February 4th, 2011 by Monique Altheim
January 31st, 2011 by Monique Altheim
According to its mission statement, the annual conference “
Computers, Privacy and Data Protection“ in
Brussels aims to create a bridge between policy makers, academics,
practitioners and activists, and aims to become Europe’s most important
forum for the discussion of data protection and privacy issues.
This goal was certainly reached during the panel on
Bahavioural Targeting and Profiling,
where technologists, privacy advocates and attorneys each presented
their own take and solutions for this very pertinent privacy issue.
All parties agreed that data collection is at the core of the online
marketing business model and therefore had to be dealt with. One
technologist suggested introducing the creation of a “cloudbroker”, who
would be an intermediary between the consumer and the advertising
agencies and would only pass on data of the consumer’s choosing.
Another IT professional repeated the old mantras of Do Not Track,
more transparency, monitoring tools, privacy certifications and Privacy
by Design.
A third one, Paul Francis, working for the Max Planck Institute in
Germany, proposed a very sophisticated privacy based advertising model,
called the
PRIVAD project
whereby a “dealer” would propose “software agents” for downloading in
users’ computers. The user would then create their own data and profile
with that software and pass it on to the dealer, who, after anonymizing
the data, would pass it on to a broker. The broker and the ad agencies
would thus only come into possession of separate bits of anonymous data,
and would not be able to build profiles of users. The targeted ads
would then be sent back to the user via the same anonymized paths.
One attorney on the panel drew attention to price discrimination as a
result of profiling. One way this is happening today is via Groupon
coupon offers, and he predicted this will happen more pervasively in
closed networks like Facebook. He questioned the legality of such
practices.
Privacy activist Alexander Hanff of
PrivacyInternational
proposed that, regardless of the claimed billions at stake for the ad
industry, privacy is a human right and not for sale. He proposed
straightforward opt-in for all.
One very good point was made in the audience that even when a
consumer gives consent to the collection of a particular information,
he/she does not necessarily give consent to the collection of multiple
data into aggregated data and profiles. Therefore it seems that the
concepts of PII and private data are outdated and need to be replaced by
“aggregated data” and “identity”.
Jeff Chester of
The Center for Digital Democracy
stated that in the US, leading brands have built a pervasive commercial
surveillance society and that they are selling individuals to the
highest bidder. He warned the audience that the next frontier would be
“neuromarketing’, whereby the advanced knowledge of how our brain
functions would be put to use to influence consumers on a subconscious
level.
Jeff conveyed how the ad industry is afraid of the EU data protection
model, and instead is pushing towards a “make believe” regulation and
self-regulation.
Another very interesting panel discussed
Surveillance in the Netherlands.
The panelists portrayed a “surveillance” society, where people are
watched by omnipresent CCTVs, where biometric passports are stored in
central data bases, where pat downs and house searches occur without
probable cause or warrant, where everyone is deemed guilty until proven
innocent and where the citizens are so trusting of their government that
they don’t even protest to these privacy invasive practices.
A very hot topic was the discussion of the EU
Data Retention Directive, that is up for review. For more background on this matter, see this recent
post on this blog.
Chris Soghoian spoke of the state of data retention in the US. He
explained how, except for certain areas like finance, there is no
mandatory retention requirement , but that a system of voluntary
retention has developed. For example, ATT and Verizon are paid $ 8
million a year by the FBI to provide real time access to two years of
stored records. Microsoft, Google, Sprint MySpace and Facebook all have
retention policies in place for voluntary help to law enforcement. The
public is largely unaware of these practices, since they are never
disclosed in the privacy policies of these companies. Apparently TMobile
is the only telecom NOT logging their customer’s information.
I suppose that at the time of the conference, Chris had not heard of the most recent
rumors in the House concerning a possible imminent retention bill.
The most popular and widely attended panel was the one discussing the
Revision of the EU Data Protection Directive consisting of
(from left to right): Achim Klabunde of the European Commission,
Giovanni Buttarelli of the European Data Protection Supervisor’s office,
Marie-Helene Boulanger of the European Commission, Jim Halpert of DLA
Piper LLP, Jacob Kohnstamm, Chairman of the Article 29 Working Party
& Dutch Data Protection Authority and Daniel Guagnin of the
Technische Universitat Berlin (DE).
Marie-Helene Boulanger repeated the objectives of the revision:
Strengthening of individual rights, enhancing harmonization,
reinforcement of the data controller’s responsibility, a better
integration of the 3rd pillar ( police and judiciary), and improvement
of international data transfers.
The most interesting and provocative statement was made by Jacob
Kohnstamm. He warned against puttng a disproportionate burden on the
consumer by requiring his/her consent in a increasingly complex online
ecosystem, that the consumer does not fully understand. He asked instead
for more responsibility and accountability of the data controllers. He
was very passionate about the fact that there is no other area in law
where those selling products are not responsible for those products, and
does not see why the sale of data should be an exception.
Jim Halpert drew attention to the fact that the EU model is slowing
down business ( four months to receive the authorities’ approval for
model contracts) and suggested Privacy by Design solutions to prevent
problems at the front end.
In the audience, Tanguy Van Overstraeten of Linklaters suggested that
a regulation instead of a directive would provide businesses with the
legal certainty they need for global operations. While a regulation
would be directly and equally binding on all member states,a directive
would have to be implemented by each state individually and would
inevitably lead to lack of harmonization and applicable law problems.
Peter Hustinx, in his recent opinion reviewed in this
post , indeed recommended a regulation and not a directive.
Cloud Computing and
Privacy Impact Assessments were other topics that provoked lively discussions on the panels as well as in the audience.
During the conference,
EPIC presented the 2011 International Privacy Champion Award to European Parliament Member
Sophie in’t Veld and the 2011 Domestic Privacy Champion Award to
Jeff Chester, founder and executive director of the
Center for Digital Democracy.
In’t Veld was recognized for her work as “leading defender of
fundamental freedoms,” Chester as a “tireless champion of consumer
rights.”
Privacy International,
EPIC , and the
Center for Media and Communications Studies (CMSC) released
“European Privacy and Human Rights (EPHR) 2010,”
during the CPDP conference. The EPHR is a report investigating the
scope of privacy and data protection laws a in Europe. The study
includes 33 individual reports covering issues from privacy enforcement
to ID cards, biometrics, and data-sharing and video surveillance The
study ranks privacy protection across the European Union (EU). This blog
posted a few months ago an
interview of Cédric Laurant, one of the contributors to the massive report.
The conference ended with an inspiring address by Peter Hustinx, the European Data Protection Supervisor.
January 30th, 2011 by Monique Altheim
According to its mission statement, the annual conference “
Computers, Privacy and Data Protection“ in
Brussels aims to create a bridge between policy makers, academics,
practitioners and activists, and aims to become Europe’s most important
forum for the discussion of data protection and privacy issues.
The conference was held on the occasion of the annual
Data Protection Day
on January 28, celebrated in Europe to commemorate the signing of
Convention 108 in 1981, and coopted in 2009 in the US as the annual “
Data Privacy Day“, even though the US is not a signatory to convention 108.
The theme of the convention was: “European Data Protection: In Good
Health?” and the first day of the three day conference was indeed
entirely devoted to eHealth privacy issues.
The catalyst for this choice was the acceptance on March 15 2010 by
the member states of the Barcelona Declaration “European co-operation on
eHealth.”
In the EU, there is no specific legislation targeting healthcare
data, because these data are already covered by the comprehensive Data
Protection Directive.
Some member states, like Finland, Sweden, Denmark, Estonia and France have enacted specific eHealth legislation.
In the US, healthcare data are protected, on the Federal level, by
HIPAA.
Deborah Peel from
Patient Privacy Rights
deplored how in the US, HIPAA basically allows Health Plans, Healthcare
Clearing Houses and Healthcare Providers who transmit health
information in electronic form (the so-called “covered entities”) to
decide how to use Protected Health Information (PHI) without the
patient’s consent.
She estimated the number of “covered entities” who have access to US
health records and who are allowed to transfer them at 4 million.
As a consequence, there is a huge market for health records in the
US, and apparently 35% of Fortune 500 companies have admitted using
purchased medical records for hiring and promotion purposes.
Moreover, even the minimal privacy safeguards that are provided by HIPAA are not being enforced by HHS.
Deborah cited an
interesting case currently before the
U.S. Supreme Court, which agreed to decide whether state laws
prohibiting “data mining” companies from marketing information about
doctors’ drug prescriptions violate free speech rights.
(Author’s note: Hippocrates must be rolling over in his grave. Part
of the Hippocratic oath says: “What I may see or hear in the course of
treatment or even outside of the treatment in regard to the life of men,
which on no account one must spread abroad, I will keep myself holding
such things shameful to be spoken about.” )
The numerous EU panels identified and discussed many of the issues in eHealth privacy today:
- Patient-Doctor confidentiality should remain a key factor. If
patients lose trust in the confidentiality of their condition, they will
refrain from seeking proper medical care, especially for certain
conditions with stigmas stiill attached to them, like aids or many
psychiatric disorders.
- The security of eHealth data should be guaranteed.
- The access rights of patients to their medical records should be clear and enforced.
- The ownership of medical records should be clarified: Is the owner
the patient, the doctor, is there joint ownership, no ownership? Polls
indicate that as to the question of ownership of medical data, the
majority votes in favor of patients being the rightful owners of their
medical data.
- Informed consent by patients for transfer of medical data to third parties.
- The right of patients to determine who gets access to their data.
-The need to find the right balance between patients’ right of
control over their PHI and the obvious health benefits of sharing PHI:
The benefits of sharing patients’ PHI among seperate healthcare
providers and different treating hospitals are evident: better
coordination of healthcare and more efficient and personalized
treatments for the patients.
Finding a solution to better semantic interoperability between
healthcare providers without sacrificing privacy was identified as one
of the key issues of the day.
For example, in France, a patient has a right to mask his data and
also a right to mask the fact that the data were masked. While this is a
nice exercise in self-determination by the patient, it also results in a
total lack of trust in eHealth records by the healthcare providers.
Many organizations such as
epSOS ,
IDRC,
EHTEL, and
ENISA are involved in research to find solutions for these problems.
Privacy by Design, Privacy Enhancing Technologies and more recently,
Transparency Enhancing Tools (TETs) were often cited as possibly
providing solutions to what many believe is an information governance
issue.
-The dangers, as well as the benefits of sharing private health data on online social networking sites like
patientslikeme
were emphasized and the implications of doctors emailing and texting
their patients on their mobile phones were pointed out. Today, an
iPhone ECG 
/EKG electrode can be attached to the iPhone for $100, measure a
person’s ECG/EKG and send the results to the physician’s office via
WIFI. Tele-health and e-prescriptions are a reality.
Health data posted or sent online are being data mined by marketers
and data brokers and, just like the sale of off-line health data bases,
these practices pose serious risks to the credit worthiness, employment
chances and insurability of patients.
As David Garwood, director of EHTEL, so eloquently stated: “We are
becoming digital maps, bits and bytes, to be sold to the highest
bidder…The system has to work for the benefit of the patient rather than
than the patient working for the benefit of the system.”
I believe Hippocrates would have agreed.
January 28th, 2011 by Monique Altheim
January 21st, 2011 by Monique Altheim
January 19th, 2011 by Monique Altheim
The
European Data Protection Supervisor, Peter Hustinx, has published his
opinion in response to the Commission’s Communication regarding the
review of the personal data protection legal framework on his
website yesterday, while it was published on
this website one day before.
The EDPS recommends that the new legal instrument should be a
regulation instead of a directive in order to ensure greater
harmonisation of data protection in all member states. The current
personal data protection legal framework is grounded on a directive,
the Directive 95/46/EC, which has been implemented, with many
variations, into the national laws of the member states of the EU.This
has led to a lack of harmonisation in EU personal data protection law. A
regulation, on the other hand, would become immediately enforceable as
law in all member states simultaneously without the need for each state
to implement it into its national law and thus a regulation would ensure
greater uniformity of data protection in all member states.
While the EDPS agrees with the Commission’s recommendations of
November 4, 2010 on most points, he does propose more ambitious
approaches on many others.
For a comprehensive analysis of the opinion of the EDPS of Januaty
14, 2011 on the Communication from the Commission regarding “A
comprehensive approach on personal data protection in the European
Union”, click
here .
January 18th, 2011 by Monique Altheim
The European Data Protection Supervisor, Peter Hustinx, has issued an
opinion in response to the Commission’s Communication of November 4, 2010 regarding the
Review of the Data Protection Legal Framework .
The EDPS agrees with the Commission that a review of the present
legal framework for data protection in the EU is necessary in order to
ensure effective protection in a further developing information society.
On the other hand, the EDPS believes that a more ambitious approach
than the one proposed by the Commission would lead to a more effective
system.
The EDPS identifies four main drivers determining the environment in which the review process takes place:
- Technological development: The technological
developments like cloud computing, behavioural advertising, social
networks etc.., since Directive 95/46 was adopted .
- Globalisation: The abolition of trade barriers has
given rise to an increase in international and cross border data
transfers and the development of the internet and cloud computing has
allowed processing of data on a worldwide scale. The increase of
terrorism and other forms of international organised crime, has caused
an increase in international judicial activities, supported by an
enormous exchange of information for law enforcement purposes.
- The Lisbon Treaty: The abolition of the pillar
structure obliges the European Parliament and Council to provide for
data protection in all areas of EU law, and in the public sector as well
as in the private sector. Article 16 TFEU also contains an individual
right of the data subject.
- The parallel developments in international organisations, like the OECD, and the adoption of international standards.
The EDPS then states the importance of data protection: it fosters
trust and must support other (public) interests, such as a strong
European economy, the security of individuals, as well as the
accountability of governments.
It sees a comprehensive legal instrument for data protection
including police and judicial cooperation in criminal matters as one of
the main improvements a new legal framework can bring.
According to the EDPS, a general legal instrument for data protection
must be formulated in a technologically neutral way. This implies that
the rights and obligations of the various actors are to be formulated in
a general and neutral way so as to remain, in principle, valid and
enforceable irrespective of the technology chosen for processing
personal data. The EDPS suggests introducing new ‘technologically
neutral’ rights on top of the existing principles of data protection
which could have a specific importance in the rapidly changing
electronic environment
The EDPS the proceeds to make the following recommendations in order to achieve above mentioned goals:
1. Comprehensive approach:
The EDPS fully supports the comprehensive approach on data protection
which is not only the title but also the point of departure of the
Communication and necessarily includes the extension of the general
rules on data protection to police and judicial cooperation in criminal
matters. But, contrary to the suggestion of the Commission, the EDPS
believes that data processing by EU institutions should also be included
in the framework. He also reminds the Commission to include data
protection in the Common Foreign and Security Policy, sector specific
data protection regimes for EU bodies such as Europol and Eurojust, and
the ePrivacy Directive 2002/58.
2. Harmonisation:
The EDPS believes that further and better
harmonisation of the implementation of the Directive by the Member
States is one of the principal objectives of the review process. He
specifies the following areas that need more harmonisation: Definitions;
Lawfulness of processing; Grounds for data processing; Data subject
rights; International transfers (BCR); National Data Protection
Authorities; The EDPS also agrees withthe Commission that a harmonised
system of notification requirements would reduce costs as well as
administrative burden for data controllers and suggests a standard
pan-European notification form.
Finally, the EDPS believes that the review process is also an
opportunity to reconsider the type of legal instrument for data
protection.
The EDPS recommends
Regulation, not a directive! “A
Regulation, a single instrument which is directly applicable in the
Member States, is the most effective means to protect the fundamental
right to data protection and to create a real internal market where
personal data can move freely and where the level of protection is equal
independently of the country or the sector where the data are
processed …The choice for a Regulation as a general instrument allows,
where necessary, provisions directly addressed to Member States where
flexibility is needed. It also does not influence the competence of
Member States to adopt additional rules for data protection, where
needed, in conformity with EU law.
3. Strenghtening the rights of individuals:
In light of the increasing encroachment on individuals’ privacy by
third parties online for purposes of targeting advertisements, e.g
through data mining, and web tracking, the EDPS advocates including an
explicit principle of transparency,
as well as strenghtening existing provisions.For example, a provision
could render illegal privacy policies which are opaque or difficult to
understand.
The EDPS also supports the obligation to report
security breaches, suggests additional rules to clarify the concept of informed , unambiguous
consent,
data portability and the
right to be forgotten. The
right to be forgotten could be implemented by attaching an obligatory
expiration date to the data, a concept that is already applied to e.g.
criminal records.
The EDPS suggests the adoption of specific provisions pertaining to the processing of personal data relating to
children, e.g. a specific provision protecting children against behavioural advertising, as well as the introduction of
consumer collective redress mechanisms. (class actions).
4. Strenghtening the role of organisations/controllers:
The EDPS favors inserting a general provision on
accountability of controllers. This would stimulate controllers to put
into place proactive measures, such as internal control mechanisms, in
order to be able to comply with all the elements of data protection law.
The EDPS is of the opinion that demonstrating compliance to the
public at large should, in certain cases, also be made mandatory. This
could be done for instance, by requiring controllers to include data
protection in public (annual) reports.
The EDPS suggests codification of the
Privacy by Design
principle, and considers it to be an accountability issue. “Privacy by
design refers to the integration of data protection and privacy from the
very inception of new products, services and procedures that entail the
processing of personal data…More specifically, the provision would
explicitly require data controllers to implement technical and
organization measures, both at the time of the design of the processing
system and at the time of the processing itself, particularly in order
to ensure the protection of personal data and prevent any unauthorized
processing.” The EDPS considers, on top of that, creating a separate
obligation addressed to designers and manufacturers of new products and
services with likely impact on privacy and data protection. The EDPS
supports the Commission’s idea of EU certification schemes for privacy
compliant products and services.
5. Globalisation and applicable law:
In order to find a solution to the conundrum of applicable law ( see this
previous post
), the EDPS favors the development of international rules, such as the
“Madrid Standards”. Meanwhile, until such standards will be adopted, the
EDPS suggests clarification of the criteria determining applicable law.
The EPDS proposes that EU law is applicable when personal data are
processed outside the borders of the EU, but where there is a
justified claim
of applying EU law. “The example of non European cloud computing
services targeted to EU residents is an illustration why this is needed.
In an environment where data are not physically stored and processed in
a fixed location, where service providers and users located in
different countries have interfering influence on data, it is very
difficult to identify who is responsible for complying with which data
protection principles.” But if the legal instrument is a Regulation,
applicable uniformly to all Member States, the need for complicated
applicable law rules becomes less urgent. This is one of the reasons why
the EDPS strongly favours the adoption of a Regulation.
The EDPS also fully supports the objective of the Commission to
streamline current procedures for international data transfer,
especially for Binding Corporate Rules. (BCR).
6. The area of Police and Justice:
As mentioned above, the EDPS believes that the area
of police and judicial cooperation should be included in the general
instrument. For example, DPAs will have the same extensive and
harmonised powers vis-Ã -vis police and judicial authorities as they have
vis-Ã -vis other data controllers. This would not exclude necessary and
proportionate special rules. Special safeguards for the protection of
the individual should be introduced, such as in relation to the
processing of biometric and genetic data in the field of law
enforcement.
7. DPAs and the cooperation between DPAs:
The EDPS supports the Commission’s suggestion to
strengthen the independence, resources and enforcement powers of DPAs.
In addition, the EDPS suggests codifying a definition of independence
into the new law, as well as a requirement that they be given
sufficient human and financial resources in order to make this
independence possible. The EDPS encourages more cooperation between the
DPAs in enforcement actions, with the help of the Article 29 Working
Party. The EDPS also aims for more independence and more authoritative
powers for the Working Party.
January 17th, 2011 by Monique Altheim
The EDPS (European Data Protection Supervisor), Peter Hustinx, has given his opinion regarding the
Review of the Data Protection Legal Framework on January 14.
Here is the text:
Opinion of the European Data Protection Supervisor on
the Communication from the Commission to the European Parliament, the
Council, the Economic and Social Committee and the Committee of the
Regions – “A comprehensive approach on personal data protection in the
European Union”
Table of Content
A. GENERAL PART
1. Introduction
1.1. A first and general assessment
1.2. Aim of the opinion
1.3. The building blocks of this opinion
2. Context
3. Main perspectives
3.1. Data protection fosters trust and must support other (public) interests
3.2. Consequences for the legal framework on data protection
B. ELEMENTS OF A NEW FRAMEWORK
4. Comprehensive approach
5. Further harmonisation and simplification
5.1. The need for harmonisation
5.2. Reducing the margin of manoeuvre in the implementation
5.3. Areas for further harmonisation 5.4. Simplification of the notification system
5.5. A Regulation, not a Directive
6. Strengthening the rights of individuals
6.1. The need for strengthening the rights
6.2. Increasing transparency
6.3. Support for an obligation to report security breaches
6.4. Reinforcing consent
6.5. Data portability and the right to be forgotten
6.6. Processing of personal data related to children
6.7. Collective redress mechanisms
7. Strengthening the role of organisations/controllers
7.1. General
7.2. Reinforcing data controllers’ accountability
7.3. Privacy by design
7.4. Certification services
8. Globalisation and applicable law
8.1. A clear need for more consistent protection
8.2. Investing in international rules
8.3. Clarifying applicable law criteria
8.4. Streamlining mechanisms for data flows
9. The Area of police and justice
9.1. The general framework
9.2. Additional specific rules for police and justice
9.3. Sector specific data protection regimes
10. DPAs and the Cooperation between DPAs
10.1. Reinforcing the role of DPAs 10.2. Strengthening the role
of the Working Party 10.3. The advisory role of the Working Party 10.4.
Coordinated enforcement by the Working Party 10.5. Cooperation between
the EDPS and the Working Party 10.6. Cooperation between the EDPS and
the DPAs in supervision on EU systems
C. HOW TO IMPROVE APPLICATION OF PRESENT FRAMEWORK?
11. The short term (§§ 161-166)
D. CONCLUSIONS
Opinion of the European Data Protection Supervisor
on the Communication from the Commission to the European
Parliament, the Council, the Economic and Social Committee and the
Committee of the Regions – “A comprehensive approach on personal data
protection in the European Union”
THE EUROPEAN DATA PROTECTION SUPERVISOR,
Having regard to the Treaty on the Functioning of the European Union, and in particular its Article 16,
Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Articles 7 and 8,
Having regard to Directive 95/46/EC of the European Parliament and of
the Council of 24 October 1995 on the protection of individuals with
regard to the processing of personal data and on the free movement of
such data1,
Having regard to Regulation (EC) No 45/2001 of the European
Parliament and of the Council of 18 December 2000 on the protection of
individuals with regard to the processing of personal data by the
Community institutions and bodies and on the free movement of such
data2, and in particular its Article 41,
HAS ADOPTED THE FOLLOWING OPINION
A. GENERAL PART
1. Introduction
1.1. A first and general assessment
1. On 4 November 2010, the Commission adopted a Communication
entitled “A comprehensive approach on personal data protection in the
European Union” (the “Communication”)3. The Communication was sent to
the EDPS for consultation. The EDPS welcomes the fact that he was
consulted by the Commission in accordance with Article 41 of Regulation
(EC) No. 45/2001. Already before the adoption of the Communication the
EDPS was given the possibility to give informal comments. Some of these
comments have been taken into account in the final version of the
document.
2. The Communication intends to lay down the Commission’s approach
for the review of the EU legal system for the protection of personal
data in all areas of the Union’s activities, taking account, in
particular, of the challenges resulting from globalisation and new
technologies.4
3. The EDPS welcomes the Communication in general, as he is convinced
that a review of the present legal framework for data protection in the
EU is necessary, in order to ensure effective protection in a further
developing information society. Already in his Opinion of 25 July 2007
on the Implementation of the Data Protection Directive5 he concluded
that in the longer term, changes of Directive 95/46/EC seem unavoidable.
4. The Communication represents an important step towards such a
legislative change which in turn would be the most important development
in the area of EU data protection since the adoption of Directive
95/46/EC which is generally considered as the main cornerstone of data
protection within the European Union (and wider within the European
Economic Area).
5. The Communication gives the right framework for a well targeted
review, also because it identifies – generally spoken – the main issues
and challenges. The EDPS shares the view of the Commission that a strong
system of data protection will still be needed in the future, based on
the notion that existing general principles of data protection are still
valid in a society which undergoes fundamental changes due to rapid
technological developments and globalisation. This requires reviewing
existing legislative arrangements.
6. The Communication rightly emphasises that the challenges are
enormous. The EDPS fully shares this statement and underlines the
consequence that the proposed solutions should be correspondingly
ambitious and should enhance the effectiveness of the protection.
1.2. Aim of the opinion
7. This opinion assesses the proposed solutions in the Communication
on the basis of these two criteria: ambition and effectiveness. Its
perspective is positive in general. The EDPS supports the Communication,
but is at the same time critical on aspects where in his view more
ambition would lead to a more effective system.
8. The EDPS aims to contribute with this opinion to the further
development of the legal framework on data protection. He looks forward
to the Proposal of the Commission which is expected by mid 2011 and
hopes that his suggestions will be taken into account in the wording of
this proposal. He also notes that the Communication seems to exclude
certain areas, such as data processing by EU institutions and bodies,
from the general instrument. If the Commission would indeed decide to
leave out certain areas at this stage – which the EDPS would regret – he
urges the Commission to commit itself to realise a fully comprehensive
architecture within a short and specified timeframe.
1.3. The building blocks of this opinion
9.This opinion does not stand alone. It is based on earlier positions
taken by the EDPS and by the European data protection authorities on
various occasions. In particular, it must be underlined that in the
already mentioned EDPS Opinion of 25 July 2007 some main elements for
future change were identified and developed.6 It is also based on
discussions with other stakeholders in the areas of privacy and data
protection. Their contributions offered a very useful background for
both the Communication and this opinion. In this regard, it can be
concluded that there exists a level of synergy on how to improve
effectiveness of data protection.
10. Another important building block of this Opinion is the document
called ‘The Future of Privacy’, the Joint contribution of the Article 29
Data Protection Working Party and the Working Party on Police and
Justice to the Consultation launched by the Commission in 2009 (the “WP
document on the Future of Privacy”).7
11. More recently, at a Press Conference on 15 November 2010, the
EDPS gave his first reactions on the present Communication. This opinion
elaborates the more general views brought forward during this Press
Conference.8
12. Finally, this Opinion profits from a number of earlier EDPS
Opinions, as well as from documents of the Article 29 Data Protection
Working Party. References to those opinions and documents can be found
in various places of this opinion, where relevant.
2. Context
13.The review of data protection rules occurs at a crucial historical
moment. The Communication describes the context extensively and in a
convincing way. Based on this description the EDPS identifies the four
main drivers determining the environment in which the review process
takes place.
14. The first driver is technological development. Today’s technology
is not the same as when Directive 95/46 was conceived and adopted.
Technological phenomena like cloud computing, behavioural advertising,
social networks, road toll collecting and geo-location devices
profoundly changed the way in which data are processed and pose enormous
challenges for data protection. A review of European data protection
rules will have to address these challenges effectively.
15. The second driver is globalisation. The progressive abolition of
trade barriers has given businesses an increasing worldwide dimension.
Cross border data processing and international transfers have
tremendously increased over the past years. Furthermore, data processing
has become ubiquitous due to Information and Communication
Technologies: internet and cloud computing allowed delocalised
processing of large quantities of data on a worldwide scale. The last
decade also witnessed an increase in international police and judicial
activities to fight terrorism and other forms of international organised
crime, supported by an enormous exchange of information for law
enforcement purposes. All this calls for a serious consideration of how
personal data protection can be ensured effectively in the globalised
world without substantially hampering international processing
activities.
16. The third driver is the Lisbon Treaty. The entry into force of
the Lisbon Treaty marks a new era for data protection. Article 16 TFEU
not only contains an individual right of the data subject, but also
provides a direct legal basis for a strong EU-wide data protection law.
Furthermore, the abolition of the pillar structure obliges the European
Parliament and Council to provide for data protection in all areas of EU
law. In other words, it allows for a comprehensive legal framework for
data protection applicable to the private sector, the public sector in
the Member States and the EU institutions and bodies. The Stockholm
Programme9 consistently states in this regard that the Union must secure
a comprehensive strategy to protect data within the EU and in its
relations with other countries.
17. The fourth driver is represented by parallel developments taking
place in the context of international organisations. There are various
ongoing debates focussing on the modernisation of the current legal
instruments for data protection. It is important to mention in this
respect the current reflections undertaken in relation to the future
revision of Convention 108 of the Council of Europe10 and of the OECD
Privacy Guidelines.11 Another important development regards the adoption
of international standards on the protection of personal data and
privacy, which might possibly lead to the adoption of a binding global
instrument on data protection. All these initiatives deserve full
support. Their common goal should be ensuring effective and consistent
protection in a technologically driven and globalised environment.
3. Main perspectives
3.1. Data protection fosters trust and must support other (public) interests
18. A strong framework for data protection is the necessary
consequence of the importance given to data protection under the Lisbon
Treaty, in particular in Article 8 of the Charter of the Fundamental
Rights of the Union and Article 16 TFEU, as well as the strong link with
Article 7 of the Charter.12
19. However, a strong framework for data protection also serves wider
public and private interests in an information society with ubiquitous
data processing. Data protection fosters trust, and trust is an
essential component of the well functioning of our society. It is
essential that arrangements for data protection are construed in a way
that they – as much as possible – actively support rather than hamper
other legitimate rights and interests.
20. Important examples of other legitimate interests are a strong
European economy, the security of individuals, as well as the
accountability of governments.
21. Economic development in the EU goes hand in hand with the
introduction and the marketing of new technologies and services. In the
information society the emergence and successful deployment of
information and communications technologies and services depends on
trust. If people do not trust ICT, these technologies are likely to
fail.13 And people will only trust ICT if their data are efficiently
protected. Therefore, data protection should be an integral part of
technologies and services. A strong framework for data protection
fosters the European economy, provided that this framework is not only
strong but also tailored in the right way. Further harmonisation within
the EU and minimisation of administrative burdens are in this
perspective essential (see Chapter 5 of the opinion).
22. Much has been said in recent years about the need for balancing
privacy and security, especially in relation to instruments for data
processing and exchange in the area of police and judicial
cooperation.14 Data protection was quite often wrongly characterised as
an obstacle to fully protecting the physical security of individuals15,
or at least as an unavoidable condition to be respected by law
enforcement authorities. However, this is not the whole story. A strong
framework of data protection can sharpen and strengthen security. On the
basis of principles of data protection – when applied well –
controllers are obliged to ensure that information is accurate and up to
date, and that superfluous personal data that are not necessary for law
enforcement are eliminated from the systems. One can equally point to
obligations to implement technological and organisational measures to
ensure the security of systems such as protecting systems against
unauthorised disclosure or access, as developed in the field of data
protection.
23.Respecting principles of data protection may further ensure that
law enforcement authorities operate under the rule of law which triggers
trust in their behaviour and therefore fosters in a wider sense trust
in our societies. The case law developed under Article 8 of the European
Convention of Human Rights ensures that police and judicial authorities
can process all data relevant for their work, but not in an unlimited
manner. Data protection requires checks and balances (see on police and
justice Chapter 9 of the opinion).
24. In democratic societies governments are accountable for all their
activities, including for their use of personal data for the different
public interests they serve. This varies from publication of data on the
internet for reasons of transparency, to the use of data as a support
of policies in areas like public health, transport or taxation, or the
surveillance of individuals for law enforcement purposes. A strong data
protection framework allows governments to respect their
responsibilities and to be accountable, as part of good governance.
3.2. Consequences for the legal framework on data protection
3.2.1. Further harmonisation is needed
25. The Communication rightly identified that one of the essential
shortcomings of the current framework is that it leaves too much
discretion to the Member States in the implementation of the European
provisions into national law. Lack of harmonisation has a number of
negative consequences in an information society where the physical
borders between the Member States are less and less relevant (see
Chapter 5 of the opinion).
3.2.2. General principles of data protection still remain valid
26. A first and more formal reason why the general principles of data
protection should and could not be changed is of a legal nature. These
principles are laid down in Council of Europe Convention 108 which is
binding on all the Member States. This Convention is the basis of data
protection in the EU. Moreover, some of the main principles are
explicitly mentioned in Article 8 of the Charter of the Fundamental
rights of the Union. Changing of these principles would thus require
changing the Treaties.
27. However, this is not the full story. There are also substantial
reasons not to change the general principles. The EDPS strongly believes
that an information society can and should not function without an
adequate protection of privacy and personal data of individuals. When
more information is being processed, also better protection is needed.
An information society where abundant amounts of information about
everyone are being processed needs to be built on the concept of control
by the individual, in order to allow him or her to act as an individual
and to use his freedoms in a democratic society such as the freedoms of
expression and speech.
28. Furthermore, it is difficult to imagine control of the individual
without obligations on controllers to limit processing in accordance
with principles of necessity, proportionality and purpose limitation. It
is equally difficult to imagine control by the individual in the
absence of recognised data subjects’ rights, such as the rights of
access, rectification, erasure or blocking of data.
3.2.3. Fundamental rights perspective
29. The EDPS underlines that data protection is recognised as a
fundamental right. This does not mean that data protection should always
prevail over other important rights and interests in a
democratic society, but it does have consequences for the nature and
scope of the protection that must be given under an EU legal framework,
so as to ensure that data protection requirements are always
adequately taken into account.
30. These main consequences can be defined as follows:
• Protection must be effective. A legal framework must provide for
instruments that make it feasible for individuals to exercise their
rights in practice.
• The framework must be stable over a long period.
• Protection must be given under all circumstances and not depend on the political
preferences in a certain timeframe.
• Limitations to the exercise of the right may be needed, but they must be
exceptional, duly justified and never affect the essential elements of the right
itself.16 The EDPS recommends that the Commission take these consequences into account when proposing legislative solutions.
3.2.4. New legislative arrangements are needed
31. The Communication rightly concentrates on the need for
strengthening the legislative arrangements for data protection. In this
context, it makes sense to recall that in the WP document on the Future
of Privacy17 the Data Protection Authorities emphasised the need for
stronger roles for the different actors in the field of data protection,
notably the data subjects, the data controllers and the supervisory
authorities themselves.
32. There seems to be a wide consensus amongst stakeholders that
stronger legislative arrangements – taking into account technological
developments and globalisation – are the key towards ambitious and
effective data protection also in the future. As already indicated in
point 7, these are the criteria for the assessment of the EDPS of any
proposed solutions.
3.2.5. Comprehensiveness as a conditio sine qua non
33. As recalled in the Communication, Directive 95/46 applies to all
personal data processing activities in Member States in both the public
and the private sectors, with exception of activities which fall outside
the scope of former Community law18. Whilst this exception was needed
under the former Treaty, this is no longer the case after the entry into
force of the Lisbon Treaty. Moreover, the exception is contrary to –
the text and in any event the spirit of – Article 16 TFEU.
34. According to the EDPS, a comprehensive legal instrument for data
protection including police and judicial cooperation in criminal matters
must be seen as one of the main improvements a new legal framework can
bring. It is a
conditio sine qua non for effective data protection in future.
35. The EDPS highlights the following arguments in support of this statement:
• The distinction between activities of the private sector and of the
law enforcement sector is blurring. Private sector entities may process
data which are ultimately used for law enforcement purposes (example:
PNR data19), whilst in other cases, they are required to keep data for
law enforcement purposes (example: Data Retention Directive20).
• There is no fundamental difference between police and judicial
authorities and other authorities delivering law enforcement (taxation,
customs, anti-fraud, immigration) subject to Directive 95/46
. • As accurately described in the Communication, the data protection
legal instrument currently applicable to police and judicial
authorities (Framework Decision 2008/97721) is inadequate.
• Most Member States have implemented Directive 95/46 and Convention
108 in their national legislations, making them applicable also to their
police and judicial authorities.
36. Including police and justice in the general legal instrument
would not only offer more guarantees to citizens but also make the task
of police authorities easier. Having to apply various sets of rules is
cumbersome, needlessly time-consuming and stands in the way of
international cooperation (see further Chapter 9 of the opinion). This
also argues for including the processing activities by national security
services, in so far as this is possible under the current state of EU
law.
3.2.6. Technological neutrality
37. The period since the adoption of Directive 95/46 in 1995 can be
characterised as technologically turbulent. New technological
developments and appliances are introduced on a frequent basis. In many
cases this has led to fundamental changes in the way personal data of
individuals are being processed. The information society can no longer
be considered as a parallel environment where individuals can
participate on a voluntary basis, but has become an integrated part of
our day to day lives. Just as an example, the concept of an Internet of
things22 establishes links between physical objects and on line
information related to them.
38. Technology will further develop. This has its consequences for
the new legal framework. It must be effective for a greater number of
years, and at the same time not hamper further technological
developments. This requires that the legal arrangements are
technologically neutral. However, the framework must also bring more
legal certainty for companies and for individuals. They must understand
what is expected from them and be able to exercise their rights. This
requires that the legal arrangements are precise.
39. According to the EDPS, a general legal instrument for data
protection must be formulated in a technologically neutral way, as far
as possible. This implies that the rights and obligations of the various
actors are to be formulated in a general and neutral way so as to
remain, in principle, valid and enforceable irrespective of the
technology chosen for processing personal data. There is no other
choice, given the fast pace of technology advancements nowadays. The
EDPS suggests introducing new ‘technologically neutral’ rights on top of
the existing principles of data protection which could have a specific
importance in the rapidly changing electronic environment (see mainly
Chapters 6 and 7).
3.2.7. Long term: Legal certainty for a longer period
40. Directive 95/46 has been the central piece of data protection in
the EU for the last 15 years. It was implemented in the laws of the
Member States and applied by the different actors. Over the years the
application has profited from practical experiences and from further
guidance given by the Commission, the Data Protection Authorities (on
the national level and in the framework of the Article 29 Working Party)
and national and European Courts.
41. It is good to emphasise that these developments need time and
that – especially since we deal with a general framework giving effect
to a fundamental right – this time is needed to create legal certainty
and stability. A new general legal instrument needs to be drafted with
the ambition that it will be able to create legal certainty and
stability for a longer period, keeping in mind that it is very difficult
to predict how technology and globalisation will further develop. In
any event, the EDPS fully supports the aim to create legal certainty for
a longer period, comparable to the perspective of Directive 95/46. In
short, where technology develops at a fast pace, the law must be stable.
3.2.8. Short term: Make better use of existing instruments
42. In the short term, it is essential to ensure the effectiveness of
existing legislative arrangements, in the first place by concentrating
on enforcement, at national and at EU level (see Chapter 11 of this
opinion).
B. ELEMENTS OF A NEW FRAMEWORK
4. Comprehensive approach
43. The EDPS fully supports the comprehensive approach on data
protection which is not only the title but also the point of departure
of the Communication and necessarily includes the extension of the
general rules on data protection to police and judicial cooperation in
criminal matters.23
44. However, he also notes that the Commission does not intend to
include all data processing activities in this general legal instrument.
In particular, data processing by EU institutions, bodies, offices and
agencies will not be included. The Commission only states that it ‘will
assess the need to adapt other legal instruments to the new general data
protection framework’.
45. The EDPS has a clear preference for including processing on the
EU level in the general legal framework. He reminds that this was the
original intention of the former Art 286 EC which mentioned data
protection for the first time on the level of the Treaty. Article 286 EC
simply stated that legal instruments on the processing of personal data
would apply to the institutions as well. More importantly, one legal
text avoids the risk of discrepancies between provisions and would be
most suitable for data exchange between the EU level and the public and
private entities in the Member States. It would also avoid the risk
that, after modifying Directive 95/46, there is no political interest
any more in amending Regulation 45/2001 or to give this modification
sufficient priority to avoid discrepancies in dates of entry into force.
46. The EDPS urges the Commission – in case it would conclude that
the inclusion of processing at the EU level in the general legal
instrument would not be feasible – to commit itself to propose an
adaptation of Regulation 45/2001 (not to ‘assess the need’) within the
shortest possible timeframe and preferably by the end of 2011.
47. It is equally important that the Commission ensures that other areas do not stay behind, in particular:
• Data protection in the Common Foreign and Security Policy, on the basis of Article 39 TEU.24
• Sector specific data protection regimes for EU bodies such as
Europol, Eurojust and for large scale information systems, in so far as
they need to be adapted to the new legal instrument.
• The ePrivacy Directive 2002/58, in so far as it needs to be adapted to the new legal instrument.
48.Finally, a general legal instrument for data protection may and
probably must be complemented by additional sectoral and specific
regulations, for instance for police and judicial cooperation, but also
in other areas.25 Where needed and in conformity with the principle of
subsidiarity, those additional regulations should be adopted at EU
level. Member States may draw up additional rules, in specific areas
where this is justified (see 5.2).
5: Further harmonisation and simplification
5.1. The need for harmonisation
49.Harmonisation is of paramount importance for EU data protection
law. The Communication correctly stressed that data protection has a
strong internal market dimension, as it must ensure the free flow of
personal data between Member States within the internal market. However,
the level of harmonisation under the present Directive has been judged
as less than satisfactory. The Communication recognises that this is one
of the main recurrent concerns of stakeholders. In particular,
stakeholders stress the need to enhance legal certainty, reduce the
administrative burden and ensure a level playing field for economic
operators. As the Commission rightly notes, this is particularly the
case for data controllers established in several Member States and
obliged to comply with the (possibly diverging) requirements of national
data protection laws.26
50. Harmonisation is not only important for the internal market but
also with a view to ensuring adequate data protection. Article 16 of the
TFEU provides that “everyone” has the right to the protection of
personal data concerning them. In order for this right to be effectively
respected, an equivalent level of protection must be guaranteed
throughout the EU. The WP document on the Future of Privacy highlighted
that several provisions relating to data subjects’ positions have not
been implemented or interpreted uniformly in all Member States27. In a
globalised and interconnected world, these divergences could undermine
or limit the protection of individuals.
51. The EDPS believes that further and better harmonisation is one of
the principal objectives of the review process. The EDPS welcomes the
Commission’s commitment to examine the means to achieve further
harmonisation of data protection at EU level. However, he notes with
some surprise that the Communication does not put forward at this stage
any concrete options. He therefore indicates himself a few areas where
greater convergence is most urgent (see 5.3). Further harmonisation in
these areas should not only be achieved by reducingthe margin of
manoeuvre for national law, but also preventing incorrect implementation
by Member States (see also Chapter 11) and ensuring more consistent and
coordinated enforcement (see also Chapter 10).
5.2. Reducing the margin of manoeuvre in the implementation of the Directive
52. The Directive contains a number of provisions that are broadly
formulated and that therefore leave significant room for diverging
implementation. Recital 9 of the Directive explicitly confirms that
Member States are given a certain margin of manoeuvre and that, within
this margin, disparities could arise in the implementation of the
Directive. Several provisions have been implemented differently by
Member States, including some crucial provisions28. This situation is
not satisfactory and greater convergence should be sought.
53. This does not mean that diversity should be excluded outright. In
certain areas flexibility might be needed in order to preserve
justified specificities, important public interests or the institutional
autonomy of the Member States. According to the EDPS, room for
divergence between the Member States should be limited in particular to
the following specific situations:
• Freedom of expression: under the present framework (Article 9),
Member States may provide for exemptions and derogations in relation to
the processing of data carried out for journalistic purposes or for the
purpose of artistic or literary expression. This flexibility appears
well placed, subject of course to limits in the Charter and ECHR, given
the different traditions and cultural differences that may exist in this
field across Member States. However, this would not stand in the way of
a possible update of the current Article 9 in the light of developments
on the Internet.
• Specific public interests: under the present framework (Article
13), Member States may adopt legislative measures to restrict the scope
of the obligations and rights when such a restriction constitutes a
necessary measure to safeguard important public interest, such as
national security, defence, public security, etc. This competence of
Member States remains justified. However, where possible, the
interpretation of the exceptions should be further harmonised (see
Section 9.1). In addition, the current scope for exception to Article
6(1) appears unduly wide.
• Legal remedies, sanctions and administrative procedures: a European
framework should determine the main conditions, but under the current
state of EU law the determination of sanctions, legal remedies,
procedural rules and the modalities of inspections as applicable at
national level must be left to Member States.
5.3. Areas for further harmonisation
54. Definitions (Article 2 of Directive 95/46). Definitions are the
cornerstone of the legal system and should be uniformly interpreted in
all Member States, with no margin of implementation. Divergences have
arisen under the present framework, like for example as to the notion of
controller29. The EDPS suggests adding further items to the current
list in Article 2 in order to provide for more legal certainty, such as
anonymous data, pseudonymous data, judicial data, data transfer and data
protection officer.
55. Lawfulness of processing (Article 5). The new legal instrument
should be as precise as possible with regard to the core elements
determining the lawfulness of data processing. Article 5 of the
Directive (as well as its Recital 9), mandating Member States to
determine more precisely the conditions under which the processing is
lawful, may thus be no longer needed in a future framework.
56. Grounds for data processing (Article 7 and 8). The definition of
the conditions for data processing is an essential element of any data
protection legislation. Member States should not be allowed to introduce
additional or modified grounds for processing or to exclude any. The
possibility of derogations should be excluded or limited (particularly
with regard to sensitive data30). In a new legal instrument the grounds
for data processing should be clearly formulated, thereby reducing the
margin of appreciation in the implementation or enforcement. In
particular, the notion of consent may need to be further specified (see
Section 6.5). Moreover, the ground based on the legitimate interest of
the data controller (Article 7, letter (f)), gives way to widely
diverging interpretations, due to
57. element its flexible nature. Further specification is needed.
Another provision that possibly must be specified is Article 8(2)(b),
allowing the processing of sensitive data necessary for the purposes of
carrying out the obligations and specific rights of the controller in
the field of employment law31.
58. Data subject rights (Articles 10-15). This is one of the areas in
which not all elements of the Directive have been consistently
implemented and interpreted by Member States. Data subjects’ rights are a
central element for an effective data protection. As a consequence, the
room for manoeuvre should be substantially reduced. The EDPS recommends
that the information provided to data subjects by the controller should
be uniform across the EU.
59. International transfers (Articles 25-26). This is an area which
has given rise to widespread criticism because of the lack of a uniform
practice throughout the EU. Stakeholders criticised that the
Commission’s decisions on adequacy are interpreted and implemented very
differently by the Member States. Binding Corporate Rules (BCRs) are a
further (
area?) where the EDPS recommends further harmonisation (see Chapter 9).
60. National Data Protection Authorities (Article 28). National DPAs
are subject to widely diverging rules in the 27 Member States,
particularly with regard to their status, resources and powers. Article
28 has partly contributed to this divergence because of its lack of
precision32 and should be further specified, in conformity with the
Judgment of the European Court of Justice in Case C-518/0733 (see
further Chapter 10).
5.4. Simplification of the notification system
61. Notification requirements (Article 18-21 of Directive 95/46) are
another field where Member States have so far been granted significant
freedom. The Communication rightly recognises that a harmonised system
would reduce costs as well as administrative burden for data
controllers34.
62. This is an area where simplification should be the main
objective. The review of the data protection framework is a unique
opportunity to further simplify and/or reduce the scope of the current
notification requirements. The Communication recognises that there is a
general consensus amongst stakeholders that the current system of
notifications is rather cumbersome and does not provide, in itself,
added value for the protection of individuals’ personal data.35 The EDPS
thus welcomes the Commission’s commitment to explore different
possibilities for the simplification of the current notification system.
63. In his view, the point of departure of this simplification would
be a shift from a system where notification is the rule, save as
otherwise provided (i.e., “exemption system”), to a more targeted
system. The exemption system proved to be inefficient, as it was
implemented in an inconsistent way across Member States.36 The EDPS
suggests considering the following alternatives:
• Limit the obligation to notify to specific kinds of processing
operations entailing specific risks (these notifications could trigger
further steps such as prior checking of the processing).
• A simple registration obligation requiring data controllers to
register (as opposed to extensive registration of all data processing
operations).
In addition, a standard pan-European notification form could be
introduced so as to ensure harmonised approaches with regard to the
information requested.
64. The review of the current notification system should be without
prejudice to improving prior-checking obligations for certain processing
obligations likely to present specific risks (such as large scale
information systems). The EDPS would favour the inclusion in the new
legal instrument of a non-exhaustive list of cases where such
prior-checking is required. Regulation 45/2001 on the protection of
individuals with regard to the processing of personal data by EU
institutions and bodies provides a useful model for this purpose37.
5.5. A Regulation, not a Directive
65. Finally, the EDPS believes that the review process is also an
opportunity to reconsider the type of legal instrument for data
protection. A Regulation, a single instrument which is directly
applicable in the Member States, is the most effective means to protect
the fundamental right to data protection and to create a real internal
market where personal data can move freely and where the level of
protection is equal independently of the country or the sector where the
data are processed.
66. A Regulation would reduce room for contradictory interpretations
and for unjustified differences in the implementation and the
application of the law. It would also reduce the importance of
determining the law applicable to processing operations within the EU,
which is one of the most controversial aspects of the present system
(see Chapter 9).
67. In the area of data protection a Regulation is all the more justified, since
• Article 16 TFEU has upgraded the right to the protection of
personal data to the Treaty level and envisages – or even mandates – a
uniform level of protection of
individual throughout the EU.
• Data processing takes place in an electronic environment where internal borders
between the Member States have become less relevant.
68. The choice for a Regulation as a general instrument allows, where
necessary, provisions directly addressed to Member States where
flexibility is needed. It also does not influence the competence of
Member States to adopt additional rules for data protection, where
needed, in conformity with EU law.
6. Strengthening the rights of individuals
6.1. The need for strengthening the rights
69. The EDPS fully supports the Communication where it proposes
strengthening individuals’ rights, since existing legal instruments do
not fully deliver the effective protection that is needed in an
increasingly complex digitalized world.
70. On the one hand, the development of a digitalized world entails a
sharp growth in the collection, use and further transfer of personal
data in an extremely complex and non transparent way. Individuals are
often not aware or do not understand how this happens, who collects
their data, nor how to exercise control. An illustration of this
phenomenon is the monitoring by ad network providers of individuals’ web
browsing activities, using cookies or similar devices, for the purposes
of targeted advertising. When users visit web sites, they do not expect
that an out of sight third party logs such visits and creates users’
records, based on information revealing their life style, or what they
like or dislike.
71. On the other hand, the development stimulates individuals
pro-actively sharing their personal information, for example on social
networks. Increasingly young people are part of a social network and
interact with their peers. It is doubtful whether (young) people, are
aware of the breadth of their disclosure and of the long term effects of
their actions.
6.2. Increasing transparency
72. Transparency is of paramount importance in any data protection
regime, not only because of its inherent value but also because it
enables other data protection principles to be exercised. Only if
individuals know about the data processing, they will be able to
exercise their rights.
73. Several provisions in Directive 95/46 deal with transparency.
Article 10 and 11 contain an obligation to give information to
individuals about the collection of their personal data. Moreover,
Article 12 recognizes the right to receive a copy of one’s own personal
data in an intelligible form (right of access). Article 15 recognises
the right to have access to the logic on which automated decisions
producing legal effects are made. Last but not least, Article 6.1(a)
requiring the processing to be fair also entails a transparency
requirement. Personal data cannot be processed for any hidden or secret
reasons.
74. The Communication suggests adding a general principle of
transparency. In reaction to this suggestion, the EDPS underlines that
the notion of transparency is already an integral part of the present
legal framework on data protection, albeit in an implicit way. This can
be deduced from the various provisions dealing with transparency, as
mentioned in the preceding paragraph. According to the EDPS, it could
have added value to include an
explicit principle of
transparency, either or not linked to the existing provision of fair
processing. This would increase legal certainty and also confirm that a
controller should under all circumstances process personal data in a
transparent way, not only on request or when a specific legal provision
requires him to do so.
75. However, it is perhaps more important to reinforce the existing
provisions dealing with transparency, such as the existing Articles 10
and 11 of Directive 95/46. Those provisions specify the information
elements that must be provided, but are not precise on the modalities.
More concretely, the EDPS suggests strengthening the existing provisions
by:
• A requirement for a controller to provide information on data
processing in a manner which is easily accessible and easy to
understand, and in clear and plain language38. The information should be
clear, conspicuous and prominent. The provision could also encompass
the obligation to ensure easy understanding of the information. This
obligation would render illegal privacy policies which are opaque or
difficult to understand.
• A requirement to render the information easily and directly to data
subjects. The information should also be permanently accessible, and
not after a very short time disappear from an electronic medium. This
would help users to store and reproduce information in the future,
enabling further access.
6.3. Support for an obligation to report security breaches
76. The EDPS supports the introduction of a provision on personal
data breach notification in the general instrument, which extends the
obligation which was included in the revised ePrivacy Directive for
certain providers to all data controllers, as proposed in the
Communication. Under the revised ePrivacy Directive the obligation only
applies to providers of electronic communication services (providers of
telephony (including VoIP) service and Internet access). Other data
controllers are not covered by the obligation. The reasons that justify
the obligation fully apply to data controllers other than providers of
electronic communication services.
77. Security breach notification serves different purposes and aims.
The most obvious one, highlighted by the Communication, is to serve as
an information tool to make individuals aware of the risks they face
when their personal data are compromised. This may help them to take the
necessary measures to mitigate such risks. For example, when alerted of
breaches affecting their financial information, individuals will be
able, among other things, to change passwords or cancel their accounts.
In addition, security breach notification contributes to the effective
application of other principles and obligations in the Directive. For
example, security breach notification requirements incentivize data
controllers to implement stronger security measures to prevent breaches.
Security breach is also a tool to strengthen the responsibility of data
controllers and, more in particular to enhance accountability (see
Chapter 7). Finally, it serves as a tool for the enforcement by DPAs.
The notification of a breach to DPAs may lead to an investigation of the
overall practices of a data controller.
78. The specific rules on security breach in the amended ePrivacy
Directive were broadly discussed during the parliamentary phase of the
legislative framework that preceded the adoption of the ePrivacy
Directive. In this debate, the opinions of the Article 29 Working Party
and EDPS were taken into consideration together with the views of other
stakeholders. The rules reflect the views of different stakeholders.
They represent a balance of interests: while the criteria triggering the
obligation to notify are, in principle, adequate to protect
individuals, they do so without imposing overly cumbersome, not useful
requirements.
6.4. Reinforcing consent
79. Article 7 of the Data Protection Directive lists six legal bases
for processing personal data. Consent of the individual is one of them. A
data controller is allowed to process personal data to the extent in
which individuals have given informed consent to have their data
collected and further processed.
80. In practice, often users have limited control in relation to
their data, particularly in technological environments. One of the
methods that is sometimes used is implied consent, which is consent that
has been inferred. It can be inferred from an action of the individual
(e.g. the action consisting in using a web site is deemed as consenting
to log user’s data for marketing purposes). It can also be inferred from
silence or inaction (not un-clicking a ticked box is deemed to be
consent).
81. According to the Directive, for consent to be valid it must be
informed, freely given and specific. It must be an informed indication
of the individuals’ wishes by which he signifies his agreement to
personal data relating to him being processed. The way in which consent
is given must be unambiguous.
82. Consent that has been inferred by an action and more particularly
by silence or inaction is often not an unambiguous consent. However, it
is not always clear what constitutes true, unambiguous consent. Some
data controllers exploit this uncertainty by relying on methods not
suitable to deliver true, unambiguous consent.
83. In light of the above, the EDPS supports the Commission on the
need to clarify the limits of consent and to make sure that only consent
that is construed in a solid way is taken as such. In this context, the
EDPS suggests as follows39:
• It could be considered to broaden the situations where express consent is required, currently limited to sensitive data.
• Adopt additional rules for consent in the on-line environment. •
Adopt additional rules for consent to process data for secondary
purposes (i.e., the
processing is secondary to the main processing or not an obvious
one). • In an additional legislative instrument, either or not adopted
by the Commission under Article 290 TFEU, determine the type of consent
needed, for example, to specify the level of consent on the processing
of data from RFID tags on consumer
products or on other specific techniques.
84. Data portability and the right to be forgotten are two connected
concepts put forward by the Communication to strengthen data subjects’
rights. They are complementary to the principles already mentioned in
the Directive, providing for a right for the data subject to object to
the further processing of his/her personal data, and an obligation for
the data controller to delete information as soon as it is no longer
necessary for the purpose of the processing.
85. These two new notions have mostly added value in an information
society context, where more and more data are automatically stored and
kept for indefinite periods of time. Practice shows that, even if data
are uploaded by the data subject himself, the degree of control he
effectively has on his personal data is in practice very limited. This
is all the more true in view of the gigantic memory the Internet
represents today. Besides, from an economic perspective, it is more
costly for a data controller to delete data than to keep them stored.
The exercise of the rights of the individual therefore goes against the
natural economic trend.
86. Both data portability and the right to be forgotten could
contribute to shift the balance in favour of the data subject. The
objective of data portability would be to give more control to the
individual on his information, while the right to be forgotten would
ensure that the information automatically disappears after a certain
period of time, even if the data subject does not take action or is not
even aware the data was ever stored.
87. More specifically, data portability is understood as the users’
ability to change preference about the processing of their data, in
connection in particular with new technology services. Increasingly,
this applies to services that entail the storage of information,
including personal data, such as mobile telephony and, services that
store pictures, emails, and other information, sometimes using cloud
computing services.
6.5. Data portability and the right to be forgotten
88. Individuals must easily and freely be able to change the provider
and transfer their personal data to another service provider. The EDPS
considers that existing rights set forth in Directive 95/46 could be
reinforced by including a portability right in particular in the context
of information society services, to assist individuals in ensuring that
providers and other relevant controllers give them access to their
personal information while at the same time ensuring that the old
providers or other controllers delete that information even if they
would like to keep it for their own legitimate purposes.
89. A newly codified “right to be forgotten” would ensure the
deletion of personal data or the prohibition to further use them,
without a necessary action of the data subject, but at the condition
that this data has been already stored for a certain amount of time. The
data would in other words be attributed some sort of expiration date.
This principle is already affirmed in national court cases or applied in
specific sectors, for instance for police files, criminal records or
disciplinary files: under some national laws, information about
individuals is automatically deleted or not to be further used or
disseminated, especially after a fixed period of time, without need for a
prior analysis on a case by case basis.
90. In this sense, a new “right to be forgotten” should be connected
to data portability. The added value it would bring is that it would not
require efforts or insistence from the data subject to have his data
deleted, as this should be done in an objective and automated way. Only
in very specific circumstances, where a specific need to keep data
longer could be established, could a data controller be entitled to keep
the data. That “right to be forgotten” would thus reverse the burden of
proof from the individual to the data controller and constitute a
“privacy by default” setting for the processing of personal data.
91. The EDPS considers that the right to be forgotten could prove
especially useful in the context of information society services. An
obligation to delete or not further disseminate information after a
fixed period of time makes sense especially in the media or the
internet, and notably in social networks. It would also be useful as far
as terminal equipments are concerned: data stored on mobile devices or
computers would be automatically deleted or blocked after a fixed period
of time, when they are no more in the possession of the individual. In
that sense the right to be forgotten can be translated in a “privacy by
design” obligation.
92. In sum, the EDPS is of the opinion that data portability and the
right to be forgotten are useful concepts. It could be worthwhile to
include them in the legal instrument, but probably limited to the
electronic environment.
6.6. Processing of personal data related to children
93. Under Directive 95/46 there are no particular rules regarding the
processing of children’s personal data. This does not recognise the
need for a specific protection of children in specific circumstances,
because of their vulnerability, and because it causes legal uncertainty,
particularly in the following areas:
• the collection of children’s data and the way they must be informed about the collection;
• the way children’s consent is obtained. Because there are no
specific rules on how to obtain children’s consent and on the age under
which children should be
considered as such, these subject are dealt with under national law, which differs
from Member State to Member State40; • the way and conditions under which children or their legal representatives can
exercise their rights under the Directive.
94. The EDPS considers that children’s particular interests would be
better protected if the new legal instrument contained additional
provisions, specifically addressed to the collection and further
processing of children’s data. Such specific provisions would also
provide legal certainty in this specific area and they would be to the
benefit of data controllers who are currently exposed to different legal
requirements.
95. The EDPS suggests including the following provisions in the legal
instrument: • A requirement for information to be adapted to children
insofar as this would make it easier for children to understand what it
means when data from them are collected. • Other information
requirements adapted to children, on the manner in which the information
must be provided and possibly also on the content. • A specific
provision protecting children against behavioural advertising. • The
purpose limitation principle should be reinforced as far as children’s
data are concerned. • Some categories of data should never be collected
from children. • An age threshold. Below such threshold, generally
speaking information from children should be collected only with
explicit and verifiable parental consent. • If parental consent is
necessary, it would be necessary to establish rules on how to
authenticate the age of the child, in other words, how to know that the
child is a minor and how to verify parental consent. This is an area
where the EU can draw inspiration from other countries such as the
United States41.
6.7. Collective redress mechanisms
96. Strengthening the substance of individuals’ rights would be
pointless, in the absence of effective procedural mechanisms to enforce
such rights. In this context, the EDPS recommends the introduction in
the EU legislation of collective redress mechanisms for breach of data
protection rules. In particular, collective redress mechanisms
empowering groups of citizens to combine their claims in a single action
might constitute a very powerful tool to facilitate the enforcement of
the data protection rules.42 This innovation is also supported by the
Data Protection Authorities in the WP document on the Future of Privacy.
97. In cases with smaller impact, it is unlikely that the victims of a
breach of data protection rules would bring individual actions against
the controllers, given the costs, delays, uncertainties, risks and
burdens they would be exposed to. These difficulties could be overcome
or substantially alleviated if a system of collective redress were in
place, empowering the victims of breaches to bundle their individual
claims in a single action. The EDPS would also favour the empowerment of
qualified entities, such as consumer associations or public bodies, to
bring actions for damages on behalf of victims of data protection
breaches. These actions should be without prejudice to the right of data
subject to bring individual actions.
98. Not only are collective actions important for ensuring full
compensation or other remedial action; they also perform indirectly a
deterrence enhancing function. The risk of incurring expensive
collective damages in such actions would multiply the controllers’
incentives to effectively ensure compliance. In this regard, an enhanced
private enforcement by means of collective redress mechanisms would
complement public enforcement.
99. The Communication does not take a position regarding this topic.
The EDPS is aware of the ongoing debate at European level on the
introduction of consumer collective redress. He is also conscious of the
risk of excesses that these mechanisms may bring about on the basis of
the experience in other legal systems. However, these factors do not
constitute in his view sufficient arguments to reject or postpone their
introduction in the data protection legislation, in light of the
benefits that they would entail43.
7. Strengthening the role of organisations/controllers
7.1. General
100. The EDPS is of the opinion that, in addition to reinforcing
individuals’ rights, a modern legal instrument for data protection must
contain the necessary tools that enhance the responsibility of data
controllers. More particularly, the framework must contain incentives
for data controllers in the private or public sector to pro-actively
include data protection measures in their business processes. These
tools would in the first place be helpful because, as said before,
technological developments resulted in a sharp growth in the collection,
use and further transfer of personal data which heightens the risks for
the privacy and protection of personal data of individuals which should
be compensated in an effective way. In the second place, the current
framework lacks – except in a few, well- defined provisions (see below) –
such tools and data controllers may take a
reactive approach
to data protection and privacy, and only act after a problem has arisen.
This approach is reflected in statistics that show poor compliance
practices and data losses as recurring problems.
101. According to the EDPS, the existing framework is not enough to
protect personal data effectively under present and future conditions.
The higher the risks, the higher the need to implement concrete measures
that protect information at a practical level and deliver effective
protection. Unless these pro-active measures are
de facto implemented,
mistakes, mishaps and negligence are likely to continue, endangering
individuals’ privacy in this increasingly digital society. To achieve
this, the EDPS proposes the following measures.
7.2. Reinforcing data controllers’ accountability
102. The EDPS recommends inserting a new provision in the legal
instrument requiring data controllers to implement appropriate and
effective measures to put into effect the principles and obligations of
the legal instrument and demonstrate this on request.
103. This type of provision is not entirely new. Article 6 (2) of the
Directive 95/46 refers to the principles relating to data quality and
mentions that “It shall be for the controller to ensure that paragraph 1
is complied with”. Equally, Article 17 (1) requires data controllers to
implement measures, of both a technical and organisational nature.
However, these provisions have a limited scope. Inserting a general
provision on accountability would stimulate controllers to put into
place proactive measures in order to be able to comply with all the
elements of data protection law.
104. A provision on accountability would have the consequence that
data controllers are required to put in place internal mechanisms and
control systems ensuring compliance with the principles and obligations
of the framework. This would require, for example, involving the highest
management in data protection policies, mapping procedures to ensure
proper identification of all data processing operations, having binding
data protection policies which should also be continually reviewed and
updated to cover new data processing operations, complying with the
principles of data quality, notice, security, access, etc. It would also
require that controllers keep evidence to demonstrate compliance to
authorities on request. Demonstrating compliance to the public at large
should, in certain cases, also be made mandatory. This could be done for
instance, by requiring controllers to include data protection in public
(annual) reports, when such reports are mandatory on other grounds.
105. Obviously, the types of internal and external measures to be
implemented must be appropriate and depend on the facts and
circumstances of each particular case. It makes a difference whether a
controller processes a few hundred customer records consisting merely of
names and addresses or if he processes records of millions of patients,
including their medical history. The same applies to the specific ways
in which the effectiveness of the measures must be assessed. There is a
need for scalability.
106. The general comprehensive data protection legal instrument
should not lay down the specific requirements of accountability but only
its essential elements. The Communication foresees certain elements to
reinforce the responsibility of data controllers, which are very
welcome. More particularly, the EDPS fully supports making data
protection officers and privacy impact assessments mandatory, under
certain threshold conditions.
107. Additionally, the EDPS recommends delegating powers to the
Commission under Article 290 TFEU to supplement the basic requirements
necessary to meet the accountability standard. Using these powers would
enhance data controllers’ legal certainty and harmonize compliance
throughout the EU. In developing such specific instruments, the Article
29 Working Party and the EDPS should be consulted.
108. Finally, the concrete accountability measures to be implemented
by data controllers could also be imposed by data protection authorities
in the context of their enforcement powers. To do so, data protection
authorities should be given new powers enabling them to impose remedial
measures or sanctions. Examples should include setting up internal
compliance programs, to implement privacy by design in specific products
and services, etc. Remedies should only be imposed in so far as they
are appropriate, proportionate and effective to ensure compliance with
applicable and enforceable legal standards.
7.3. Privacy by design
109. Privacy by design refers to the integration of data protection
and privacy from the very inception of new products, services and
procedures that entail the processing of personal data. According to the
EDPS privacy by design is an element of accountability. Accordingly,
data controllers would also be required to demonstrate that they had
implemented privacy by design, where appropriate. Recently, the 32nd
International Conference of Data Protection and Privacy Commissioners
issued a resolution recognising privacy by design as an essential
component of fundamental privacy protection.44
110. Directive 95/46 contains some provisions encouraging privacy by
design45, but does not recognize such obligation explicitly. The EDPS is
pleased with the Communication’s endorsement of privacy by design as a
tool towards ensuring compliance with the data protection rules. He
suggests including a binding provision setting forth a “privacy by
design” obligation, which could build on the wording of Recital 46 of
Directive 95/46. More specifically, the provision would explicitly
require data controllers to implement technical and organization
measures, both at the time of the design of the processing system and at
the time of the processing itself, particularly in order to ensure the
protection of personal data and prevent any unauthorized processing.46
111. On the basis of such a provision data controllers would be
required – inter alia – to ensure that data processing systems are
designed to process as little personal data as possible, to implement
privacy by default settings, for example in social networks, to keeping
individual’s profiles private from others by default and to implement
tools enabling users to better protect their personal data (e.g. access
controls, encryption).
112. The advantages of a more explicit reference to privacy by design can be summarised as follows:
• It would highlight the importance of the principle
per se, as a tool towards ensuring that processes, products and services are designed from the outset with privacy in mind.
• It would reduce privacy abuses and it would minimize the
unnecessary collection of data and empower individuals to exercise real
choices as their personal data. • It would avoid having to put “band
aids” later on in an attempt to fix problems that
may be difficult to repair if not impossible. • it would also
facilitate the effective application and enforcement of this principle
by data protection authorities.
113. The combined effect of this obligation would result in a
stronger demand for privacy by design products and services, which
should give more incentives to industry to meet such demand. It should
be considered, on top of that, to create a separate obligation addressed
to designers and manufacturers of new products and services with likely
impact on data protection and privacy. The EDPS suggests including such
a separate obligation which could further enable data controllers to
comply with their own obligation.
Under the present framework, Recital 46 encourages controllers
implementing such measures, but a recital does of course not have
binding forcen on data protection and privacy. The EDPS suggests
including such a separate obligation which could further enable data
controllers to comply with their own obligation.
114. The codification of privacy by design could be complemented by a
provision setting forth general privacy by design requirements
applicable across sectors, products and services, such as for example,
ensuring user’s empowerment measures, to be adopted pursuant to the
principle.
115. Additionally, the EDPS recommends delegating powers to the
Commission under Article 290 TFEU to – where appropriate – supplement
the basic requirements of privacy by design for selected products and
services. Using these powers would enhance data controllers’ legal
certainty and harmonize compliance throughout the EU. In developing such
specific instruments, the Article 29 Working Party and the EDPS should
be consulted (see in the same way point 106 on accountability).
116. Finally, the data protection authorities should be given the
power to impose remedial measures or sanctions, under similar
restrictive conditions as already mentioned in point 107, where
controllers have clearly failed to take concrete steps in cases where
this would be required.
7.4. Certification services
117. The Communication recognizes the need to explore the creation of
EU certification schemes for privacy compliant products and services.
The EDPS fully supports this aim and suggests including a provision
providing for their creation and possible effect across the EU, which
may be further developed later on in additional legislation. The
provision should complement the provisions on accountability and privacy
by design
118. Voluntary certification schemes would enable verification that a
data controller has put in place measures to comply with the legal
instrument. Furthermore, data controllers – or even products or services
– enjoying the benefit of a certification label are likely to gain a
competitive advantage over others. Such schemes would also help data
protection authorities in their supervision and enforcement role.
8. Globalisation and applicable law
8.1. A clear need for more consistent protection
119. As mentioned earlier in Chapter 2, the transfer of personal data
beyond the EU borders has exponentially grown as a consequence of the
development of new technologies, the role of multinational companies and
the increased influence of governments in the processing and sharing of
personal data on an international scale. This is one of the main
reasons justifying the revision of the current legal framework.
Consequently, this is one of the areas where the EDPS asks for ambition
and effectiveness, since there is a clear need for more consistent
protection where data are processed outside the EU.
8.2. Investing in international rules
120. According to the EDPS more investment is needed in the
development of international rules. More harmonisation with regard to
the level of protection of personal data across the world would
considerably clarify the substance of the principles to be complied
with, and the conditions for transfers of data. These global rules would
need to reconcile the requirement for a high standard of data
protection – including core EU data protection elements – with regional
specificities.
121. The EDPS supports the ambitious work done so far in the
framework of the International Conference of Data Protection
Commissioners to develop and disseminate the so called “Madrid
standards”, with a view to integrate them into a binding instrument and
possibly initiate an intergovernmental conference.47 He calls on the
Commission to take the necessary initiatives to facilitate the
realisation of this objective.
122. In the view of the EDPS it is also important to ensure
consistency between this initiative for international standards, the
current review of the EU data protection framework and other
developments such as the current revision of the OECD Privacy Guidelines
and of Convention 108 of the Council of Europe which is open to
signature by third countries (see also point 17). The EDPS considers
that the Commission has a specific role to play here, in specifying how
it will promote such consistency in the negotiations in the OECD and the
Council of Europe.
8.3. Clarifying applicable law criteria
123. Since full consistency can not easily be achieved, there will –
at least in the near future – remain some diversity between the laws
within the EU and a fortiori beyond EU borders. The EDPS considers that a
new legal instrument will need to clarify the criteria determining
applicable law, and to ensure streamlined mechanisms for data flows as
well as accountability of actors involved in data flows.
124. In the first place the legal instrument should ensure that EU
law is applicable when personal data are processed outside the borders
of the EU, but where there is a justified claim of applying EU law. The
example of non European cloud computing services targeted to EU
residents is an illustration why this is needed. In an environment where
data are not physically stored and processed in a fixed location, where
service providers and users located in different countries have
interfering influence on data, it is very difficult to identify who is
responsible for complying with which data protection principles.
Guidance is being given, especially by data protection authorities, on
how to interpret and apply Directive 95/46 in such cases, but guidance
alone is not enough to ensure legal certainty in this new environment.
125. Within the territory of the EU the need for more precision in
the legal framework and a simplified criterion to determine the law
applicable has been emphasised by the Article 29 Working Party in a
recent opinion.48
126. According to the EDPS, the preferred option would be to lay down
the legal instrument in a Regulation which would lead to identical
rules applicable in all Member States. A regulation would make the need
of determining applicable law less important. This is one of the reasons
why the EDPS strongly favours the adoption of a Regulation. However,
also a Regulation could allow some margin of manoeuvre for the Member
States. If some significant margin of manoeuvre is kept in the new
instrument, the EDPS would support the suggestion from the Working Party
for a shift from a distributive application of different national laws
to a centralised application of a single legislation in all Member
States where a controller has establishments. He also pleads for
more cooperation and coordination between Data Protection Authorities in
transnational cases and complaints (see Chapter 10).
8.4. Streamlining mechanisms for data flows
127. The need for consistency and for a high level benchmark must be
taken into account not only with a view to global data protection
principles, but also with regard to international transfers. The EDPS
fully supports the objective of the Commission to streamline current
procedures for international data transfers and ensure a more uniform
and coherent approach vis-Ã -vis third countries and international
organisations.
128. The mechanism of data flows includes both private sector
transfers, in particular via contractual clauses or Binding Corporate
Rules (BCRs), and transfers between public authorities. BCRs are one of
the elements where a more coherent and streamlined approach would be
desirable. The EDPS recommends addressing conditions for BCRs in an
explicit way in the new legal instrument49, by:
- recognizing explicitly BCRs as tools that provide adequate safeguards;
- providing for the main elements/ conditions for the adoption of BCRs;
- setting forth cooperation procedures for the adoption of BCRs,
including criteria for the selection of a leading supervisory authority
(one stop shop).
9. The Area of police and justice
9.1. The general instrument
129. The Commission has repeatedly highlighted the importance of
strengthening data protection in the context of law enforcement and
crime prevention where the exchange and use of personal information has
significantly intensified. Also the Stockholm Programme, approved by the
European Council, refers to a strong data protection regime as the main
prerequisite for the EU Information Management Strategy in this area.50
130. The review of the general data protection framework is the
perfect occasion to make progress in this respect, in particular since
the Communication rightly describes Framework Decision 2008/977 as
inadequate.51
131. The EDPS argued in section 3.2.5 of this Opinion why the area of
police and judicial cooperation should be included in the general
instrument. Inclusion of police and justice has a number of additional
advantages. It means that the rules will no longer only apply to
cross-border data exchanges52, but also to domestic processing. Adequate
protection in the exchange of personal data with third countries will
be better guaranteed, also with regard to international agreements.
Furthermore, DPAs will have the same extensive and harmonised powers
vis-Ã -vis police and judicial authorities as they have vis-Ã -vis other
data controllers. Finally, the current Article 13, providing for the
Member States’ power to adopt specific legislation to restrict
obligations and rights under the general instrument for specific public
interests, will have to be applied in the same restrictive way as it
applies in other areas. In particular, the specific safeguards provided
for under the general instrument in this field will have to be respected
also in national legislation adopted in the area of police and judicial
cooperation.
9.2. Additional specific rules for police and justice
132. However, such an inclusion does not exclude special rules and
derogations, which duly take account of the specificities of this
sector, in line with Declaration 21 attached to the Lisbon Treaty.
Limitations to the rights of data subjects may be foreseen, but they
have to be necessary, proportionate and not alter the essential elements
of the right itself. It should be emphasized in this context that
Directive 95/46, including its Article 13, currently applies to law
enforcement in various areas (e.g. taxation, customs, antifraud) that
are not fundamentally different from many activities in the area of
police and justice.
133. In addition, specific safeguards need also to be put in place,
in order to compensate the data subject by giving him additional
protection in an area where the processing of personal data may be more
intrusive.
134. In light of the above, the EDPS considers that the new framework
should include at least the following elements, in line with Convention
108 and Recommendation No R (87) 15:
• A distinction between different categories of data and files in
accordance with their accuracy and reliability, endorsing the principle
that data based on facts should be distinguished from data based on
opinions or personal assessment.
• A distinction between various categories of data subjects (criminal
suspects, victims, witnesses, etc.) and files (temporary, permanent and
intelligence files). Specific conditions and safeguards need to be
foreseen for the processing of data of non-suspects.
• Mechanisms to ensure periodic verification and rectification in order to safeguard the quality of the data being processed.
• Specific provisions and/or safeguards may be devised in relation to
the (increasingly relevant) processing of biometric and genetic data in
the field of law enforcement. Their use should be limited only to cases
where no less intrusive means are available which may ensure the same
effect.53
• Conditions for transfers of personal data to non competent
authorities and private parties, as well as for access and further use
by law enforcement authorities of personal data collected by private
parties.
9.3. Sector specific data protection regimes
135. The Communication states that “the Framework Decision does not
replace the various sector-specific legislative instruments for police
and judicial co-operation in criminal matters adopted at EU level, in
particular those governing the functioning of Europol, Eurojust, the
Schengen Information System (SIS) and the Customs Information System
(CIS), which either contain particular data protection regimes, and/or
which usually refer to the data protection instruments of the Council of
Europe”.
136. In the view of the EDPS, a new legal framework should be, as far
as possible, clear, simple and consistent. When there is a
proliferation of different regimes applying to for instance Europol,
Eurojust, SIS and Prüm, compliance with the rules remains or even
becomes more complicated. That is one of the reasons why the EDPS
favours a comprehensive legal instrument for all sectors.
137. However, the EDPS understands that aligning the rules from the
different systems will require considerable work, which has to be
carried out carefully. The EDPS considers that a gradual approach as
mentioned in the Communication makes sense as long as the commitment to
ensuring a high level of data protection in a consistent and effective
way remains clear and visible. To be more concrete:
• In a first stage, the general legal instrument for data protection
should be made applicable to all processing in the area of police and
judicial cooperation, including the adjustments for police and justice
(as meant in 9.2).
• In a second stage, the sector specific data protection regimes
should be aligned with this general instrument. The Commission should
commit itself to adopt proposals for this second stage, within a short
and specified timeframe.
10. DPAs and the Cooperation between DPAs
10.1. Reinforcing the role of DPAs
138. The EDPS fully supports the objective of the Commission to
address the issue of the status of data protection authorities (DPAs),
and more explicitly to strengthen their independence, resources and
enforcement powers.
139. The EDPS also insists on the need to clarify in the new legal
instrument the essential notion of independence of DPAs. The European
Court of Justice has recently taken a decision on this issue in Case
C-518/0754, where it emphasised that independence means the absence of
any external influence. A DPA may seek nor take instructions from
anybody. The EDPS suggests explicitly codifying these elements of
independence in the law.
140. In order to exercise their tasks the DPAs must be given
sufficient human and financial resources. The EDPS suggests including
this requirement in the law.55 He finally stresses the need to make sure
that authorities have fully harmonised powers in terms of investigation
and imposing sufficiently deterring and remedial measures and
sanctions. This would enhance legal certainty for data subjects and for
data controllers.
141. Strengthening the independence, resources and powers of DPAs
should go together with reinforced cooperation at multilateral level,
especially in view of the growing number of data protection issues on a
European scale. The main infrastructure to be used for this cooperation
is obviously the Article 29 Working Party.
10.2. Strengthening the role of the Working Party
142. History shows that, from its start in 1997 until today, the
functioning of the group has evolved. It has grown towards more
independence and may not qualify any more, in practice, as a simple
advisory working party to the Commission. The EDPS suggests further
improvements of the functioning of the Working Party, including of its
infrastructure and its independence.
143. The EDPS believes that the strength of the group is
intrinsically linked with the independence and powers of its members.
The autonomy of the Working Party should be ensured in the new legal
framework, in accordance with the criteria developed for a complete
independence of DPAs by the European Court of Justice in case C-518/07.
The EDPS considers that the Working Party should also be provided with
sufficient resources and budget and a reinforced secretariat, to support
its contributions.
144. With regard to the secretariat of the Working Party, the EDPS
values the fact that it is integrated in the Data Protection Unit of DG
Justice, with the advantage that the Working Party itself can benefit
from efficient and flexible contacts and up-to-date information on data
protection developments. On the other hand, he questions the fact that
the Commission (and more specifically the Unit) is at the same time
member, secretariat and addressee of the Working Party’s opinions. This
would justify more independence of the secretariat. The EDPS encourages
the Commission to assess – in close consultation with stakeholders – how
this independence can best be ensured.
145. Finally, reinforcing the powers for DPAs also requires stronger
powers for the Working Party, with a structure including better rules
and safeguards and more transparency. This will be developed for the
advisory role as well as for the enforcement role of the Working party.
10.3. The advisory role of the Working Party
146. The positions of the Working Party must be effectively
implemented when it comes to its advisory role to the Commission,
especially in relation to the interpretation and application of the
principles of the Directive and other data protection instruments, in
other words to ensure the authoritative character of the Working Party
positions. Further discussion is needed amongst DPAs in order to
identify how to include this in the legal instrument.
147. The EDPS recommends solutions which would make opinions of the
Working Party more authoritative without modifying substantially its way
of functioning. The EDPS suggests including an obligation for the DPAs
and the Commission to
take utmost account of opinions and common positions adopted
by the Working Party, based on the model adopted for the positions of
the Body of European Regulators for Electronic Communications (BEREC)56.
Furthermore, the new legal instrument could give the Working Party the
explicit task to adopt “interpretative recommendations”. These
alternative solutions would give the positions of the Working Party a
stronger role, also before the Courts.
10.4. Coordinated enforcement by the Working Party
148. Under the present framework the enforcement of data protection
law in the Member States is left to 27 Data Protection Authorities with
little coordination as regards the handling of specific cases. When it
comes to cases involving more than one Member State or having clearly a
global dimension, this multiplies costs for undertakings, which are
forced to deal with different public authorities for the same activity,
and it enhances the risk of inconsistent application: in exceptional
cases, the same processing activities may be considered lawful by one
DPA and prohibited by another.
149. Some cases have a strategic dimension which should be addressed
in a centralised way. The Article 29 Working Party facilitates
coordination and enforcement actions between DPAs57 in major data
protection issues with such international implications. This was the
case with social networks and search engines58, as well as with regard
to coordinated inspections conducted in different Member States on
telecommunication and health insurance issues.
150. There are however limits to the enforcement actions that the
Working Party can undertake under the present framework. Common
positions can be taken by the Working Party, but there is no instrument
to ensure that these positions are effectively implemented in practice.
151. The EDPS suggests including in the legal instrument additional
provisions that could support coordinated enforcement, in particular:
• An obligation to ensure that DPAs and the Commission
take utmost account of opinions and common positions adopted by WP 29.59
• An obligation for DPAs to faithfully cooperate with each other and
with the Commission and the WP 2960. As a practical illustration of a
faithful cooperation, a procedure could be set up by which DPAs inform
the Commission or the Working Party in case of national enforcement
measures with a cross border element, in analogy to the procedure
applicable in the present framework with regard to national adequacy
decisions.
• Specifying the voting rules to increase the commitment of DPAs to
implement the decisions of the Working Party. It could be provided that
the Working Party envisages deciding on the basis of consensus and when
consensus could not be reached takes enforcement only with a qualified
majority. In addition to this, a recital could foresee that those DPAs
casting a positive vote on a document have an obligation or policy
commitment to implement it at national level.
152. binding force to WP29 positions. This would undermine the
independent status of individual DPAs, which has to be guaranteed by the
Member States under national law. Would the Working Party decisions
have a direct impact on third parties such as data controllers, new
procedures should be foreseen including safeguards such as transparency
and redress, including possibly appeal before the European Court of
Justice.
10.5. Cooperation between the EDPS and the Working Party
153. The way in which the EDPS and the Working Party cooperate could
also be fine- tuned. The EDPS is a member of the Working Party, and he
contributes within the group to positions on the main strategic EU
developments, while ensuring consistency with his own positions. The
EDPS notes the increasing number of privacy issues, both in the private
as well as in the public sector, which have implications at national
level in many Member States, and where there is a specific role for the
Working Party to play.
154. The EDPS has a complementary task to advise on the developments
in the context of the EU, which should be maintained. As a European
body, he exercises this advisory competence towards EU Institutions in
the same way as national DPAs advise their governments.
The EDPS would put a caveat against introducing stronger measures,
such as giving competence towards EU Institutions in the same way as
national DPAs advise their governments.
155. The EDPS and the Working Party act from a different but
complementary perspective. There is for these reasons a need to preserve
and maybe improve coordination between the Working Party and the EDPS,
to make sure that they work together on the main data protection issues,
for instance by coordinating agendas on a regular basis61, and by
ensuring transparency on issues which have a more national or specific
EU aspect.
156. Coordination is not mentioned in the present Directive for the
simple reason that the EDPS did not exist at the time where the
Directive was adopted, but after six years of existence the
complementarities of the EDPS and the Working Party are visible and
could be formally recognised. The EDPS recalls that under Regulation
45/2001 he has the duty to cooperate with the national DPAs and to
participate in the activities of the Working Party. The EDPS recommends
to explicitly mention cooperation in the new legal instrument, and to
structure it where necessary, for instance by laying down a procedure
for cooperation.
10.6. Cooperation between the EDPS and the DPAs in supervision on EU systems
157. These considerations also apply to areas where the supervision
must be coordinated between the European and national level. This is the
case for EU bodies that process significant amounts of data delivered
by national authorities or for large scale information systems with a
European and a national component.
158. The existing system for some EU bodies and large scale
information systems – for instance, Europol, Eurojust and the first
generation Schengen Information System (SIS) have Joint Supervisory
Bodies with representatives of national DPAs – is a remnant of
intergovernmental cooperation in the pre-Lisbon era and does not respect
the institutional structure of the EU of which Europol and Eurojust are
now an integral part, and in which the “Schengen acquis” has now also
been integrated62.
159. The Communication announces that the Commission will launch in
2011 a consultation of stakeholders on the revision of these supervision
systems. The EDPS urges the Commission to take as soon as possible
(within a short and specified timeframe, see above) position in the
ongoing discussion on supervision. He will take – in this discussion –
the following viewpoint.
160. As a point of departure, it should be guaranteed that all
supervisory bodies fulfil the indispensable criteria of independence,
resources and enforcement powers. Furthermore, it should be ensured that
the perspectives and expertise that exists on the EU level is taken
into account. That means that cooperation should take place not only
between the national authorities but also with the European DPA
(currently the EDPS). The EDPS finds it necessary to follow a model that
fulfils these requirements.63
161. In recent years the model of “coordinated supervision” was
developed. This model of supervision, as now operational in Eurodac and
parts of the Customs Information System, will soon be expanded to the
Visa Information System (VIS) and the second generation Schengen
Information System (SIS II). This model has three layers: (1)
supervision at national level is ensured by DPAs; (2) supervision at EU
level is ensured by the EDPS; (3) coordination is ensured by way of
regular meetings convened by the EDPS acting as the secretariat of this
coordination mechanism. This model has proven to be successful and
effective and should be envisaged in the future for other information
systems.
C. HOW TO IMPROVE APPLICATION OF PRESENT FRAMEWORK?
11. The short term
162. Whilst the review process is ongoing, efforts should be devoted
to ensure full and effective implementation of the current rules. These
rules will still be applicable until the future framework is adopted and
then implemented into national laws of the Member States. In this
direction, several lines of actions may be identified.
163. First, the Commission should continue monitoring Member States
compliance with Directive 95/46 and, where necessary, use its powers
under Article 258 TFEU. Recently, infringement proceedings have been
opened for a failure to correctly implement Article 28 of the Directive
with regard to the requisite of independence of DPAs64. Also in other
areas full compliance needs to be monitored and enforced.65 The EDPS
thus welcomes and fully supports the Commission’s commitment in the
Communication to pursue an active infringement policy. The Commission
should also continue the structural dialogue with Member States on
implementation.66
164. Second, enforcement at national level must be encouraged so as
to ensure practical application of data protection rules, including with
respect to new technological phenomena and global players. DPAs should
make full use of their investigative and sanctioning powers. It is also
important that the existing rights of data subjects, particularly the
rights of access, are fully implemented in practice.
165. Third, greater coordination in the enforcement seems necessary
in the short term. The role of the WP29 and its interpretative documents
in this regard is crucial, but also DPAs should do their most to put
them in practice. Diverging outcomes in EU-wide or global cases need to
be avoided and common approaches can and should be reached within the
Working Party. EU-wide coordinated investigations under the auspices of
the Working Party can also bring significant added value.
166. Fourth, data protection principles should be “built-in”
proactively in new regulations which may have an impact, directly or
indirectly, on data protection. At the EU level, the EDPS makes
considerable efforts to contribute to better European legislation and
these efforts must be undertaken also at national level. Data protection
authorities should therefore make full use of their advisory powers to
ensure such a proactive approach. Data protection authorities, including
the EDPS, can also play a proactive role in monitoring technological
developments. Monitoring is important with a view to identifying at an
early stage emerging trends, highlighting possible data protection
implications, supporting data protection-friendly solutions and raising
the awareness of stakeholders.
167. Finally, further cooperation between the various actors at
international level needs to be actively pursued. It is therefore
important to reinforce the international instruments of cooperation.
Initiatives like the Madrid standards and the ongoing work within the
Council of Europe and the OECD deserve full support. In this context, it
is very positive that also the US Federal Trade Commission has now
joined the family of Privacy and Data Protection Commissioners in the
framework of their International Conference.
D. CONCLUSIONS
General observations
168. The EDPS welcomes the Commission’s Communication in general, as
he is convinced that the review of the present legal framework for data
protection is necessary, in order to ensure effective protection in an
increasingly developing and globalised information society.
169. The Communication identifies the main issues and challenges. The
EDPS shares the view of the Commission that a strong system of data
protection will still be needed in the future, based on the notion that
existing general principles of data protection are still valid in a
society which undergoes fundamental changes. The EDPS shares the
statement in the Communication that the challenges are enormous and
underlines the consequence that the proposed solutions should be
correspondingly ambitious and enhance the effectiveness of the
protection. As a result he asks for a more ambitious approach on a
number of points.
170. The EDPS fully supports the comprehensive approach to data
protection. However, he regrets that the Communication excludes certain
areas, such as the data processing by EU institutions and bodies, from
the general legal instrument. If the Commission were to decide to leave
out these areas, the EDPS urges the Commission to adopt a proposal for
the EU level within the shortest possible timeframe, but preferably by
the end of 2011.
Main perspectives
171. The points of departure of the review process for the EDPS are
as follows: • Arrangements for data protection must as far as possible
actively support rather than hamper other legitimate interests (such as
European economy, the security of
individuals and accountability of governments). • The general
principles of data protection should not and cannot be changed. •
Further harmonisation should be one of the key objectives of the review.
• The fundamental rights perspective should lie at the heart of the
review process. A
fundamental right aims to protect citizens under all circumstances. •
The new legal instrument must include the police and justice sector. •
The new legal instrument must be formulated in a technologically neutral
way as
much as possible and must aim to create legal certainty over the longer term.
Elements of a new framework
Harmonisation and simplification
172. The EDPS welcomes the Commission’s commitment to examine the
means to achieve further harmonisation of data protection at EU level.
The EDPS determines areas where further and better harmonisation is
urgent: definitions, grounds for data processing, data subjects’ rights,
international transfers and data protection authorities.
173. The EDPS suggests considering the following alternatives to
simplify and/or reduce the scope of the notification requirements: •
Limit the obligation to notify to specific kinds of processing
operations entailing
specific risks. • A simple registration obligation requiring data controllers to register (as opposed to
extensive registration of all data processing operations). • The introduction of a standard pan-European notification form.
174. According to the EDPS a Regulation, a single instrument which is
directly applicable in the Member States, is the most effective means
to protect the fundamental right to data protection and to achieve
further convergence in the internal market.
Strengthening the rights of individuals
175. The EDPS supports the Communication where it proposes
strengthening individuals’ rights. He makes the following suggestions: •
A principle of transparency could be included in the law. However, it
is more important to reinforce the existing provisions dealing with
transparency (such as the existing Articles 10 and 11 of Directive
95/46).
• A provision on personal data breach notification, which extends the
obligation included in the revised ePrivacy Directive from certain
providers to all data
controllers, should be introduced in the general instrument.
• The limits of consent should be clarified. Broadening the cases
where express consent is required should be considered as well as
adopting additional rules for the online environment.
• Additional rights should be introduced such as data portability and
the right to be forgotten, especially for information society services
on the internet.
• Children’s interests should be better protected with a number of
additional provisions, specifically addressed to the collection and
further processing of children’s data.
• Collective redress mechanisms for breach of data protection rules
should be introduced in the EU legislation, in order to empower
qualified entities to bring actions on behalf of groups of individuals.
Strengthening the obligations of organisations/controllers
176. The new framework must contain incentives for data controllers
to pro-actively include data protection measures in their business
processes. The EDPS proposes the introduction of general provisions on
accountability and “privacy by design”. A provision on privacy
certification schemes should also be introduced.
Globalisation and applicable law
177. The EDPS supports the ambitious work in the framework of the
International Conference of Data Protection Commissioners to develop the
so called “Madrid standards”, with a view to integrate them into a
binding instrument and possibly initiate an intergovernmental
conference. The EDPS calls on the Commission to take concrete steps in
this direction in close cooperation with the OECD and the Council of
Europe.
178. A new legal instrument must clarify the criteria determining
applicable law. It should be ensured that data that are processed
outside the borders of the EU do not escape EU jurisdiction where there
is a justified claim for applying EU law. If the legal framework would
have the form of a Regulation there would be identical rules in all
Member States and it would become less relevant to determine applicable
law (within the EU).
179. The EDPS fully supports the objective to ensure a more uniform
and coherent approach vis-Ã -vis third countries and international
organisations. Binding Corporate Rules (BCRs) should be included in the
legal instrument.
The area of police and justice
180. A comprehensive instrument including police and justice may
allow for special rules which duly take account of the specificities of
this sector, in line with Declaration 21 attached to the Lisbon Treaty.
Specific safeguards need to be put in place, in order to compensate data
subjects by giving them additional protection in an area where the
processing of personal data is by nature more intrusive.
181. The new legal framework should be, as far as possible, clear,
simple and consistent. A proliferation of different regimes applying to,
for instance, Europol, Eurojust, SIS and Prüm, should be avoided. The
EDPS understands that aligning the rules from the different systems will
have to be carried out carefully and gradually.
DPAs and the cooperation between DPAs
182. The EDPS fully supports the objective of the Commission to
address the issue of the status of data protection authorities (DPAs),
and to strengthen their independence, resources and enforcement powers.
He recommends: • Codifying in the new legal instrument the essential
notion of independence of DPAs,
as specified by the ECJ. • Stating in the law that DPAs must be given
sufficient resources. • Giving authorities harmonised investigation and
sanctioning powers.
183. The EDPS suggests further improvements of the functioning of the
Article 29 Working Party, including its independence and
infrastructure. The Working Party should also be provided with
sufficient resources and a reinforced secretariat.
184. The EDPS suggests reinforcing the advisory role of the Working
Party by introducing an obligation for DPAs and the Commission to
take the utmost account of opinions and common positions adopted
by the Working Party. The EDPS is not in favour of giving binding force
to Working Party positions, particularly because of the independent
status of individual DPAs. The EDPS recommends that the Commission
introduce specific provisions to enhance cooperation with the EDPS in
the new legal instrument.
185. The EDPS urges the Commission to take a position as soon as
possible on the issue of supervision of EU bodies and large scale
information systems, taking into consideration that all supervisory
bodies should fulfil the indispensable criteria of independence,
sufficient resources and enforcement powers and that it should be
ensured that the EU perspective is well represented. The EDPS supports
the model of ‘coordinated supervision’.
Improvements under the present system:
186. The EDPS encourages the Commission to: • Continue monitoring Member States’ compliance with Directive 95/46 and, where
necessary, using its enforcement powers under Article 258 TFEU. •
Encourage enforcement at the national level and the coordination of
enforcement. • Build data protection principles pro-actively into new
regulations which may have an
impact, directly or indirectly, on data protection. • Actively pursue
further cooperation between the various actors at international level.
Brussels, 14 January 2010
Peter HUSTINX European Data Protection Supervisor
Footnotes:
1 OJ 1995, L 281/31
2 OJ 2001, L 8/1
3 COM (2010) 609 final.
4 See p. 5 of the Communication, first paragraph.
5 EDPS Opinion of 25 July 2007 on the Communication from the
Commission to the European Parliament and the Council on the follow-up
of the Work Programme for better implementation of the Data Protection
Directive, OJ C 255, 27.10.2007, p. 1
6 In particular (see point 77 of the opinion): no need to change
existing principles, but a clear need for other administrative
arrangements; the wide scope of data protection law applicable to all
use of personal data should not change; data protection law should allow
a balanced approach in concrete cases and should also allow data
protection authorities to set priorities; the system should fully apply
to the use of personal data for law enforcement purposes, although
appropriate additional measures may be necessary to deal with special
problems in this area
7 Document WP 168
(http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2009/wp168_en.pdf).
Its main message is that a legislative change is a good opportunity to
clarify some key rules and principles (e.g. consent, transparency),
introduce some new principles (e.g. privacy by design, accountability),
strengthen the effectiveness by modernising the arrangements (e.g. by
limiting existing notification requirements) and include all into one
comprehensive legal framework (incl. police and judicial cooperation).
8 The Speaking Points for the Press Conference are available on the EDPS website, at:
http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/EDPS/Publications/Speeches/2010/10
-11-15_Press_conf_speaking_points_PHBG_EN.pdf.
9 The Stockholm Programme ─ An open and secure Europe serving and protecting citizens, OJ C115, 04/05/2010, p. 1- 38, at p. 10.
10 Council of Europe Convention 108 for the protection of individuals
with regard to automatic processing of personal data, ETS No 108,
28.1.1981.
11 OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, published on www.oecd.org.
12 This importance of data protection and the link with privacy in
the Charter were underlined by the Court of Justice in its Judgment of 9
November 2010, Joint Cases C-92/09 and C-93/09, Schecke, not yet
published in ECR.
13 See EDPS Opinion of 18 March 2010 on promoting trust in the
Information Society by fostering data protection and privacy, OJ C 280,
16.10.2010, p. 1, para 113
14 See e.g. EDPS Opinion of 10 July 2009 on the Communication from
the Commission to the European Parliament and the Council on an Area of
freedom, security and justice serving the citizen, OJ C 276, 17.09.2009,
p. 8
15 Security is a wider notion than physical security, but as an
illustration of the arguments at stake it is here used in its more
limited sense.
16 See also the EDPS Opinion of 25 July 2007 on the Communication
from the Commission to the European Parliament and the Council on the
follow-up of the Work Programme for better implementation of the Data
Protection Directive, para 17, which builds on the case law of the
European Court of Human Rights and the Court of Justice.
17 See footnote 7.
18 This opinion will mainly focus on the former 3rd pillar (police
and judicial cooperation in criminal matters), since the former 2nd
pillar is not only a more complicated area of EU law (as also recognised
by Article 16 TFEU and Article 39 EU), but also to a lesser extent
relevant for data processing.
19 See e.g. Communication from the Commission on the global approach
to transfers of Passenger Name Record (PNR) data to third countries, COM
(2010) 492 final.
20 Directive 2006/24/EC of the European Parliament and of the Council
of 15 March 2006 on the retention of data generated or processed in
connection with the provision of publicly available electronic
communications services or of public communications networks and
amending Directive 2002/58/EC (OJ 2006 L 105/ 54).
21 Council Framework Decision 2008/977/JHA of 27.11.2008 on the
protection of personal data processed in the framework of police and
judicial cooperation in criminal matters (OJ 2008 L 350/60).
22 As defined in ‘Internet of things – An action plan for Europe’, COM (2009) 278 Final
23 See p. 14 of the Communication and Section 3.2.5 of this opinion.
24 See also EDPS Opinion of 24 November 2010 on the Communication
from the Commission to the European Parliament and the Council
concerning the EU Counter-Terrorism Policy: main achievements and future
challenges, point 31
25 See also WP document on the Future of Privacy (footnote 7), points 18-21.
26 Communication, p. 10
27 See WP document on the Future of Privacy (footnote 7), point 70.
The document refers in particular to liability provisions and the
possibility to claim immaterial damages.
28 Some divergent approaches also exist with regard to manual data.
29 See WP 29 Opinion 1/2010 on the concepts of “controller” and “processor” (WP 169).
30 Article 8(4) and (5) currently authorize under certain conditions
Member States to provide for further derogations with regard to
sensitive data.
31 See, in this regard, the Commission’s First Report on the
implementation of the Data Protection Directive, cited above, p. 14.
32 WP document on the Future of Privacy, para 87
33 Case C-518/07, Commission v. Germany, not yet published in ECR.
34 Communication, p. 10.
35 Communication, p. 10
36 Article 29 Working Party report on the obligation to notify the
national supervisory authorities, the best use of exceptions and
simplifications and the role of the data protection officers in the
European Union, WP 106, 2005, p. 7.
37 See Article 27 of the Regulation, OJ 2001, L 8/1.
38 See Communication, p. 6.
39 The WP 29 is currently working on an opinion on ‘consent’. This opinion might lead to additional suggestions
40 Consent is usually linked to the age when children can enter into
contractual obligations. This is the age when children are supposed to
have reached a certain level of maturity. For example, Spanish law
requires parental consent to collect children data for children who are
not yet 14 years old. Above this age, children will be deemed to be able
to consent. In the United Kingdom, the Data protection Act does not
refer to a particular age or threshold. However, the UK Data protection
Authority has interpreted that children above 12 can provide consent.
Conversely, children under 12 cannot provide consent and in order to
obtain their personal data first it is necessary to obtain the
permission of a parent or guardian.
41 In the US, COPPA requires operators of commercial websites or
online services directed to children under 13 to obtain parental consent
before collecting personal information and operators of commercial
general audience websites to have actual knowledge that specific
visitors are children.
42 See also EDPS Opinion of 25 July 2007 on the Communication from
the Commission to the European Parliament and the Council on the
follow-up of the Work Programme for better implementation of the Data
Protection Directive, OJ C 255, 27.10.2007, p. 10.
43 Some national laws already provide for similar mechanisms.
44 Resolution on Privacy by Design, adopted by the 32nd International
Conference of Data Protection and Privacy Commissioners, Jerusalem
27-29 October 2010.
45 The Directive includes provisions which indirectly, in different
situations, demand the implementation of privacy by design. In
particular, Article 17 requires that data controllers implement
appropriate technical and organization measures to prevent unlawful data
processing. The ePrivacy Directive is more explicit. Article 14.3
provides that “Where required, measures may be adopted to ensure that
terminal equipment is constructed in a way that is compatible with the
right of users to protect and control the use of their personal data, in
accordance with Directive 1999/5/EC and Council Decision 87/95/EEC of
22 December 1986 on standardisation in the field of information
technology and communications)”.
46 Under the present framework, Recital 46 encourages controllers
implementing such measures, but a recital does of course not have
binding force.
47 As suggested by Resolution on International Standards, adopted by
the 32nd International Conference of Data Protection and Privacy
Commissioners, Jerusalem 27-29 October 2010.
48 WP29 Opinion 8/2010 on applicable law, WP 179
49 On international transfers, see also Chapter 8 of the opinion
50 See on this EDPS Opinion of 30 September 2010 on the Communication
from the Commission to the European Parliament and the Council –
“Overview of information management in the area of freedom, security and
justice”, paras 9-19.
51 See Section 3.2.5 above.
52 This is currently the limited scope of Framework Decision 2008/977.
53 In this direction, see WP document on the Future of Privacy, point 112.
54 Case C-518/07, Commission v. Germany, not yet published in ECR.
55 See, for example Article 43 (2) of Regulation 45/2001, which contains such requirement for the EDPS.
56 Regulation (EC) No 1211/2009 of the European Parliament and of the
Council of 25 November 2009 establishing the Body of European
Regulators for Electronic Communications (BEREC) and the Office, OJ
L337, 9 18.12.200, p. 1.
57 Beside the Article 29 Working Party, the European Conference of
Data Protection Commissioners has created about ten years ago a
permanent workshop aimed at addressing cross-border complaints in a
coordinated way. Although this workshop presents undeniable added value
in terms of exchange between DPAs’ staffs and offers a reliable network
of contact points, it can not be considered as a coordination mechanism
for decision making
58 See the letters of WP 29 of 12.05.2010 and 26.05.2010, published
on the WP29 website
(http://ec.europa.eu/justice/policies/privacy/workinggroup/wpdocs/2010-others_en.htm).
59 As mentioned above, a similar obligation is laid down in
Regulation (EC) No 1211/2009 which specifies the role of the Body of
European Regulators for Electronic Communications (BEREC).
60 See, in this regard, Article 3 of Regulation (EC) No 1211/2009, cited above.
61 E.g. on the basis of the Inventory of legislative activities
published annually and updated regularly, which is available on the EDPS
website.
62 Under Regulation 45/2001, the EDPS has a duty to cooperate with these bodies.
63 For Eurojust, a model should also take into account that the data
protection supervision respects the independence of the judiciary, in so
far as Eurojust process data in the context of criminal proceedings.
64 See Case C-518/07, cited above and Commission Press Release of 28 October 2010 (IP/10/1430).
65 The Commission has opened an infringement proceeding against the
UK for an alleged breach of various data protection provisions,
including the requirement of confidentiality of electronic
communications in respect of behavioural advertising. See Commission
Press Release of 9 April 2009 (IP/09/570).
66 see Commission’s First Report on the implementation of the Data Protection Directive, cited above, p. 22 et seq.
RT @
