Commission in accordance with Articles 10a(3) and 17(3) of Regulation (EC) No 773/2004, reply to it by simply confirming (in unequivocal terms) that the statement of objections corresponds to the contents of their settlement submissions and that they therefore remain committed to follow the settlement procedure. In the absence of such a reply, the Commission may disregard the undertaking's request to follow the settlement procedure.

27.

The Commission may legitimately adopt a statement of objections which does not endorse the parties' settlement submission. If so, the general provisions in Articles 10(2), 12(1) and 15(1) of Regulation (EC) No 773/2004 will apply. The acknowledgements provided by the parties in the settlement submission would be deemed to be withdrawn and could not be used against any of the parties to the proceedings. Hence, the parties concerned would no longer be bound by their settlement submissions and would be granted a time-limit allowing them to present their defence anew, including the possibility to request an oral hearing and access to the file, if they so wish.

28.

Upon the parties' replies to the statement of objections confirming their commitment to settle, Regulation (EC) No 773/2004 allows the Commission to proceed, without any other procedural step, to the adoption of the subsequent final decision pursuant to Articles 7 and/or 23 of Regulation (EC) No 1/2003, after consultation of the Advisory Committee pursuant to Article 14 of Regulation (EC) No 1/2003. In particular, this implies that no oral hearing or access to the file may be requested by those parties once their settlement submissions have been endorsed by the statement of objections (22), in line with Articles 12(2) (23) and 15(1a) (24) of Regulation (EC) No 773/2004.

29.

The Commission may legitimately adopt a final position which departs from its preliminary position expressed in a statement of objections endorsing the parties' written settlement submissions, either in view of the arguments provided by the Advisory Committee or for other considerations in view of the ultimate autonomy of the Commission College to this effect (25). However, should the Commission intend to follow that course, it will inform the parties of this intention and notify to them a new statement of objections in order to allow for their defence in accordance with the general rules of procedure (26). It follows that the parties would then be entitled to have access to the file, to request an oral hearing and to reply to the statement of objections. The acknowledgments provided by the parties in the settlement submissions would be deemed to have been withdrawn and could not be used against any of the parties to the proceedings.

30.

The final amount of the fine in a particular case is determined in the decision finding an infringement and imposing a sanction pursuant to Article 7 and Article 23 of Regulation (EC) No 1/2003.

31.

In line with the Commission's practice, the fact that an undertaking cooperated with the Commission under this Notice during the administrative procedure will be indicated in any decision, so as to explain the reason for the level of the fine.

32.

Should the Commission decide to reward a party for settlement in the framework of this Notice, it will reduce by XX % the amount of the fine after the 10 % cap has been applied having regard to the Guidelines on the method of setting fines imposed pursuant to Article 23(2)(a) of Regulation (EC) No 1/2003 (27) and any specific increase for deterrence (28) used in their regard will not exceed a multiplication by two.

33.

In cases settled with leniency applicants, the reduction of the fine granted to them will be the sum of the leniency reward and the settlement reward.

34.

This Notice applies to any case pending before the Commission at the time of or after its publication in the Official Journal.

35.

The Commission considers that normally public disclosure of documents and written or recorded statements received in the context of this Notice would undermine certain public or private interests, for example the protection of the purpose of inspections and investigations, within the meaning of Article 4 of Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (29), even after the decision has been taken

36.

Final decisions taken by the Commission under Regulation (EC) No 1/2003 are subject to judicial review in accordance with Article 230 of the EC Treaty. Moreover, as provided in Article 229 of the EC Treaty and Article 31 of Regulation (EC) No 1/2003, the Court of Justice has unlimited jurisdiction to review decisions on sanctions adopted pursuant to Article 23 of Regulation (EC) No 1/2003.

—

‘The Commission shall give the parties to whom it addresses a statement of objections the opportunity to be heard before consulting the Advisory Committee referred to in Article 14(1) of Regulation (EC) No 1/2003’ (Article 11(1) of Regulation (EC) No 773/2004).

—

‘Before taking decisions as provided for in Articles 7, 8, 23 and Article 24(2), the Commission shall give the undertakings or associations of undertakings which are the subject of the proceedings conducted by the Commission the opportunity of being heard on the matters to which the Commission has taken objection. The Commission shall base its decisions only on objections on which the parties concerned have been able to comment. Complainants shall be associated closely with the proceedings’ (Article 27(1) of Regulation (EC) No 1/2003).

27.10.2007   

EN

Official Journal of the European Union

C 255/58

Name of product

Description

Geographical area

Proof of origin

Method of production

Link

Labelling

National requirements