text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3 COM (2012) 736 final. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: See below under Section 2.3.1. 5 See ECHR 17 July 2008, I v Finland (appl. No 20511/03), paragraph 38 and ECHR 25 November 2008, Armonas v Lithuania (appl. No 36919/02), paragraph 40.

text: See EDPS Opinion on the data protection reform package, para. 298 and 299, 7 March 2012, available at: www.edps.europa.eu. 7 15 February 2007. 8 Recommendation No.R (97) 5 on the protection of medical data (13 February 1997). 9 See in particular EDPS Opinion on the proposal for a Directive of the European Parliament and of the Council on the application of patients' rights in cross-border healthcare, OJ C 128, 6.6.2009, p.20, EDPS Opinion on the proposal for a decision of the European Parliament and of the Council on serious cross-border threats to health, 28 March 2012, EDPS Opinion on the proposal for a Regulation on clinical trials on medicinal products for human use, and repealing Directive

text: and EDPS Opinion on the proposals for a Regulation on medical devices, and amending Directive

text: Regulation (EC) No 178/2002

text: and

text: Regulation (EC) No 1223/2009

text: See EDPS Opinion on the proposals for a Regulation on medical devices, and amending Directive

text: Regulation (EC) No 178/2002

text: and

text: Regulation (EC) No 1223/2009

text: and a Regulation on in vitro diagnostic medical devices, 8 February 2013 available at: www.edps.europa.eu. 11 For an analysis of the legal framework applicable to the processing of personal data in the distribution and usage of mobile apps, please see the recently published Opinion of the

text: Article 29

text: Working Party on apps on smart devices, WP 29 Opinion 2/2013,

text: WP 202

text: of 27.02. 2013.

text: This could indicate that if personal data concerning health is only allowed to be used for the treatment of the individual it relates to or if the patient has given his or her consent for some of the data to be used in a study or wider analysis.

amnesord:
ePrivacy Directive
Rights of the Individual
Privacy by Design
Health
mHealth
Research & Science
Surveillance
Profiling
Mobile Devices & Apps

title: eHealth Action Plan 2012-2020

text: Opinion of the European Data Protection Supervisor

text: on the Communication from the Commission on 'eHealth Action Plan 2012-2020 - Innovative healthcare for the 21st century'

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free 2 movement of such data , and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 6 December 2012, the Commission adopted a Communication on the 'eHealth Action Plan 2012-2020 - Innovative healthcare for the 21st century' 3 (the Communication) . This Proposal was sent to the EDPS for consultation on 7 December 2012.

text: 2. Before the adoption of the Communication, the EDPS was given the possibility to provide informal comments to the Commission. He welcomes that some of his comments have been taken into account in the Communication. 1.2. Objectives and scope of the Communication and aim of the EDPS Opinion

text: 3. The Communication establishes an eHealth Action Plan for 2012-2020. The Action Plan presents the view that Information and Communication Technologies (ICT) applied to healthcare and well-being can improve the efficiency and effectiveness of healthcare systems, empower the individual citizen and unlock innovation in the health and well-being markets.

text: 4. This EDPS Opinion is to be seen in the light of the growing importance of eHealth in the evolving information society and of the ongoing policy debate within the EU on eHealth. The Opinion focuses especially on the implications of the fundamental right to data protection for eHealth initiatives. It also comments on the areas for further action identified in the Communication.

text: 2. ANALYSIS OF THE PROPOSAL 2.1. General comments 2.1.1. Data protection in the Communication and reference to applicable legislation

text: 5. The EDPS welcomes the recognition of the relevance of data protection for eHealth in a subsection to section 4.3 of the Communication, which is named 'Empowering citizens and patients: review of data protection rules' (data protection subsection).

text: 6. The EDPS welcomes the fact that the draft Communication makes reference to the proposed general Data Protection Regulation. However, until the proposed new legislation enters into force -this may take a few years- the current legal framework for data protection will remain applicable.

text: 7. The EDPS therefore recommends the Communication to refer to the current data protection legal framework set forth under Directive

text: and Directive

text: , which contains the relevant data protection principles that are currently applicable. These rules are to be respected for any action to be taken in the short to medium term until the proposed revised Data Protection legislative package will enter into force. 2.1.2. Patients´ empowerment and right to self determination

text: 8. The EDPS welcomes the emphasis put in the Communication on the empowerment of the patient and the respect of his/her right to selfdetermination. He also welcomes references to the rights to be forgotten and to data portability as foreseen in the proposed Data Protection Regulation. The EDPS wishes to underline that the rights to have access to one's own personal data and to be informed in a clear and transparent manner of how these data are processed through health and well-being technologies also contribute to such empowerment. However, the EDPS notes that the importance of these rights in the context of eHealth has not been made clearer in the Communication. In particular, he therefore encourages the Commission to draw the attention of (data) controllers acting in the field of eHealth to the necessity to provide individuals with clear information about the processing of their data in eHealth applications as the cornerstone of patient empowerment in this area. 2.2. Personal data concerning health

text: 9. Data processing in the context of eHealth and well-being ICT often involves the processing of personal data -of the patients, of any other data subject involved, and of health professionals- in the sense of

text: Article 2

text: (a) of Directive

text: 10. The Communication distinguishes between health data and well-being data. The EDPS would like to underline that both categories of data may involve the processing of personal data relating to health.

text: 11. Processing of such data is subject to strict data protection rules as laid down in

text: Article 8 of Directive 95/46/EC

text: and its implementing national laws (and as foreseen in Article 9 of the proposed Data Protection Regulation). The EDPS wishes to underline that this sets a high standard with which compliance must be ensured and wishes to underline the guidance already given to controllers and processors in the area .

text: 12. Furthermore, the importance of protecting personal data concerning Health has repeatedly been emphasised by the European Court of Human Rights in the context of Article 8 of the European Convention of Human Rights. The Court has stated: ‘The protection of personal data, in particular medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention’ . 2.3. Comments on data protection issues in section 4.3 of the Communication 2.3.1. The role of data protection in eHealth

text: 13. As a first point, the EDPS would like to emphasise that compliance with data protection requirements, in particular in the field of eHealth, should not be seen as a barrier to the deployment of ICT but as a main enabler of trust. These data protection requirements ensure for instance that data are kept accurate, that users are provided with relevant information about the processing operations to be carried out and have the means to exercise a degree of control over their own data, and that appropriate security and confidentiality measures are implemented across the entire chain of processing.

text: 14. Therefore, the EDPS welcomes the second paragraph on page 9 of the Communication stating that 'Effective data protection is vital for building trust in eHealth. It is also a key driver for its successful cross-border deployment, in which harmonisation of rules concerning cross border exchange of health data is essential' and the reference in footnote 34 to the EDPS Opinion on the Data protection Reform.

text: 15. The EDPS agrees that it is essential that there must be clear rules on handling health data and believes that the main problem thus far has not been the lack of clarity of these rules at national level but rather the lack of sufficient harmonisation within the EU of the rules concerning the processing of health data .

text: 16. The EDPS would like to underline that guidance has already been provided on the application of the current data protection rules in the area of health, in particular by the

text: Article 29

text: Working Party in its working document on the processing of personal data relating to health in electronic health records 7 8 (EHR) , and by the Council of Europe . The EDPS also has provided advice in connection with EU legislative proposals on health data and has highlighted in his Opinions how the relevant data protection principles under the current legal framework must be applied in that context . The EDPS notes that the availability of such guidance in respect of eHealth processing operations taking place under the current legal framework has not been emphasised in the Communication with specific references to the relevant documents.

text: 17. The EDPS welcomes, however, the clear link to the Staff Working Document on the applicability of the existing EU legal framework to telemedicine services, which contains useful information about the existing data protection legal framework and which was presented together with the Action plan. 2.3.2. Future guidance on the processing of Health data

text: 18. The EDPS welcomes that the Commission will be preparing guidance on how the processing of health data should be done under the new data protection framework. In view of the challenges described in the data protection subsection, such guidance should not only cover data portability and the right to be forgotten but also other challenging areas such as the concept of ownership of the data, the conditions of access and re-use of health data for research purposes, public health purposes, or possible additional purposes (such as current open data initiatives), or the use of cloud computing infrastructure and services for health and well-being data processing.

text: 19. The EDPS believes that guidance would be particularly helpful on the issue of identifying who is the controller and on the responsibilities of the different operators involved in eHealth and well-being ICT, including of the designer of the ICT. He recommends that the Commission consults the

text: Article 29

text: Working Party, in which the EU national data protection authorities are represented, and the EDPS in the preparation of such guidance. 2.3.3. Design of eHealth and well-being ICT, medical devices and mobile applications

text: 20. The EDPS welcomes that the Communication underlines that the design of eHealth and well-being ICT should implement the principle of privacy by design and by default and make use of Privacy Enhancing Technologies (PETs) as foreseen in the proposed data protection regulation and that the Communication makes reference to the principle that controllers shall be accountable for their data processing, carry out data protection impact assessments, and comply with strengthened security requirements.

text: 21. The Communication makes a reference to the Commission proposals to strengthen the European regulatory framework for medical devices and in vitro medical devices. In this context, the EDPS would like to emphasise the data protection concerns highlighted in his recent Opinion on these proposals .

text: 22. The use of m-health and health and well-being mobile apps poses considerable and new data protection challenges and must therefore also be analysed from a data protection perspective, with due account of the data protection legal framework and of the e-Privacy rules set forth in Directive

text: . Similarly to other forms of processing, general data protection principles are particularly relevant in the design and deployment of innovative mobile apps relating to health and well-being. In particular, the application of the principle of privacy by design and the use of PETs would allow data protection and privacy requirements to be embedded in such apps at the stage of their design.

text: 23. For these reasons, the EDPS would like to be consulted before the adoption by the Commission of the planned Green paper on an EU framework applicable to m-health and health and well-being mobile apps. 2.4. Specific comments on other parts of the Action Plan 2.4.1. Supporting research, development and innovation in eHealth

text: 24. In Section 5.1. of the Communication, it is stated that 'There will be an additional focus on ways of analysing and mining large amounts of data for the benefit of individual citizens, researchers, practitioners, businesses and decision makers.' The EDPS notes that the Communication does not underline that any data mining is only acceptable in very limited circumstances and provided that full account is taken of data protection rules; he encourages the Commission to draw the attention of controllers to this fact.

text: 25. To the greatest extent possible, any processing of large amounts of data for purposes of analysis should be done on the basis of anonymous data. In the context of health, the use of non-anonymous data may nonetheless be justified in certain cases for specific purposes (such as the study of epidemics, heredity, etc). However, the cases in which data mining may involve personal data and the extent of such personal data processing (e.g. the types of data processed) must be assessed on a case-by-case basis. Furthermore, the persons who are authorised to access these data and the modalities for such access should be clearly defined.

text: 26. The defined standards and/or common guidelines to be developed in the context of pre-commercial procurement and public procurement of innovation should include rules on data handling including also safe deletion when data are no longer needed for the purposed envisaged. 2.4.2. Profiling

text: 27. It is not clear what is meant under the objectives to have 'an ICT and computational science framework for digital, personalised and predictive medicine'. To achieve such types of personalisation through ICT may require building up profiles of individuals on the basis of compiling data from different sources (e.g. user generated-data combined with health records). The combination of data for purpose of building up profiles raises serious data protection concerns, in particular if they lead to decisions being taken that may affect individuals (e.g. insurance companies may decide not to insure someone if they have access or require access to the health profile of an individual which shows predictions of a high probability of cancer). Hence, the EDPS notes that the Communication does not underline that profiling should only be done in very limited circumstances and provided that strict data protection requirements are met (e.g. as set forth in Article 20 of the proposed Data Protection Regulation) and recommends the Commission to remind controllers of this important obligation. 2.4.3. Facilitating wider deployment and supporting user skills and literacy

text: 28. The EDPS welcomes the work planned by the Commission in supporting the work of the eHealth network, in defining a minimum dataset for health records, in providing guidance on electronic identification and authentication used in eHealth and in advancing the security and interoperability of databases for medicinal products. He wishes to underline that the work on all these topics should be done in accordance with data protection requirements. This was recognised explicitly in

text: Article 14(2)

text: last paragraph of Directive 2011/24 on the application of patients' rights in cross-border healthcare. Similarly, the EDPS recommends that the work of the Commission in these areas shall be pursued in due observance of the principles of data protection as set out, in particular, in Directives

text: and

text: 29. The EDPS also welcomes actions to promote skills and health literacy. He, however, would like to stress that the information to citizens on the benefits and hazards of eHealth solutions should also include the required data protection information, including on how their data are processed and how they can control them. The EDPS therefore notes that the Communication does not include data protection as part of the promotion of skills and health literacy and recommends that the Commission considers data protection in any actions undertaken in this respect. 2.4.3. Fostering EU-wide standards, interoperability testing and certification of eHealth

text: 30. There are many data protection risks to take into account for building up a common European eHealth Interoperability Framework (e.g. data quality and reliability, confidentiality, access restrictions, further use and purpose limitation principle, etc). Article 33 of the proposed Data Protection Regulation foresees for many processing operations, including for those on health data, that data protection impact assessments (DPIA) should be carried out before launching any interoperable system. The EDPS therefore recommends that the Commission carries out such a DPIA already today, before any further action is undertaken in this context.

text: 31. The particular sensitivity of personal data concerning health and its protection under EU data protection legislation requires that the observation of data protection safeguards becomes an integral feature of the eHealth Interoperability Framework at all levels. Transfers of health data within and between jurisdictions must be executed in such a way that additional information required to respect purpose limitation and other constraints on the processing of the data is transmitted together with the data in an interoperable format that both sender and receiver can understand.

text: 32. The EDPS also urges the Commission, when examining the interoperability of health records, to look into possible legislative initiatives at EU level, as he believes that such interoperability would benefit from a strong legal basis, which would include specific data protection safeguards.

text: 3. CONCLUSIONS

text: 33. The EDPS welcomes the attention paid specifically to data protection in the proposed Communication, but identified some scope for further improvement.

text: 34. The EDPS underlines that data protection requirements should be appropriately considered by industry, Member States and the Commission when implementing initiatives within the eHealth area. In particular he:  emphasizes that personal data processed in the context of eHealth and wellbeing ICT often relate to health data, which require a higher level of data protection and underlines the guidance already given to controllers and processors in the area;  notes that the Communication does not refer to the current data protection legal framework set forth under Directive

text: and Directive

text: , which contains the relevant data protection principles that are currently applicable and reminds the Commission that these rules are to be respected for any action to be taken in the short to medium term until the proposed revised Data Protection Regulation enters into force;  notes that the importance of the data subject's rights of access and information in the context of eHealth has not been made clear in the Communication. He therefore encourages the Commission to draw the attention of controllers active in the field of eHealth on the necessity to provide clear information to individuals about the processing of their personal data in eHealth applications;  notes that the availability of guidance in respect of eHealth processing operations taking place under the current legal framework has not been emphasized in the Communication with specific references to the relevant documents and recommends that the Commission consults the

text: Article 29

text: Working Party, in which the EU national data protection authorities are represented, and the EDPS in the preparation of such guidance;  recommends consulting the EDPS before the adoption by the Commission of a Green paper on an EU framework applicable to m-health and health and wellbeing mobile apps;  notes that the Communication does not underline that any data mining using non-anonymous health data is only acceptable under very limited circumstances and provided that full account is taken of data protection rules and encourages the Commission to draw the attention of controllers to this fact;  underlines that profiling should only be done in very limited circumstances and provided that strict data protection requirements must be met (e.g. as set forth in Article 20 of the proposed Data Protection Regulation) and encourages the Commission to remind controllers of this important obligation.  reminds the Commission that any future work in the areas of facilitating wider deployment, supporting user skills and literacy should be pursued in due observance of the principles of data protection;  recommends that the Commission carries out a data protection impact assessment in the context of the development of a common European eHealth Interoperability Framework, before any further action is undertaken;  urges the Commission, when examining the interoperability of health records, to look into possible legislative initiatives at EU level, as he believes that such interoperability would benefit from a strong legal basis, which would include specific data protection safeguards. Done in Brussels, 27 March 2013 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor


text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3 COM (2012) 744 final.

text: Proposal for a Regulation of the European Parliament and of the Council amending Council Regulation (EC) N°1346/2000 on insolvency proceedings (hereinafter: "the Proposal"). 5

text: Article 46

text: a. 6 Recitals 31b and 31c.

text: Article 3 (2) of Directive 95/46/EC

text: states that : "This directive shall not apply to the processing of personal data in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law [...].

text: Joined Cases

text: and

text: , Schecke, paras 56-64. 9 See in this regard also EDPS Opinion of 9 October 2012 on the Amendment to the Commission proposal on the financing, management and monitoring of the common agricultural policy, available at http://www.edps.europa.eu/EDPSWEB/edps/Consultation/Opinions. 10 See in this regard also EDPS Opinion of 15 April 2011 on the Financial rules applicable to the annual budget of the Union, OJ C 215, 21.7.2011, p. 13–18. 11 See impact assessment page 29, first paragraph.

text: Judgment in Joined Cases

text: and

text: Volker und Markus Schecke GbR and Hartmut Eifert v Land Hessen.

text: See also paragraph 13 and footnote 7 above.

text: Similar to

text: Article 14

text: and following of the proposed regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data issued by the Commission on 25 January 2012, COM/2012/09 final. 15 See

text: Article 6

text: (d) of Directive

identifier: EDPS yttrande (2013)

amnesord:
Necessity & Proportionality
Transfers of data
Finance & Economy
Judicial Cooperation

publisher: Europeiska datatillsynsmannen

sprak: en

title: Insolvency proceedings

serie: yttranden

text: Opinion of the European Data Protection Supervisor

type: stycke

text: on the Commission proposal for a Regulation amending

text: Council Regulation (EC) No 1346/2000

text: on insolvency proceedings

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free 2 movement of such data , and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 12 December 2012, the Commission adopted a proposal for a Regulation amending

text: Council Regulation (EC) No 1346/2000

text: on insolvency proceedings 3 (‘the proposed Regulation’) . This Proposal was sent to the EDPS for consultation on 13 December 2012.

text: 2. The EDPS welcomes the fact that he is consulted by the Commission and that a reference to this Opinion is included in the preambles of the proposed legal instrument.

text: 3. Before the adoption of the proposed Regulation, the EDPS was given the opportunity to provide informal comments to the Commission.

text: 4. The EDPS regrets that only a few of his comments have been taken into account in the proposed Regulation. Even though an article is now dedicated to data protection, safeguards have not been strengthened accordingly. 1.2. Objectives and scope of the proposed Regulation

text: 5. The proposed Regulation amends the Insolvency Regulation in order to cope with weaknesses revealed in its practical application . It inter alia addresses issues relating to the scope of the Regulation, the determination of the Member State competent to open the proceedings, the opening of secondary proceedings and the rules on publicity of decisions opening and closing insolvency proceedings.

text: 6. Amongst the measures proposed that will impact data protection, the Proposal provides for a mandatory publication of the decisions opening or closing a proceeding and encourages and organises cross-boarder exchanges of information between stakeholders.

text: 7. Information thus published and/or exchanged may identify (either directly or indirectly) debtors, creditors, and liquidators involved in the proceeding. Therefore, EU data protection legislation applies. In particular, Directive

text: will apply to the processing of data by stakeholders in Member States and by national competent authorities, while

text: Regulation (EC) 45/2001

text: will apply to the processing of data by the Commission through the e-Justice Portal. 1.3. Aim of the EDPS Opinion

text: 8. The proposed Regulation may affect the rights of individuals related to the processing of their personal data as, amongst other issues, it deals with the publication of personal data in a register accessible to the public on the Internet, free of charge, with the interconnection of existing national registers and with cross border exchange of information between stakeholders.

text: 9. Although the EDPS welcomes the effort made by the Commission to guarantee the correct application of EU rules concerning the protection of personal data in the proposed Regulation, he has identified some shortcomings and inconsistencies in the way the proposed Regulation deals with issues related to/concerning personal data.

text: 2. ANALYSIS OF THE PROPOSAL 2.1. General reference to data protection legislation

text: 10. Both substantive provisions and proposed Recitals of the Regulation refer to the applicable data protection legislation, namely Directive

text: and

text: Regulation (EC) No 45/2001

text: . Also, a reference is made to Article 8 of the Charter of Fundamental Rights, thus emphasising the relevance of the protection of personal data in the context of the Proposal.

text: 11. Considering that insolvency proceedings described in the Proposal necessarily involve processing of personal data (collection, storage, cross-border exchange of information including personal data between stakeholders, publication of data relating to proceedings), these references to data protection law are welcomed.

text: 12. Moreover, the EDPS welcomes that

text: Article 46

text: a is dedicated to data protection and that a sensible distinction is made between the data processed at the Member States level for which the Directive

text: shall apply and the ones processed at the EU level by the Commission, to which

text: Regulation (EC) No 45/2001

text: shall apply.

text: 13. However, the EDPS recommends once again a necessary clarification of the reference to Directive

text: by specifying that the provisions will apply in accordance with the national rules which implement it. Besides, the EDPS wishes to remind that in various Member States national provisions implementing Directive

text: do not apply to processing operations in the framework of criminal proceedings eventually related to the insolvency proceedings referred to in the proposed Regulation, pursuant to

text: Article 3 (2) of Directive 95/46/EC

text: . The reference to Directive

text: in

text: Article 46

text: a therefore shall be read as "subject to national legislation implementing Directive 95/46" and "provided that processing operations referred to in Article 3 (2) of Directive 95/46 are not concerned". Moreover, the processing of personal data by civil courts and individuals eventually acting on their behalf (i.e. liquidators) may require specific attention as well, due to the fragmented transposition of Directive 95/46 to the judicial activities of civil courts.

text: 14. Furthermore, although the intent of these aforementioned references is welcome, the EDPS regrets that they are not further developed. Considering the extent to which the proposed Regulation interferes with debtors' right to protection of private life, general references to the applicable data protection legislation are indeed necessary but not sufficient to effectively guarantee the right to protection of personal data during insolvency proceedings.

text: 15. Therefore, the general references need to be specified and translated into concrete safeguards that will apply for any situation in which personal data processing is envisaged. Such safeguards should be developed in the proposed Regulation. For instance, the retention period of the data processed and sometimes published for insolvency proceedings should be specified. Besides, it is not sufficiently clear who is responsible for the data published and, as a result, who should update the data and ensure it is secured enough. In other words, data controllers should be designated. In addition, substantive provisions are needed to further develop in a concrete manner the modalities according to which the existing rights of the data subject about whom data is collected and processed may be exercised against the various actors in such a specific area. Finally, to ensure harmonisation throughout the EU, the responsibility to set up those data protection safeguards should be taken on by the European legislator. Advice on how to formulate these safeguards will be developed below. 2.2. Public register of court decisions regarding insolvency proceedings accessible on the Internet free of charge

text: 16. One of the main objectives of the proposed Regulation is to improve the publicity given to courts decisions regarding insolvency proceedings.

text: 17. The proposed Regulation deals inter alia with the issue of mandatory publication of court decisions regarding insolvency proceedings in public registers accessible on the Internet, free of charge.

text: 18. Recital 6 of the Proposal considers the mandatory publication of relevant decisions in cross-borders insolvency cases in a publicly accessible electronic register necessary to improve the information of creditors and courts involved. It specifies that the Regulation should provide for the interconnection of insolvency registers by way of implementing act.

text: 19. The new recitals 29 and 29a explain the aim of this publication, namely improving the information of creditors and courts involved and preventing the opening of parallel insolvency proceedings, assert the necessity of a mandatory publication and of the interconnection of insolvency registers.

text: Article 20

text: a provides for the establishment of insolvency registers and lists data that should be subject to publication. The EDPS welcomes this article that leaves no margin of manoeuvre to Member States as to which data should or should not be published.

text: 21. The EDPS acknowledges that the aims pursued by the Commission in the proposed Regulation are legitimate. He understands the importance of transparency regarding the opening and the closing of insolvency proceedings and the need for creditors and courts involved to be well informed and to avoid the parallel opening of insolvency proceedings.

text: 22. Nevertheless, the systematic and mandatory publication of data has to comply with the principles of necessity and proportionality, also taking into account its potentially intrusive nature. In other words, measures proposed have to be limited to what is appropriate to achieve the objective pursued and should not go beyond what is necessary to achieve it.

text: 23. The EDPS therefore welcomes that categories of data to be collected and published are specified and limited to what is strictly necessary and that the publication obligation will not apply to an individual not exercising an independent business or professional activity.

text: 24. However, there is still no sufficient evidence that this publication on a register accessible to the public on the Internet and free of charge, as it is currently formulated, meets the requirements of data protection as clarified by the Court of Justice in the Schecke ruling, in which the Court of Justice underlined that the institutions should explore different methods of publication to find the one which would be consistent with the objective of publication, while causing the least interference with the beneficiaries' rights to private life and to protection of personal data. The EDPS takes the view that the necessity and proportionality of this particular measure are not sufficiently established and that, in any event, adequate safeguards should be provided. Necessity and proportionality of the publication

text: 25. It should be borne in mind that for assessing the compliance with data protection requirements of a provision requiring public disclosure of personal information, it is of crucial importance to have a clear and well-defined purpose which the envisaged publication intends to serve. Only with a clear and well-defined purpose can it be assessed whether the publication of personal data involved is actually necessary and proportionate.

text: 26. After examining the proposal, the Explanatory memorandum and particularly the impact assessment, the EDPS takes the view that the proportionality of this measure is not clearly established. It is not explained how a publication on the Internet in a register easily accessible to the public will better serve the desired objective of transparency amongst stakeholders than any of other conceivable alternatives, such as: (i) a public register not accessible on the Internet (see also point 31 on external/internal search engines), or (ii) a public register only accessible to professionals. More balanced solutions would allow being more selective about the number of people having direct and justified access to the information and, therefore, would lower the risks linked to Internet publication. In that perspective, a reflection is also recommended on the proposed free of charge approach on access, since -for instance- a public register that would display a selection of information for free, but with a minimum fee charged for access to complete data may contribute to the recommended application of the principle of the need-to-know.

text: 27. The impact assessment does not indicate whether less intrusive methods than an Internet publication might have let to the same results in terms of information while at the same time causing less interference with the privacy rights of the individuals concerned.

text: 28. Today, not all Member States give access to insolvency registers on the Internet. Some favour less intrusive methods of publication. They publish the information "in an electronic register or database, e.g a company register or an electronic version of the official bulletin" .

text: 29. In the EDPS' view, this option is more proportionate and therefore preferred compared to a publication on the Internet. Moreover, it complies with the case law of theCourt of Justice of the European Union.

text: 30. The EDPS wishes on that to highlight once again the Schecke ruling .

text: 31. Moreover, the publication on Internet raises two specific issues: 1) how to ensure that the information is kept online for no longer than is necessary and that the data cannot be manipulated or altered; 2) the use of external search engines entails the risk that the information could be taken out of context and channelled through and outside the web in ways which cannot be easily controlled.

text: 32. Therefore, the EDPS recommends that the proportionality of the proposed system be carefully assessed and that it is verified whether the publication on the Internet is actually necessary to achieve the public interest objective pursued or whether there are less intrusive measures to attain the same objective. The need for adequate safeguards

text: 33. The EDPS recommends introducing more detailed provisions on the modalities of establishment and management of the national registers in the proposed Regulation. Such provisions must comply with the requirements of Directive

text: 34. The impact assessment states that the inclusion of data on natural persons and other debtors who are subject to insolvency proceedings within public electronic registers constitutes a data processing activity and affects the right to the protection of personal data. It draws the conclusion that "for this impact to be considered necessary and proportionate with respect to the objectives of the policy, specific provisions will need to be introduced in the amending Regulation to justify the necessity and purpose of each category of data to be published by Member States. Further the right to access to data subjects encompassing the right to rectification and erasure will need to be highlighted. Finally, access to data in the register of another Member State, especially data on natural persons subject to insolvency proceedings, must be for legitimate reasons. The usage and processing of this data shall be regulated".

text: 35. The EDPS welcomes such a call for inserting requirements on data protection in the Regulation. However, he notes that none of these requirements have been taken into account when drafting the proposed Regulation.

text: 36. Therefore, the EDPS would recommend supplementing the Regulation with the following elements.

text: Article 20

text: (a) of the Proposal provides the obligation for Member States to establish insolvency registers at the national level. Those registers, made available to the public on the internet free of charge will, inter alia, list the name and address of the debtor and the name and address of the liquidator appointed in the proceedings, if any. Personal data will therefore be collected/processed in these registers. For this reason, the provision should include the following data protections safeguards: it must (i) identify the purpose of the processing operations and establish which are the compatible uses; (ii) identify which entities (judges and authorities responsible for the opening and the closing of insolvency procedures, competent authorities and potentially others) will have access to which data stored in the database and will have the possibility to modify the data; (iii) ensure the right of access and appropriate information for all the data subjects whose personal data may be stored and exchanged (iv) define and limit the retention period for the personal data to the minimum necessary for the performance of such purpose. These are essential elements that should be included in the Regulation itself. If needed, specific points could be further elaborated at least in delegated or in implementing acts.

text: 38. The proposal should also ensure that the rights of the data subjects are respected in a proactive manner. It should be ensured that the persons have sufficient information about the publication of their data before the publication is made and that the security of their data is guaranteed. The EDPS therefore recommends that the circumstances and the conditions for making effective data subjects access rights to information processed about them are clearly defined in a substantive provision. Currently, the proposed Regulation does not indicate the particular procedure to be followed by Member States to concretely grant data subjects with information on their rights in the context of insolvency proceedings. Nor does it provide for important procedural guarantees or safeguards against the unlimited retention of information published, the absence of update of data once published or for requirements to prevent any security breach.

text: 39. Furthermore, the EDPS recommends the introduction in the Proposal of a provision specifying: - the obligation to provide timely information about the publication and processing of personal data to the natural persons representing the legal persons in debt (debtors); - the obligation to timely inform data subjects before the publication of the decision opening or closing the proceedings;

text: 40. The management rights in relation to the processing operations are not explicitly clarified either. In this respect, the EDPS finds it necessary to suggest that a new provision is included in the proposed Regulation requiring Member States to specify the allocation of responsibilities of authorities dealing with the proceedings. Namely, authorities responsible for the publication shall be made responsible for ensuring that personal data of the persons concerned are kept online only for a reasonable period of time, after which they are systematically deleted. They should also guarantee that these data are updated on a regular basis. Moreover, Member States should be required to ensure that adequate security measures and safeguards are put in place when setting up the registers, especially to protect against the risks related to the use of external search engines. These measures and safeguards may consist for instance in the exclusion of the data indexation by means of external search engines. 2.3. Interconnection of national public registers

text: Article 20

text: b provides for the interconnection of insolvency registers and leaves it to the Commission to establish a decentralised system for the interconnection of insolvency registers by means of implementing acts. It is specified that the system shall be composed of the insolvency registers and the European e-Justice Portal. The technical measures ensuring the minimum information technology security standards for communication and distribution of information within the system of interconnection of insolvency registers shall be detailed by the Commission by way of implementing acts.

text: 42. The EDPS welcomes that interconnection of insolvency registers is addressed in a substantive provision of the proposed Regulation. He however notes that this interconnection will involve processing of personal data at EU level and therefore requires for more details regarding the functioning of the e-Justice portal in this context.

text: 43. Besides, since the interconnection of registers and the use of e-mails will facilitate interaction between stakeholders to the proceedings they will, as a result, necessarily imply exchange of personal data. As a consequence, it is important that at least the principles of necessity (need-to-know) and proportionality are clearly established in the Regulation and complied with by any future implementing measure. In addition, the EDPS recalls that the Commission is due to issue a legislative proposal for the e-Justice portal later this year which should inter alia provide a clear legal basis and specific data protection safeguards for the processing operations which will be facilitated by the portal.

text: 44. The EDPS also insists on the crucial need for clarifying the modalities of establishment and management of this decentralised system (

text: Article 20

text: b) by introducing more detailed provisions in the proposed Regulation. Those provisions should provide for specifications regarding the concrete functioning of the e-Justice portal, for which currently no legal basis exists. They should also help in designating the controller of the personal data thus processed. Such provisions must comply with the requirements of

text: Regulation (EC) No 45/2001

text: 45. Besides, considering that personal data of all the stakeholders will be processed throughout the system, it would have been useful to detail in the Proposal (possibly, in an annex) the expected minimum security requirements. From the way the Proposal is drafted, it is not clear whether data will be stored in the e- Justice portal after the user has carried out a search. More specifically, will the results of the search and the logs be stored in the decentralised system? This should be clarified. Security and data protection requirements will partly depend on the answer to this issue. Some data protection safeguards should be implemented in any case, including those provided for in Art. 22 of Regulation 45/2001: secure logging of access to personal data, in a way that logs can be subsequently checked; security of communications, data protection requirements in setting up the system management organisation.

text: 46. In the hypothesis of a central storage, complementary safeguards should be implemented such as an access policy preventing unauthorised access and accidental or deliberate disclosure or modification. The retention period of the data stored in the portal should also be defined and managed. It should also be explained how update and deletion of information is organised.

text: 47. Finally, the EDPS notes that the explanatory memorandum of the Proposal, in the "Budgetary implications" section, reports that the "The IT application for the interconnection of the insolvency registers has already been developed and will be hosted on the e-Justice Portal". The EDPS recommends that all functional, technical and security specifications, including data protection safeguards, as directly specified in the Proposal or in implementing acts be taken into account and that by no means the existence of an IT application already developed could justify possible inconsistencies with the requirements. 2.4. Exchange of information between stakeholders: the question of data protection should be addressed

text: 48. The Proposal encourages cooperation and communication between liquidators (

text: article 31

text: ), between courts (

text: Article 31

text: a), between liquidators and courts (

text: Article 31

text: b) in the context of main and secondary proceedings, and cooperation and communication of information between liquidators (

text: Article 42

text: a), between courts (42b), and between liquidators and courts (42c) in the context of insolvency of members of a group of companies. These forms of cooperation necessarily involve exchanges of information and therefore of relevant personal data of debtors and creditors.

text: 49. In the EDPS' view, Directive

text: applies to such exchanges of information in so far they do not concern criminal matters excluded from its scope by virtue of Article 3(2) of that Directive . The EDPS recommends that the rights of the data subject to be informed of such cooperation and of the processing of his personal data by a liquidator located in a different Member State are better specified. The data subject should be given concrete modalities to contact this person with a view to effectively exercise his or her rights. This issue should be addressed in a specific provision relating to data protection whenever information is exchanged between stakeholders. The EDPS also recommends that the retention period, the update of data, and the way to ensure security of data processed are specified (as explained below). 2.5 Data protection requirements common to exchange and publication of personal data

text: 50. Several provisions of the Proposal imply that more personal data will be processed than under the current Regulation. Considering that the scope of the Regulation is being enlarged and will include more data relating to natural persons, including representatives of legal persons, the EDPS recommends that a specific provision of the Regulation is dedicated to the information of the data subjects regarding their rights as far as their data is processed.

text: 51. In addition, the EDPS recommends that the Regulation requires that information shall be provided in writing in an intelligible form, using clear and plain language, adapted to the data subject. Translations of this information should also be available in the language spoken by the data subject .

text: 52. Under data protection law data should only be kept for the time necessary to achieve the purposes for which they were collected. The EDPS therefore proposes adding a specific provision which would state that personal data should be kept in the register or by the stakeholders only for the time necessary to achieve the purposes for which they were collected and to ensure that data subjects are able to access their personal data in order to exercise their rights, and that they should be automatically deleted after a period following the closure of the proceeding. This period of time should be justified and motivated. This justification should be included in the Recitals. This retention period should also apply to personal data kept in national registers and files, except if specific provisions of national law provide for a different maximum retention period.

text: 53. The EDPS recommends specifying who will be responsible for the update of data for instance when an enterprise is rescued and the insolvency proceedings are accordingly closed or when proceedings are opened in two embers states and personal data is exchanged accordingly.

text: 3. CONCLUSIONS

text: 54. The EDPS welcomes the attention paid specifically to data protection in the proposed Regulation, but identified some scope for further improvement.

text: 55. The EDPS recommends that:  references to this Opinion are included in the preambles of all proposals; 

text: Article 46

text: (a) of the proposed Regulation clarifies the reference to Directive

text: by specifying that the provisions will apply in accordance with the national rules which implement Directive

text: ;  concrete and effective data protection safeguards are put in place for any situation in which personal data processing is envisaged;  the necessity and the proportionality of the proposed system for the Internet publication of decisions opening and closing insolvency proceedings is assessed and it is verified whether the publication obligation does not go beyond what is necessary to achieve the public interest objective pursued and whether there are not less restrictive measures to attain the same objective. Subject to the outcome of this proportionality test, the publication obligation should in any event be supported by adequate safeguards to ensure full respect of the rights of the persons concerned, the security/accuracy of the data and their deletion after an adequate period of time;

text: 56. The EDPS furthermore recommends that:  the modalities of the functioning of national databases and the EU database with regard to data protection issues are clarified by introducing more detailed provisions in the proposed Regulations, in compliance with Directive

text: and

text: Regulation (EC) No 45/2001

text: . In particular, the provision establishing the database(s) must (i) identify the purpose of the processing operations and establish which are the compatible uses; (ii) identify which entities (competent authorities, Commission) will have access to which data stored in the database and will have the possibility to modify the data; (iii) ensure the right of access and appropriate information for all the data subjects whose personal data may be stored and exchanged (iv) define and limit the retention period for the personal data to the minimum necessary for the performance of such purpose;  at least core principles of the decentralised system for the interconnection of insolvency registers such as necessity and proportionality are established in the present Proposal (while further safeguards are expected to be provided in the forthcoming Commission's legislative proposal for the e-Justice portal.  it is specified whether any data will be stored in the e-Justice portal. If this is the case, specific safeguards should be added. Done in Brussels, 27 March 2013 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor

type: vagledning

utgivare: edps


text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3 COM (2012) 776 final. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: Directive

text: of the European Parliament and of the Council of 13 June 2003 on occurrence reporting in civil aviation; OJ L 167, 4.7.2003, p. 23. 5 Occurrences are any significant aviation safety event, including incidents, accidents and serious incidents (See Article 2(8) of the Proposal). 6 'Organisation' is defined in the proposal as "any organisation providing aviation products and/or services and encompasses notably aircraft operators, approved maintenance organisations, organisations responsible for type design and/or manufacture of aircraft, air navigation service providers and certified aerodromes" (See

text: Article 2(9)

text: ) of the Proposal). 7

text: Commission Regulation (EC) No 1321/2007 of 12 November 2007

text: laying down implementing rules for the integration into a central repository of information on civil aviation occurrences, OJ L 294 of 13.11.2007, p. 3. 8

text: Commission Regulation (EC) No 1330/2007 of 24 September 2007

text: laying down implementing rules for the dissemination to interested parties of information on civil aviation occurrences, OJ L 295 of 14.11.2007, p. 7.

text: See on personal data notably Section 3.1. 10 See Annex I of the Proposal "List of incidents to be reported under the mandatory occurrence reporting system". 11 See EDPS Opinion on the proposal for a Regulation of the European Parliament and of the Council on investigation and prevention of accidents and incidents in civil aviation; OJ C 132, 21.5.2010, p.1. 12

text: Regulation (EU) No 996/2010

text: of the European Parliament and of the Council of 20 October 2010 on the investigation and prevention of accidents and incidents in civil aviation and repealing Directive

text: Text with EEA relevance; OJ L 295, 12.11.2010, p. 35. 13

text: Article 2

text: (a) of Directive

text: and of

text: Regulation (EC) No 45/2001

text: According to

text: Recital 26

text: of

text: Directive 95/46/EC

text: and

text: Recital 8

text: of

text: Regulation (EC) No 45/2001

text: , to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person. 15

text: Article 29

text: Working Party, Opinion 4/2007 on the concept of personal data, 20 June 2007, (

text: WP 136

text: ), p. 13, available on http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2007/wp136_en.pdf). 16 Idem. 17 See

text: Article 2

text: (d) of Directive

text: and of

text: Regulation (EC) No 45/2001

text: Data should be adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed (

text: Article 6

text: (c) of Directive

text: and

text: Article 4

text: (c)

text: Regulation (EC) No 45/2001

text: ). 19 That is, making sure that individuals are not identifiable taking into account all the means likely reasonably to be used either by the controller or by any other person. 20 See point 12 of the present Opinion and footnote 14 on the possibility to identify individuals from aggregated or 'disidentified' data.

text: Article 7(1)

text: states that "occurrence reports (...) shall contain at least the information listed in Annex II.2". 22 Special categories of data are those "revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life" (see

text: Article 8 of Directive 95/46/EC

text: and

text: Article 10 of Regulation (EC) No 45/2001

text: ). 23 See

text: Article 6 of Directive 95/46/EC

text: and Article 4

text: Regulation (EC) No 45/2001

text: Except in case of gross negligence. 25 See the Explanatory Memorandum of the Proposal, in particular p. 6-7. 26 See Articles

text: of Directive 95/46/EC and Articles

text: of Regulation (EC) 45/2001.

text: For example, to be included in the guidance material and workshops mentioned in Recital 10 of the Proposal. 28 See Articles

text: and

text: of Directive 95/46/EC as regards organisations' and national databases and Articles 21 and 22 of the

text: Regulation (EC) 45/2001

text: as regards the European Central Repository. 29 Points a(7-8) of Annex III. 30 See

text: Article 25 of Directive 95/46/EC

text: and

text: Article 9 of Regulation (EC) 45/2001

text: . 31 See

text: Article 26(1)

text: (d) of Directive

text: and

text: Article 9(6) of Regulation (EC) 45/2001

text: . 32 See

text: Article 29

text: Working Party, Working document on a common interpretation of

text: Article 26(1) of Directive 95/46/EC of 24 October 1995

text: WP 114

text: , available athttp://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2005/wp114_en.pdf. 33 See

text: Article 26(2) of Directive 95/46/EC

text: and

text: Article 9(7) of Regulation (EC) 45/2001

text: . 34 See Commission Decision of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive

text: (Appendix 2), available athttp://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32001D0497:EN:NOT.

text: Point 7 of Annex IV. 36 See

text: Article 8(4) of Directive 95/46/EC

text: and

text: Article 10(4) of Regulation (EC) No 45/2001

text: . 37 See

text: Article 8(5) of Directive 95/46/EC

text: and

text: Article 10(5) of Regulation (EC) No 45/2001

text: . 38 See

text: Article 20 of Directive 95/46/EC

text: Article 27 of Regulation (EC) 45/2001

text: Point 7 of Annex IV.

amnesord:
Transfers of data
Transport

title: Civil aviation

text: Opinion of the European Data Protection Supervisor

text: on the Commission Proposal for a Regulation on occurrence reporting in civil aviation and repealing Directive No

text: Commission Regulation (EC) No 1321/2007

text: Commission Regulation (EC) No 1330/2007

text: and

text: Article 19 of Regulation (EU) No 996/2010

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 18 December 2012, the Commission adopted a Proposal for a Regulation on occurrence reporting in civil aviation and repealing Directive No

text: Commission Regulation (EC) No 1321/2007

text: Commission Regulation (EC) No 1330/2007

text: and

text: (‘the Proposal) . This Proposal was sent to the EDPS for consultation on 8 January 2013.

text: 2. The EDPS welcomes the fact that he is consulted by the Commission and that a reference to this Opinion is included in the Preamble of the Proposal. Before the adoption of the Proposal, the EDPS was given the opportunity to provide informal comments to the Commission. 1.2. Objectives and scope of the Proposal

text: 3. The three instruments to be repealed by the Proposal organise occurence reporting in the following way: Directive

text: requires each Member State to set up a mandatory occurrence reporting system (hereinafter "MORS"). Under this legislation, aviation professionals are obliged to report occurrences in their daily operational work 6 through the system established by their organisation . In addition, Member States are requested to collect, store, protect and disseminate among themselves information on occurrences. Two implementing rules complete this legislation: Commission Regulation 7 No 1321/2007 , which establishes a European Central Repository (ECR) regrouping all civil aviation occurrences collected by Member States, and

text: Commission Regulation (EC) No 1330/2007

text: , which lays down rules regarding the dissemination of the information contained in the ECR.

text: 4. The Proposal builds on Directive

text: to improve the existing occurrence reporting systems in civil aviation both at national and European level. Amongst other changes, it proposes the following:  ensuring that all relevant occurrences are reported and that the data reported and stored are complete and of high quality;  adding a voluntary reporting system to the mandatory system;  requiring not only Member States but also organisations to report occurrences and to organise the transmission of these reports to the ECR;  encouraging the reporting through a harmonised protection from hierarchical punishment or prosecution of individuals reporting occurrences;  ensuring adequate access to information contained in the ECR. 1.3. Aim of the EDPS Opinion

text: 5. It follows from the Proposal that occurrences will be reported by employees to their organisations, who will then store them in a database and report them to national designated competent authorities or to the European Aviation Safety Agency (EASA). These authorities, together with EASA and the Commission, will transfer information on civil aviation occurrences to the ECR, managed by the Commission. In addition, the Commission will process data relating to interested parties requesting access to the information stored in the ECR.

text: 6. The EDPS acknowledges the fact that the purpose of the Proposal is not to regulate the processing of personal data. However, the information that will be stored, reported and transferred may relate to natural persons who are either directly or indirectly identifiable, such as reporters, third parties involved in the reported occurrence and interested parties applying for access. The reported information might not only involve technical problems but also, for instance, violent passengers, crew incapacitation or 10 health incidents .

text: 7. Therefore, the present Opinion will analyse the elements of the Proposal which concern 11 the processing of personal data. It builds on a previous EDPS Opinion on one of the Regulations which are being repealed by the Proposal .

text: 2. GENERAL REMARKS

text: 8. The EDPS welcomes the fact that most processing operations relating to occurrence reporting will concern 'disidentified' data. However, he reminds that disidentified data in the context of the proposal will still be personal data, as explained below, and thus EU data protection requirements apply.

text: 9. The EDPS also welcomes the fact that the Proposal already incorporates certain data protection principles such as purpose limitation, the obligation of confidentiality and the principle of data quality. However, additional safeguards are needed, especially as regards 'non-disidentified' data.

text: 3. SPECIFIC REMARKS 3.1. EU data protection legislation is applicable to all personal data

text: 10. Directive

text: and

text: Regulation (EC) No 45/2001

text: apply to the processing of personal data, which are defined as "any information relating to an identified or identifiable natural person ('data subject')". This identification might be direct, e.g., by a name, or indirect, e.g., by an identification number or other factors . As long as there is a reasonable possibility that natural persons involved can be identified, either directly or indirectly, the relevant data are considered personal data, and thus EU data protection legislation is applicable.

text: 11. Recital 29 of the Proposal states that occurrence reports "should be disidentified and details related to the reporter should not be registered into databases". Article 16(2) of the Proposal states that Member States shall ensure that personal identifiers are not recorded in the national databases and

text: Article 16(1)

text: adds that "disidentified information shall be disseminated within the organisation". Disidentification is defined in Article 2(1) of the Proposal as "removing from occurrence reports submitted all personal details pertaining to the reporter and technical details which are leading to the identity of the reporter, or of third parties, being inferred from the information".

text: 12. It is probable that persons involved in occurrence reporting, members of the crew or even passengers might be identifiable to those having access to the mentioned databases. In this regard, the EDPS would like to underline the phenomenon of unique or rare combinations, where different pieces of information combined together allow data subjects to be differentiated from others or "singled out" and thus to be identified, 15 as it has been pointed out by the

text: Article 29

text: Working Party . For example, disidentified reports or aggregated information could still allow someone working in the organisation to combine pieces of information and deduct, for instance, the name(s) of the reporting pilot(s) and/or of members of the cabin crew.

text: 13. In any case, according to Article 16(1) of the Proposal, personal data - including direct identifiers - relating to occurrence reports will still be available to the independent handlers referred to in

text: Article 6(1)

text: . Individuals will thus still be identifiable, at least by these handlers. As the concept of "identifiability" refers to identification "by any (...) person" , EU data protection legislation is applicable to all personal data, disidentified or not. In other words, what is provided for in the Proposal amounts at best to partial anonymisation.

text: 14. Therefore, the EDPS welcomes Recital 38 of the Proposal which states that "the rules on data processing and the protection of individuals as defined in Directive 95/46 (...) and in

text: Regulation (EU) No 45/2001

text: (...) should be fully respected in the application of this Regulation". He also welcomes Article 20(2) of the Proposal, according to which "this Regulation shall apply without prejudice to national legislations implementing Directive

text: and in accordance with

text: Regulation (EC) No 45/2001

text: ". 3.2. The controllers of the processing should be identified

text: 15. Directive

text: states that "where the purposes and means of processing are determined by national or Community laws or regulations, the controller or the specific criteria for his nomination may be designated by national or Community law" . The EDPS understands that the controller of every organisation's database is the organisation itself or the handler referred to in

text: Article 6(1)

text: in case of non-disidentified data. Similarly, the competent authority, body or entity designated by each Member State according to

text: Article 6(2)

text: will be the controller of the national databases and the Commission will be the controller of the ECR. This should be specified in the Proposal.

text: 16. Directive

text: will thus apply to the processing of data by organisations (including handlers referred to in Article 6(1) of the Proposal) and by national competent authorities (see

text: Article 16(2)

text: ), while

text: Regulation (EC) 45/2001

text: will apply to the processing of data by EASA and by the Commission, namely in the context of the ECR. 3.3. The scope of disidentification should be clarified

text: 17. Article 16(1) of the Proposal states that organisations "shall ensure that all personal data such as names or addresses of individual persons are only available to the independent handlers referred to in

text: Article 6(1)

text: . This sentence is confusing because (i) it might give the impression that only direct identifiers (such as names and addresses) are personal data, dismissing the possibility of indirect identification and (ii) it is narrower than the definition of disidentification in

text: Article 2(1)

text: . The latter does not only refer to the removal of personal details but also to the removal of technical details "which are leading to the identity of the reporter, or of third parties, being inferred from the information".

text: 18. In order to clarify the scope of disidentification, the EDPS recommends replacing in Article

text: and

text: "personal data" by "personal details" and adding a reference to the possibility of identification through technical details, in accordance with

text: Article 2(1)

text: Article 5(6)

text: allows Member States and organisations to establish additional reporting systems. It should be specified that this information should also be disidentified. The EDPS therefore recommends clarifying in

text: Article 16(2)

text: that personal data contained in the safety information collection and processing systems established in accordance with

text: Article 5(6)

text: should also be disidentified.

text: 20. The EDPS would like to remind that, even if

text: Articles 16

text: (1-2) and 5(6) are clarified as recommended, identification would still be possible, as at least independent handlers will have access to the full data, including personal details. However, he welcomes the obligation of disidentification as a measure complying with the principles of necessity, proportionality and data minimisation and contributing to data security requirements.

text: 21. Before its publication, information should not only be disidentified but fully anonymised . This should be specified in

text: Article 13(10)

text: . In addition, information made available to interested parties listed in Annex III and not relating to their own equipment, operations or field of activity, should also not only be aggregated or disidentified, as requested by

text: Article 11(4)

text: , but fully anonymised.

text: Article 11(4)

text: should be amended accordingly.

text: 22. As regards data available to independent handlers, the EDPS recommends disidentifying or deleting these data as soon as possible, unless the necessity of storing the data is justified, e.g., to comply with other legal obligations of the organisations.

text: Article 16

text: should be amended accordingly and any storage of personal data by the handler after their recording in the organisations' databases should be justified in the Preamble.

text: 23. Finally, it should also be clarified in the Preamble that disidentification in the sense of the Proposal is relative and does not correspond to full anonymisation. In addition, in line with the above recommendations, the Preamble should also explain that disidentification and full anonymisation measures are to be applied in different contexts. 3.4. The categories of data to be processed should be defined

text: 24. The EDPS welcomes the fact that the list of information to be included in occurrence reports is described in Annex II. However,

text: Article 7(1)

text: provides that occurrence reports may contain other information . The EDPS recommends making the list exhaustive or at least better defining the additional information.

text: 25. In addition,

text: Article 5(3)

text: states that voluntary reporting systems shall allow the collection of details on occurrences which are not listed in Annex I. The EDPS regrets the fact that the types of occurrences that can be voluntarily reported are not specified. The EDPS therefore recommends specifying in Annexes I and II all the occurrences and related data fields that might be collected under mandatory and voluntary reporting systems, or at least better defining the additional information.

text: 26. This reasoning also applies to

text: Article 5(6)

text: , which allows Member States and organisations to "establish other systems to collect details on occurrences that may not be captured" by mandatory and voluntary reporting systems. The EDPS recommends specifying or at least better defining in the Annex which details could be collected under these additional systems, especially those involving personal data. Only those strictly necessary should be collected.

text: 27. The list of data to be provided by interested parties in order to request access to the ECR is laid down in Annex IV of the Proposal. Similarly to

text: Article 7(1)

text: Article 11(1)

text: states that this list is not exhaustive. The EDPS recommends completing the list of Annex IV if necessary and clarifying in

text: Article 11(1)

text: that the list is exhaustive. In addition, the open fields contained in Annex IV (information requested) should be better specified or defined in order to avoid the collection of unnecessary personal data.

text: 28. If it is not possible to specify or define all the occurrences and data fields to be processed according to Article

text: and

text: , these Articles should at least mention that additional personal information not required by the Proposal should not contain special categories of data as defined by

text: Article 8 of Directive 95/46/EC

text: and

text: ('sensitive data') . 3.5. Provisions on data quality are welcomed

text: 29. The EDPS welcomes the fact that the Proposal already incorporates some of the main data quality requirements , such as the principle of purpose limitation, the obligation of confidentiality, and the requirements of accuracy and of keeping the data updated. As the Commission acknowledges, this will not only contribute to the protection of privacy and data protection but will also serve the purposes of the Proposal. Purpose limitation and confidentiality will avoid that employees be discouraged to report occurrences by the fear of possible retaliations or sanctions . The accuracy and updating of the data will ensure a better quality and completeness of the reports, enabling a better identification of risk areas and needs for action .

text: 30. In this regard, the EDPS welcomes the provisions on purpose limitation contained in Recital 28, which states that the information collected "should strictly be used for the purpose of maintaining or improving aviation safety and should not be used to attribute blame or liability" and in

text: Articles 15

text: (2-3), 11(7), 16(1-6). He also welcomes Recital 10 and

text: Article 7(3)

text: on data quality, and

text: Article 9(1)

text: on updating. 3.6. Retention periods should be specified

text: Article 6(3)

text: states that organisations shall store occurrence reports in a database. This Article should specify the period during which the data shall be stored in the organisations' databases. It should also specify for how long the data received by handlers but not recorded in the databases (e.g., direct and/or indirect identifiers) will be stored. Once these data are not necessary any more, they should be deleted (see point 22 above).

text: 32. Occurrence reports collected by organisations should in turn be stored by Member States' competent authorities in national databases.

text: Article 6

text: should thus also specify the period during which data will be stored in national databases. The same comment is valid for the data stored in the ECR. Only if the data were completely anonymised, the information could be stored without limit. The need to store the data for a determined period should be justified in the Preamble of the Proposal. 3.7. Provisions on data subjects' rights and transparency should be added

text: 33. According to Directive

text: and

text: Regulation (EC) 45/2001

text: , controllers (organisations, national designated authorities and the Commission) should inform data subjects about the identity of the controller of the databases; the purposes for which the data collected are processed and any other information such as to whom the data will be transferred. Adequate procedures should also be established to grant individuals the rights of access, correction, blocking and (as far as possible) deletion of the data relating to them, and to inform individuals about these procedures.

text: 34. The EDPS is aware that in the case of disidentified or aggregated information, it might be very difficult or even impossible for the controller to grant the rights of access, correction, blocking and deletion; and that this could require processing more personal data than needed for the purposes of the Proposal. These rights should nevertheless be fully granted as regards the data including personal details that will be available to independent handlers. Although the rights of individuals and the obligation to inform them are already laid down by Directive

text: and

text: Regulation (EC) 45/2001

text: , it would be useful to clarify these in

text: Article 6

text: or in the Preamble, to ensure that all controllers are aware of their obligations. 3.8. Security measures should be foreseen

text: 35. The EDPS welcomes the provisions on confidentiality in Recital 28 and Articles

text: and

text: . In addition, the Proposal should provide that organisations, Member States' competent authorities and the Commission shall establish specific privacy and security measures for the organisations' and national databases and for the ECR respectively. These could include general data protection measures such as a manual or guidelines for officers and employees having access and entering information in the databases, appropriate training for such officers and the requirement to establish a 28 security policy for the system after having carried a risk assessment . 3.9. Access by third parties should be subject to adequate safeguards

text: Article 5(6)

text: allows Member States and organisations to report occurrence details to entities other than the designated national competent authorities. The possible categories of recipients should be specified and limited to organisations based in the EU and subject to Directive

text: Article 10(1)

text: provides that any entity entrusted with regulating civil aviation safety or with investigating civil aviation accidents and incidents within the Union shall have online access to the ECR. Interested parties listed in Annex III may also obtain access to certain information contained in the ECR. The EDPS welcomes the fact that the categories of third parties are specified. However, Annex III includes third parties not established in the EU, such as third country organisations and international aviation organisations .

text: 38. The EDPS would like to remind that as a matter of principle, the transfer of personal data to third countries which do not ensure an adequate level of data protection is prohibited. Although some exceptions apply, for example if the transfer is necessary or 31 legally required (in the EU) on important (EU) public interest grounds , these exceptions seem difficult to apply in this case, as at least transfers to third countries are likely to be based on these third countries' interests. In any case, exceptions cannot be 32 the legal basis for repeated transfers .

text: 39. However, transfers could take place in accordance with EU data protection law if it is ensured that the recipient provides adequate data protection safeguards . These safeguards could be based on the data protection principles contained in the Standard Contractual Clauses for the transfers of personal data to third countries adopted by the Commission and should be binding to third parties, e.g., by means of a contract or an agreement. Such safeguards, to be signed by third country organisations or international organisations requesting the data, should be included in the Proposal, for example in a new Annex.

text: 40. As regards the processing of data of interested parties requesting access to the ECR, the EDPS welcomes the fact that Annex IV determines the categories of data to be collected for this purpose. He recommends specifying in the Proposal the data protection measures that will apply to the processing of data relating to third parties (e.g., for how long the data will be stored after access has been granted or denied and who has access to these data).

text: 41. The form contained in Annex IV should include, apart from the notice on access to information , a privacy notice. This should include information about the identity of the controller, the purpose of the processing and the recipients of the data. 3.10. The processing of sensitive data should be subject to additional safeguards

text: 42. The EDPS notes that Annex I listing the incidents to be reported under the mandatory occurrence reporting system includes sensitive data relating e.g. to injuries, "severe health event affecting crew member or passengers" or " difficulty in controlling intoxicated, violent or unruly passengers". Some of these categories might be related to offences and to the evaluation of the conduct of individuals.

text: 43. According to

text: Article 8 of Directive 95/46/EC

text: and

text: the processing of personal data concerning health is only allowed if certain exceptions apply. The necessity of processing sensitive data for one of the exceptions (e.g., if needed "for reasons of substantial public interest" ) should be justified in the Preamble of the Proposal.

text: Article 8(5) of Directive 95/46/EC

text: and

text: only allow the processing of personal data relating to offences, criminal convictions or security measures if laid by law and subject to the provision of suitable safeguards. The Proposal might imply the processing of these categories of data, for example in relation to employees involved in an occurrence or as regards violent passengers.

text: 45. The EDPS recommends implementing additional safeguards for the processing of special categories of data, such as the prohibition to disclose these categories of data to third parties not subject to EU data protection law and the restriction of their disclosure to other interested parties. In addition, the processing of these categories of data may be subject to prior check by EU national data protection authorities and by the EDPS . Stricter security measures might also be needed, according to the results of the risk assessment mentioned in point 35.

text: 4. CONCLUSIONS

text: 46. The EDPS welcomes the attention paid to the protection of personal data, particularly through the engagement taken to 'disidentify' a major part of the data processed under occurrence reporting. However, he reminds that the data processed will still be personal data and thus welcomes the references to the applicability of EU data protection legislation. What is provided for amounts at best to partial anonymisation.

text: 47. The EDPS recommends clarifying the scope of 'disidentification'. In particular, he proposes the following improvements to the text:  in the Preamble, clarifying that disidentification in the sense of the Proposal is relative and does not correspond to full anonymisation. In addition, in line with the above recommendations, the Preamble should also explain that disidentification and full anonymisation measures are to be applied in different contexts;  in

text: Article 16

text: : specifying that data available to independent handlers should also be disidentified or deleted as soon as possible, unless the necessity of storing the data is justified, e.g., to comply with other legal obligations of the organisations;  in order to clarify the scope of disidentification, the EDPS recommends replacing in Article

text: and

text: Article 2(1)

text: Article 5(6)

text: Article 16(2)

text: Article 5(6)

text: should also be disidentified;  in

text: Article 13(10)

text: : specify that the information should be anonymised before its publication;  in

text: Article 11(4)

text: : specify that information made available to interested parties listed in Annex III and not relating to their own equipment, operations or field of activity, should not only be aggregated or disidentified, as requested by

text: Article 11(4)

text: , but fully anonymised.

text: 48. The EDPS advises specifying in the Proposal who will be the controller of every database. He also recommends defining in the Annexes I and II, in

text: Article 5(6)

text: all the categories of data to be processed and clarifying Articles

text: and

text: accordingly. If it is not possible to specify all the occurrences and data fields to be processed according to Article

text: and

text: , these Articles should at least mention that additional information not required by the Proposal should not contain special categories of data as defined by

text: Article 8 of Directive 95/46/EC

text: and

text: ('sensitive data').

text: 49. The EDPS also recommends specifying the periods during which data shall be stored in the databases, the rights of data subjects and the security measures to be implemented.

text: 50. In case of transfers to third country organisations or international organisations, these should commit to respect adequate safeguards to be provided in a binding instrument. These safeguards could be based on the data protection principles contained in the Standard Contractual Clauses for the transfers of personal data to third countries adopted by the Commission and could be added in the Annex of the Proposal.

text: 51. As regards the processing of data of interested parties requesting access to the ECR, the EDPS recommends specifying in the Proposal the data protection measures that will apply to the processing of data relating to third parties (e.g., for how long the data will be stored after access has been granted or denied and who has access to these data). In addition, the form contained in Annex IV should include, apart from the notice on access to information , a privacy notice.

text: 52. Finally, the necessity of processing sensitive data for any of the grounds contained in

text: Article 8

text: (2-4) of Directive

text: and

text: Article 10

text: (2-4) of

text: Regulation (EC) No 45/2001

text: should be justified in the Preamble. The EDPS also recommends adopting additional safeguards as regards the processing of special categories of data, such as stricter security measures, the prohibition to disclose the related categories of data to third parties not subject to EU data protection law and the restriction of its disclosure to other interested parties. In addition, the processing of these categories of data may be subject to prior check by EU national data protection authorities and by the EDPS. Done in Brussels, 10 April 2013 (signed) Giovanni BUTTARELLI Assistant Supervisor