text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.01.2001, p. 1. 3 COM(2013) 529 final.

text: Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: See the EDPS Opinion of 9 December 2011 on the Proposal for a Council Decision on the conclusion of the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security, OJ C 35/03, 09.02.2012, p.16; Opinion of 15 July 2011 on the Proposal for a Council Decision on the conclusion of an Agreement between the European Union and Australia on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the Australian Customs and Border Protection Service, OJ C 322/01, 23.12.2011, p.1; Opinion of the EDPS of 25 March 2011 on the Proposal for a Directive of the European Parliament and of the Council on the use of Passenger Name Record data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime; Opinion of 19 October 2010 on the global approach to transfers of Passenger Name Record (PNR) data to third countries; Opinion of 20 December 2007 on the Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) data for law enforcement purposes, OJ C 110, 01.05.2008, p. 1; Opinion of 15 June 2005 on the Proposal for a Council Decision on the conclusion of an agreement between the European Community and the Government of Canada on the processing of Advance Passenger Information (API) / Passenger Name Record (PNR) data, OJ C 218, 6.9.2005, p. 6 (all available on http://www.edps.europa.eu/EDPSWEB/edps/cache/bypass/Consultation/OpinionsC). See also the

text: Article 29

text: Working Party's opinions on PNR are available on http://ec.europa.eu/justice/policies/privacy/workinggroup/wpdocs/index_en.htm#data_transfers. See Articles 7, 8 and 52(1) of the Charter of Fundamental Rights of the European Union (OJ C 83, 30.03.2010, p. 389) and 10 Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms (ETS No 5), Council of Europe, 4.11.1950. See European Court of Human Rights judgment of 4 December 2008, S. and Marper v. the UK. See European Court of Justice, judgment of 9 November 2010,

text: Volker and Markus Schecke GbR v. Land Hessen and

text: Eifert v. Land Hessen and Bundesansalt für Landwirtschaft und Ernährung.

text: United Nations Convention against Transnational Organized Crime, adopted by the UN General Assembly resolution 55/25 of 15 November 2000.

text: See, for example, the

text: Article 29

text: Working Party Opinion 7/2010 on the European Commission's Communication on the global approach to transfers of Passenger Name Record (PNR) data to third countries (

text: WP 178

text: ), adopted on 12 November 2010 and the EDPS Opinion of 9 December 2011 on the Proposal for a Council Decision on the conclusion of the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security, OJ C 35/03, 09.02.2012, p.16.

text: Administrative Guidelines for the Provision to Others, Allowing Access to Others and Use of Advance Passenger Information (API) and Passenger Name Record (PNR) Data of January 14, 2010 (available on http://www.cbsa-asfc.gc.ca/publications/dm-md/d1/d1-16-3-eng.html). 12 Form BSF153 "Traveller's API/PNR Information Request", available on http://www.cbsaasfc.gc.ca/publications/forms-formulaires/bsf153.pdf. 13 Canada will be initially (30 days after reception) "depersonalize" through "masking" only the names of passengers. After 2 years, also other names, number of travellers, contact and origin information, general remarks and API data collected for reservation purposes will me "masked". 14 See footnote 6.

text: See Opinions cited above.

text: See European Court of Justice judgment of 9 March 2010,

text: , European Commission v Federal Republic of Germany.

text: According to section 18(1)(2) of the Canadian Federal Court Act, "an application for judicial review in respect of a decision or an order of a federal board, commission or other tribunal (...) shall be made within 30 days after the time the decision or order was first communicated (...) to the party directly affected by it (...)".

identifier: EDPS yttrande (2013)

amnesord:
International Agreements
PNR
Transfers of data

publisher: Europeiska datatillsynsmannen

sprak: en

title: Passenger Name Record data - Agreement between Canada and the European Union

serie: yttranden

text: Opinion of the European Data Protection Supervisor

type: stycke

text: on the Proposals for Council Decisions on the conclusion and the signature of the Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data

text: I. Consultation of the EDPS

text: 1. On 19 July 2013 the European Commission adopted the Proposals for Council Decisions on the conclusion and the signature of the Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data (hereinafter: "the proposals"), which contain the text of the proposed Agreement between Canada and the European Union (hereinafter: "the Agreement"). The Proposals were sent to the EDPS on 23 July 2013.

text: 2. The EDPS also had the opportunity to provide his advice before the adoption of the proposals. The EDPS welcomes this previous consultation. However, as it took place after the closing of the negotiations, the EDPS input could not be taken into account. The present opinion builds on the comments provided at that occasion. II. General remarks

text: 3. As stated on earlier occasions , the EDPS questions the necessity and proportionality of PNR schemes and of bulk transfers of PNR data to third countries. Both are conditions required by the EU Charter and the European Convention of Human Rights for any limitation to fundamental rights, including to the rights respect for private life and the protection of personal data . According to the jurisprudence, not only the reasons put forward by the public authority to justify any such restriction should be relevant and sufficient , but it should also be demonstrated that other less intrusive methods are not available . To date, the EDPS has not seen convincing elements showing the necessity and proportionality of the massive and routine processing of data of non-suspicious passengers for law enforcement purposes.

text: 4. Nevertheless, the EDPS welcomes the data protection safeguards provided in the Agreement, although he regrets the fact that the retention period has been extended in comparison with the previous PNR agreement with Canada.

text: 5. The EDPS also welcomes the efforts undertaken by the Commission as regards oversight and redress under the constraints entailed by the nature of the Agreement. However, he is concerned about the limitations of judicial review and about the fact that administrative redress can be provided in some cases by an internal authority which is not independent. He also questions the appropriateness of an executive agreement to provide adequate and effective rights to data subjects.

text: 6. The Agreement regulates the use by the "Canadian Competent Authority" of PNR data transferred by EU air carriers and other carriers operating flights from the EU . The EDPS recommends requiring confirmation that no other Canadian authority can directly access or request PNR data to those carriers, thus circumventing the agreement. III. Specific remarks III.1. Legal basis

text: 7. The proposals are based on Article 82(1)(d) and Article 87(2)(a) of the TFEU on judicial cooperation in criminal matters and police cooperation, in conjunction with Articles 218(5) and 218(6)(a) of the TFEU as regards the signature and conclusion.

text: 8. The EDPS questions the choice of the legal basis. As stated in the Explanatory Memorandum of the proposals, air carriers are obliged to provide the Canadian Border Services Agency with access to certain PNR data. According to Article 1 of the Agreement, its purpose is to set out the conditions for the transfer and use of PNR data in order to, on the one hand, "ensure the security and safety of the public" and, on the other hand, "prescribe the means by which the data shall be protected". In addition, the vast majority of provisions of the Agreement relate to the latter objective, i.e. the protection of personal data, including data security and integrity.

text: 9. Therefore, the EDPS questions the exclusive choice of Article 82(1)(d) and Article 87(2)(a) of the TFEU as legal basis and would recommend considering Article 16 of the TFEU on the protection of personal data as a comprehensive legal basis, in conjunction with Articles 218(5) and 218(6)(a) of the TFEU. III.2. Purpose and definitions a) Preventing, detecting, investigating or prosecuting terrorist offences

text: 10. The EDPS welcomes the fact that the proposals include a list of the offences considered as "terrorist offences". However, he questions the inclusion in Article 3(2)(a)(v) of the Agreement of acts or omissions that cause "serious interference with or serious disruption of an essential service, facility or system". The EDPS understands that this definition is based on section 83.01 of the Canadian Criminal Code, but he considers that the scope of this subparagraph is too broad.

text: 11. In this regard, the EDPS welcomes the exclusion from this category of acts or omissions which result from "lawful or unlawful advocacy, protest, dissent or stoppage of work, such as strike" that are not intended to result in death, serious body harm, endangering an individual's life, or serious risk to the public's health or safety. However, the EDPS would recommend further narrowing the definition of the offences falling under Article 3(2)(a)(v), for example, further limiting the consideration of "terrorist offences" only to those interferences or disruptions which may endanger an individual's life.

text: 12. In addition, in order to enhance legal certainty and ensure appropriate information to data subjects, the EDPS recommends listing in Article 3(2)(b) the relevant international conventions and protocols. b) Preventing, detecting, investigating or prosecuting serious transnational crime

text: 13. Article 3(3) defines serious transnational crime as "any offence punishable in Canada by a maximum deprivation of liberty of at least four years or a more serious penalty and as they are defined by the Canadian law, if the crime is transnational in nature".

text: 14. The EDPS welcomes the fact that the transnational nature of crimes is clearly defined. In particular, the EDPS welcomes Article 3(a-d), which is almost identical to Article 3(2) of the UN Convention against Transnational Organised Crime (hereinafter: "the UN Convention"). However, the EDPS questions Article 3(e), according to which the fact that the offender travels or intends to travel to another country is enough to consider a crime as "transnational". The EDPS recommends limiting the definition of the transnational nature of crimes to the situations provided in the UN Convention.

text: 15. The EDPS also welcomes the fact that a threshold (offences punishable in Canada by a maximum deprivation of liberty of at least 4 years or more serious penalty) is set for crimes to be considered as "serious". In order to achieve greater legal certainty and transparency, the EDPS recommends listing the crimes that would fall under this definition according to Canadian law. This is also relevant to assess whether the definition excludes minor offences for which the transfer of PNR data to Canadian competent authorities would not be in line with the principle of proportionality. c) Other uses

text: 16. The EDPS questions the possibility of using PNR data in case of a "significant public health risk" provided in Article 3(4)(b), especially taking into account the limited reliability of PNR data. The international standards mentioned requiring this use of PNR should be listed.

text: 17. Article 3(5)(a) states that Canada may also process PNR data, on a case by case basis, to ensure oversight and accountability. It should be specified under which circumstances and by which authorities this processing is allowed.

text: 18. The possibility of processing PNR data to comply with a subpoena, warrant or order, even if limited to those issued or made by a court, potentially enlarges the purposes for which PNR data can be processed. It should be added that this should only be possible for the purposes stated in Article 3(1). III.3. Non-discrimination

text: 19. The EDPS welcomes Article 7 which prevents unlawful discrimination. The EDPS would recommend specifying that this principle applies in particular with regard to the nationality, country of residence and physical presence of passengers. It would also be useful to explicitly state in the Agreement or in the accompanying documents which types of "lawful" discrimination would be possible. III.4. Sensitive data

text: 20. Article 8(1) of the Agreement states that the Canadian Competent Authorities shall "mask" sensitive data using automated systems. Article 8(5) sets a maximum retention period of 15 days and Articles 8(3) and 8(4) detail the exceptional circumstances and procedures that allow the processing of sensitive data on a case-by-case basis. The EDPS welcomes the safeguards provided, but recommends completely excluding the processing of sensitive data. As previously recommended by the EDPS and the Article 29 Working Party, sensitive data should be filtered by air carriers . III.5. Security and logging

text: 21. The EDPS welcomes the measures required by Article 9 on data security and integrity and Article 17 on logging and documentation. However, he would also recommend providing for notification of data breaches to the European Commission and to Data Protection Authorities. III.6. Transparency

text: 22. The EDPS welcomes the information to be publicised in the Canadian Competent Authorities' website and to be provided to passengers according to Article 11. This information should be easily accessible. The EDPS recommends that Article 11(2) state that the Parties shall "require" the air travel industry and other interested parties to provide the listed information to data subjects and not only "work with" them "to promote transparency". In addition, the EDPS recommends adding to Articles 11(1) and 11(2) information on the categories of data concerned, the recipient(s) of the data and the mechanisms available under Canadian law to seek judicial review. III.7. Access and rectification

text: 23. The EDPS understands that, according to Canadian law, persons which are not present in Canada cannot exercise the rights provided by the Canadian Privacy Act and the Access to Information Act. Therefore, the EDPS welcomes the fact that Memorandum D1-16-3 of the Canada Border Services Agency (CBSA) extends the rights of access, rectification and notation to foreign nationals that are not present in Canada . The EDPS recommends mentioning this memorandum in the text of the Agreement, in the letters exchanged between the Parties or in the documents accompanying the decision.

text: 24. In cases where, according to Article 12(3), Canada cannot disclose the data to the data subject, the possibility of indirect access, e.g. through European Data Protection Authorities, should be available. This should be specified in the Agreement. III.8. Automated processing

text: 25. The EDPS welcomes Article 15 of the Agreement, which prevents Canada from taking decisions significantly affecting passengers solely on the basis of automated processing. However, taking into account the broad scope of automated processing foreseen in the PNR systems and in order to avoid a too restrictive interpretation of "decisions significantly adversely affecting a passenger", the EDPS recommends deleting the word "significantly". III.9. Data retention

text: 26. The EDPS is strongly concerned about the length of the maximum retention period provided (five years), which is even longer than the one provided in the precedent Agreement (three and a half years). He is also concerned about the period during which the data will be available before being "further 13 depersonalized" (two years).

text: 27. Consistently with his previous opinions , the EDPS recommends deleting or anonymising the data immediately after analysis and 30 days after reception as a maximum. In any case, the retention period should be justified, in particular taking into account that its length was not deemed necessary in the previous Agreement. III.10. List of PNR data

text: 28. Annex I of the Agreement contains a list of PNR data elements, which is almost identical to the list contained in the agreements currently in force with Australia and the US. These categories have already been considered disproportionate on previous occasions by the EDPS and the Article 29 Working Party , and should therefore be reduced.

text: 29. The presence of open categories could undermine legal certainty. Data elements such as "all available contact information", "all baggage information" and "general remarks" should be better defined. In particular, the field "General remarks", including OSI, SSI and SSR information, can reveal data related to religious beliefs (e.g. meal preferences) or health (e.g. request for a wheelchair). As discussed above, the processing of sensitive data should be explicitly excluded.

text: 30. Therefore, the list should be narrowed. In line with previous opinions of the EDPS and the Article 29 Working Party, the EDPS recommends limiting the data elements to the following categories: PNR record locator code, date of reservation, date(s) of intended travel, passenger name, other names on PNR, all travel itinerary, identifiers for free tickets, one-way tickets, ticketing field information, ATFQ (Automatic Ticket Fare Quote) data, ticket number, date of ticket issuance, no show history, number of bags, bag tag numbers, go show information, number of bags on each segment, voluntary/involuntary upgrades, and historical changes to PNR data with regard to the aforementioned items. III.11. Method of transfer

text: 31. The EDPS supports the choice of the push method as the exclusive means to transfer PNR data by air carriers, as provided in Article 20. III.12. Onward transfers

text: 32. The EDPS welcomes the safeguards provided in Articles 18 and 19. However, he recommends specifying which are the "other government authorities in Canada" to which PNR data can be disclosed, either in the Agreement or in accompanying documents.

text: 33. The EDPS also welcomes the requirement that recipient authorities in Canada afford protection "equivalent" to the safeguards described in the Agreement. As regards disclosure outside Canada, Article 19 requires that the CBSA be satisfied that the recipient foreign authority applies standards that are equivalent to those set in the Agreement.

text: 34. The EDPS recommends adding that those standards should be laid down in an agreement or arrangement, which should be as binding legally and factually as possible between Canada/ the CBSA and the recipient country/authority. In addition, such agreements should be notified to the European Commission and to EU national Data Protection Authorities.

text: 35. Onward transfers to other countries are also possible on the basis of standards that have been agreed with the EU. This provision should not allow the circumvention of any PNR agreement concluded between the EU and a third country.

text: 36. In addition, in order to avoid a flexible interpretation of "on a case-by-case basis", the EDPS suggests adding in Article 19(1) the requirement of prior judicial authorisation or of the existence of an immediate threat for onward transfers. III.13. Oversight and redress

text: 37. Article 10 provides for oversight "by an independent public authority, or by an authority created by administrative means that exercises its functions in an impartial manner and that has a proven record of autonomy". The EDPS welcomes the reference to an independent public authority, but regrets the fact that oversight may take place alternatively by a (non independent) authority created by administrative means. Although internal autonomous oversight is positive and contributes to ensuring compliance and accountability, external overall oversight by an independent authority, such as the Privacy Commissioner of Canada, should also be explicitly provided in all cases.

text: 38. The importance of full independence has been outlined by the European Court of Justice, according to which any form of State scrutiny over a data protection supervisory authority "in principle allows the government (...) or an administrative body subject to that government to influence, directly or indirectly, the decisions of the supervisory authorities or, as the case may be, to cancel and replace those decisions." The Court also stated that the mere risk that the State or an administrative body "could exercise a political influence over the decisions of the supervisory authorities is enough to hinder the latter authorities’ independent performance of their tasks".

text: 39. The EDPS understands that, as required in Article 30, Canada will notify the EU of the identity of these authorities and their distribution of competences and that this information will be publicised together with the Agreement. As regards the "independent public authority" providing oversight, the EDPS recommends designating the Canadian Privacy Commissioner. Dissuasive sanctions should also be laid down for cases of non compliance with the Agreement.

text: 40. As regards Article 14(1) on judicial review, the EDPS reiterates the comments made above on the independence of the authorities providing oversight. The EDPS welcomes the obligation that the relevant authority notifies complainants of the means of seeking judicial review. However, the EDPS recommends also specifying in the Agreement, in the letters exchanged between the Parties or in documents accompanying the decision which are the mechanisms available to persons not resident in Canada to seek judicial review under Canadian law.

text: 41. Article 14(2) ensures that any individual be able to seek effective judicial redress "in accordance with Canadian law" by way of judicial review. The EDPS welcomes the reference to "any individual" but he suggests confirming that this right is available under Canadian law regardless of the nationality, country of origin, residence of the individual or presence in Canada, either in the Agreement or at least in the letters exchanged between the Parties or in the documents accompanying the decision.

text: 42. In addition, it is not clear whether the right to judicial review could be exercised if the relevant decision or action has not been communicated to the individual concerned , in particular if provisions of the Agreement other than those related to access and rectification/notation are infringed. The EDPS recommends clarifying this. He also suggests specifying which "other remedy which may include compensation" Article 14(2) refers to.

text: 43. The EDPS welcomes the effort undertaken by the Commission as regards oversight and redress. However, he notes the limitations of judicial review with respect to judicial redress, and of administrative redress by an internal "autonomous authority" which depends on the State or an administrative body and thus cannot act fully independently. On a more general level, the EDPS understands that executive agreements cannot create new rights for EU citizens not present in Canada, which are not available under Canadian law, such as full administrative redress by an independent authority. Therefore, he questions the appropriateness of this type of agreements to protect fundamental rights such as privacy and data protection. III.14. Review of the implementation of the Agreement

text: 44. Article 26(2) states that the Parties shall jointly review the implementation of the Agreement one year after its entry into force and then "at regular intervals". The EDPS recommends specifying the frequency of these additional reviews.

text: 45. Furthermore, the content of the review should be further specified. The EDPS suggests that the review focus not only on the implementation of the Agreement but also on the evaluation of its necessity and proportionality. In particular, it could involve the collection of statistics on the number of individuals affected and effectively convicted or otherwise dealt with on the basis of the transfer of PNR data, and on the exercise of data subjects' rights.

text: 46. According to Article 26(4), the review teams shall include data protection experts. The EDPS recommends explicitly stating that European Data Protection Authorities should be included in the EU review team. IV. Conclusions

text: 47. As previously stated, the EDPS questions the necessity and proportionality of PNR schemes and of the bulk transfers of PNR data to third countries. He also questions the choice of the legal basis and recommends that the proposals be based on Article 16 of the TFEU, in conjunction with Articles 218(5) and 218(6)(a) of the TFEU.

text: 48. The EDPS is also concerned about the limited availability of independent administrative redress and full judicial redress for EU citizens not present in Canada and questions the appropriateness of an executive agreement to achieve them. He also recommends requiring confirmation that no other Canadian authority can directly access or request PNR data to the carriers covered by the Agreement.

text: 49. As regards the specific provisions of the agreement, the EDPS welcomes the data protection safeguards included. However, the Agreement should:  completely exclude the processing of sensitive data;  provide for deletion or anonymisation of the data immediately after analysis and 30 days after reception as a maximum and, in any case, reduce and justify the proposed retention period, which has been extended in comparison with the previous PNR Agreement with Canada;  limit the categories of PNR data to be processed;  explicitly mention that overall oversight will be carried out by an independent authority.

text: 50. In addition, the EDPS recommends specifying the following, either in the Agreement or in the accompanying documents:  further narrowing and clarifying the concepts defining the purposes of the Agreement;  clarifying which types of "lawful" discrimination would be possible;  providing for an obligation to notify data breaches to the European Commission and to Data Protection Authorities;  completing the provisions on transparency;  extending the prohibition of deciding solely on the basis of automated processing to all decisions affecting passengers on the basis of the Agreement;  specifying to which authorities in Canada PNR data can be further transferred, adding the requirement of prior judicial authorisation or of the existence of an immediate threat, providing for an obligation of including adequate data protection safeguards in agreements or arrangements with other recipient countries or authorities and for their notification to the European Commission and to EU Data Protection Authorities;  naming the relevant authorities and laying down dissuasive sanctions for non compliance with the Agreement;  specifying which are the mechanisms available to persons not resident in Canada to seek judicial review under Canadian law;  clarifying if the right to judicial review could be exercised even if the relevant decision or action has not been communicated to the individual concerned, in particular if provisions of the Agreement other than those related to access and rectification/notation are infringed;  specifying to which "other remedy which may include compensation" Article 14(2) refers;  specifying the frequency of reviews of the implementation of the Agreement, their content (which should include on the evaluation of its necessity and proportionality) and explicitly including EU Data Protection Authorities in the EU review team. Done in Brussels, 30 September 2013 (signed) Peter HUSTINX European Data Protection Supervisor

type: vagledning

utgivare: edps


text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3 COM (2013) 316 final. 4 COM (2009) 434 final.

text: Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: Directive

text: of the European Parliament and of the Council of 7 July 2010 on the framework for the deployment of Intelligent Transport Systems in the field of road transport and for interfaces with other modes of transport, OJ L2017/1, 6.9.2010. 6 Commission recommendation of 8 September 2011 on support for an EU-wide eCall service in electronic communication networks for the transmission of in-vehicle emergency calls based on 112 ('eCalls'),

text: , OJ L 303/46, 22.11.2011. 7 Commission Delegated

text: Regulation (EU) No 305/2013 of 26 November 2012

text: supplementing Directive

text: of the European Parliament and of the Council with regard to the harmonised provision for an interoperable EU-wide eCall Text with EEA relevance, OJ L 091 , 03/04/2013 P. 0001 – 0004. 8 See in particular Opinion of 22 July 2009 on the ITS Directive, formal comments of 12 December 2011 on the Commission Recommendation on the implementation of the harmonised EU-wide eCall, and the letter of 19 December 2012 on the Commission Delegated Regulation with regard to the harmonised provision for an interoperable EU-wide eCall, all published on the EDPS website: www.edps.europa.eu (under "Consultation"). 9 See

text: Article 4

text: and Article 5(1) of the Proposal. 10 See in particular Recital 6.

text: Currently recital 13 states that 'According to the recommendations made by the

text: Article 29

text: Data Protection Working Party […], any processing of personal data through the eCall in-vehicle system should comply with the personal data protection rules provided for in Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data an on the free movement of such data […]'. 12 Working document number 1609/06/EN

text: WP 125

text: adopted on 26 September 2006.

text: See

text: Article 29

text: WP documents: 881/11/EN

text: Opinion 13/2011 on Geolocation services on smart mobile devices adopted on 16 May 2011 and 00461/13/EN Opinion 02/2013 on apps on smart devices adopted on 27 February 2013. 14 See footnote 12. 15 See on this also earlier EDPS opinions such as Opinion of 4 July 2013 on a proposal for a Directive of the European Parliament and of the Council on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing, and a proposal for a Regulation of the European Parliament and of the Council on information on the payer accompanying transfers of funds, in particular para 15 and 26, published on EDPS website.

text: Communication cited in footnote 4: p. 7 and 8: 'eCall builds on technical components (satellite positioning, processing and communication capabilities) that also provide the basis for several in-vehicle applications, including those required by existing or planned regulation applicable to commercial or private vehicles, such as the digital tachograph, electronic toll collection or provisions on the transport of dangerous goods and live animals'. […] The definition of an 'open in-vehicle platform' concept is part of the ITS Action Plan, and the introduction of eCall based on this concept would positively contribute to its momentum. The automative and telecommunications industry and service providers will benefit from new services based on the introduction of the eCall telematics platform in all vehicles. This is particularly valuable in times of crisis'. 17 Recital 13 refers to the working document cited in footnote 12.

text: In its Opinion 13/2011 on Geolocation services on smart mobile devices, the

text: Article 29

text: Working Party stressed that 'Given the sensitivity of the processing of (patterns of) location data, prior informed consent is the main applicable ground for making data processing legitimate when it comes to the processing of the locations of a smart mobile device in the context of information society services'. 19 The WP29 refers to a full set of data (FSD); see Working document cited in footnote 12.

text: See footnote 17

text: , page 12. 22 See in this sense also footnote 17's reference to WP29 opinion ‘on geolocation services on smart mobile devices'.

text: See

text: Article 6

text: (c) of Directive

text: and developments relating to the data minimisation principle in the draft data protection Regulation.

text: Article 6

text: (e) of Directive

text: . 25 E.g. Art. 17 of Directive

text: and Art. 4 of Directive

amnesord:
Rights of the Individual
Right of Information
Transport
eCall
Surveillance
Tracking

title: Deployment of the eCall System

text: Opinion of the EDPS on the proposal for a Regulation of the European Parliament and of the Council concerning type-approval requirements for the deployment of the eCall system and amending Directive

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such 2 data , and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1 Consultation of the EDPS

text: 1. On 13 June 2013, the Commission adopted the proposal for a Regulation of the European Parliament and of the Council concerning type-approval requirements for the deployment of the eCall system and amending Directive

text: ('the Proposal') announced in the Commission Communication of 21 August 2009 on 'eCall: Time for Deployment' ('the 2009 Communication') .

text: 2. The EDPS welcomes the fact that he is consulted by the Commission and that a reference to the consultation is included in the preambles of the Proposal.

text: 3. Before the adoption of the Proposal, the EDPS was given the possibility to provide informal comments to the Commission. He highly appreciates that most of his comments have been taken into account. 1.2 Objective and scope of the Proposal

text: 4. This Proposal complements other regulatory measures which have been implemented to support the deployment of eCall, such as the ITS Directive

text: , the Commission Recommendation of 8 September 2011 on the support to the EU-wide eCall service , and the adoption of specifications for the upgrade of Public Safety Answering Points (PSAPs) , on which the EDPS was consulted and provided comments .

text: 5. The Proposal provides for the mandatory introduction of an eCall in-vehicle system in new type-approved vehicles in Europe. Contrary to the current system where eCall is installed by car manufacturers on a voluntary basis, the Proposal provides for the mandatory fitting of eCall devices in all new vehicles starting with new passenger cars and light commercial vehicles by 1 October 2015 . It therefore contains several obligations addressed to vehicle/equipment manufacturers.

text: 2. GENERAL ANALYSIS OF THE PROPOSAL 2.1 Applicability of data protection legislation to any processing of personal data envisaged under the Proposal

text: 6. 'e-Call in-vehicle system' is defined in Article 3 of the Proposal as a 'system activated either automatically via in-vehicle sensors or manually, which carries, by means of mobile wireless communications networks, a standardised minimum set of data (hereinafter 'MSD') and establishes a 112-based audio channel between the occupants of the vehicle and a public safety answering point'.

text: 7. The EDPS wishes to emphasize that, for privately owned cars, the vehicle identification is directly related to the identity of the owner of the car who is in several cases identical with the driver. For other cars, e.g. rental cars, information obtained from the owner will lead to the identification of the driver. Combined with these 10 personal details, the positioning information (location data of the vehicle), and other information processed, is related to a directly or indirectly identifiable individual and therefore qualifies as personal data.

text: 8. Processing of personal data is one of the core obligations created by the Proposal which is therefore subject to the application of and compliance with data protection legislation and safeguards. In this regard, the EDPS reminds that it is essential to explicitly mention the applicable EU data protection law in a substantive provision of the Proposal: a mere indirect reference in a recital cannot be considered as sufficient.

text: 9. The reference should explicitly provide, as a general rule, that Directive

text: and its national implementing rules apply to the processing of personal data within the framework of the Proposal.

text: 10. The EDPS also wishes to stress that, contrary to what may be implied from the wording of the proposal, the applicability of data protection law is not the consequence of a recommendation by the

text: Article 29

text: Working Party. To avoid any ambiguity/confusion, he recommends dissociating the reference to the

text: Article 29

text: Working Party working document of the reference made to the data protection legislation in Recital 13.

text: 11. Besides, the EDPS notes that concrete data protection safeguards are not developed enough in the proposal. For instance, it is envisaged that the data, originally collected to be transferred in case of accident, either automatically or manually, to a PSAP, can be used for other purposes by car manufacturers and no further specification are given on the necessary data protection safeguards that should be implemented simultaneously to avoid function creep.

text: 12. The EDPS therefore recalls that clarifying in a substantive provision the applicable data protection legislation is essential and welcomed but not sufficient. The references to applicable data protection law should indeed be specified in concrete safeguards, including in particular the purpose limitation requirement, which will apply to any situation in which personal data processing is envisaged, namely 112 eCall as well as private eCall and added value services based on the embedded system. To this end, further guidance will be given in this Opinion. 2.2 The potential intrusiveness of the eCall system

text: 13. The technical approach chosen in the Proposal is the integration of location and communications service equipment in each new car sold in the EU. This equipment will be able to identify and record the car’s location at least with the same precision and granularity as mobile phones can do this today. From a technical perspective, this equipment may therefore carry at least the same privacy and data protection risks as mobile equipment .

text: 14. The system mandated by the Proposal shall be open and accessible without discrimination for third parties, for repair and maintenance, and also serve as a platform for added value services provided by third parties. If such services could make full use of the technical possibilities of the equipment installed in each new car, they could create considerable additional risks for privacy, comparable with those of mobile apps on smart phones.

text: 15. The intrusiveness of an eCall system and the potential impact on citizen's right to privacy has raised the

text: Article 29

text: Working Party's concern in such a proportion that, already in 2006 , when its deployment was only considered on a voluntary basis, it has issued a Working Document developing the specific data protection guarantees that should be implemented whenever the system is installed.

text: 16. In this regard, the EDPS highly welcomes the introduction in Article 6 of the Proposal of a substantive provision dedicated to data protection. In particular, he notes with satisfaction that

text: Article 6

text: would require vehicle manufacturers (i) to ensure that vehicles equipped with the system are not traceable and are not subject to any constant tracking in their normal operational status related to the eCall, (ii) to make use of privacy enhancing technologies (hereinafter 'PETs') as well as to adopt safeguards to prevent surveillance and misuse of the data, (iii) to make sure that the in-vehicle system only processes the minimum set of data, (iv) and to inform eCall users about the processing of data and in particular: - its legal basis, - its activation by default, - the modalities of data processing, - the purpose pursued, - the types of data collected and processed and the recipients, - the time limit for the retention of data, - the fact that there is no constant tracking, - the modalities for exercising data subject's rights and - any necessary additional information.

text: 17. The EDPS however regrets that not all essential safeguards are specified in the Proposal. He notes that

text: Article 6(4)

text: refers to the adoption of delegated acts which could give further specifications. However, he insists that specifications regarding essential data protection safeguards are given in the legislative proposal itself .

text: 18. He therefore recommends the introduction of an additional paragraph to Article 6 of the Proposal which contains these additional essential safeguards, and in particular:  Designates the data controller and the entity responsible for handling access requests.  Specifies the list of data referred to as a minimum set of data and as a full set of data (possibly to be elaborated in a delegated or implementing act).  Includes the possibility for data subjects to deactivate private eCall and added value services.  Specifies retention periods for the data processed.  Specifies the modalities of the exercise of data subjects’ rights,

text: 19. He also insists that the intrusiveness of the embedded device implies that stricter safeguards are set up to avoid, more specifically, function creep and processing of data the data subject is not aware of through the use of the device for private eCall and added value services, which implies data processing for new purposes. Further recommendations will be given in paragraph 3 of this Opinion. 2.3 The necessary regulation of private eCall and of added value services in the proposal

text: 20. The EDPS furthermore regrets that the requirements displayed in the Proposal only apply to the 112 eCall systems and therefore do not address private eCall systems and added value services. These services are only mentioned in

text: Article 6(3)

text: (i), in connection with the information that needs to be provided.

text: 21. The development, by car manufacturers, of private eCall systems and added value services is not only a prospective. Already in its 'eCall: Time for Deployment' communication, the Commission itself insisted on eCall being an 'opportunity to 16 deploy added-value services' and noted that 'proprietary in-vehicle emergency call services are offered in Europe and worldwide by different automobile branches and service providers (e.g., Volvo OnCall, GM OnStar, PSA, Fiat, BMW). They are typically bundled with other services, such as breakdown assistance, onboard mobile telephony, dynamic navigation, etc.''. The right of all stakeholders such as car manufacturers and independent operators to offer additional emergency and/or added value services, in parallel with or building on the (public) 112-based eCall in-vehicle system' is indeed envisaged in Recital 8 of the Proposal.

text: 22. Surprisingly, the Proposal only regulates and addresses data protection implications of 17 EU 112 eCall. Although Recital 13 of the Proposal confirms that any processing of personal data through the eCall in-vehicle system should comply with Directive

text: ', the proposal does not introduce a substantive provision which would effectively address private eCall services as well as added value services. These private services, which are not strictly speaking health-related emergency calls, are, per se, privacy-intrusive and should take account, as much as possible at design stage, of data protection safeguards. The EDPS therefore notes that the current wording of the Regulation, recognizing the potential offered to car manufacturers by the eCall embedded system without offering further guidance as to data protection implications involved, allows those systems to develop in an unregulated manner, thus creating a legal loophole.

text: 23. He finds necessary to recall that the processing of data for a different purpose than the one for which they were originally collected is strictly regulated by

text: Article 6 of Directive 96/46/EC

text: , and if the purpose is incompatible with the original one, this should be considered as a function creep and the processing would be unlawful. In the present case, the use of data originally collected for a public interest (emergency and health issues) and further processed for commercial purposes would, most probably, be considered in principle as incompatible and, thus, as a breach of applicable data protection legislation. For the processing carried out by car manufacturers to be considered as legitimate, specific safeguard would be necessary which would require the latter to ensure in particular that data subjects gave their clear and unambiguous consent prior to the use of their personal data.

text: 24. Therefore, even if the EDPS understands that the main purpose of the present legislation is to regulate 112 eCall, he insists that all data protection implications of the system have to be concretely addressed in the Proposal. Other services have already been developed and are likely to be developed even more as a result of the obligation to provide for the public eCall service in every car.

text: 25. The Proposal should regulate those private eCall services and added value services so that they comply with the same or stricter data protection requirements than those foreseen for the mandatory 112 eCall system and that, for instance, constant tracking is prohibited. The EDPS therefore recommends that

text: Article 6(1)

text: is amended to ensure that both 112 and private e-Calls services, as well as added value services, enter within the scope of the Proposal. Concrete guarantees that should be included will be further developed in this opinion. 2.4 The necessary provision of a clear and timely information as a logical consequence of the mandatory introduction of an eCall embedded system in new vehicles

text: 26. The EDPS highly welcomes that

text: Article 6(3)

text: requires manufacturers to provide individuals purchasing new vehicles with information about the embedded 112 eCall in-vehicle system and the resulting processing of data, and specifies in the Regulation itself the details of what such information should cover, i.a. the fact that the system is activated by default, and the modalities of the data processing that is performed as required under Articles

text: and

text: of Directive 95/46/EC (such as the purpose of the 112 eCall processing, the reference to the legal basis for the processing, the types of data collected and processed, the recipients of the data, the fact that there is no constant tracking of the vehicle, the time limit for the retention of data in the invehicle system and the modalities for exercising data subjects' rights).

text: 27. Articles

text: and

text: of Directive 95/46/EC also imply that the modalities of the communication of the information to the consumers be clarified in the Proposal. The EDPS therefore recommends that

text: Article 6(3)

text: is complemented to this extent and specifies, for instance, that car manufacturers will provide such information as part of the technical documentation handed over together with the vehicle (as the in-vehicle system would constitute a part of the equipment of the car). Such a choice allows second-hand car buyers to be informed of the existence of the system as well. Besides, the EDPS recommends that it is specified in the Proposal that the availability of the information be pointed out to the car owner at the time of the purchase of the car, in a separate document.

text: 28. The EDPS also notes that

text: Article 6(4)

text: refers to delegated acts which will be adopted by the Commission to further define the modalities of the user information referred to in paragraph 3 and insists that he shall be consulted prior to their adoption. 2.5 The required application of equivalent data protection safeguards to private eCall services and added value services

text: 29. Contrary to the 112 e-Call, private eCall and added value services shall be activated on a voluntary basis, and the information given to the data subject will enable him to give his unambiguous consent to the processing or simply refuse it. The default should be that the e-Call system cannot be used to provide those services unless the user has been properly informed and has actively consented to it. The EDPS emphasises that consent is the main applicable ground for making data processing legitimate for these services. None of the other grounds for making data processing legitimate displayed in

text: Article 7 of Directive 95/46/EC

text: would correspond to the processing that car manufacturers will carry out.

text: 30. This is all the more important since the provision of facultative added value services by car manufacturers is based on a system that the clients have by default in their cars and that potentially enables the constant collection of the vehicle’s geolocation. In that sense, there is a parallel with geolocation services on smart mobile devices, and the same safeguards apply . 2.5.1 Comprehensive information of users on added value services to ensure an informed consent

text: 31. The obligation to inform about the mandatory processing taking place through the 112 eCall (and the safeguards that have been implemented in this context) is without prejudice to the additional information that manufacturers must provide about the processing of personal data in relation to their provision of a private eCall service and/or other added value services based on the system.

text: 32. It has to be kept in mind that the provision of these services will likely rely on the processing of more data than the minimum set of data agreed upon for the 112 eCall - 19 and may also entail the use of more intrusive means (such as constant geo-location).

text: 33. The validity of consent depends inter alia on the quality of the information given about the data protection implications of the service offered. As stated by the

text: Article 29

text: Working Party in its opinion 13/2011 on Geolocation services on smart mobile devices, 'Information must be clear, comprehensive, understandable for a broad, non- 20 technical audience and permanently and easily accessible' . In the present case, consumers should be provided with clear information so that they can not only understand the processing operation(s) taking place through the in-vehicle system, but the differences that may exist between the processing carried out for the mandatory 112 eCall and the one for the private eCall, and freely consent to the processing.

text: 34. In this regard, the EDPS reminds that car manufacturers shall not assume that their customers are technically skilled persons and will have to clearly explain the modalities of the processing. Besides, the information shall be accessible and visible, i.e. given directly to the car user and submitted at the moment of the purchase and not only be available somewhere in the technical documentation.

text: 35. He therefore welcomes that section 2.5 of the Impact Assessment mentions that in case of the provision of added value services, there should be an appropriate contract between the consumer and the service provider and that

text: Article 6(3)

text: (i) of the Proposal requires car manufacturers to provide 'any necessary additional information regarding the processing of personal data in relation to the provision of a private eCall service and/or other added value services'. He however regrets that the proposal itself does not mention the contract obligation.

text: 36. The EDPS therefore recommends that the requirement for an appropriate and distinct contract between the consumer and the service provider is stated in a specific provision of the proposed Regulation He also recommends clarifying in the provision that this contract should cover data protection aspects, including providing appropriate information to consumers on the service(s) and collecting their consent for the processing of data in relation to the provision of these added value services. This could, if needed, be elaborated in the delegated acts that the Commission will adopt. He recalls that he shall be consulted on these acts before their final adoption.

text: 37. This contract will have to provide the following additional information: - Clear and transparent information of end-users on the mandatory processing of location data, including a clear description of the data processed and the conditions of processing. - Separately, similar information in relation to the facultative processing for additional facultative services. - Clear and transparent information on the fact that facultative services are not activated by default and will be activated on the basis of consent. - The absence of any constant geo-location unless the user has been made aware of it and is in a position to give prior free and informed consent. - Information relating to the elements proposed in paragraph 16 of this Opinion.

text: 38. The EDPS would also favour that this information is copied in the notice/technical documentation of the car and therefore accessible, on a permanent basis, to the car owner or the person he might lend/sell the car to. 2.5.2 The requirement for a free, specific and informed consent to private e-Call services and added value services

text: 39. As already stated above, the information given will enable the data subject to express his consent to the processing envisaged. Clear, complete and prior information is not, however, the only requirement to ensure that consent is valid.

text: Article 2

text: (h) of Directive

text: specifies that consent must be freely given, specific and concretely result in an informed indication, by the data subject, of his wishes by which he signifies his agreement to personal data relating to him being processed.

text: Article 7

text: (a) thereof adds as a condition that, for the processing to be legitimate, this consent shall be given unambiguously.

text: 41. These requirements have been further explained by the

text: Article 29

text: Working Party in its opinion 15/2011 on the definition of consent where it clearly states that 'consent can only be valid if the data subject is able to exercise a real choice, and there is no risk of deception, intimidation, coercion or significant negative consequences if he/she does not consent'.

text: 42. Applied to car manufacturers, these requirements mean that they shall seek the prior informed consent of potential users of private e-Call and/or added value services. Besides, it must be clear that such consent cannot be obtained freely through mandatory acceptance of general terms and conditions, or through opt-out possibilities. Equally, consent cannot be freely given if the data subject has to accept a (non-negotiable) clause in a contract (as is generally the case with car sale contracts) or if he suffers any kind of pressure into consenting to such processing. This also excludes pressure from car insurance companies or car rental companies to keep it activated.

text: 43. Besides, consent given must be specific and therefore obtained for each of the different purposes for which data are being processed. If the purpose of the processing changes in a material way, the controller must seek renewed specific consent. For instance, if the data is processed to be transferred to a third party for insurance purposes and not anymore by the car manufacturer himself or his processor for assistance purposes, active prior consent of the user must be sought.

text: 44. Furthermore, to allow the user to consent freely, the EDPS would highly recommend a design that would allow the user to know when the e-Call system is used to process its location data for the purpose of added value services, outside the scope of emergency e-Call processing.

text: 45. Finally, data subjects must be able to withdraw their consent in an easy way, without any negative consequence.

text: 46. To sum-up, the EDPS recommends that the proposal ensures that data subjects are given the choice to opt for the services, through a specific contract offer, made prior to the processing. Non-negotiable clauses part of a car sale contract, or clauses belonging to general terms and conditions, whose acceptance is mandatory, will not fit this requirement.

text: 47. Besides, there should be no adverse consequence to the refusal of the offer. Therefore, in addition to the recommendations already given regarding the information that should be given to the data subject, the EDPS recommends that it is also stated in the contract that the refusal of the service offered will not involve adverse consequences linked to that refusal. Such a statement could appear in the privacy statement of the contract.

text: 3. SPECIFIC COMMENTS 3.1 The necessity to prohibit constant tracking for added value services

text: 48. The EDPS notes that Article 6(1) of the Proposal states that 'manufacturers shall ensure that vehicles equipped with eCall in-vehicle system are not traceable and are not subject to any constant tracking in their normal operational status related to the eCall'. He understands that constant tracking is only prohibited for 112eCall services and private eCall services and recommends clarifying in the Proposal that, by analogy with 112 and private eCall services, added value services shall not allow constant tracking. 3.2 The importance of listing the categories of data processed under 112 eCall, private eCall and added value services

text: 49. The Proposal does not specify to which data the MSD processed for 112 eCall corresponds. It appears that the MSD ('minimum set of data') necessary were selected by the eCall driving group in 2006 and standardised by the standard ‘Road transport and traffic telematics — eSafety’ (EN 15722) as follows: the time of incident, the precise location including direction of driving, the vehicle identification, the eCall identifier giving the severity of the incident (manual or automatically triggered), information about a possible service provider. Stakeholders should not have to check inaccessible standards to access this information.

text: 50. The EDPS therefore recommends listing the categories of data processed under the 112 eCall in a substantive provision of the Proposal (see point 16 above).

text: 51. Furthermore, the EDPS notes that private eCall and added value services will most probably involve the processing of additional personal data by a third party, i.e. insurance companies, automobile call centres, medical companies, lawyers, motors clubs. In this regard, the EDPS recalls that, when processing data, third party service providers have to comply with the data minimisation principle meaning that only the data necessary to achieve the purpose pursued should be collected . They should therefore design technical arrangements to select only the necessary and suitable information, thus respecting the prohibition of processing of sensitive data.

text: 52. As a result, the personal data that car manufacturers can process for the purpose of private eCall or added value services should be clearly listed in the Proposal or, if this was not possible, in delegated acts. At the very least, the list of data of which the processing is prohibited should be specified in either of these legal instruments and the concept of 'full set of data' should be defined in the Proposal. 3.3 The required choice of a retention period for the data processed

text: 53. Under Directive

text: , data exchanged should only be kept for the time necessary to achieve the purposes for which they were collected and should be automatically deleted following the expiry of the retention period. This period of retention should be justified and motivated, possibly in Recitals. The EDPS notes that the retention period of the data processed for 112 eCall purpose is not specified even though this information is included in the notice that should be given to data subjects by car manufacturers. He reminds that retention periods of the data processed for mandatory e-Call purpose as well as for private e-Call/added-value services have to be determined. In in any event, the data shall not be retained longer than necessary for adequate transmission to the appropriate PSAP and the MSD should be deleted afterwards. These storage periods shall be adapted and harmonised depending on the parties and location of the data (in-car storage, PSAP databases storage). If the data were to be necessary after the expiration of the required period of storage, in particular for statistical purposes, they should be anonymised, i.e. there should be no way to identify directly or indirectly a person based on these data. The EDPS advises specifying these safeguards with regard to retention. 3.4 Ensuring security of the data processed

text: 54. Security of the processing of personal data, ensuring among other objectives confidentiality of data and preventing unauthorised access or modification, is an 25 obligation for controllers consistently established by all data protection instruments . This obligation also applies to the processing of personal data in the context of eCall systems, both for public and private eCall systems, as well as for any value-added services using the same platform.

text: 55. Data protection legislation requires that security safeguards are appropriate to the risks related to the processing of data processing operations, taking account of the state of the art and the cost of the measure. In order to implement this requirement, controllers have to apply a risk management approach based on thorough assessment of threats and vulnerabilities of their processing operations.

text: 56. Security considerations for complex embedded systems such as eCall systems concern not only the processing of personal data, but may also need to take account of other functions for which specific risks may exist, e.g. the interaction with other elements of embedded in-car systems. In particular, where an environment has to be made accessible for the installation of components provided by third parties, the complexity of security assessments may be significant.

text: 57. In general, IT based components require regular updates and maintenance, both in hardware and software components, inter alia in order to address security vulnerabilities which are frequently detected after their deployment, or for ensuring continuous compatibility with technological development. This need generally increases with the functionality and the number of interfaces supported, as well as with the lifetime of systems. The lifetime of cars and their embedded system is usually longer than that of consumer electronic products such as personal computers and mobile communications devices, increasing the likelihood of update requirements.

text: 58. Article 5(6) of the Proposal provides that eCall systems shall be “accessible to all independent operators free of charge and without discrimination at least for repair and maintenance purposes”. This requirement could mean that third parties would have the possibility to perform manipulations on the equipment, e.g. by exchanging hardware components or installing software upgrades or modifications, after the sale of the car to the consumer. Such modifications of the eCall system could affect the security of this system and other components of the car electronics connected to it.

text: 59. The Proposal and the accompanying documents do not indicate whether a comprehensive analysis of the security of the personal data processed and of other relevant risks related to the mandatory roll-out of eCall systems, including on road safety, has been performed, covering the expected lifetime of the systems, and if specific security measures will be included in the type approval process.

text: 60. While testing against appropriate standards could be one measure contributing to ensuring security, the list of standards provided in the Proposal appears to cover only certain aspects of eCall systems and may not include all relevant standards. The EDPS also notes that

text: Article 5(4)

text: requires that eCall in-vehicle systems must be “tested” for type-approval, which it is not fully in line with Recital (10) which requires that the systems are “fully tested” for type approval. To ensure consistency, and that all technical aspects are effectively tested before type approval, the EDPS recommends clarifying in

text: Article 5(4)

text: that the system needs to be 'fully tested' instead of simply 'tested'. 3.4.1 Restricting access to data on a need to know basis

text: 61. The question of access to any data stored in the in-vehicle system is also particularly relevant in relation to the desire to create an 'open access' platform. It should be clarified in the proposed Regulation under which conditions third parties providing private eCall or added value services may access data that would be stored in the invehicle system. As to the technical features that will be deployed by manufacturers to embed the eCall system in the vehicle, the Commission should promote the use of relevant standards and should also underline the necessity to ensure the interoperability of the eCall in-vehicle system with other third party applications. 3.4.2 Clarifying the modalities to exercise data subjects' rights

text: 62. The modalities of information of data subjects regarding both processing involved by 112 eCall and private eCall and added value services have been addressed above and, as already stated, this information should include information of data subjects on how to exercise their rights. However, to ensure a harmonised application of data subjects' rights, the EDPS would recommend that the contact of the services responsible for handling access requests, in every Member State, is given to data subjects within the documentation informing them about eCall.

text: 4. CONCLUSIONS

text: 63. The EDPS emphasises that the processing of personal data is one of the core obligations created by the Proposal and welcomes that many recommendations he made in relation to 112 eCall's data protection implications were taken into account.

text: 64. Regarding 112 eCall, the EDPS recommends that the following issues are further specified in the Proposal:  an explicit reference to applicable EU data protection law should be inserted in the Proposal in a substantive and dedicated provision, mentioning in particular Directive

text: and specifying that the provisions will apply in accordance with the national rules implementing it;  the reference to the

text: Article 29

text: Working Party working document is dissociated from the reference made to the data protection legislation in Recital 13;  concrete data protection safeguards applying to 112 eCall should be developed in the Proposal rather than in delegated acts and in particular that

text: Article 6

text: : - designates the controller and the authority responsible for handling access requests; - specifies the list of data referred to as a minimum set of data and as a full set of data (possibly to be elaborated in a delegated or implementing act); - includes the possibility for data subjects to deactivate private eCall and added value services; - specifies retention periods for the data processed. - specifies the modalities of the exercise of data subjects’ rights. 

text: Article 6(3)

text: should be complemented to ensure that the information it refers to is part of the technical documentation handed over together with the vehicle and it should be specified in the Proposal that the availability of the information has to be pointed out to the car owner at the time of the purchase of the car, in a separate document.  The EDPS should be consulted prior to the adoption of delegated acts foreseen in

text: Article 6(4)

text: 65. Regarding private eCall and added value services, the EDPS reminds that they are regulated by the Proposal so that they comply with similar or stricter data protection requirements than those foreseen for the 112 eCall system. He also reminds that:  the Proposal specifies that contrary to the 112 e-Call, private eCall and added value services shall be activated on a voluntary basis and deactivated by default;  the requirement for an appropriate and distinct contract between the consumer and the service provider is stated in a specific provision of the proposed Regulation and that it is clarified in the provision that this contract should cover data protection aspects, including providing appropriate information to consumers on the service(s) and collecting their consent for the processing of data in relation to the provision of these added value services. The proposal ensures that data subjects are given the choice to opt for the services, through a specific contract offer, made prior to the processing. Nonnegotiable clauses part of a car sale contract, or clauses belonging to general terms and conditions, whose acceptance is mandatory, will not fit this requirement.  It should also be stated in the contract that the refusal of the service offered will not involve adverse consequences linked to that refusal. Such a statement could appear in the privacy statement of the contract.

text: 66. The EDPS further recommends that:  it is clarified in the Proposal that constant tracking is prohibited for added value services;  the categories of data processed under the 112 eCall - and private eCall and added value services is specified in a substantive provision of the Proposal and that the concept of 'FSD' is defined in the Proposal;  only the data necessary to private eCall and added value services are processed in compliance with the data minimisation principle;  a specific provision recalls that the processing of sensitive data under private eCall and added value services is prohibited;  the retention period of data processed under 112 eCall, private eCall and added value services is determined and specified in a substantive provision of the Proposal;  security of the data processed under 112 eCall, private eCall and added value services is guaranteed by some specifications in the text. Done in Brussels, 29 October 2013 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor


text: OJ L281, 23.11.1995, p. 31. 2 OJ L8, 12.1.2001, p. 1. 3 COM(2013) 449 final. 4 Executive Summary of the Impact Assessment (SWD(2013) 223 final), Section 3.1, page 4. 5 Idem, Section 5.3.4, page 7. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: For the latter, see judgment of the CJEU in Schecke (

text: and

text: ), [2010] ECR I-11063, paras. 52- 53. 7 See Impact Assessment, Section 2.1.2, pages 12-13.

text: Idem, page 13, fourth paragraph. 9 On the concept of purpose limitation, see Opinion 03/2013 on Purpose Limitation of the

text: Article 29

text: Data Protection Working Party adopted on 2 April 2013. On exceptions under

text: Article 13

text: , see specifically Section III.3 of the Opinion. 10 See paragraph 19 below.

text: See

text: Article 6(1)

text: (b) and (c) of Directive

text: . 12 On data protection by design, see Article 23 of the Commission proposal for a Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data (COM(2012)11 final). See also paras 177-182 of the 7 March 2012 EDPS Opinion on the data protection reform package, available at http://www.edps.europa.eu/EDPSWEB/edps/Consultation/Reform_package;jsessionid=46ACCFDB9005EB9 50DF9C7D58BDE5377.

text: An example of data protection by design could be to automatically flag data fields that may contain/or do contain personal data, so that it could be deleted automatically when using the data for further purposes, sharing the data with third parties, or publishing it. This can help minimise unnecessary data sharing (e.g. with tax authorities, or in case of publication). 14 CJEU, Schecke (

text: and

text: ), [2010] ECR I-11063, para. 81.

amnesord:
Privacy by Design
Finance & Economy
Tax cooperation

title: Electronic invoicing in public procurement

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION

text: 1. On 26 June 2013, the Commission adopted a proposal for a Directive of the European Parliament and of the Council on electronic invoicing in public procurement ('the Proposal'). On 8 July 2013, the Proposal was sent to the EDPS for consultation.

text: 2. The objective of the Proposal is to 'diminish market access barriers in cross-border public procurement, generated by insufficient interoperability of e-invoicing standards.' To achieve this, a 'new, common European standard would be developed and made available for use by all market operators. Acceptance by all contracting authorities of e-invoices compliant with this standard would be required in public procurement, without replacing existing technical solutions.'

text: 2. ANALYSIS OF THE PROPOSAL 2.1. General comments Personal data processing in the context of e-invoicing

text: 3. While the main objective of the Proposal is not the processing of personal data, processing e-invoices under the Proposal may nevertheless require the processing of certain amount of personal data. Therefore, data protection is a relevant consideration for e-invoicing.

text: 4. First, certain elements (data fields) of the e-invoices may contain personal data. The contracting entities can be either legal or natural persons. Where the contracting entities are natural persons, their data will be considered personal data. This will also be the case where the official title of the legal person identifies one or more natural persons .

text: 5. Further, in cases where the contracting entities need to evidence that they have provided certain services (e.g. medical, social or educational services) to a number of defined individuals, the information that they may need to submit to the contracting authority will contain personal data regarding these individuals. This may sometimes also include sensitive data, for example, in the health and social sector the information may include the type of medical/psychological treatment or social services provided, which are linked (or can be linked), to the names of the individuals to whom these treatments/services were provided.

text: 6. Finally, if and when the data contained in the e-invoices will be used for further purposes that ultimately aim linking the data to specific individuals (such as corporate officers, shareholders or employees of a company) - for example, to investigate a specific incident of tax fraud - the initially seemingly innocuous and non-personal data on the invoices will also be considered personal data.

text: 7. In all these cases, personal data will require appropriate protection, and the national rules transposing Directive

text: become applicable. Benefits and risks of e-invoicing: easier access in machine-readable format provides more room for 'mission creep'

text: 8. The EDPS supports the objective of the Commission to facilitate the move towards paperless e-invoicing and recognises the benefits of e-invoicing, which include simpler and shorter processing times, and resulting cost savings, as well as reduction of paper 7 waste and CO2 footprint.

text: 9. At the same time, he also calls attention to the privacy and data protection risks that will be increased as a result of the increasing availability of invoice data in paperless and machine-readable form for further purposes, including automated profiling and datamining for tax and law enforcement purposes, that are currently not regulated in the Proposal, and only briefly and generally mentioned in the accompanying Impact Assessment.

text: 10. As discussed in the Impact Assessment , these additional purposes may bring additional benefits: 'The electronic processing of invoices positively influences the transparency of the procurement process. When a tax audit occurs, e-invoices can be more easily made available to tax authorities than paper invoices, allowing them to check for compliance more easily.' E-invoicing also 'significantly reduces operational risk of fraudulent invoices and duplicate payments'. Further, if 'e-invoicing is integrated with tax reporting, it can reduce administrative burden, as tax declarations can be generated automatically.'

text: 11. Tax authorities and law enforcement authorities may - in general - more efficiently access and further process the data to help reduce tax fraud and combat other forms of crime, if and when they are given access to the data. In particular, new opportunities will arise with regard to profiling and data-mining. This is not specifically mentioned in the Proposal or in the Impact Assessment, but the Proposal does not exclude this either.

text: 12. Similarly, publication of any part of the invoice data, or preparation of statistical datasets using the invoice data, will become a much easier task. If and when data based on the e-invoices will be published, this may increase the transparency of the procurement process. Purpose limitation: limits on acceptable further use of data

text: 13. Despite all these benefits, increasing availability of the data in machine-readable format will also pose the risk of mission creep, that is, use of the data for initially unforeseen purposes. These initially unforeseen purposes may or may not be compatible with the original purposes foreseen. Use of the data for these additional purposes may or may not be permissible and - if allowed - may require additional data protection safeguards.

text: 14. In the context of e-invoicing, subject to appropriate data protection safeguards, epayments and e-archiving may, in principle, be considered as compatible purposes. Some other further purposes, on the other hand, such as using the archived data for data mining to help reduce tax fraud will likely not be considered as compatible, and may only be possible, if at all, subject to the exceptions and strict criteria under

text: Article 13 of Directive 95/46/EC

text: . Importance of appropriate data protection safeguards

text: 15. For these reasons, the EDPS welcomes the reference in recital (6) and Article 3(1) of the Proposal to the protection of personal data and to Directive

text: 16. At the same time, he recommends further improvements in the precise drafting of these provisions, and proposes a limited number of additional safeguards to be outlined in the Proposal, as set out below. 2.2. Specific comments Reference to applicable data protection law and EDPS consultation

text: 17. The EDPS recommends clarifying that the Proposal is not meant to provide for general derogations from data protection principles and that relevant personal data processing legislation (national law implementing Directive

text: ) remains fully applicable in the e-invoicing context. This should preferably be done in a substantive provision in the operative part of the text, possibly supplemented by a dedicated recital.

text: 18. Further, the EDPS recommends adding a recital referring to the fact that he has been consulted and issued this Opinion. European standard for the semantic data model of the core electronic invoice

text: 19. Article 3(1) of the Proposal provides that the 'Commission shall request the relevant European standardisation organisation to draw up a European standard for the semantic data model of the core electronic invoice'. The same paragraph further provides that 'the Commission shall require that the European standard for the semantic data model of the core electronic invoice ... guarantee personal data protection in accordance with Directive

text: 20. In order to ensure appropriate protection for personal data, it is indeed essential that the standardised elements of the e-invoices, that are foreseen to be provided for in the new European standard, be designed so as to contain no more personal data than what is necessary for purposes of processing the e-invoices (and for any further purposes that are compatible with this purpose), in accordance with the principles of proportionality, 11 data minimisation and purpose limitation. This is also in accordance with the principle of data protection by design, which requires that data protection concerns be taken into account from the very beginning.

text: 21. For these reasons, the EDPS welcomes that the Proposal requires that data protection safeguards be considered right from the outset when developing the standard. On the other hand, he also calls attention to the fact that a good and well-considered standard, while it can go some way to help address data protection concerns, cannot in itself 'guarantee' personal data protection.

text: 22. Based on these considerations, and to further improve the provision, the EDPS recommends that the provision be slightly reworded and require that  the standard help ensure compliance with Directive

text:  in accordance with the principle of data protection by design, and  in particular, that the standard must ensure - in accordance with the principles of proportionality and data minimisation - that the elements of the e-invoice contain no more personal data than what is necessary for purposes of processing the e-invoices (and for any further purposes that are compatible with this purpose).

text: 23. In addition, the EDPS recommends that the following (or similar) specification be added to the Proposal:  Unless otherwise specified in EU or national law and subject to appropriate safeguards under

text: Article 13 of Directive 95/46/EC

text: , personal data in e-invoices shall be only used for purposes of processing the e-invoices (and for any further purposes that are compatible with this purpose), in accordance with the principle of purpose limitation. Publication of information

text: 24. As noted above, the Proposal does not state explicitly that e-invoices, or any data (for example statistical data) derived from them would be made publicly available and if so, whether such publication could include personal data.

text: 25. If it is the intention of the legislator to provide for the publication of personal data, or if it is foreseen that this may happen at least in some Member States, for example, to increase transparency and accountability, the EDPS recommends including explicit provisions to that effect in the Proposal.

text: 26. As a minimum, a substantive provision should clarify what kind of personal data may be made public and for what purpose(s). In this context, attention is drawn to the Schecke judgment in which the Court of Justice underlined that, in order to strike a proper balance between the various interests involved, the EU institutions must take into consideration methods of publishing information which would be consistent with the objective of such publication while at the same time causing less interference with an individual’s right to respect for their private life and to protection of their personal data .

text: 27. An alternative to providing a harmonised solution to publication at the EU level would be adding a provision in the Proposal stating that  EU or national law must specify, subject to appropriate safeguards under

text: Article 13 of Directive 95/46/EC

text: that a necessary and proportionate amount of personal data, in particular, those relating to the contracting entities, may be published for purposes of transparency and accountability. Such law should also specify that further use of the data for incompatible purposes is not permitted.

text: 3. CONCLUSIONS

text: 28. The EDPS appreciates that certain data protection issues have been taken into account in the Proposal. In this Opinion he gives recommendations on how the Proposal could be further improved from a data protection perspective.

text: 29. In particular, the EDPS recommends:  including a substantive provision to clarify that the Proposal is not meant to provide for general derogations from data protection principles and that relevant personal data protection legislation (i.e. national rules implementing Directive

text: ) remain fully applicable in the context of e-invoicing;  amending Article 3(2) of the Proposal to ensure that the European standards to be adopted will follow a 'privacy by design' approach and ensure that data protection requirements are taken into account, and that the standards will respect, in particular, the principles of proportionality, data minimisation and purpose limitation;  should it be the intention of the legislator to provide for the publication of personal data for purposes of transparency and accountability, including explicit substantive provisions that would specify what kind of personal data may be made public and for what purpose(s); alternatively, including a reference to EU or national law, which should, in turn, provide appropriate safeguards. Done in Brussels, 11 November 2013 (signed) Giovanni BUTTARELLI European Data Protection Assistant Supervisor