text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3 COM (2012) 776 final. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: Directive

text: of the European Parliament and of the Council of 13 June 2003 on occurrence reporting in civil aviation; OJ L 167, 4.7.2003, p. 23. 5 Occurrences are any significant aviation safety event, including incidents, accidents and serious incidents (See Article 2(8) of the Proposal). 6 'Organisation' is defined in the proposal as "any organisation providing aviation products and/or services and encompasses notably aircraft operators, approved maintenance organisations, organisations responsible for type design and/or manufacture of aircraft, air navigation service providers and certified aerodromes" (See

text: Article 2(9)

text: ) of the Proposal). 7

text: Commission Regulation (EC) No 1321/2007 of 12 November 2007

text: laying down implementing rules for the integration into a central repository of information on civil aviation occurrences, OJ L 294 of 13.11.2007, p. 3. 8

text: Commission Regulation (EC) No 1330/2007 of 24 September 2007

text: laying down implementing rules for the dissemination to interested parties of information on civil aviation occurrences, OJ L 295 of 14.11.2007, p. 7.

text: See on personal data notably Section 3.1. 10 See Annex I of the Proposal "List of incidents to be reported under the mandatory occurrence reporting system". 11 See EDPS Opinion on the proposal for a Regulation of the European Parliament and of the Council on investigation and prevention of accidents and incidents in civil aviation; OJ C 132, 21.5.2010, p.1. 12

text: Regulation (EU) No 996/2010

text: of the European Parliament and of the Council of 20 October 2010 on the investigation and prevention of accidents and incidents in civil aviation and repealing Directive

text: Text with EEA relevance; OJ L 295, 12.11.2010, p. 35. 13

text: Article 2

text: (a) of Directive

text: and of

text: Regulation (EC) No 45/2001

text: According to

text: Recital 26

text: of

text: Directive 95/46/EC

text: and

text: Recital 8

text: of

text: Regulation (EC) No 45/2001

text: , to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person. 15

text: Article 29

text: Working Party, Opinion 4/2007 on the concept of personal data, 20 June 2007, (

text: WP 136

text: ), p. 13, available on http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2007/wp136_en.pdf). 16 Idem. 17 See

text: Article 2

text: (d) of Directive

text: and of

text: Regulation (EC) No 45/2001

text: Data should be adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed (

text: Article 6

text: (c) of Directive

text: and

text: Article 4

text: (c)

text: Regulation (EC) No 45/2001

text: ). 19 That is, making sure that individuals are not identifiable taking into account all the means likely reasonably to be used either by the controller or by any other person. 20 See point 12 of the present Opinion and footnote 14 on the possibility to identify individuals from aggregated or 'disidentified' data.

text: Article 7(1)

text: states that "occurrence reports (...) shall contain at least the information listed in Annex II.2". 22 Special categories of data are those "revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life" (see

text: Article 8 of Directive 95/46/EC

text: and

text: Article 10 of Regulation (EC) No 45/2001

text: ). 23 See

text: Article 6 of Directive 95/46/EC

text: and Article 4

text: Regulation (EC) No 45/2001

text: Except in case of gross negligence. 25 See the Explanatory Memorandum of the Proposal, in particular p. 6-7. 26 See Articles

text: of Directive 95/46/EC and Articles

text: of Regulation (EC) 45/2001.

text: For example, to be included in the guidance material and workshops mentioned in Recital 10 of the Proposal. 28 See Articles

text: and

text: of Directive 95/46/EC as regards organisations' and national databases and Articles 21 and 22 of the

text: Regulation (EC) 45/2001

text: as regards the European Central Repository. 29 Points a(7-8) of Annex III. 30 See

text: Article 25 of Directive 95/46/EC

text: and

text: Article 9 of Regulation (EC) 45/2001

text: . 31 See

text: Article 26(1)

text: (d) of Directive

text: and

text: Article 9(6) of Regulation (EC) 45/2001

text: . 32 See

text: Article 29

text: Working Party, Working document on a common interpretation of

text: Article 26(1) of Directive 95/46/EC of 24 October 1995

text: WP 114

text: , available athttp://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2005/wp114_en.pdf. 33 See

text: Article 26(2) of Directive 95/46/EC

text: and

text: Article 9(7) of Regulation (EC) 45/2001

text: . 34 See Commission Decision of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive

text: (Appendix 2), available athttp://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32001D0497:EN:NOT.

text: Point 7 of Annex IV. 36 See

text: Article 8(4) of Directive 95/46/EC

text: and

text: Article 10(4) of Regulation (EC) No 45/2001

text: . 37 See

text: Article 8(5) of Directive 95/46/EC

text: and

text: Article 10(5) of Regulation (EC) No 45/2001

text: . 38 See

text: Article 20 of Directive 95/46/EC

text: Article 27 of Regulation (EC) 45/2001

text: Point 7 of Annex IV.

amnesord:
Net Neutrality
Privacy by Design
Information Security
Research & Science
Cloud Computing

title: The Digital Agenda for Europe

text: Opinion of the European Data Protection Supervisor

text: on the Commission Proposal for a Regulation on occurrence reporting in civil aviation and repealing Directive No

text: Commission Regulation (EC) No 1321/2007

text: Commission Regulation (EC) No 1330/2007

text: and

text: Article 19 of Regulation (EU) No 996/2010

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 18 December 2012, the Commission adopted a Proposal for a Regulation on occurrence reporting in civil aviation and repealing Directive No

text: Commission Regulation (EC) No 1321/2007

text: Commission Regulation (EC) No 1330/2007

text: and

text: (‘the Proposal) . This Proposal was sent to the EDPS for consultation on 8 January 2013.

text: 2. The EDPS welcomes the fact that he is consulted by the Commission and that a reference to this Opinion is included in the Preamble of the Proposal. Before the adoption of the Proposal, the EDPS was given the opportunity to provide informal comments to the Commission. 1.2. Objectives and scope of the Proposal

text: 3. The three instruments to be repealed by the Proposal organise occurence reporting in the following way: Directive

text: requires each Member State to set up a mandatory occurrence reporting system (hereinafter "MORS"). Under this legislation, aviation professionals are obliged to report occurrences in their daily operational work 6 through the system established by their organisation . In addition, Member States are requested to collect, store, protect and disseminate among themselves information on occurrences. Two implementing rules complete this legislation: Commission Regulation 7 No 1321/2007 , which establishes a European Central Repository (ECR) regrouping all civil aviation occurrences collected by Member States, and

text: Commission Regulation (EC) No 1330/2007

text: , which lays down rules regarding the dissemination of the information contained in the ECR.

text: 4. The Proposal builds on Directive

text: to improve the existing occurrence reporting systems in civil aviation both at national and European level. Amongst other changes, it proposes the following:  ensuring that all relevant occurrences are reported and that the data reported and stored are complete and of high quality;  adding a voluntary reporting system to the mandatory system;  requiring not only Member States but also organisations to report occurrences and to organise the transmission of these reports to the ECR;  encouraging the reporting through a harmonised protection from hierarchical punishment or prosecution of individuals reporting occurrences;  ensuring adequate access to information contained in the ECR. 1.3. Aim of the EDPS Opinion

text: 5. It follows from the Proposal that occurrences will be reported by employees to their organisations, who will then store them in a database and report them to national designated competent authorities or to the European Aviation Safety Agency (EASA). These authorities, together with EASA and the Commission, will transfer information on civil aviation occurrences to the ECR, managed by the Commission. In addition, the Commission will process data relating to interested parties requesting access to the information stored in the ECR.

text: 6. The EDPS acknowledges the fact that the purpose of the Proposal is not to regulate the processing of personal data. However, the information that will be stored, reported and transferred may relate to natural persons who are either directly or indirectly identifiable, such as reporters, third parties involved in the reported occurrence and interested parties applying for access. The reported information might not only involve technical problems but also, for instance, violent passengers, crew incapacitation or 10 health incidents .

text: 7. Therefore, the present Opinion will analyse the elements of the Proposal which concern 11 the processing of personal data. It builds on a previous EDPS Opinion on one of the Regulations which are being repealed by the Proposal .

text: 2. GENERAL REMARKS

text: 8. The EDPS welcomes the fact that most processing operations relating to occurrence reporting will concern 'disidentified' data. However, he reminds that disidentified data in the context of the proposal will still be personal data, as explained below, and thus EU data protection requirements apply.

text: 9. The EDPS also welcomes the fact that the Proposal already incorporates certain data protection principles such as purpose limitation, the obligation of confidentiality and the principle of data quality. However, additional safeguards are needed, especially as regards 'non-disidentified' data.

text: 3. SPECIFIC REMARKS 3.1. EU data protection legislation is applicable to all personal data

text: 10. Directive

text: and

text: Regulation (EC) No 45/2001

text: apply to the processing of personal data, which are defined as "any information relating to an identified or identifiable natural person ('data subject')". This identification might be direct, e.g., by a name, or indirect, e.g., by an identification number or other factors . As long as there is a reasonable possibility that natural persons involved can be identified, either directly or indirectly, the relevant data are considered personal data, and thus EU data protection legislation is applicable.

text: 11. Recital 29 of the Proposal states that occurrence reports "should be disidentified and details related to the reporter should not be registered into databases". Article 16(2) of the Proposal states that Member States shall ensure that personal identifiers are not recorded in the national databases and

text: Article 16(1)

text: adds that "disidentified information shall be disseminated within the organisation". Disidentification is defined in Article 2(1) of the Proposal as "removing from occurrence reports submitted all personal details pertaining to the reporter and technical details which are leading to the identity of the reporter, or of third parties, being inferred from the information".

text: 12. It is probable that persons involved in occurrence reporting, members of the crew or even passengers might be identifiable to those having access to the mentioned databases. In this regard, the EDPS would like to underline the phenomenon of unique or rare combinations, where different pieces of information combined together allow data subjects to be differentiated from others or "singled out" and thus to be identified, 15 as it has been pointed out by the

text: Article 29

text: Working Party . For example, disidentified reports or aggregated information could still allow someone working in the organisation to combine pieces of information and deduct, for instance, the name(s) of the reporting pilot(s) and/or of members of the cabin crew.

text: 13. In any case, according to Article 16(1) of the Proposal, personal data - including direct identifiers - relating to occurrence reports will still be available to the independent handlers referred to in

text: Article 6(1)

text: . Individuals will thus still be identifiable, at least by these handlers. As the concept of "identifiability" refers to identification "by any (...) person" , EU data protection legislation is applicable to all personal data, disidentified or not. In other words, what is provided for in the Proposal amounts at best to partial anonymisation.

text: 14. Therefore, the EDPS welcomes Recital 38 of the Proposal which states that "the rules on data processing and the protection of individuals as defined in Directive 95/46 (...) and in

text: Regulation (EU) No 45/2001

text: (...) should be fully respected in the application of this Regulation". He also welcomes Article 20(2) of the Proposal, according to which "this Regulation shall apply without prejudice to national legislations implementing Directive

text: and in accordance with

text: Regulation (EC) No 45/2001

text: ". 3.2. The controllers of the processing should be identified

text: 15. Directive

text: states that "where the purposes and means of processing are determined by national or Community laws or regulations, the controller or the specific criteria for his nomination may be designated by national or Community law" . The EDPS understands that the controller of every organisation's database is the organisation itself or the handler referred to in

text: Article 6(1)

text: in case of non-disidentified data. Similarly, the competent authority, body or entity designated by each Member State according to

text: Article 6(2)

text: will be the controller of the national databases and the Commission will be the controller of the ECR. This should be specified in the Proposal.

text: 16. Directive

text: will thus apply to the processing of data by organisations (including handlers referred to in Article 6(1) of the Proposal) and by national competent authorities (see

text: Article 16(2)

text: ), while

text: Regulation (EC) 45/2001

text: will apply to the processing of data by EASA and by the Commission, namely in the context of the ECR. 3.3. The scope of disidentification should be clarified

text: 17. Article 16(1) of the Proposal states that organisations "shall ensure that all personal data such as names or addresses of individual persons are only available to the independent handlers referred to in

text: Article 6(1)

text: . This sentence is confusing because (i) it might give the impression that only direct identifiers (such as names and addresses) are personal data, dismissing the possibility of indirect identification and (ii) it is narrower than the definition of disidentification in

text: Article 2(1)

text: . The latter does not only refer to the removal of personal details but also to the removal of technical details "which are leading to the identity of the reporter, or of third parties, being inferred from the information".

text: 18. In order to clarify the scope of disidentification, the EDPS recommends replacing in Article

text: and

text: "personal data" by "personal details" and adding a reference to the possibility of identification through technical details, in accordance with

text: Article 2(1)

text: Article 5(6)

text: allows Member States and organisations to establish additional reporting systems. It should be specified that this information should also be disidentified. The EDPS therefore recommends clarifying in

text: Article 16(2)

text: that personal data contained in the safety information collection and processing systems established in accordance with

text: Article 5(6)

text: should also be disidentified.

text: 20. The EDPS would like to remind that, even if

text: Articles 16

text: (1-2) and 5(6) are clarified as recommended, identification would still be possible, as at least independent handlers will have access to the full data, including personal details. However, he welcomes the obligation of disidentification as a measure complying with the principles of necessity, proportionality and data minimisation and contributing to data security requirements.

text: 21. Before its publication, information should not only be disidentified but fully anonymised . This should be specified in

text: Article 13(10)

text: . In addition, information made available to interested parties listed in Annex III and not relating to their own equipment, operations or field of activity, should also not only be aggregated or disidentified, as requested by

text: Article 11(4)

text: , but fully anonymised.

text: Article 11(4)

text: should be amended accordingly.

text: 22. As regards data available to independent handlers, the EDPS recommends disidentifying or deleting these data as soon as possible, unless the necessity of storing the data is justified, e.g., to comply with other legal obligations of the organisations.

text: Article 16

text: should be amended accordingly and any storage of personal data by the handler after their recording in the organisations' databases should be justified in the Preamble.

text: 23. Finally, it should also be clarified in the Preamble that disidentification in the sense of the Proposal is relative and does not correspond to full anonymisation. In addition, in line with the above recommendations, the Preamble should also explain that disidentification and full anonymisation measures are to be applied in different contexts. 3.4. The categories of data to be processed should be defined

text: 24. The EDPS welcomes the fact that the list of information to be included in occurrence reports is described in Annex II. However,

text: Article 7(1)

text: provides that occurrence reports may contain other information . The EDPS recommends making the list exhaustive or at least better defining the additional information.

text: 25. In addition,

text: Article 5(3)

text: states that voluntary reporting systems shall allow the collection of details on occurrences which are not listed in Annex I. The EDPS regrets the fact that the types of occurrences that can be voluntarily reported are not specified. The EDPS therefore recommends specifying in Annexes I and II all the occurrences and related data fields that might be collected under mandatory and voluntary reporting systems, or at least better defining the additional information.

text: 26. This reasoning also applies to

text: Article 5(6)

text: , which allows Member States and organisations to "establish other systems to collect details on occurrences that may not be captured" by mandatory and voluntary reporting systems. The EDPS recommends specifying or at least better defining in the Annex which details could be collected under these additional systems, especially those involving personal data. Only those strictly necessary should be collected.

text: 27. The list of data to be provided by interested parties in order to request access to the ECR is laid down in Annex IV of the Proposal. Similarly to

text: Article 7(1)

text: Article 11(1)

text: states that this list is not exhaustive. The EDPS recommends completing the list of Annex IV if necessary and clarifying in

text: Article 11(1)

text: that the list is exhaustive. In addition, the open fields contained in Annex IV (information requested) should be better specified or defined in order to avoid the collection of unnecessary personal data.

text: 28. If it is not possible to specify or define all the occurrences and data fields to be processed according to Article

text: and

text: , these Articles should at least mention that additional personal information not required by the Proposal should not contain special categories of data as defined by

text: Article 8 of Directive 95/46/EC

text: and

text: ('sensitive data') . 3.5. Provisions on data quality are welcomed

text: 29. The EDPS welcomes the fact that the Proposal already incorporates some of the main data quality requirements , such as the principle of purpose limitation, the obligation of confidentiality, and the requirements of accuracy and of keeping the data updated. As the Commission acknowledges, this will not only contribute to the protection of privacy and data protection but will also serve the purposes of the Proposal. Purpose limitation and confidentiality will avoid that employees be discouraged to report occurrences by the fear of possible retaliations or sanctions . The accuracy and updating of the data will ensure a better quality and completeness of the reports, enabling a better identification of risk areas and needs for action .

text: 30. In this regard, the EDPS welcomes the provisions on purpose limitation contained in Recital 28, which states that the information collected "should strictly be used for the purpose of maintaining or improving aviation safety and should not be used to attribute blame or liability" and in

text: Articles 15

text: (2-3), 11(7), 16(1-6). He also welcomes Recital 10 and

text: Article 7(3)

text: on data quality, and

text: Article 9(1)

text: on updating. 3.6. Retention periods should be specified

text: Article 6(3)

text: states that organisations shall store occurrence reports in a database. This Article should specify the period during which the data shall be stored in the organisations' databases. It should also specify for how long the data received by handlers but not recorded in the databases (e.g., direct and/or indirect identifiers) will be stored. Once these data are not necessary any more, they should be deleted (see point 22 above).

text: 32. Occurrence reports collected by organisations should in turn be stored by Member States' competent authorities in national databases.

text: Article 6

text: should thus also specify the period during which data will be stored in national databases. The same comment is valid for the data stored in the ECR. Only if the data were completely anonymised, the information could be stored without limit. The need to store the data for a determined period should be justified in the Preamble of the Proposal. 3.7. Provisions on data subjects' rights and transparency should be added

text: 33. According to Directive

text: and

text: Regulation (EC) 45/2001

text: , controllers (organisations, national designated authorities and the Commission) should inform data subjects about the identity of the controller of the databases; the purposes for which the data collected are processed and any other information such as to whom the data will be transferred. Adequate procedures should also be established to grant individuals the rights of access, correction, blocking and (as far as possible) deletion of the data relating to them, and to inform individuals about these procedures.

text: 34. The EDPS is aware that in the case of disidentified or aggregated information, it might be very difficult or even impossible for the controller to grant the rights of access, correction, blocking and deletion; and that this could require processing more personal data than needed for the purposes of the Proposal. These rights should nevertheless be fully granted as regards the data including personal details that will be available to independent handlers. Although the rights of individuals and the obligation to inform them are already laid down by Directive

text: and

text: Regulation (EC) 45/2001

text: , it would be useful to clarify these in

text: Article 6

text: or in the Preamble, to ensure that all controllers are aware of their obligations. 3.8. Security measures should be foreseen

text: 35. The EDPS welcomes the provisions on confidentiality in Recital 28 and Articles

text: and

text: . In addition, the Proposal should provide that organisations, Member States' competent authorities and the Commission shall establish specific privacy and security measures for the organisations' and national databases and for the ECR respectively. These could include general data protection measures such as a manual or guidelines for officers and employees having access and entering information in the databases, appropriate training for such officers and the requirement to establish a 28 security policy for the system after having carried a risk assessment . 3.9. Access by third parties should be subject to adequate safeguards

text: Article 5(6)

text: allows Member States and organisations to report occurrence details to entities other than the designated national competent authorities. The possible categories of recipients should be specified and limited to organisations based in the EU and subject to Directive

text: Article 10(1)

text: provides that any entity entrusted with regulating civil aviation safety or with investigating civil aviation accidents and incidents within the Union shall have online access to the ECR. Interested parties listed in Annex III may also obtain access to certain information contained in the ECR. The EDPS welcomes the fact that the categories of third parties are specified. However, Annex III includes third parties not established in the EU, such as third country organisations and international aviation organisations .

text: 38. The EDPS would like to remind that as a matter of principle, the transfer of personal data to third countries which do not ensure an adequate level of data protection is prohibited. Although some exceptions apply, for example if the transfer is necessary or 31 legally required (in the EU) on important (EU) public interest grounds , these exceptions seem difficult to apply in this case, as at least transfers to third countries are likely to be based on these third countries' interests. In any case, exceptions cannot be 32 the legal basis for repeated transfers .

text: 39. However, transfers could take place in accordance with EU data protection law if it is ensured that the recipient provides adequate data protection safeguards . These safeguards could be based on the data protection principles contained in the Standard Contractual Clauses for the transfers of personal data to third countries adopted by the Commission and should be binding to third parties, e.g., by means of a contract or an agreement. Such safeguards, to be signed by third country organisations or international organisations requesting the data, should be included in the Proposal, for example in a new Annex.

text: 40. As regards the processing of data of interested parties requesting access to the ECR, the EDPS welcomes the fact that Annex IV determines the categories of data to be collected for this purpose. He recommends specifying in the Proposal the data protection measures that will apply to the processing of data relating to third parties (e.g., for how long the data will be stored after access has been granted or denied and who has access to these data).

text: 41. The form contained in Annex IV should include, apart from the notice on access to information , a privacy notice. This should include information about the identity of the controller, the purpose of the processing and the recipients of the data. 3.10. The processing of sensitive data should be subject to additional safeguards

text: 42. The EDPS notes that Annex I listing the incidents to be reported under the mandatory occurrence reporting system includes sensitive data relating e.g. to injuries, "severe health event affecting crew member or passengers" or " difficulty in controlling intoxicated, violent or unruly passengers". Some of these categories might be related to offences and to the evaluation of the conduct of individuals.

text: 43. According to

text: Article 8 of Directive 95/46/EC

text: and

text: the processing of personal data concerning health is only allowed if certain exceptions apply. The necessity of processing sensitive data for one of the exceptions (e.g., if needed "for reasons of substantial public interest" ) should be justified in the Preamble of the Proposal.

text: Article 8(5) of Directive 95/46/EC

text: and

text: 4. CONCLUSIONS

text: Article 16

text: and

text: Article 2(1)

text: Article 5(6)

text: Article 16(2)

text: Article 5(6)

text: should also be disidentified;  in

text: Article 13(10)

text: Article 11(4)

text: Article 11(4)

text: , but fully anonymised.

text: Article 5(6)

text: and

text: and

text: Article 8 of Directive 95/46/EC

text: and

text: ('sensitive data').

text: Article 8

text: (2-4) of Directive

text: and

text: Article 10

text: (2-4) of

text: Regulation (EC) No 45/2001


text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3 COM (2013) 4 final. 4 Annex of the Proposal. 5 Annex II of the agreement. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: EDPS Opinion of 18 January 2013 on the Proposal for a Regulation amending

text: Regulation (EC) No 273/2004

text: on drug precursors and the Proposal for a Regulation amending

text: Council Regulation (EC) No 111/2005

text: laying down rules for the monitoring of trade between the Community and third countries in drug precursors, in particular p.9-10, available on http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/ 2013/13-01-18_Drug_precursors_EN.pdf. 7 United Nations Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances, adopted in Vienna on 19 December 1988, available on http://www.unodc.org/pdf/convention_1988_en.pdf.

text: See European Court of Justice, 9 November 2010, Volker und Markus Schecke,

text: and

text: , para. 53 and

text: Article 29

text: Working Party Opinion nº 4/2007 of 20 June 2007 on the concept of personal data (

text: WP 136

text: ), p.23-24, available on: http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2007/wp136_en.pdf. 9 See page 2 of the Proposal. 10 See Recital 3 of the Proposal. 11 According to Article 2 of the agreement, the Parties' competent authorities will communicate directly with one another.

text: See

text: Article 8(1) of Directive 95/46/EC

text: . 13 See

text: Article 8(5) of Directive 95/46/EC

text: . 14 See EDPS Opinion on EU internal and external trade in drug precursors, cited above. 15 See Article 3(1) of the agreement.

text: Article 13

text: allows a restriction to the principle of purpose limitation if such a restriction constitutes a necessary measure to safeguard national security, defence, public security, the prevention, investigation, detection and prosecution of criminal offences or of breaches of ethics for the regulated professions, an important economic or financial interest, or the protection of the data subject or the rights and freedoms of others. See also

text: Article 29

text: Working Party, Working document on Transfers of personal data to third countries: Applying Articles 25 and 26 of the EU data protection directive (

text: WP 12

text: ), p. 6, available on http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/1998/wp12_en.pdf. 17 In particular, it should be laid down by EU or EU Member States’ law or in thisagreement, necessary in a democratic society, proportionate and sufficiently clear and precise to be foreseeable (See

text: Article 29

text: Working Party Opinion 3/2013 on purpose limitation (

text: WP 203

text: ), p. 36-37, available on http://ec.europa.eu/justice/data-protection/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf). 18 See Article 5(2) of the agreement. 19

text: Regulation (EC) No 273/2004

text: on drug precursors and

text: Council Regulation (EC) No 111/2005

text: laying down rules for the monitoring of trade between the Community and third countries in drug precursors. 20 See

text: Article 25 of Directive 95/46/EC

text: See

text: Article 26(1)

text: (d) of Directive

text: . 22 See

text: Article 29

text: Working Party, Working document on a common interpretation of

text: Article 26(1) of Directive 95/46/EC of 24 October 1995

text: WP 114

text: , available at http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2005/wp114_en.pdf. 23 Council of Europe, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No.: 108), Strasbourg, 28 January 1981. 24 Council of Europe, Additional Protocol to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data regarding supervisory authorities and transborder data flows (ETS No. 181), Strasbourg, 8 November 2001. 25 See

text: Article 29

text: Working Party,

text: WP 12

text: , cited above. 26

text: Commission Decision 2001/497/EC of 15 June 2001

text: on standard contractual clauses for the transfer of personal data to third countries, under the Directive

text: , OJ L 181 of 4.7.2001, p.19; and Commission Decision of 27 December 2004 amending Decision

text: as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries, OJ L 385 of 29.12.2004, p. 74.

text: See the principle on "Exemptions from transparency and right of access" of the agreement. 28 See Article 9 of the agreement.

text: United Nations, Vienna Convention on the Law of Treaties of 1969. See, in particular,

text: Article 60

identifier: EDPS yttrande (2013)

amnesord:
International Agreements
Transfers of data
Police Cooperation

publisher: Europeiska datatillsynsmannen

sprak: en

title: Drug precursors

serie: yttranden

text: Opinion of the European Data Protection Supervisor

type: stycke

text: on the Proposal for a Council decision on the conclusion of the Agreement between the European Union and the Russian Federation on drug precursors

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free 2 movement of such data , and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1 Context of the consultation of the EDPS

text: 1. On 21 January 2013, the Commission adopted a Proposal for a Council decision on the conclusion of the Agreement between the European Union and 3 the Russian Federation on drug precursors (hereinafter: 'the Proposal') . The Proposal was sent to the EDPS for consultation on the same day.

text: 2. The Proposal includes the text of the agreement between the European Union and the Russian Federation on drug precursors (hereinafter: "the agreement") . Annex II of the agreement contains a list of data protection definitions and principles (hereinafter: "data protection principles") .

text: 3. The EDPS had been previously consulted by the Commission. The present Opinion builds on the advice provided at that occasion and on the EDPS Opinion on the amendments to the Regulations on EU internal and external trade in drug precursors . I.2. Aim of the agreement

text: 4. The agreement aims at further strengthening cooperation between the European Union and the Russian Federation on the prevention of diversion from legitimate trade of the substances used to illicitly manufacture narcotic drugs and psychotropic substances (hereinafter: "drug precursors").

text: 5. On the basis of the UN Convention of 1988 against Illicit Traffic in Narcotic Drugs and Psychotropic Substances (hereinafter "the 1988 Convention") , the agreement will allow the coordination of trade monitoring procedures and mutual assistance between the competent authorities of the Parties (the European Union and the Russian Federation), together with technical and scientific cooperation and the setting up of a Joint Follow-Up expert group. II. GENERAL COMMENTS

text: 6. The EDPS is aware that the purpose of the agreement is not the processing of personal data. However, the agreement will imply the processing of personal data relating to natural persons, either directly or indirectly, for instance if a natural person can be identified through a legal person.

text: 7. Therefore, the EDPS welcomes the references to the protection of personal data and the inclusion of data protection principles to be respected by the Parties.

text: 8. The EDPS is nevertheless concerned about the actual enforceability of these principles and about the establishment of an authority in the Russian Federation which, according to the agreement, will be in charge of supervising the implementation of the data protection principles. III. SPECIFIC COMMENTS III.I. Applicability of EU data protection legislation

text: 9. The agreement requires the exchange of data relating to operators importing or exporting drug precursors between the EU and Russia. The processing of data relating to legal persons is not covered by EU data protection legislation. However, these data might also relate to identified or identifiable natural persons, for example, if the name of the legal person includes the name of a natural person or if data about a small business contains information about one of its owners . In these cases, the data protection legislation applies.

text: 10. The EDPS therefore welcomes the reference in the Explanatory Memorandum to the fact that the agreement may occasionally imply exchanges of personal data . He also welcomes that the Preamble states that "the agreement should ensure full respect of fundamental rights" and, in particular, "a high level of protection for the processing and transfer of personal data between the Parties" . However, he notes that this declaration by itself does not ensure that the agreement provides an adequate level of protection (see section III.5. below).

text: 11. As the agreement implies the processing of personal data by Member States' authorities (together with Russian authorities) , Directive

text: is applicable. Therefore, the EDPS recommends including an explicit reference to the applicability of EU national laws implementing Directive

text: to the transfers of personal data by the EU to Russian authorities and to the processing of personal data by Member States’ authorities. The EDPS also suggests including references to Articles 7 and 8 of the EU Charter of Fundamental Rights. III.2. Categories of data to be processed

text: 12. The EDPS welcomes the references in Articles 3(2) and 4(1) of the agreement to

text: Article 12(10)

text: (a) of the 1988 Convention, which lists the categories of data that can be exchanged for the purposes of trade monitoring and mutual assistance. However,

text: Article 12(10)

text: (a)(v) of the 1988 Convention allows the exchange of "any other information which is mutually agreed upon by the Parties".

text: 13. In addition,

text: Article 4(2)

text: states that "the Parties shall also provide each other (...) with mutual assistance if there are reasons to believe that "other relevant information is of interest to the other Party". Similarly,

text: Article 5(3)

text: , states that the information to be contained in the written requests to be sent to a Party shall contain "other information that may be used for the execution of the request".

text: 14. The EDPS recommends specifying in an exhaustive manner in Articles

text: and

text: all the categories of personal data that may be exchanged. This is all the more relevant taking into account the potential sensitivity of the data to be exchanged (see section III.3). III.3. Processing of special categories of data

text: Article 8 of Directive 95/46/EC

text: explicitly prohibits, except under strict conditions, the processing of personal "data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life" and restricts the processing of personal data relating to offences, criminal convictions or security measures .

text: 16. As previously noted by the EDPS , open data fields such as the ones contained in Articles

text: and

text: (as well as in Articles

text: and

text: which refer to

text: Article 12(10)

text: (a)(v) of the 1988 Convention) could potentially include sensitive data, e.g., if the information reported on suspect transactions includes health data or data revealing ethnic origin. In order to avoid this possibility, the EDPS recommends, as stated above, listing all the categories of data to be exchanged.

text: 17. In addition, the agreement requires the competent authorities of the Parties to inform each other whenever they have reasonable grounds to believe that there may be a diversion of drug precursors from legitimate trade . Personal data contained in these reports on suspect transactions can thus be related to offences.

text: Article 8 of Directive 95/46/EC

text: only allows the processing of data relating to offences if it is carried out under the control of an official authority or if suitable specific safeguards are provided by law.

text: 18. Although the agreement only provides for processing by the Parties’ competent authorities, the EDPS recommends including additional safeguards in the agreement or in Annex II, such as short retention periods and strict security measures. It should also be specified that once a suspicion is cleared, information transferred e.g., under

text: Article 3(1)

text: , should be deleted. In addition, as recommended in section III.6, the Parties’ competent authorities should not transfer the data to other recipients, either national or of third countries, unless strict conditions apply. III.4. Purpose limitation and data retention

text: 19. Article 5 of the agreement is entirely dedicated to confidentiality and data protection. The EDPS welcomes the principle of purpose limitation contained in

text: Article 5(2)

text: , which states that personal data obtained under the agreement shall be used solely for the purposes of this agreement. However, he regrets the fact that

text: Article 5(3)

text: allows the processing for further purposes, without specifying them.

text: 20. These other purposes should be explicitly stated in the agreement and should be compatible with the original purpose for which the data were transferred. This is especially relevant as regards the possible processing of sensitive data (for example, relating to suspicious transactions, see above). The processing for other incompatible purposes should only be allowed for any of the grounds contained in

text: Article 13 of Directive 95/46/EC

text: . Any exception to the principle of purpose limitation should be interpreted in a restrictive way, used only in specific cases and subject to strict conditions .

text: 21. The EDPS also welcomes the prohibition of keeping the data for longer than 18 necessary , but he recommends specifying maximum retention periods. The EDPS is aware that the harmonisation of retention periods may be difficult, even within the EU. However, at least a maximum period could be determined, based on the experience of EU Member States and the Commission in the implementation of the 1988 Convention,

text: Regulation (EC) No 273/2004

text: and

text: Council Regulation (EC) No 111/2005

text: on drug precursors . The EDPS suggests taking this up further in the legislative process, and in this context asking further guidance to the national authorities concerned as well as to the

text: Article 29

text: Working Party. III.5. Legal basis for international transfers

text: 20. As a general rule, Directive

text: only allows transfers of personal data to 20 third countries which do ensure an adequate level of protection . Although some exceptions apply, e.g., if the transfer is necessary or legally required on important public interest grounds , these exceptions cannot justify repeated and structured transfers as the ones foreseen in the agreement .

text: 21. The Russian Federation is not considered to grant an adequate level of protection for personal data. The EDPS also notes that the Russian Federation has not ratified the Council of Europe Convention No. 108 on automatic processing of personal data or its additional protocol on supervisory authorities and transborder data flows .

text: 22. The EDPS therefore welcomes the inclusion of data protection principles which, according to Article 5 of the agreement, "are mandatory for the Parties". If the principles are respected and effectively enforceable, the transfers could take place on the basis of

text: Article 26(2) of Directive 95/46/EC

text: , which requires "adequate safeguards". These principles will be analysed below. III.6. The data protection principles

text: 23. The EDPS welcomes the fact that

text: Article 5(5)

text: specifies that in case personal data are exchanged, their processing shall comply with the data protection principles. The EDPS also welcomes the list of principles contained in Annex II, which, if read together with

text: Article 5

text: , is very close to the basic list of minimum conditions for assessing "adequate protection" provided by the

text: Article 29

text: Working Party and to the principles attached to the Commission Standard Contractual Clauses .

text: 24. The EDPS would however recommend adding in the agreement or in Annex II the provisions on "data security" and "sensitive data" (see also point III.3 above), present in the two sets of principles listed above. In addition, as regards the principles of "transparency" and "rights of access, rectification, erasure and blocking of data", he would recommend specifying in the text of the agreement or in the Annex the procedures to give effect to these principles.

text: 25. The EDPS welcomes the principle of "redress", including the right to administrative and judicial remedy to individuals "regardless of their nationality or country of residence" and the references to compensation and sanctions. The practical information on existing remedies should be mentioned in the agreement or at least in letters exchanged between the parties or in documents accompanying the agreement.

text: 26. The term "competent authority" used under this principle is misleading. The EDPS understands that it refers to data protection supervisory authorities. However, this is the same term used to refer to authorities competent to monitor and report on trade in drug precursors. Therefore, the EDPS recommends specifying in the paragraph on "redress" that it refers to authorities competent for the protection of personal data and the supervision of their processing. The relevant authorities should be mentioned in the agreement or at least in letters exchanged between the parties or in documents accompanying the agreement.

text: 27. The EDPS welcomes the provisions on "supervision of data processing". However, although there is a reference to supervision by independent public authorities, it is not specified which will be those authorities and whether they will be really independent in practice. As with the previous principle, this should be specified in the agreement or at least in letters exchanged between the parties or in documents accompanying the agreement.

text: 28. As regards “onward transfers”, the EDPS welcomes the fact that Annex II states that transfers of personal data to other authorities and public bodies of a third country shall be allowed if this country provides an adequate level of data protection and for the purposes for which the data have been transmitted. It should also be added that the competent authorities of the Parties should not transfer personal data to other national recipients unless the conditions mentioned above are fulfilled. The EDPS also welcomes the fact that, “subject to reasonable legal limitations provided by national law the Parties shall inform the data subject on such onward transfer”.

text: 29. The last principle provides for exceptions to the rights of transparency and direct access by data subjects. In cases where access cannot be granted to data subjects because it would "jeopardise an official investigation" or "violate the human rights of other persons" , indirect access through EU national data protection authorities should be provided. This should be clearly laid down in the agreement. III.7. Review and reporting

text: 30. The agreement establishes a joint follow-up expert group entitled to make recommendations, administer the agreement and ensure its proper implementation .This group will consist of representatives of the authorities competent for the monitoring and reporting on trade in drug precursors. Participation of data protection supervisory authorities is not foreseen.

text: 31. The EDPS suggests providing that the data protection supervisory authorities of the Parties should contribute to the review of the implementation of the agreement, either because invited in the framework of the joint follow-up expert group, or as a separate process. The independence of the relevant Russian supervisory authority should be carefully analysed on the basis of the requirements of EU data protection law and taking into account Council of Europe Convention No. 108. The result of this analysis should be laid down in the documents accompanying the agreement or in the letters exchanged between the parties.

text: 32. If the independence of such authority cannot be established, EU national data protection authorities should be involved in the oversight of the implementation of the agreement both by EU and by Russian competent authorities. Therefore, it should be specified in the agreement or at least in the documents accompanying it or in the letters exchanged between the parties that the EU review team should include EU national data protection authorities.

text: 33. In addition, it should be specified that Russian authorities competent for the implementation of the agreement should ensure access by EU data protection authorities to relevant documentation, systems and staff for the purposes of the review. The results of the joint review should be reported to the European Parliament and to the Council, where needed with full respect of confidentiality. III.8. Suspension and termination

text: 34. Finally, the EDPS recommends completing Article 12 of the agreement with a clause allowing any Party to suspend or terminate the agreement in the event of a breach of the other Party's obligations under the agreement, including as regards compliance with the data protection principles. The EDPS notes that suspension and termination is in general provided by the Vienna Convention . However, he recommends adding this explicit reference to breaches of the data protection principles as a reason for suspending or terminating it. Such a clause could also include, for example, consultations between the Parties prior to any possible suspension. IV. CONCLUSIONS

text: 35. The EDPS welcomes the provisions on the protection of personal data in the text of the agreement and the inclusion in the Annex of data protection principles to be respected by the Parties.

text: 36. The EDPS suggests including an explicit reference to the applicability of EU national laws implementing Directive

text: to the transfers of personal data by the EU to Russian authorities and to the processing of personal data by EU authorities. He also suggests including references to Articles 7 and 8 of the EU Charter of Fundamental Rights.

text: 37. He also recommends specifying in Articles

text: and

text: and

text: all the categories of personal data that might be exchanged. Furthermore, additional safeguards, such as shorter retention periods and stricter security measures should be included in the agreement or in Annex II for data relating to suspect transactions. The other purposes for which the data could be processed according to

text: Article 5(3)

text: 38. The EDPS also welcomes the prohibition of keeping the data for longer than necessary in Article 5(2) of the agreement, but he recommends specifying at least maximum retention periods.

text: 39. The EDPS welcomes the inclusion of mandatory data protection principles. However, he would recommend completing them as follows:  adding the provisions on "data security" and the specific requirements for processing "sensitive data";  specifying the procedures for making effective the principles of "transparency" and "rights of access, rectification, erasure and blocking of data" in the text of the agreement or in the Annex;  as regards “onward transfers”, it should be added that the competent authorities of the Parties should not transfer personal data to other national recipients unless the recipient provides adequate protection and for the purposes for which the data have been transmitted.  as regards the principle of "redress", it should be specified that the term “competent authorities”, used in the rest of the agreement in a different context, refers here to authorities competent for the protection of personal data and the supervision of their processing;  the relevant authorities and the practical information on existing remedies should be mentioned in the agreement or at least in letters exchanged between the parties or in documents accompanying the agreement;  as regards the principle on “exceptions to the rights of transparency and direct access”: it should be specified that, in cases where the right of access cannot be granted to data subjects, indirect access through EU national data protection authorities should be provided.

text: 41. It should also be specified that the data protection supervisory authorities of the Parties should jointly review the implementation of the agreement, either in the framework of the joint follow-up expert group, or as a separate process. In addition, if the independence of the relevant Russian supervisory authority is not sufficiently established, it should be specified that EU national data protection authorities should be involved in the supervision of the implementation of the agreement by Russian authorities. The results of the review should be reported to the European Parliament and to the Council, where needed with full respect of confidentiality.

text: 42. The EDPS also recommends completing Article 12 of the agreement with a clause allowing any Party to suspend or terminate the agreement in the event of a breach of the other Party's obligations under the agreement, including as regards compliance with the data protection principles. Done in Brussels, 23 April 2013 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor

type: vagledning

utgivare: edps


text: OJ L281, 23.11.1995, p. 31. 2 OJ L8, 12.1.2001, p. 1. 3 OJ L350, 30.12.2008, p. 60. 4 COM(2012)735 final.

text: COM(2012)732 final 6 The Stockholm Programme - An open and secure Europe serving and protecting citizens, Council Document 5731/10, 3.3.2010. 7 Treaty on the Functioning of the European Union, OJ C 83/47, 30.03.2010. 8 The Stockholm Programme - An open and secure Europe serving and protecting citizens, Council Document 5731/10, 3.3.2010, section 4.2.2 9 Communication of 20 July 2010 from the Commission to the European Parliament and the Council entitled ‘Overview of information management in the area of freedom, security and justice’, COM(2010) 385 final.

text: See for instance EDPS Opinion of 10 July 2009 on the Communication from the Commission to the European Parliament and the Council on an Area of freedom, security and justice serving the citizen, OJ C 276, 17.11.2009, p. 8 and EDPS Opinion of 7 October 2009 on the proposals regarding law enforcement access to EURODAC, OJ C 92, 10.04.2010, p. 1. 11 See point 2.5 of the Communication. 12 See point 2.3 of the Communication

text: See for instance EDPS Opinion of 5 September 2012 on law enforcement access to EURODAC, EDPS Opinion of 30 September 2010 on the Communication from the Commission to the European Parliament and the Council – ‘Overview of information management in the area of freedom, security and justice’, EDPS Opinion of 24 November 2010 on the Communication from the Commission to the European Parliament and the Council concerning the EU Counter-Terrorism Policy: main achievements and future challenges, EDPS Opinion of 20 December 2007 on the draft Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) data for law enforcement purposes, and EDPS Opinion of 19 October 2005 on three Proposals regarding the Second Generation Schengen Information System (SIS II). Council Framework Decision 2006/960/JHA of 18 December 2006 on simplifying the exchange of information and intelligence between law enforcement authorities of the Member States of the European Union, OJ L 386, 29.12.2006, p. 89 Council Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime, OJ L210, 06.08.2008, p. 1 and Council Decision 2008/616/JHA of 23 June 2008 on the implementation of Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime, OJ L 210, 06.08.2008, p. 12. Council Decision 2009/371/JHA establishing the European Police Office, OJ L 121, 15.05.2009, p. 37. Council Decision 2007/533/JHAof 12 June 2007 on the establishment, operation and use of the second generation Schengen Information System (SIS II), OJ 205, 07.08.2007 p. 63. Council Framework Decision 2009/315/JHA of 26 February 2009 on the organisation and content of the exchange of information extracted from the criminal record between Member States , OJ L 93, 07.04.2009,p. 23, and Council Decision 2009/316/JHA of 6 April 2009 on the establishment of the European Criminal Records Information System (ECRIS) in application of Article 11 of Framework Decision 2009/315/JHA , OJ L 93 , 07.04.2009 p. 33.

text: sophisticated IT tools. Technological phenomena like cloud computing, social networks, road toll collecting and geo-location devices as well as the linking and

text: human behaviours have profoundly changed the way in which data may be collected

text: data mining and profiling are becoming more and more proactive and investigations take place on the basis of general developments, sometimes without concrete suspicions, but with the use of powerful IT-tools.

text: See for instance Council Decision 2008/633/JHA of 23 June 2008 concerning access for consultation of the Visa Information System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences, OJ L 218,13.08.2008, p. 129; the Amended proposal of the Commission for a Regulation of the European Parliament and of the Council on the establishment of 'EURODAC' for the comparison of fingerprints for the effective application of Regulation (EU) No […/…] (establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person) and to request comparisons with EURODAC data by Member States' law enforcement authorities and Europol for law enforcement purposes and amending

text: Regulation (EU) No 1077/2011

text: establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (Recast version), COM (2012) 254 final, 30.05.2012 and the proposal of the Commission for a Regulation of the European Parliament and of the Council establishing an Entry/Exit system (EES) to register any entry and exit of third country nationals crossing the external borders of the Member States of the European Union, COM(2013) 95 final, 28.02.2013. Directive 2006/24/CE of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive

text: , OJ L 105, 13.04.2006, p.54. See

text: Council Decision 2012/472/EU of 26 April 2012

text: on the conclusion of the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security, OJ L 215, 11.08.2012, p.4. Directive

text: of the European Parliament and of the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing OJ L 309, 25.11.2005, p. 15 (currently under review). See also the Communication of 13.July 2011 from the Commission to the European parliament and the Council entitled 'A European terrorist finance tracking system: available options', COM(2011)429 final.

text: Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, OJ L 350, 30.12.2008, p. 60.

text: See also EDPS opinion of 19 December 2005 on the Proposal for a Council Framework Decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters (COM (2005)475 final), OJ C 47, 25.02.2006, p. 27 25 Proposal of 25 January 2012 for a Directive on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data, COM(2012) 10 final. 26 See on this the announcement by the Commission on 9 April 2013: ‘SIS II goes live’ : http://ec.europa.eu/dgs/home-affairs/what-is-new/news/news/2013/20130409_01_en.htm

text: See EDPS Opinion of 26 February 2006 on Exchange of information under the principle of availability; EDPS Comments of 10 March 2006 on the Commission's Communication of 24 November 2005 on improved effectiveness of enhanced interoperability and synergies among European databases in the area of Justice and Home Affairs, and EDPS Opinion of 7 December 2009 on the Agency for large-scale IT systems.

text: Communication of 27 March 2013 from the Commission to the European Parliament, the Council, the European and economic and Social Committee and the Committee of the Regions entitled 'Establishing a European Law Enforcement Training Scheme', COM(2013) 172 final. 29 Proposal of 27 March 2013 for a Regulation of the European Parliament and of the Council on the European Union Agency for Law Enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA, COM(2013) 173 final.

amnesord:
Police Cooperation
Security

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular

text: Article 28 (2)

text: thereof,

text: Having regard to Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 7 December 2012, the Commission adopted a Communication entitled 'Strengthening law enforcement cooperation in the EU: the European Information Exchange Model (EIXM) (hereinafter: 'the Communication'). On the same day the Commission adopted a report on the implementation of Council Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime (the ‘Prüm Decision’). This report will not be separately commented in this opinion, but is mentioned here in order to better understand the context.

text: 2. Before the adoption of the Communication, the EDPS was given the opportunity to provide informal comments. The EDPS welcomes that some of his comments have been taken into account in the Communication. 1.2. Background and objectives of the Communication

text: 3. The Stockholm Programme aims at meeting future challenges and further strengthening the area of freedom, security and justice with actions focusing on the interests and needs of citizens. It establishes the EU's priorities in the field of Justice and Home Affairs for the period of 2010-2014 and defines strategic guidelines for legislative and operational planning within the area of freedom, security and justice in accordance with Article 68 of the Treaty on the Functioning of the European Union ('TFEU') .

text: 4. In particular, the Stockholm Programme acknowledges the need for coherence and consolidation in developing information management and exchange in the field of EU internal security and invites the Council and the Commission to implement the Information Management Strategy for EU internal security, including a strong data protection regime. In this context, the Stockholm Programme also invites the Commission to assess the need for a European Information Exchange Model (EIXM) based on evaluation of existing instruments in the field of EU information exchange. This assessment should help to determine whether these instruments function as originally intended and meet the goals of the Information Management Strategy .

text: 5. Following-up the Stockholm Programme, the Commission published a Communication in July 2010 (hereafter the 'Communication of 2010') which provides a full overview of the EU-level measures in place, under implementation or consideration, that regulate the collection, storage or cross-border exchange of personal information for the purpose of law enforcement and migration management.

text: 6. Answering the invitation of the Stockholm Programme and building on the Communication of 2010, the present Communication aims to take stock of how the cross-border information exchange in the EU works in practice and to recommend possible improvements.

text: 2. COMMENTS 2.1. General comments Need for better information exchange whilst respecting fundamental rights

text: 7. As already pointed out in previous opinions , the EDPS acknowledges that a better exchange of information is an essential policy goal for the European Union in the area of freedom, security and justice. This emphasis on information exchange is even more logical in the absence of a European police force, a European criminal justice system and a totally harmonised European border control. Measures relating to information are therefore an essential contribution of the European Union allowing the national authorities of the Member States to address cross border crime in an effective way and to effectively protect the external borders.

text: 8. However, these measures should not only contribute to guaranteeing the security of the citizen, but within our European society they also have to fully respect the citizen's fundamental rights including the right to the protection of personal data. This is all the more important as exchange of information in the area of police and judicial cooperation in criminal matters involves to a large extent personal data. The processing of personal data in this area poses specific risks for the individuals and therefore requires a high level of data protection.

text: 9. The EDPS appreciates the general attention paid to data protection in the Communication. He welcomes that the Communication refers to the substantive principles of (i) safeguarding fundamental rights - in particular the right to privacy and protection of personal data - and (ii) the necessity requirement which implies that a restriction of the right to privacy may be justified only if it is lawful, pursues a legitimate aim and is necessary in a democratic society. The Communication also recalls that necessity tests and purpose limitation are essential.

text: 10. The EDPS also positively notes that the Communication emphasises the need to ensure high data quality, data security and data protection and stresses that "whatever combination or sequence is used for exchanging information, the rules on data protection, data security and data quality as well as the purpose for which the instruments may be used must be respected". The context of instruments already available

text: 11. The Communication states at the outset that information exchange generally works well, adding that neither new EU-level law enforcement databases nor new EU information exchange instruments are needed, but existing instruments should be better implemented. The EDPS welcomes this conclusion. Considering that a multiplicity of systems for the cross-border exchange of information carries risks in terms of personal data protection and invasion of privacy, the EDPS has in various opinions advocated that before creating a new instrument, a thorough and more up-to-date evaluation should be carried out in order to see whether a full implementation of the existing instruments would not be sufficient.

text: 12. The Communication mainly focuses on Member State's use of four EU instruments: the Swedish initiative , the Prüm Decisions , Europol and the Schengen Information System . It does not address all existing and envisaged EU instruments for police and judicial cooperation in criminal matters and does not mention for instance the existing European Criminal Record Information System for EU nationals. Furthermore although the Communication mentions other EU instruments in the area of freedom, security and justice (e.g. Customs information System, Visa Information System, EURODAC, EUROSUR) or initiatives (e.g. the proposals for an Entry-Exit System), it does not analyse them.

text: 13. Finally, the EDPS draws the attention to the fact that also legal instruments in other areas than the area of freedom, security and justice should be taken into consideration, since they become more and more relevant (see the instruments meant in point 16). Tendencies in investigative methods

text: 14. New technologies have lead to an increasing amount of available information and a wide range of possible uses of this information. In an information society there is the logical tendency that law enforcement authorities increasingly make use of information available in open sources, and combine this information using sharing of data from different databases or the use of analytical tools to predict and further processed. Working methods of law enforcement authorities such as

text: 15. There is a general and growing tendency to grant law enforcement authorities access to available data which were, are or will be initially collected and processed for purposes that are not related to the combat of crimes and which concern individuals who in principle are not suspected of committing any crime. Wider access is more often given or envisaged for law enforcement authorities to several large-scale information and identification systems set up for example in the areas of immigration and borders control .

text: 16. Traditionally, a clear separation has existed between law enforcement and private sector activities, where law enforcement tasks are performed by specifically dedicated authorities and private actors are only solicited on a case by case basis to communicate personal data to these authorities in the event of concrete suspicion. There is now a tendency to require that private actors cooperate with law enforcement authorities on a systematic basis. This tendency relates for instance to the traffic data of electronic communications and the passenger data of individuals flying to (certain) third countries , and is also developing in the financial sector .

text: 17. The availability of an increasing amount of information outside the law enforcement area as well as the use of new powerful IT tools by law enforcement authorities contribute - to a certain extent - to the current ongoing shift from a surveillance of individuals that are suspected of having committed or having taken part in a criminal offence or regarding whom there are reasonable grounds based on factual indications that they will commit criminal offences to a more general surveillance where all individuals may be considered a priori as potential law breakers, and for that reason subjected to surveillance. Consequences

text: 18. Because of these far reaching developments there is a need to rethink and possibly redefine the right balance between law enforcement purposes and safeguarding fundamental rights of the individuals. It is for instance worth noting that when information is gathered through surveillance methods outside of a concrete criminal case, also the context of fundamental rights protection changes. One could argue that when there is no case before a court, the principle of fair trial (Article 6 of the European Convention of Human Rights) cannot be applied and that therefore data protection and privacy considerations should gain importance.

text: 19. This implies in the first place a reflection on the effectiveness of data protection principles in light of technological changes as well as the growing gathering and use of data for law enforcement purposes. This may lead to adjustments and/or additional safeguards.

text: 20. In the second place, there is indeed nowadays, more than ever before, a clear need for an in-depth reflection on EU information exchange, in view of developments relating to IT large-scale systems and the growing use of data initially collected for purposes not related to the combat of crime. This reflection should also address the effectiveness for public security of the current trend to a widespread, systematic and proactive monitoring of non suspected individuals and its actual usefulness in the fight against crime.

text: 21. The EDPS welcomes the Communication as a first step towards a full evaluation process and encourages the Commission to carry out the above further reflections, the outcome of which should lead to a comprehensive, integrated and wellstructured EU policy on information and exchange management in this area. The relation with the existing and the proposed data protection framework

text: 22. The EDPS notes that it is crucial to ensure a consistent and comprehensive legal framework for data protection. A first important step has been taken through the 23 adoption of Council Framework Decision 2008/977/JHA . However, this legal instrument cannot be qualified as a comprehensive framework, in essence because its provisions do not have general application. They do not apply to domestic situations, when personal data originate from the Member State which uses them . Secondly, the other data protection instruments applicable in the area of freedom, security and justice should be further harmonised and consolidated.

text: 23. The EDPS would like to stress that the ongoing discussions on the Commission's proposal of 25 January 2012 for a Directive applying to the processing of personal data for law enforcement purposes should not prevent the Commission from already now - making an inventory of data protection problems and risks, and of possible improvements within the current legal context. To the contrary, the discussions on the proposed directive could serve as an inspiration for further developing the European Information Exchange Model. Good examples in this context are the discussions on clear distinctions as to processing of data on suspects and non suspects. The EDPS recommends further analysing these notions in the context of the European Information Exchange Model.

text: 24. The EDPS notes that the Communication refers to the Commission proposal for a Directive. In particular, the Communication mentions the need of reviewing existing instruments to align them with the proposed Directive. The EDPS fully subscribes to this intention and encourages the Commission to take further action in this direction. 2.2. Specific comments Assessment of instruments

text: 25. The Communication gives examples of success stories on exchange of information under the Swedish Initiative and the Prüm Decisions while stressing at the same time that implementation of the Prüm Decision is seriously lagging behind and that the Swedish initiative has not reached its full potential. As regards the SIS and SIRENE channels, the Communication mentions that it does not present recommendations because extensive changes are already underway, in particular the migration to SIS II.

text: 26. As mentioned in the Communication, the first outcomes of the exchange of information based on the Swedish initiative and Prüm Decisions are positive in the context of law enforcement. However, the EDPS wishes to point out that a comprehensive assessment of these instruments (including where appropriate failures and weaknesses of the systems such as the number of people wrongly arrested or inconvenienced following a false hit in the system) can only happen once they are fully implemented. He encourages the Commission to pursue the assessment of these instruments during and after their full implementation. Choice of channels

text: 27. In its Communication, the Commission states that apart from legal requirements to use specific channels, Member States use different channels to different extents. Although nothing in the Communication seems to indicate that the use of different channels raises particular concerns, the Commission concludes that the time has come for a more coherent approach, which gives Europol a central role. In this respect, the Communication invites the Member States to use, for exchanges where the channel is not legally defined, the Europol channel using the SIENA tool as the default channel, unless there are specific reasons to use another.

text: 28. The EDPS supports the need for a consistent and harmonised approach on the choice of channels. However, as regards the use of one of the channels as default channel, he recalls the principle of purpose limitation which is a key principle of data protection. As pointed out in the Communication, there is a diversity of instruments, channels and tools, each designed for particular purposes. The use of a channel designed for a specific purpose should not lead to the possible use or collection of the data transiting on this channel for other purposes. This poses the risk of what is often described as 'function creep', namely, a gradual widening of the use of a system or database beyond the purpose for which it was originally intended. Furthermore, the use of a channel has also a direct impact on the responsibilities in terms of data protection and security of the authority/agency managing the channel. The EDPS regrets that the Communication does not underline these consequences, and recommends that the guidance which the Council is invited to give takes these perspectives into account.

text: 29. Finally, the EDPS draws attention to the fact that mechanisms that are designed for information exchange for a specific purpose are not necessarily appropriate to other purposes. The communication tool SIENA developed by Europol has been tailored for specific exchange of information between the competent authorities of Member States and third parties for police cooperation. Thus specific functionalities of SIENA have been developed and implemented based on the needs identified at the moment of the creation of such tool. These functionalities require amongst others the users to enter certain types and amount of information. The EDPS points out that SIENA's functionalities are not necessarily appropriate for the exchange of information in a different context and for different purposes. Therefore, in this specific case, he encourages the Commission to justify more clearly the choice of this channel, and to assess whether this choice is in compliance with the principle of privacy by design. Managing the channels - SPOC

text: 30. The Communication invites the Member States to create – or use, if already existing - a Single Point of Contact (SPOC) as a ‘one-stop shop’ for international cooperation covering all main channels, available 24/7, bringing together all law enforcement authorities with access to all relevant national databases. Given the existence of different units dealing with different parts of police cooperation on national level, the EDPS understands that the accessibility via one single point of contact will help the requesting country as it would not have to address the different authorities and contacts in the requested country.

text: 31. The creation of SPOCs may present advantages since it facilitates the overview of the cross-border information flow and it allows a further recording of actors directly involved. However, the creation of SPOCs should take into account data protection implications. All databases have been created for defined purposes and are subject to specific rules. A database may only be accessed by duly authorised staff in the performance of their tasks and for the purposes for which the database has been created. Therefore, the composition and the modalities of SPOCs should be carefully analysed and defined in order to ensure that the rules applicable to each database are complied with.

text: 32. In the absence of harmonised conditions for SPOCs there might be cases where entities represented in SPOCs will not be authorised to directly access the database but will facilitate the access and ensure that the requested information is communicated to the requested authority from another Member State. The EDPS notes that the Communication specifies that SPOCS should have direct access to national databases where legally permissible. The EDPS notes with satisfaction that the Communication recalls that information may only be actually exchanged and used where legally permitted, which includes compliance with data protection rules. However, he invites the Commission to start working on harmonised conditions for SPOCs, to ensure that the requirements are similar in all Member States and effectively protect individuals. Ensuring data quality, data security and data protection

text: 33. As to the interoperability between different national systems and administrative structures referred to in the Communication, the EDPS stresses the need to consider the protection of personal data as an inherent part of the establishment or improvement - of the interoperability of relevant systems.

text: 34. As already underlined in earlier comments and opinions , making access to or exchange of data technically feasible becomes, in many cases, a powerful drive for de facto acceding or exchanging these data. Although the introduction of interoperability will not lead to new databases, it will necessarily introduce a new use of existing databases by providing new possibilities of access to those databases.

text: 35. In that respect, the EDPS would like to point at the basic data protection principle of purpose limitation, which requires that personal data may not be used for purposes which are incompatible with the purpose for which the data were originally collected, unless this would be specifically allowed under certain strict conditions. Improving training and awareness

text: 36. The Communication refers to the preparation by the Commission of a European Law Enforcement Training Scheme that will include training on cross-border exchange information. The EDPS notes the recent adoption of the Commission Communication establishing a European Law Enforcement Training Scheme on which he will come back in his opinion on the proposal for a Regulation on Europol . Taking into account that cross-border information exchange will in a number of cases involve personal data, the EDPS would like to draw attention to the need of including trainings on information security and data protection in the Scheme envisaged by the Commission as well as in the trainings Member States are invited to ensure.

text: 3. CONCLUSIONS

text: 37. The EDPS appreciates the general attention devoted to data protection in the Communication which emphasises the need to ensure high data quality, data security and data protection and recalls that whatever the combination or sequence used for exchanging information, the rules on data protection, data security and data quality as well as the purpose for which the instruments may be used must be respected.

text: 38. The EDPS also:  welcomes that the Communication concludes that neither new EU-level law enforcement databases nor new EU information exchange instruments are needed;  emphasizes the need for a full evaluation process of the instruments and initiatives in the Justice and Home Affairs area, the outcome of which should lead to a comprehensive, integrated and well-structured EU policy on information and exchange management and encourages the Commission to pursue the assessment of other existing instruments;  encourages the Commission to carry out reflections on (i) the effectiveness of data protection principles in light of technological changes, the developments relating to IT large-scale systems and the growing use of data initially collected for purposes not related to the combat of crime, as well as on (ii) the effectiveness for public security of the current tendency to a widespread, systematic and proactive monitoring of non suspected individuals and its real usefulness in the fights against crimes; the outcome of these reflections should lead to a comprehensive, integrated and well-structured EU policy on information and exchange management in this area;  underlines that the ongoing discussions on the proposal for a Directive should not prevent the Commission from making an inventory of data protection problems and risks, and of possible improvements within the current legal context, and recommends using theses discussions in particular on the distinction on processing of data of suspects and non suspects for further development of the European Information Exchange Model;  fully subscribes to the need for reviewing existing instruments to align them with the proposed Directive and encourages the Commission to take further action;  encourages the Commission to pursue the assessment of existing instruments along and after their full implementation;  recommends that the guidance which the Council is invited to give as regards the choice of channel takes into account the consequences in terms of purpose limitation and responsibilities;  encourages the Commission to justify more clearly the choice of the Europol channel using the SIENA tools as default channel and to assess whether this choice is in compliance with the principle of privacy by design;  notes with satisfaction that the Communication recalls that information may only be actually exchanged and used where legally permitted, which includes compliance with data protection rules, and invites the Commission to start working on harmonised conditions for SPOCs, to ensure that the requirements are similar in all Member States and effectively protect individuals;  recommends including trainings on information security and data protection in the Scheme envisaged by the Commission as well as in the trainings Member States are invited to ensure. Done in Brussels, 29 April 2013 (signed) Peter HUSTINX European Data Protection Supervisor