text: OJ L281, 23.11.1995, p. 31. 2 OJ L8, 12.1.2001, p. 1. 3 OJ L350, 30.12.2008, p. 60. 4 COM(2013)796 final. hereinafter: 'the Proposal'. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: Regulation (EC) No 515/97 of 13 March 1997

text: on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters, as amended by Regulation 766/2008 on 9 July 2008 (OJ L 82, 22.3.1997, p. 1). Hereinafter: 'the Regulation'. 6 The purpose of CIS is to assist competent national authorities and the Commission ('CIS partners') in preventing, investigating, and prosecuting operations that are in breach of customs and agricultural provisions. To this end, it allows CIS partners to put up alerts in the system requesting other CIS partners to take certain actions, more specifically: sighting and reporting, discreet surveillance, specific checks and operational analysis. These alerts can relate to commodities, means of transport, businesses and persons.

text: Council Decision 2009/917/JHA of 30 November 2009 on the use of information technology for customs purposes (OJ L 323, 10.12.2009, p. 20). The customs union is an area of exclusive EU competence according to

text: Article 3(1)

text: (a) of the Treaty on the Functioning of the European Union (TFEU). 9 In concrete terms, from a formal point of view, there are thus also two separate parts of CIS: one established under Regulation 515/97 ('CIS EU') and one established under Council Decision 2009/917/JHA ('CIS MS'). The difference between them lies in the types of goods they relate to: CIS under the Council Decision refers to drugs, weapons and some other categories such as laundered money and stolen cars, while all other categories are dealt with by CIS as established under Regulation 515/97. Art. 33: 'Within the scope of application of the Treaties, the European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall take measures in order to strengthen customs cooperation between Member States and between the latter and the Commission.' Art. 325: '1. The Union and the Member States shall counter fraud and any other illegal activities affecting the financial interests of the Union through measures to be taken in accordance with this Article, which shall act as a deterrent and be such as to afford effective protection in the Member States, and in all the Union’s institutions, bodies, offices and agencies. 2. Member States shall take the same measures to counter fraud affecting the financial interests of the Union as they take to counter fraud affecting their own financial interests. 3. Without prejudice to other provisions of the Treaties, the Member States shall coordinate their action aimed at protecting the financial interests of the Union against fraud. To this end they shall organise, together with the Commission, close and regular cooperation between the competent authorities. [...].' (emphasis added). Article 9 of the Protocol n.36 on transitional provisions to the Lisbon Treaty states that acts adopted on the basis of Titles V and VI of the TEU before the entry into force of the Lisbon Treaty (such as the

text: Decision) are to be 'preserved until those acts are repealed, annulled or amended in implementation of the Treaties'. 12 See the current

text: Article 18

text: a(3) of the Regulation, as well as data contained in the CIS and FIDE databases. 13 ECJ, 9 November 2010, Volker und Markus Schecke,

text: and

text: , OJ C 13/6, 15.1.2011, paras 53-54.

text: EDPS Opinion of 20 April 2009 on the Initiative of the French Republic for a Council Decision on the use of information technology for customs purposes, OJ C 229, 23.09.2009, p. 12. See in particular paragraphs 56 and following: '[...]The EDPS draws attention of the legislator to the need for ensuring a consistent and comprehensive supervision of the whole system. The complex legal framework governing the CIS, based on two legal bases, should be taken into account and two different supervision models should be avoided both for the sake of legal clarity and for practical reasons.[...]'. See also Giovanni Buttarelli's speech during the meeting of LIBE Committee on the use of information technology for customs purposes, European Parliament, Brussels, 29 September 2009, and in particular, point 8: 'We see the need to ensure an external coherence of this system with other large‐scale IT systems (such as SIS II, VIS, Eurodac, Internal Market Information System) where the coordinated supervision model was introduced for both the First and the Third Pillar Areas and has already been in place for some time with very good results. All these systems present similar problems and challenges in terms of a truly effective supervision. ' (available on https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/EDPS/Publications/S peeches/2009/09-09-29_LIBE_CIS_EN.pdf). See also points 54 to 56 of the EDPS Opinion of 31 May 2013 on the Proposal for a Regulation of the European Parliament and of the Council on the European Union Agency for Law enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA where the EDPS takes the view that the provisions on supervision and cooperation in supervision could well be a model for the proposal of the Commission for data protection at EU level announced in the data protection reform. 15 See COM (2013) 0173 and relevant EDPS Opinion of 31 May 2013 on the Proposal for a Regulation of the European Parliament and of the Council on the European Union Agency for Law enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA; see

text: also, more recently, COM (2012) 532, COM(2012) 533, COM (2012) 534 and COM (2012) 535 and the relevant opinion of the European Data Protection Supervisor on the package of legislative measures reforming Eurojust and setting up the European Public Prosecutor's Office ('EPPO'). Both opinions are available at www.edps.europa.eu. 16

text: Case C-518/07

text: , Commission v. Germany, judgment of 9 March 2010;

text: Case C-614/10

text: , Commission v Austria, judgment of 16 October 2012. 17 The EDPS exercises his supervisory role through various tools, such as prior checks, consultations, complaint handling, visits and inspections. The institution has the power to obtain access to all personal data and to all information necessary for his enquiries, and may access any premises in which an EU body carries on its activities. If necessary, the EDPS has a number of formal enforcement powers, such as the power to order the rectification, blocking, erasure or destruction of data that would be processed in breach of the legislation; the power to warn or admonish the controller-EU body; the power to impose a temporary or definitive ban on the processing and refer a matter to the CJEU.

text: Which excludes the CSM database. 19 Unless both texts are substituted by a single instrument based on the TFEU, as suggested above in paragraph 9.

text: Details on how the procedure currently works are in the EDPS´opinion on notifications for Prior Checking received from the Data Protection Officer of the European Anti-Fraud Office regarding the Virtual Operational Cooperation Unit, the Mutual Assistance Broker, and the Customs Information System of 17 October 2011, paragraph 3.7.1, available at www.edps.europa.eu .

text: This understanding has been based on informal contacts with the Commission services. 22 Respectively, '(a) data concerning current investigation files may not be stored for more than three years without any operation in breach of customs and agricultural legislation being observed; data must be anonymised before that time limit if one year has elapsed since the last observation; (b) data concerning administrative enquiries or criminal investigations in which an operation in breach of customs and agricultural legislation has been established but which have not given rise to an administrative decision, a conviction or an order to pay a criminal fine or an administrative penalty may not be stored for more than six years; (c) data concerning administrative enquiries or criminal investigations which have given rise to an administrative decision, a conviction or an order to pay a criminal fine or an administrative penalty may not be stored for more than ten years.’'

text: See 'Additional EDPS comments on the data protection reform package' of 15 March 2013, available at www.edps.europa.eu: 'Anonymisation requires not only deleting all directly identifying attributes (e.g. names, civil registry numbers, phone numbers, biometric data) from the data set, but usually also data which in combination reveal unique characteristics and any further modifications, to prevent reidentifiability. Some types of personal data, such as biometric data, are sufficient by themselves to identify data subjects and therefore cannot be part of any anonymised data set by their very nature (e.g. facial photographs, fingerprints). Recent research suggests that also fine grained location data can be sufficient by itself to identify the individual it relates to. The concept of identification moreover involves the capacity to distinguish an individual from all other individuals ('singling out'), even when commonly used identifiers are not available '.

text: Council Regulation (EEC) No 2913/92 of 12 October 1992

text: establishing the Community Customs Code, as amended, OJ L 302, 19.10.1992, p. 1. 25 See the third indent of Article 4(25) of the Community Customs Code. 26 See Rotaru v. Romania, No 28341/95, §§ 50, 52 and 55; and Amann v. Switzerland, No 27798/95, §§ 50 et s. 27 See

text: Article 29

text: Working Party Opinion on purpose limitation (

text: WP 203

identifier: EDPS yttrande (2014)

amnesord:
Transfers of data
Large-Scale IT Systems
CIS
Information Security

publisher: Europeiska datatillsynsmannen

sprak: en

title: Application of the law on customs and agricultural matters

serie: yttranden

text: Opinion of the European Data Protection Supervisor

type: stycke

text: on the Proposal for a Regulation of the European Parliament and of the Council amending

text: on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular

text: Article 28 (2)

text: thereof,

text: Having regard to Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 25 November 2013, the Commission adopted a proposal for a Regulation of the European Parliament and of the Council amending

text: on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters, as amended by Regulation 766/2008 on 9 July 2008 . The Proposal was sent to the EDPS for consultation on 29 November 2013.

text: 2. Before the adoption of the Proposal, the EDPS was given the possibility to provide informal comments to the Commission. Some of these comments have been taken into account. As a result, the data protection safeguards in the Proposal have been strengthened. 1.2. Background and objectives of the Proposal

text: 3. The Proposal amends one of the most important legal instruments for action against breaches of customs legislation. The fight against breaches of Union customs legislation involves extensive exchanges of information - including personal data - in the context of cooperation between competent authorities in the Member States and between the latter and the Commission.

text: 4. The Proposal´s stated aim is to render the enforcement and cooperation in this area of EU law more effective. In relation to the tracking of goods, it introduces new obligations for carriers to supply the Commission with information on container movements (the so-called Container Status Messages - 'CSM'); it also aims at streamlining the rules organizing the central database for import, export and transit data in order to improve the analysis of the flows of goods.

text: 5. The Proposal also introduces the possibility for the Commission to obtain directly from private sector operators documents supporting import and export declarations, with the explicit purpose to speed up OLAF’s investigations.

text: 6. The Proposal also has the stated aim to simplify and harmonise the data protection supervision rules applicable to the different databases set up on the basis of the Regulation. It introduces a maximum retention period for data 6 stored in the Customs Information System ('CIS') and in the other databases.

text: 7. For the sake of clarity, the databases and directories covered by the Regulation are the following:  The 'European Data directory' -

text: Article 18

text: (a);  The 'CSM directory' -

text: Articles 18

text: (c), 18(d) and 18(e);  The 'Import, export and transit directory' -

text: Article 18

text: (g);  The CIS database -

text: Articles 23

text: to 41;  The FIDE database -

text: Articles 41

text: (a) to 41(d).

text: 2. COMMENTS 2.1. General comments a) Legal context

text: 8. Presently, cooperation between competent authorities for enforcing EU customs legislation is based on two legal instruments: Regulation 515/97 and Council Decision 2009/917/JHA (hereinafter: 'the Decision'). This dual legal basis was needed because customs cooperation was governed, on the one hand, by the EC Treaty rules as regards the customs (former 'first pillar') aspects and, on the other hand, by the EU Treaty (notably, former Title VI of EU Treaty) rules on police and judicial cooperation in criminal matters in relation to the former 'third pillar' aspects.

text: 9. As the entry into force of the Lisbon Treaty removed the pillar structure, currently the legal basis for both types of cooperation is to be found in the TFEU. The stated legal basis for the Proposal is Articles

text: and

text: TFEU . Although Council Decision 2009/917/JHA is still legally valid on the basis of transitory provisions , it should in any event be replaced by a legal instrument adopted through the ordinary legislative procedure under

text: Article 87(2)

text: TFEU.

text: 10. The Proposal, however, does not modify the Decision nor does it foresee the intention to do so in the future. In the EDPS´ view, the Commission should have taken a more comprehensive approach to the legislation on mutual assistance in the customs area to bring it in line with the changes brought by the Lisbon Treaty. A framework encompassing all areas of cooperation would harmonize the mutual assistance rules and therefore improve legal certainty, and in particular it would allow the creation of a coherent and seamless data protection supervision system. Further changes to the supervision structure will be discussed in detail below.

text: 11. The EDPS therefore regrets that the Commission missed the opportunity of proposing a comprehensive text to replace the previous two legal bases. b) Categories of data

text: 12. The EDPS acknowledges that most of the data to be processed in the context of the Regulation relate to legal persons active in the international trade of goods. However, the Regulation itself expressly states that data of natural persons are processed (e.g., name, nationality, origin, birth date, sex and address of persons involved in movements of containers and means of 12 transport) . The personal information processed and further shared may include information relating to individuals' alleged or confirmed involvement in wrongdoing actions in the area of customs or agricultural operations. In addition, it should be highlighted that names of legal persons may also identify natural persons, as underlined by the Court of Justice . c) Applicability of data protection law

text: 13. The EDPS welcomes the reference in recital 11 to the applicability of Regulation 45/2001 to the processing of personal data by Union institutions. However, for legal clarity and consistency, given that the Regulation also applies to processing of data by competent authorities in the Member States, a general provision in the text of the Proposal should be added in order to clarify that Regulation 45/2001 applies to processing of personal data carried out by Union institutions and that national laws implementing Directive

text: are applicable to the processing carried out by the relevant competent authorities in the various Member States. This general provision should be added all the more, since recital 10 specifically mentions Directive

text: alongside Regulation 45/2001 in relation to provisions introduced to ensure accuracy and transparency for data subjects. d) Supervision Shortcomings of the current data protection supervision system

text: 14. The EDPS is concerned about the fact that the Proposal maintains the current dual data protection supervision system, based, respectively, on Article 37 of the Regulation (for the EDPS) and of Articles 24, 25 and 26 of the Decision (for the Joint Supervisory Authority). The unclear distinction of competences between the EDPS and the Joint Supervisory Authority (hereinafter 'JSA') is kept.

text: 15. This dual supervision, as explained in point 1.3.5 of the Explanatory Memorandum, creates significant legal uncertainties, inefficiencies and generates additional costs. The EDPS shares this concern, which was already raised in the opinion he issued on the Initiative of the French Republic for a Council Decision on the use of information technology for customs 14 purposes .

text: 16. In this respect, the Proposal only adds a new paragraph in

text: Article 37

text: , which states that the EDPS and the JSA shall co-ordinate with a view to ensuring coordinated supervision and audits of the CIS. Such a provision is not sufficient to address the inefficiencies highlighted in the Explanatory Memorandum, namely duplication of processes and lengthy procedures.

text: 17. The EDPS considers that the most desirable solution to provide for a consistent and efficient supervision would be a uniform system, based on the model of coordinated supervision which has a three-layered structure: DPAs at national level, EDPS at central level and coordination between both. Such a structure is foreseen in several other Commission proposals . Efficient and independent supervision

text: 18. In the EDPS' experience, effective supervision requires that a supervisory body can act quickly, and with a simple decision making structure. A body which consists of representatives of all Member States' data protection authorities - and which in practice would have to work on the basis of consensus - is not sufficiently effective.

text: 19. When data are processed at EU level, the appropriate EU data protection authority should exercise the supervision. It follows that where the Commission is the controller, the EDPS should guarantee the supervision. The present system with a JSA has served its purpose for the 'intergovernmental' phase of customs cooperation, but is now no longer appropriate.

text: 20. Such a choice would take into account the entry into force of the Lisbon Treaty and the abolition of the pillar structure. As mentioned above, the cooperation in the customs area involving detection, prevention and investigation of crimes is now one of the policies under the 'umbrella' of the TFEU, alongside customs cooperation and fraud combatting.

text: Article 16

text: TFEU and Regulation 45/2001 apply to all these areas.

text: 21. The EDPS has a strong experience in supervising OLAF´s activities in the 'first pillar' areas, and therefore also has the knowledge and capacity to deliver effective and independent supervision of all data processing taking place within its remit.

text: 22. Furthermore, the EDPS embodies the criteria of independence of a data protection supervisory authority required by

text: Article 16

text: TFEU and in the case law of the CJEU . The Court stressed that it is fundamental that the supervisory authorities have effective powers of investigation and of imposing sufficiently deterrent and remedial measures and sanctions. The JSA currently does not have these powers .

text: 23. Certainly, when the processing takes place on the territory of a Member State, the relevant data protection authority of that Member State should be competent for supervising the processing. The role of the latter authority is indeed determinant and indispensable to assess whether data have been lawfully processed at national level. Since the Regulation leads to numerous exchanges of personal data between the national authorities involved and the Commission, cooperation between the EDPS and national supervisory authorities is also crucial.

text: 24. The EDPS highlights the importance of providing for an appropriate structural involvement of the national data protection authorities. Consequently, national data protection authorities would be involved in the decision making process whenever specific issues arise which require a concrete assessment at national level. In this context, the EDPS has good experiences in cooperation, for instance relating to Eurodac, SIS II and VIS, through what is usually called 'coordinated supervision'.

text: 25. In this perspective, the EDPS suggests envisaging the three-layered model for the supervision of all databases - which involve processing of personal data established on the basis of the Regulation and the Proposal (namely, CIS including FIDE -, the European Data directory, and the Import, export and transit directory) and would welcome that, in the future, the EDPS be designated as secretariat of supervision coordination under both the Decision and the Regulation . The shortcomings of the current Proposal

text: 26. Notwithstanding the comments of general nature expressed in the paragraphs above, the newly introduced provisions based on the dual supervision model will be analysed below.

text: 27. In an attempt to overcome the shortcomings of the current supervision system, the Proposal envisages clarifying the data protection law applicable to and the supervisory responsibilities related to the newly introduced directories and to CIS. The EDPS observes a certain inconsistency in the way the Proposal introduces new provisions referring to Regulation 45/2001 and to the EDPS´ role. More specifically: -

text: Article 18

text: (a)(5) - referring to the European Data directory - recalls that the EDPS should supervise the compliance of the database with Regulation 45/2001; - a similar provision has been inserted in

text: Article 37(3)

text: (a) as regards CIS. Furthermore, the modified

text: Article 37(3)

text: (a) establishes that the Regulation (notably, Regulation 515/97) 'particularises and complements' Regulation 45/2001; - as regards the Import, export and transit directory,

text: Article 18

text: (g)(4) states that Regulation 45/2001 applies to the processing by the Commission in the context of data included in the directory; that the Commission is the data controller and that the same directory is subject to prior-checking by the EDPS.

text: 28. It seems clear that there is no consistency between the provisions related to the three directories.

text: 29. Furthermore, the Proposal aims at allocating responsibilities also as regards the supervision and security of the technical aspects of the various databases. The Proposal introduces provisions regarding the security of technical systems: - for the European Data directory (

text: Article 18

text: (a)(5)); - in relation to the technical and logistical assistance and training activity and other support made available from the Commission to the Member States (

text: Article 18

text: (b)(3)); - for the Import, export and transit directory (

text: Article 18

text: (g)(5)); - and it also slightly modifies the provision on security in relation to the CIS database (

text: Article 38

text: 30. The EDPS is pleased that the Proposal aims at specifying and updating the rules on supervision and security of the databases, however the legislative technique used is far from satisfactory.

text: Article 38

text: specifically lists the measures that the Commission and the Member States - within the areas of respective responsibility as regards CIS - shall take in order to ensure the technical security of the CIS database. In this respect, the EDPS recommends that the list of measures to be taken by the Commission and the Member States to ensure technical security should also include the requirement to record all actions taken on the data, the effect of the actions, at what time and by whom, in order to obtain a comprehensive log of actions taken in relation to the database.

text: Article 18

text: (a)(5) does not specifically indicate the measures that should be taken in order to protect the personal data in the European Data Directory: the provision mostly replicates the content of Article 22 of Regulation 45/2001. The EDPS questions this choice, as such a generic provision does not add any element to the text, precisely because

text: Article 22

text: is already per se applicable to the database. In this context, it would be necessary to list in the article the specific measures that should be put in place, taking into account the types of personal data that are supposed to be processed in the database, the structure of the database, the type of entities or persons having access to it. Simply restating the text of Regulation 45/2001 is not sufficient to ensure effective application of such provision. The same criticism applies to

text: Article 18

text: Article 18

text: (b)(2) generally requires the Commission to set up technical systems for the purpose of training and assistance between the Commission and the competent authorities. Using a different approach from the provisions mentioned above,

text: Article 18

text: (b)(3) states that the systems established by the Commission for this purpose are to be supervised by the EDPS.

text: 34. Such a fragmented approach could lead to confused interpretation according to which different sets of data protection rules apply to the different databases, and the mistaken conclusion that the Commission is the data controller only in one case and a contrario not for other databases established by the Regulation. It is therefore crucial to clearly identify the relevant data protection legislation applicable to each area; to specify the provisions of Regulation 45/2001, where necessary, while at the same time avoiding redundant repetitions of provisions already applicable per se.

text: 35. If the management or hosting of the different databases (and technical systems, such as the one set up on the basis of

text: Article 18

text: (b)) involves processing of personal data by the Commission in the exercise of its activities falling within Union law, then as a legal consequence Regulation 45/2001 will apply to these processing activities.

text: 36. Consequently, the applicability of Regulation 45/2001 implies: - supervision - both in general and in relation to the technical aspects - by the EDPS; - the Commission is the data controller so long as it determines the means and purposes of the processing operations; - the possible requirement to notify certain processing activities for prior checking by the EDPS pursuant to Article 27 of Regulation 45/2001.

text: 37. The EDPS therefore suggests substituting the various fragmented provisions with uniform provisions specifying for each database: (i) the role of the Commission as data controller or possibly joint data controller together with the relevant national competent authorities; (ii) if needed for the sake of clarity, the supervisory role of the EDPS where the Commission is the controller, as opposed to cases where the processing is under the supervision of national data protection authorities; (iii) the technical measures to be adopted by the Commission in order to ensure security of the processing (possibly, the specific measures could be inserted in a delegated act in order to ensure a more flexible updating); and (iv) the need for prior checking by the EDPS pursuant to Article 27 of Regulation 45/2001. e) Transfers of data

text: 38. The Proposal includes two provisions stating that, without prejudice to Regulation 45/2001, transfers of data from the European Data directory (

text: Article 18

text: (a)(6)) and from the Import, export and transit directory (

text: Article 18

text: (g)(3)) to international organisations and/or EU institutions or agencies are possible. The EDPS welcomes the fact that the Proposal imposes as a condition for the transfer the conclusion of a memorandum of understanding ('MoU') between the Commission and the relevant recipient. Such MoUs shall include also data protection safeguards such as access and rectification rights of the data subject, right to judicial redress as well as an independent oversight mechanism.

text: 39. The EDPS highlights that transfers of data within or between EU institutions or bodies should meet the requirements of Article 7 of Regulation 45/2001, whereas MoUs could be considered as an adequate safeguard for transfers to international organisations pursuant to Article 9 of Regulation 45/2001. Therefore, the text of the Proposal should, for the sake of clarity, distinguish the legal provisions applicable to these two categories of recipients and the different requirements applicable to the relevant transfers.

text: 40. The two Articles also identify the purposes for the possible transfers: they can be either the general purpose of the Regulation (tackling breaches of customs legislation), the protection of financial interest of the Union and/or the risk management as set out in the Community Customs Code. The latter purpose raises concerns as it includes also risks related to the 'Community´s security'. This requires stronger data protection safeguards as it could imply that the data are used for law enforcement purposes (see below, section 2.1.g)

text: 41. The EDPS would therefore invite the legislator to insert - in an Annex, for instance - an exhaustive list of international organisations which could be recipients of the data. The Annex should be regularly updated and published in order to guarantee a more transparent and efficient supervision of the compatibility of the transfers with the purpose limitation principles by the EDPS. Alternatively, the list could be inserted in an implementing act. f) Data retention

text: 42. The Proposal introduces new rules on maximum data retention periods for CIS (

text: Article 33

text: ), FIDE (

text: Article 41

text: (d)), the European Data directory (

text: Article 18

text: (a)(6)) and for the Import, export and transit directory (

text: Article 18

text: Article 33

text: , while maintaining the obligation to keep data only for the time necessary to achieve the purpose for which they were introduced, introduces a maximum 'blanket' 10 year retention period, thereby eliminating the review procedure that was previously envisaged by the Regulation. The precedent provision required that the need for retention was to be reviewed annually by the national authority competent for introducing the data in the database.

text: 44. The Proposal introduces the 10 years 'blanket' retention period also for the European Data directory (

text: Article 18

text: (a)(6)) and the Import, export and transit directory (

text: Article 18

text: 45. According to recital 13, this modification is necessary 'because Member States do not systematically carry out the yearly reviews due to the administrative burden involved'. In order to simplify the procedure, the Proposal sets a 'maximum retention period of ten years, corresponding to periods provided for the directories established on the basis of this Regulation.' This period is considered necessary 'due to the long procedures for processing irregularities and because these data are needed for the conduct of joint customs operations and of investigations'.

text: 46. The justification for this extensive retention however has not been concretely demonstrated and there is no trace of evaluation of its impacts on fundamental rights in the Impact Assessment or Explanatory Memorandum.

text: 47. The newly introduced obligation to 'inform' the EDPS about cases where personal data are stored in the CIS (and in the other two directories) for a period exceeding five years cannot be considered as a satisfactory data protection safeguard, also since the need for retention of personal data for five years is not justified.

text: 48. Furthermore, recital 13 explains that the maximum retention period of 10 years is aimed at synchronizing the rules governing the storage with periods provided for the directories established by the Regulation. The EDPS understands that, in practice, the provision refers to the 'FIDE' data base. However, FIDE is a sub-category of CIS including specific data on ongoing administrative enquiries and criminal investigations, aimed at accelerating detection and prosecution of illegal customs operation. On the other hand, other data contained in CIS, in the European Data directory and in the Import, export and transit directory are more general in nature and the databases are used as a tool for ongoing cooperation and investigations between the authorities or for analytical purposes.

text: Article 41

text: (d)(1) justifies the retention periods for FIDE by referring to the national legislation and 'procedures' on retention periods of Member States, limiting the maximal retention period to 3 or 6 or 10 years pursuant to paragraph 1(a), 1(b) and (c). The 10 years retention period is applicable only for data concerning 'administrative enquiries or criminal investigations which have given rise to an administrative decision, a conviction or an order to pay a criminal fine or an administrative penalty', which is data related to an actual conviction.

text: 50. There is no substantial connection between the 10 years data retention justification given for FIDE that could apply to CIS data, since the personal data contained in CIS (listed in Article 24 and 25 of the Regulation) are used for 'the purpose of sighting and reporting, discreet surveillance or specific checks' (Article 27(1) of the Regulation), hence investigative activities on cases that could lead or not lead to a conviction. The same criticism applies to the retention period applicable to the European Data directory and the Import, Export and transit directory, which are used as operational tools to follow and verify the movements of goods and the correspondence between declarations by the operators and movements of the containers.

text: 51. The EDPS highlights that justifying the introduction of an extensive ten year retention period for personal data in a database only on the basis of 'coherence' with the retention rule elaborated for another database with different aims and requirements is contrary to the principles of data quality enshrined in Article 4 of Regulation 45/2001 and consequently not acceptable.

text: 52. Therefore, since neither the Proposal nor the Impact Assessment provide any concrete justification as to the reasons for which these periods of retention are necessary, the provisions as such are not compliant with Regulation 45/2001 as regards the cases where the Commission is the controller - or Directive

text: - as regards the cases where the national competent authorities are the controllers.

text: 53. The EDPS highlights that the justification of the need for retention periods for the different databases and directories must encompass a detailed evaluation of the duration in relation to the purpose of the retention for each specific case. The Proposal is lacking such analysis: the legislator should reconsider the justification for the newly introduced retention periods and carry out an evaluation of the relevant justification for each specific case.

text: 54. Furthermore, the Proposal does not provide any justification as to why personal data should be anonymised instead of deleted after the maximum retention periods elapsed, as provided for by the modified

text: Article 41

text: (d)(3). Once the retention period expires, in the EDPS´ view data should be simply deleted. The EDPS highlights that the concept of anonymisation in the area of data protection corresponds to eliminating not only the direct identifiers but also indirect elements that, if combined, could lead to a re-identification .

text: 55. Therefore, in order for the anonymisation process to be equivalent to deletion, the Proposal should provide more specific indications on how this procedure should be carried out, possibly in a way which respects technological neutrality in order to avoid the text becoming rapidly obsolete. Given the difficulties that this possible formulation could lead to, the EDPS strongly favours the solution according to which data should simply be deleted after the expiry of the retention phase. g) Purpose of the processing

text: 56. While the main purpose of the Regulation and the Proposal is to address breaches of the legislation on customs and agricultural matters, the directories established by

text: Article 18

text: (a) of the Regulation and new

text: Article 18

text: (g) introduced by the Proposal will be used also for risk management purposes. The relevant risks are listed in Article 4(25) of the Community Customs Code , and are not only limited to risks relating to breaches of the legislation on customs and agricultural matters, but also include, e.g., events which 'pose a threat to the Community's security' .

text: 57. If the need to process personal data for risk analysis regarding each of the risks listed in

text: Article 4(25)

text: is justified, the Proposal should provide more details on risk management procedures, further define the relevant risks, in particular by specifying which kind of risks that 'pose a threat to Community security' will be covered, and specify the criteria on which the risk analysis will be based. This would contribute to ensure the precision, accessibility and foreseeability required by the ECtHR .

text: 58. In addition,

text: Article 18

text: (a)(2)(a) as modified by the Proposal provides for the 'reuse' of the data by the Commission for the purpose of administrative or judicial procedures in compliance with legislation applicable to intellectual property.

text: 59. In order to ensure compliance with

text: Article 4(1)

text: (b) of Regulation 45/2001, the EDPS recommends clarifying for which specific purposes relating to administrative or judicial procedures the data can be 'reused'. The Proposal should also specify how this additional processing will take place and to which authorities the data can be possibly transferred.

text: 60. It should also be ensured that no decisions are taken without human intervention and that data subjects are provided with the rights of access and rectification with regards to the data processed for this purpose. 2.2. Specific comments a) The 'Import, export and transit' and the 'European Data' directories

text: 61. The EDPS welcomes the provision of

text: Article 18

text: (g)(3) which restricts within the Commission the departments empowered to process personal data contained in the 'Import, export and transit' directory. This is in line with

text: Article 22 of Regulation (EC) No 45/2001

text: which requires data controllers, inter alia, to implement technical and organisational measures, such as ensuring that information is available on a ‘need to know’ basis, to ensure an appropriate level of security of the data. Such provision is also coherent with

text: Article 18

text: (a)(4) which applies the same 'need-to-know' principle to the general directory established in

text: Article 18

text: (a).

text: 62. Also the new formulation of

text: Article 29

text: is to be welcomed for the same reasons: it establishes that access to the CIS data is to be restricted to the national authorities designated by the Member States and by the departments designated by the Commission. Paragraph 2 of the same article also establishes rules on designation and publication of the list of competent national authorities. These rules implement de facto the principle of transparency which is a fundamental pre-requisite for data subjects to exercise the rights bestowed upon them by Regulation 45/2001 and by Directive

text: 63. The EDPS welcomes the introduction of

text: Article 18

text: (g)(5) in that it excludes that special categories of data within the meaning of Article 10(5) of Regulation 45/2001 are included in the database. b) CSM directory

text: Article 18

text: (c) introduces the so-called CSM directory. It contains information on the movement of containers into or from the EU territory. The aim of this novelty is to reach a more efficient tackling of breaches of customs legislation by comparing the data on the movement of containers with data on imports and exports and transits submitted to the Commission (through the so-called 'Import, export and transit' directory). Although the Explanatory Memorandum states that the CSM directory shall not include personal data, the text of the Proposal does not mention which categories of data are to be inserted in this database.

text: Article 18

text: (f) provides that 'the minimum data elements' to be inserted in the Container Status Messages are to be laid down in a delegated act. The EDPS notes that the categories of data processed in the CSM directory are an essential element of the Proposal and therefore cannot be left to a delegated act. The text should indicate an exhaustive (not a minimum data set) list of data to be inserted. Alternatively, the text of the Proposal should explicitly prohibit that personal data are to be inserted in such database.

text: 3. CONCLUSIONS

text: 66. The EDPS welcomes the modifications that the Commission brought to the Proposal in order to enhance its compliance with the relevant data protection legislation. However, it should be noted that the Proposal also contains some rather serious weaknesses that need to be eliminated before its final adoption.

text: 67. The EDPS wishes to highlight that the Commission should have taken a more comprehensive approach to the legislation on mutual assistance in the customs area to bring it in line with the changes brought by the Lisbon Treaty, namely by deciding to eliminate the Regulation/Decision dual basis and to substitute it with a single instrument based exclusively on the TFEU, in order to guarantee legal certainty and a seamless data protection regime.

text: 68. For the reasons set out above, the EDPS would in any case recommend:  the introduction of a new model for the supervision of all databases which involve processing of personal data established on the basis of the Regulation and the Proposal (namely, CIS - including FIDE -, the European Data directory, and the Import, export and transit directory). Such model would be based on coordinated supervision which has a threelayered structure: DPAs at national level, EDPS at central level and coordination between both;  the designation of the EDPS as secretariat of supervision coordination under both the Decision and the Regulation;  the introduction of a general provision in the text of the Proposal to clarify that Regulation 45/2001 applies to processing of personal data carried out by Union institutions and that national laws implementing Directive

text: are applicable to the processing carried out by the relevant competent authorities in the various Member States;  the substitution of various fragmented provisions with uniform provisions specifying for each database (i) the role of the Commission as data controller or possibly joint data controller together with the relevant national competent authorities; (ii) if needed for the sake of clarity, the supervisory role of the EDPS where the Commission is the controller, as opposed to cases where the processing is under the supervision of national data protection authorities; (iii) the technical measures to be adopted by the Commission in order to ensure security of the processing (possibly, the specific measures could be inserted in a delegated act in order to ensure a more flexible updating); and (iv) the need for prior checking by the EDPS pursuant to Article 27 of Regulation 45/2001;  that the newly introduced retention periods are reconsidered on the basis of an evaluation of the necessity of the duration for each specific case; furthermore the provisions on anonymisation of data should be modified in order to require deletion of the data;  as regards the CSM database, the Proposal should indicate an exhaustive list of data to be inserted. Alternatively, the text of the Proposal should explicitly prohibit that personal data are to be inserted in such database. Done in Brussels, 11 March 2014 (signed) Peter HUSTINX European Data Protection Supervisor

type: vagledning

utgivare: edps


text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3 COM(2013) 813 final. 4 COM(2011) 287 final. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 63 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: See Explanatory Memorandum to the Proposal, Section 5. 6 means of the processing personal data". See also

text: Articles 2

text: (a) and 2(b) on the definitions of 'personal data' and 'processing of personal data', and

text: Article 3

text: on the scope of Directive

text: . 7 See for example paragraph 14 of this opinion, where it is proposed to replace

text: Article 8(4)

text: by a general reference to Directive

text: Article 29

text: Working Party Opinion No 4/2007 of 20 June 2007 on the concept of personal data,

text: , p. 18- 21. 9 SWD(2013) 471 final, Section 2.1.1, pp.12-13.

text: SWD(2013) 471 final , Annex 4, Section A4.2, p.112. 11 SWD(2013) 471 final., pp.114-116. 12 ECJ judgment of 18 September 1996,

text: Case T-353/94

text: (Postbank v Commission), paragraph 87. 13 ECJ judgment of 30 May 2006,

text: Case T-198/03

text: (Bank Austria Creditanstalt v Commission), paragraph 71. 14 See impact assessment SWD(2013) 471 final p. 254.

text: COM(2012) 11 final. 16 See http://www.europe-v-facebook.org/FB_E-Mails_28_9_11.pdf (accessed 28.02.2014).

text: ECJ judgment of 9 November 2010, joined Cases 92/09 and

text: (Schecke and Eifert); in particular, paragraphs 81, 85 and 86, where the Court underlined that derogations and limitations in relation to the protection of personal data must apply only in so far as strictly necessary; see also EDPS paper on ‘Public access to documents containing personal data after the Bavarian Lager ruling’ of 24 March 2011, in particular chapter III.

amnesord:
Rights of the Individual
Internal Market
Transparency

title: Protection of undisclosed know-how and business information

text: Opinion of the European Data Protection Supervisor

text: on the proposal for a directive of the European Parliament and of the Council on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 41(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Background

text: 1. On 28 November 2013, the Commission adopted a proposal for a directive on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (the 'proposal'). The proposal is described in the Explanatory Memorandum as a deliverable under the strategy outlined in the Commission Communication, ‘A Single Market for Intellectual Property Rights: Boosting creativity and innovation to provide economic growth, high quality jobs and first class products and services in Europe’.

text: 2. The concept of trade secrets in the form of ‘business information’, according to Recital 1 of the proposal, ‘extends beyond technological knowledge to commercial data such as information on customers and suppliers’.

text: 3. Given the clear relevance of personal data to this proposal, it is regrettable that the EDPS was not consulted as required by

text: Article 28(2) of Regulation (EC) No 45/2001

text: . This Opinion is therefore based on Article 41(2) of that Regulation. 1.2. Objective of the proposal and focus of this opinion

text: 4. The aim of the proposal is to establish a sufficient and comparable level of redress across the internal market in the case of trade secret misappropriation while providing sufficient safeguards to prevent abusive behaviour. In doing so it is intended to attract and to retain investors and to boost confidence in the competitiveness of European companies.

text: 5. The proposal contains provisions on the trade secret concept, on the circumstances under which the acquisition, use and disclosure of a trade secret are to be considered unlawful, and on measures, procedures and remedies which should be made available to the holder of a trade secret in the case of its unlawful acquisition, use or disclosure by a third party.

text: 6. Under the proposal, Member States would be required to put in place measures to protect secret information which is held lawfully by natural or legal persons. Unlawful acquisition, use or disclosure of a trade secret is predicated (Article 2 of the proposed directive) on the absence of consent of the trader secret holder. The proposal therefore focuses on the rights of the trade secret holder. A trade secret holder, insofar as he or she controls information relating to an identified or identifiable natural person, will frequently be a data controller as defined in

text: Article 2

text: (d) of Directive

text: , and as such has a number of obligations towards data subjects.

text: 7. This opinion highlights the need for the proposal to consider in particular the rights to privacy and to the protection of personal data of data subjects whose personal data may form part or whole of the trade secrets in question.

text: 2. GENERAL COMMENTS

text: 8. The proposal demonstrates a welcome awareness of the relevance of data protection. Recital 23 states that the proposed directive ‘respects the fundamental rights… recognised by the Charter of Fundamental Rights of the European Union, notably the right to respect [of] private and family life, the right to protection of personal data…’ Recital 24 refers specifically to the importance of these rights in relation to ‘any person involved in litigation’ concerning trade secrets.

text: Article 8(4)

text: concerning the confidentiality of trade secrets during legal proceedings explicitly requires that any processing of data pursuant to that article should be carried out in accordance with Directive

text: 9. Nevertheless, greater precision on the concept of trade secrets and clearer safeguards are required to address adequately the potential effects of the proposal on the rights to privacy and to the protection of personal data.

text: 3. SPECIFIC COMMENTS 3.1. Relevance of personal data to the definition of trade secret a) is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among or readily accessible to persons within the circles that normally deal with the kind of information in question; b) has commercial value because it is secret; c) has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret.’

text: 11. Recital 1 appears to elaborate on this definition, indicating that trade secrets include companies’ ‘know-how’ and ‘business information’ ‘covering a diversified range of information, which extends beyond technological knowledge to commercial data such as information on customers and suppliers, business plans or market research and strategies.’ Annex 21 of the impact assessment, which discusses the impact on fundamental rights, is more explicit when it states (p. 254): ‘Information kept as trade secrets (such as list of clients/ customers; internal datasets containing research data or other) may include personal data.’

text: 12. Further discussion on the concept of trade secrets is to be found in section 2.1.1 and Annex 4 of the impact assessment accompanying the proposal, wherein several alternative definitions and similar terms of varying degrees of currency are listed. A chart is reproduced which attempts to depict types of ‘confidential information’: trade secrets are shown as a sub-set of ‘business information’ which itself is distinct from ‘personal information’. (This appears to contradict the statement cited above in Recital 1 to the proposal). Four categories of the trade secrets concept are described, namely ‘secrets relating to highly specified products’, ‘technological secrets’, ‘strategic business information (including lists of customers)’ and ‘private collations of individual items of publicly available information’.

text: 13. Emerging business models in some of the fastest growing sectors of the economy are based on the availability of massive amount of data on customers and their behaviour and on the ability to collect and to monetise those data. A considerable proportion of these data are therefore personal data relating to identified or identifiable individuals, whose processing remains subject to the rights and obligations laid down in Directive

text: , even after those data have been aggregated or ‘pseudonymised’, so long as they can still be "traced back" to an identifiable individual.

text: 14. The relevance of personal data, which is defined in

text: Article 2

text: (a) of Directive

text: , to the concept of trade secrets, should therefore be more explicitly acknowledged in the proposal, in particular in

text: Article 2

text: and in recitals 1 and 28. In order to ensure compliance with Directive

text: , this acknowledgement should be further reflected as a general provision for all processing of personal data pursuant to the proposed directive, and not only processing in the course of legal proceedings (as envisaged in Recital 24 and

text: Article 8(4)

text: ). 3.2. Trade secrets, business secrets and intellectual property

text: 15. Irrespective of any confusion of what a trade secret is, the impact assessment 9 emphasises that it is not the same as an intellectual property right, which is distinct in various ways, including in that the latter gives the holder an exclusive right to the use of the information. Accordingly, the explicit intention (in Recital 28) of the proposed directive is not to ‘affect the application of any other relevant law… including intellectual property rights.’ Its relationship, according to this recital, to Directive

text: on the enforcement of intellectual property rights, where the two directives overlap, should be that the proposed directive ‘takes precedence as lex specialis’.

text: 16. A trade secret is also, according to the impact assessment, though not in the text of the 10 proposed directive itself, distinct from ‘confidential business information’ or ‘business secrets’, which is already recognised by the EU as requiring protection. The principle of protection of such information is expressed in Article 339 of the Treaty on the Functioning of the European Union, which forbids EU institutions, members of committees and staff ‘to disclose information of the kind covered by the obligation of professional secrecy, in particular information about undertakings, their business relations or their costs components.’ This principle has been extended through secondary legislation to EU regulatory agencies and national authorities in rules on financial institutions and markets, competition and public procurement. The European Court of Justice, according to the impact assessment, has identified three criteria in determining whether information is a business secret: a. that the information be known only to a limited number of persons; b. that it be ‘information of which not only disclosure to the public but also mere transmission to a person other than one that provided the information may 12 seriously harm the latter’s interest’; and c. that interests liable to be harmed by disclosure must be objectively worthy of protection.’

text: 17. These business secret criteria overlap with the definition of a trade secret in Article 2(1) of the proposed directive: both concepts suggest that steps have been taken to keep the information secret or confidential, and that its disclosure could somehow cause harm, including presumably damage to commercial interests. While the concept of business secret seems wider than that of trade secrets (as presented in the proposal), certain information may fall within both categories. A more precise distinction between the two concepts is needed in the text of the proposed directive itself to provide sufficient legal certainty to data subjects. Clarity is also needed on the relationship between the proposed directive and other legislation concerning business secrets should an overlap occur, in the same way as Recital 28 seeks to address any overlap with the rules on intellectual property rights. 3.3. An individual’s right to access personal data (

text: Article 4

text: 18. The proposal and accompanying impact assessment largely focus on the importance of protecting the rights of holders of trade secrets and protecting against illegal processing of personal data through misappropriation of a trade secret by a third party. Given the scale and complexity of data processing and their connection to confidential commercial activities the need for some degree of secrecy and high standards of data security cannot be disputed. However, this must be balanced with the need for transparency on how decisions are taken which affect the privacy of individuals whose data is being processed.

text: 19. The proposal should also, therefore, take account of the obligations of the holders of trade secrets as data controllers towards the individuals where their personal information is considered to be a trade secret. In particular, under

text: Article 12 of Directive 95/46/EC

text: , data subjects have the right to access the data being processed and to obtain rectification, erasure or blocking of the data where it is incomplete or 15 inaccurate. Under Article 18 of the proposed General Data Protection Regulation , it is envisaged to extend this right to enable the data subject to obtain a copy of data being processed electronically, including for example social network profiles, purchase and search histories, and to transmit them to another automated processing system. This is called the right to data portability.

text: 20. The proposed directive should not interfere with data subjects’ rights. There is at least one well-reported instance of a global company, which relies on processing of large scale personal data partly, refusing a request from a data subject to access personal data on grounds that disclosures would ‘adversely affect trade secrets or intellectual property'.

text: 21. Accordingly, the EDPS recommends that Article 4 of the proposed directive, which concerns lawful acquisition, use and disclosure of trade secrets, be amended. The article should clarify that the measures, procedures and remedies will not in any way restrict the rights of the data subject under Directive

text: , and in particular his or her right to access the data being processed and to obtain rectification, erasure or blocking of the data where it is incomplete or inaccurate.

text: 22. Furthermore, in the event that a conflict arises between the right to protection of trade secrets and the right to access to personal data being processed, it may be advisable to provide for an adjudication process involving the relevant supervisory authorities including the national data protection authority. 3.4. Persons suspected of committing an offence (Recital 24,

text: Article 8

text: 23. Recital 24 refers specifically to the importance of fundamental rights, particularly the rights to privacy and to the protection of personal data, in relation to ‘any person involved in litigation’ concerning trade secrets.

text: Article 8(4)

text: 24. Any investigation or litigation concerning a person suspected of illegal activity through unlawful acquisition, use or disclosure of a trade secret implies the processing of sensitive data under

text: Article 8(5) of Directive 95/46/EC

text: . Such data processing may only be under strict conditions, namely, ‘under the control of official authority, or if suitable specific safeguards are provided under national law'. A specific reference to these EU rules on treatment of sensitive data in the course of legal proceedings is therefore recommended. 3.5. Publication of judicial decisions (

text: Article 14

text: 25. Article 14 of the proposed directive provides for the dissemination and the publication in full or in part of ‘information concerning [a legal] decision’ on an infringement of a trade secret. Among the factors to be taken into account by any decision on publication, under

text: Article 14(3)

text: , would be ‘the possible harm that such a measure may cause to the privacy and reputation of the infringer, whenever the infringer is a natural person.’

text: 26. Such an exercise of balancing privacy and transparency and assessing proportionality is appropriate. However, attention should be paid not merely to whether the infringer is a natural person. According to case law established in Schecke and Eifert v Land Hessen , legal persons can claim the protection of personal data where the name of the legal person identifies one or more natural persons, such as where the official title of a partnership directly identifies natural persons who are its partners. It is therefore recommended to clarify that decisions to publish under

text: Article 14(3)

text: 4. CONCLUSION

text: 27. The EDPS is pleased to note that some account has been taken of data protection aspects of the proposal, and recommends a fuller integration of respect for the rights to privacy and the protection of personal data by means of the following changes: a) a more explicit reference in the recitals to the relevance of personal data to the concept of trade secrets; b) inclusion of a general provision for all processing of personal data pursuant to the proposed directive to be subject to the rules laid down in Directive

text: ; c) a precise distinction in the recitals between the concepts of trade secrets and business secrets and clarity on the application of EU instruments where an overlap occurs; d) clarification in

text: Article 4

text: that the proposed directive will in no way restrict the rights of the data subject under Directive

text: and in particular his or her right to access the data being processed; a provision (as appropriate) for a adjudication process in the event of a conflict between the protection of trade secrets and the right to access to personal data; e) a specific reference in

text: Article 8

text: to EU rules under

text: Article 8(5) of Directive 95/46/EC

text: on treatment of sensitive data such as on suspicion of illegal activity in the course of legal proceedings; and f) clarification in

text: Article 14

text: that decisions to publish information on the outcome of legal proceedings (

text: Article 14(3)

text: ) should take into account whether information on the infringer would identify a natural person or persons, and if so whether publication of that information is justified. Done in Brussels, 12 March 2014 (signed) Peter HUSTINX European Data Protection Supervisor


text: OJ L 281, 23.11.1995, p. 31 2 OJ L 8, 12.01.2001, p. 1

text: Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail: edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: WP 114

text: , available on http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2005/wp114_en.pdf.. 4 "Applying Articles 25 and 26 of the EU data protection directive" (

text: WP 12

text: ), available on: http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/1998/wp12_en.pdf

text: See European Court of Justice, 9 November 2010, Volker und Markus Schecke,

text: and

text: , para. 53 and

text: Article 29

text: Working Party Opinion 4/2007 of 20 June 2007 on the concept of personal data (

text: WP 136

text: ). 6 Agreement between the European Community and the Government of the People’s Republic of China on cooperation and mutual administrative assistance in customs matters, OJ L 375, 23.12.2004, p. 20, available on: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2004:375:0020:0026:EN:PDF. 7 Article 17(4) of the CCMAAA provides that practical arrangements for the implementation of this Article shall be determined by the JCCC. The draft decision implements

text: Article 17

text: regarding the exchange of data related to AEO's and MCME's only. It is to be noted that other exchanges (data regarding operators that do not participate in the AEO's or MCME's programmes) may occur in the framework of the CCMAAA (see for ex. Art. 11(d) and 12(d) of the CCMAAA) that are not covered by the draft decision.

text: Article 9(1) of Regulation (EC) No 45/2001

text: . See also

text: Article 25 of Directive 95/46/EC

text: . 9 See

text: Article 9(2)

text: (d) of

text: Regulation (EC) No 45/2001

text: . 10 See

text: Article 29

text: Working Party, Working document on a common interpretation of

text: Article 26(1) of Directive 95/46/EC

text: , cited above. http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2005/wp114_en.pdf. 11 The EDPS recommends renaming it "Processing of data", in line with EU data protection legislation.

text: Article 20

text: allows a restriction to the principle of purpose limitation if such a restriction constitutes a necessary measure for the prevention, investigation, detection and prosecution of criminal offences; an important economic or financial interest of the EU or of an EU Member State; the protection of the data subject or the rights and freedoms of others; or to safeguard national security, public security or defence. See also

text: Article 29

text: Working Party, Working document on Transfers of personal data to third countries: Applying Articles 25 and 26 of the EU data protection directive (

text: WP 12

text: ), p. 6, available on: http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/1998/wp12_en.pdf. 13 In particular, it should be laid down in the draft decision or by EU or EU Member States’ law, necessary in a democratic society, proportionate and sufficiently clear and precise to be foreseeable (See

text: Article 29

text: Working Party Opinion 3/2013 on purpose limitation (

text: WP 203

text: ), p. 36-37, available on: http://ec.europa.eu/justice/data-protection/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf).

text: See

text: Article 29

text: Working Party Working Document on transfers of personal data to third countries: Applying Articles 25 and 26 of the Data Protection Directive, dated 24 July 1998,

text: WP 12

text: , available on http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/1998/wp12_en.pdf.

text: Article 21 of CCMAAA.

amnesord:
International Agreements
Transfers of data
Adequacy Decision

title: EU-China Joint Customs Cooperation Committee

text: Opinion of the European Data Protection Supervisor

text: on the proposal for a Council Decision on the position to be adopted, on behalf of the European Union, in the EU-China Joint Customs Cooperation Committee regarding mutual recognition of the Authorised Economic Operator Programme in the European Union and the Measures on Classified Management of Enterprises Program in the People’s Republic of China

text: THE EUROPEAN DATA PROTECTION SUPEVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular

text: Article 41

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION

text: I. Introduction

text: I.1. Consultation of the EDPS and aim of the Opinion

text: 1. On 26 February 2014, the Commission published its proposal for a Council Decision on the position to be adopted, on behalf of the European Union, in the EU-China Joint Customs Cooperation Committee regarding mutual recognition of the Authorised Economic Operator Programme (hereinafter: the “programmes”) in the European Union and the Measures on Classified Management of Enterprises Program in the People’s Republic of China (hereinafter: "the proposal”). The proposal contains an attached draft Decision of the Joint Customs Cooperation Committee ("JCCC") established under the Agreement between the EU and China on Cooperation and Mutual Administrative Assistance in Customs Matters (hereinafter, “the draft decision”).

text: 2. The EDPS had been previously informally consulted and has had the opportunity to provide comments to the Commission. The aim of this Opinion is to complement these comments in light of the present Proposal and to make the EDPS' views publicly available.

text: 3. In this opinion, the EDPS will analyse the data protection aspects of the draft decision, mainly on the basis of the relevant provisions of

text: Regulation (EC) No 45/2001

text: , taking into account the interpretation that has been given to the main provisions on the transfer of personal data in the

text: Article 29

text: Data Protection Working Party's Working Document of 25 November 2005 on a common 3 interpretation of

text: Article 26(1) of Directive 95/46/EC

text: and in its Working Document of 24 July 1998 on Transfers of personal data to third countries . I.2 Context of the proposal

text: 4. EU legislation on Authorised Economic Operators was introduced by an amendment to the Community Customs Code (Regulation 648/2005 adopted in April 2005). This amendment came into force in January 2008.

text: 5. Customs relations between the EU and China are based on the EU-China Cooperation and Mutual Administrative Assistance Agreement in Customs Matters (hereinafter: ”CCMAAA”) of 8 December 2004. According to the CCMAAA, the parties’ customs authorities undertake to develop customs cooperation covering all matters relating to the application of customs legislation.

text: 6. According to the proposal, mutual recognition should allow the EU and China to provide facilitative benefits to economic operators who have invested in compliance and supply chain security and have been certified under their respective trade partnership programmes.

text: 7. In June 2012 the JCCC agreed to launch formal negotiations on mutual recognition of the programmes. Since then, three rounds of negotiations have taken place; the first in January 2013, the second in March 2013 and the third in October 2013 to finalise the draft decision of the JCCC on AEO mutual recognition.

text: 8. The proposal asks the Council to adopt a Union Position on a draft decision of the JCCC based on

text: Article 207(4)

text: first subparagraph, in conjunction with Article 218(9) of the Treaty on the Functioning of the European Union (‘TFEU’). The legal basis for the draft decision of the JCCC is Article 21 of the CCMAAA. II. General comments

text: 9. The EDPS welcomes the fact that a number of data protection safeguards are included in the draft decision. However, he is concerned about its actual enforceability and about the absence of any independent data protection supervisory authority in the People's Republic of China. In addition, the safeguards should be complemented and reinforced. III. Specific comments III.1 Applicability of the EU data protection legal framework

text: 10. The draft decision requires the exchange of data relating to operators which are members of the programmes. The EDPS is aware that the purpose of the draft decision is not the processing of personal data. However, taking into account that 5 data on operators can also relate to natural persons , EU data protection legislation is applicable.

text: 11. Therefore, the EDPS welcomes Article 6 of the draft decision on "Treatment of data", although it should be further improved (see point III.5 below). He also welcomes the reference in

text: Article 5(2)

text: to the applicability of Article 17 of the CCMAAA . In particular, Article 17(2) of the CCMAAA states that “personal data may be exchanged only where the Contracting Party which may receive it undertakes to protect such data in at least an equivalent way to the one applicable to that particular case in the Contracting Party that may supply it”. However, this provision has a declarative nature, since no evidence is provided in the CCMAAA of the existence of actual “equivalence” . Moreover, it does not by itself ensure that the CCMAAA provides an adequate level of protection (see point III.5 below). III.2. Controllership of the processing

text: 12. The draft decision states that the customs authorities shall be responsible for its implementation. Customs Authorities are defined in

text: Article 1

text: (b) of the CCMAAA as the Commission's competent services for customs matters, the Member States' competent authorities and the Chinese General Administration of Customs. Taking into consideration this definition, both the Member States and the Commission are “controllers” on the EU side. Therefore, processing of personal data by national customs authorities would be subject to Directive

text: and to the national laws implementing Directive

text: , while the processing by the Commission is subject to

text: Regulation (EC) No 45/2001

text: 13. However, the EDPS understands from the oral explanations provided by DG TAXUD that, although the implementation “on the field” will be carried out by national customs authorities, the exchange of data provided by the draft decision (exchange of data related to the operators affiliated to their respective programmes) involves exclusively the European Commission and the Chinese customs authorities and that the Member States determine neither the purposes, nor the means of such exchange.

text: 14. Therefore, the Commission would be the controller of the transfers to Chinese customs authorities, while the subsequent processing operations within the EU borders would be under the control of EU Member States’ national customs authorities. If so, this should be specified in the draft decision, as the use of the term “customs authorities” as defined by

text: Article 1

text: (b) of the CCMAAA is not fully clear. The EDPS also recommends adding a reference to the applicability of

text: Regulation (EC) No 45/2001

text: . III.3. Enforceability of the draft decision

text: 15. The EDPS is concerned about the actual enforceability of the draft decision, since the draft decision might not have the value of an international treaty. The EDPS therefore request the Commission to provide confirmation that the draft decision is binding on both Parties and will prevail over Chinese national laws.

text: 16. The EDPS is also concerned about the absence of an independent data protection authority in the People's Republic of China which could supervise the implementation of the draft decision by Chinese customs authorities and ensure effective redress for citizens of the EU as regards processing of personal data by Chinese customs authorities (see also point III.7. below on oversight and review). III.4. Categories of data to be processed

text: Article 5

text: (a) of the draft decision provides for the exchange of data relating to operators authorised under the Programmes. The EDPS welcomes the fact that most of the categories of data to be exchanged are defined by

text: Article 5(4)

text: . However,

text: Article 5(4)

text: (g) contains a very general field named “other details”. The EDPS recommends specifying already in the draft decision all the categories of data to be exchanged. At least, it should be specified that sensitive data as defined by

text: Article 10(1) of Regulation (EC) No 45/2001

text: should not be processed.

text: Article 5(1)

text: (c) states that customs authorities exchange information regarding supply chain security. If this information does not contain data on operators, this should be specified.

text: Article 4(4)

text: requires each customs authority to “report irregularities involving members of the other customs' authority programme to the other customs authority”. It should be specified which categories of personal data might be exchanged for this purpose. Furthermore, as stated above, it should be clarified whether only the Commission or also EU national customs authorities fall within the scope of this Article (see point III.2. above on controllership of the processing).

text: 20. The EDPS also notes that data exchanged under Articles

text: and

text: may include data on offences or suspected offences, for example, data relating to the suspension and revocation of membership. The processing of these categories of data is subject to prior checking by the EDPS in accordance with

text: Article 27 of Regulation (EC) No 45/2001

text: . In any event, in accordance with

text: Article 25 of Regulation (EC) No 45/2001

text: , the processing operation should be notified to the DPO of the Commission, who must notify the EDPS accordingly. III.5. Legal basis for international transfers

text: 21. In principle, EU data protection law only allows for transfers of personal data to third countries "if an adequate level of protection is ensured in the country of the recipient" . However, some exceptions apply, e.g., if the transfer is necessary or legally required on important public interest grounds . In any case, these exceptions cannot justify repeated and structured transfers as the ones foreseen in the draft decision .

text: 22. Nevertheless,

text: Article 9(7) of Regulation (EC) No 45/2001

text: allows a transfer or a set of transfers of personal data to a third country or international organisation which does not ensure an adequate level of protection "where the controller adduces adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights", subject to authorisation by the EDPS. It further specifies that such safeguards may in particular result from appropriate contractual clauses.

text: 23. Since China is not considered to grant an adequate level of protection for personal data, the controller should adduce data protection safeguards for the transfers to take place. The EDPS notes that

text: Article 6

text: on “Treatment of data” .contains certain safeguards. Nevertheless, these safeguards do not address all the necessary requirements to be considered as an adequate safeguard in the light of

text: Article 9(7)

text: . Indeed, some improvements are needed as will be elaborated below. As a point of legal drafting, the EDPS also suggests naming this provision "Processing of data".

text: 24. The Commission should also consult the EDPS with a view to a possible authorisation in accordance with

text: . Such consultation should include a thorough description and documentation of the analysis conducted in terms of adequate safeguards.

text: Article 9(8) of Regulation (EC) No 45/2001

text: also requires informing the EDPS where

text: Article 9(7)

text: has been applied. III.6. Data protection safeguards

text: 25. Article 6 of the draft decision contains a number of data protection safeguards. The EDPS welcomes

text: Article 6(1)

text: , which provides for the principle of purpose limitation, required by

text: Article 4(1)

text: (b) of

text: Regulation (EC) No 45/2001

text: . However, Article 17(4) of the CMAAA states that the Parties can use such information for other purposes if they obtain prior written consent of the authority which provided the information.

text: 26. The EDPS notes that Article 17(4) of the CMAAA might cover further processing for incompatible purposes. The EDPS reminds that processing for such purposes should only be allowed on any of the grounds contained in Article 20 of 12

text: Regulation (EC) No 45/2001

text: . Any exception to the principle of purpose limitation should be interpreted in a restrictive way, used only in specific cases and subject to strict conditions . Article 17(4) of the CMAAA should therefore be interpreted in the light of

text: Article 20 of Regulation (EC) No 45/2001

text: 27. The EDPS also welcomes

text: Article 6(3)

text: , which states that the information exchanged is accurate and regularly updated, and that it may not be processed and kept longer than necessary. Moreover, the EDPS welcomes the specification that the data should be kept no longer than necessary “for the purpose for which it is transferred”. However, it should also be specified that the data should be adequate, relevant and not excessive in relation to the purposes for which they are transferred or further processed. A maximum retention period should also be established.

text: Article 6(4)

text: should include a provision similar to the one contained in Article 17(2) of the CCMAAA , stating that personal data may only be transferred if the relevant third country, international body or other public authority of the receiving Party guarantees a level of protection that is equivalent to the one required in the draft decision. This provision should in any case specify the purposes of such transfers and the specific situations in which they are allowed. It should also explicitly state that the necessity and the proportionality of onward transfers are to be assessed on a case by case basis and that massive and systematic transfers are not allowed. The obligation to inform data subjects about the possibility of (international) onward transfers should also be included in the text.

text: 29. Data protection principles should be recognised both in substance and in practical 15 implementation . The EDPS welcomes

text: Article 6(5)

text: which grants to operators the rights of access, rectification, blocking and erasure and requires customs authorities to inform them about the procedures for the exercise of these rights. However, data subjects should also be informed before the transfer about the purpose of the processing, the identity of the controller in the third country, the possibility of onward transfers, their rights of access, rectification and opposition, and their right to a remedy and reparation. This information could be provided through letters to the current members of the Programmes or through privacy notices in the documents to be fulfilled by the new members.

text: 30. The EDPS also welcomes

text: Article 6

text: (7-8), which specifies how it will be ensured that the data are accurate and kept up to date and to ensure that the data subjects' rights of rectification, blocking and erasure are exercised also on the receiving authority.

text: 31. If the implementation of the draft decision implies that a decision producing legal effects will be taken on operators on the basis of (solely) automated processing (e.g., through a hit/no hit in the database of recognised programme members), additional safeguards should be foreseen. This should include the right for the individual to know the logic involved in the decision.

text: 32. The EDPS welcomes the fact that

text: Article 6(6)

text: grants economic operators “the right to effective administrative and judicial redress regardless of their nationality or country of residence” and the obligation for customs authorities to inform operators of the options for “seeking administrative and/or judicial redress”.

text: 33. These rights should also include dissuasive sanctions for any failure to comply with the obligations of the draft decision. Practical information on existing remedies should be mentioned in the draft decision or at least in letters exchanged between the parties or in documents accompanying the draft decision. This information should at least be provided to the EDPS in the framework of the consultation referred to above (see point III.5). III.7. Oversight and review

text: 34. The EDPS welcomes

text: Article 6(9)

text: which subjects the whole

text: Article 6

text: to oversight and review by the respective relevant authorities of the parties. However, this oversight should apply not only to

text: Article 6

text: but to any personal data processing covered by the draft decision. The EDPS notes however that there is no evidence that the General Administration of China Customs has the duties and powers allowing it to investigate data protection complaints independently.

text: 35. It is also noted that there is no explanation as to the means for ensuring redress for the damages resulting from the acts and omissions of the Chinese authorities. This should be specified in the documentation of the analysis conducted in terms of adequate safeguards, to be provided together with the final decision.

text: 36. Article 7 of the draft decision provides that the JCCC shall settle all issues related to the implementation of the decision and in particular the review of the implementation of

text: Article 6

text: . The JCCC consists of representatives of the EU and Chinese customs authorities . Participation of data protection authorities is not foreseen.

text: 37. The absence of any independent data protection supervisory authority in China reinforces the need for a data protection review of the implementation of the draft decision, including full transparency in case of complaints and blocking of transfers in case of infringement (see below point III.8.).

text: 38. Therefore, the EDPS suggests providing that the Parties to the draft decision should jointly review the implementation of the data protection aspects of the draft decision, either in the framework of the JCCC, or as a separate process. On the EU side, the EDPS – and national data protection authorities where relevant (see point III.2. above on controllership) – should be involved in the review. The modalities of this involvement could be determined at a later stage.

text: 39. The draft decision mentions the General Administration of China Customs as the authority that shall act as a contact point for data protection issues arising from the draft decision. It should be specified in the draft decision that the Chinese authorities competent for the implementation of the draft decision should provide upon request sufficient evidence of compliance and ensure access by the EU review team to relevant documentation, systems and personnel.

text: 40. The EDPS welcomes the fact that the review shall take place at the request of one of the Parties and in any event after a period of two years, and on a regular basis afterwards.

text: 41. The EDPS also recommends adding to the draft decision a provision stating that after one year of the entry into force of the draft decision, the Commission should present a report to the EDPS (and possibly to the

text: Article 29

text: Working Party – see point III.2. above on controllership) on the implementation of the data protection principles. In the future, such report should be presented on a regular basis, e.g., annually or biannually. III.8. Suspension and termination

text: 42. The EDPS recommends completing Article 8 of the draft decision with a clause allowing any Party to suspend or terminate the agreement in the event of a breach of the other Party's obligations under the agreement, including as regards compliance with the data protection principles. Such a clause could also include, for example, consultations between the Parties prior to any possible suspension. IV. Conclusions

text: 43. The EDPS welcomes the fact that a number of data protection safeguards are included in the draft decision. However, such safeguards do not address all the necessary requirements to be considered as "adequate safeguard" in the light of

text: Article 9(7)

text: 44. In addition, the EDPS is concerned about the actual enforceability of such safeguards and about the absence of an independent data protection supervisory authority in the People's Republic of China.

text: 45. In particular, he recommends the following:  providing confirmation that the draft decision is binding on both Parties and will prevail over Chinese national laws;  specifying in the draft decision the categories of data to be exchanged;  specifying who will be the controller on the EU side;  that the Commission notify the EDPS and the DPO in accordance with Articles

text: and

text: of Regulation (EC) No 45/2001 (prior check);  submitting the adduced adequate safeguards to the EDPS for authorisation in accordance with

text: Articles 9(7) of Regulation (EC) No 45/2001

text: ;  interpreting Article 17(4) of the CMAAA should therefore be interpreted in the light of

text: ;  specifying that the data should be adequate, relevant and not excessive in relation to the purposes for which they are transferred or further processed;  establishing a maximum retention period;  specifying that personal data may only be further transferred if the recipient guarantees a level of protection that is equivalent to the one required in the draft decision;  specifying that data subjects should be informed before the transfer about the purpose of the processing, the identity of the controller in the third country, the possibility of onward transfers, their rights of access, rectification and opposition, and their right to a remedy and reparation;  including additional safeguards, such as the right for the individual to know the logic involved in the decision, in case of automated decisions;  including dissuasive sanctions for any failure to comply with the obligations of the draft decision;  including in the draft decision or at least in letters exchanged between the parties or in documents accompanying the draft decision, practical information on existing remedies  specifying the means for ensuring redress for possible damages resulting from the acts and omissions of the Chinese authorities.  providing that the Parties to the draft decision should jointly review the implementation of the data protection aspects of the draft decision, either in the framework of the JCCC, or as a separate process and providing for involvement of EU national data protection authorities where relevant;  specifying in particular that oversight and review by the respective relevant authorities of the parties in accordance to

text: Article 6(9)

text: applies to any personal data processing covered by the draft decision;  specifying the means for ensuring redress for the damages resulting from the acts and omissions of the Chinese authorities;  specifying that the Chinese authorities competent for the implementation of the draft decision should provide upon request sufficient evidence of compliance and ensure access by the EU review team to relevant documentation, systems and personnel;  stating that after one year of the entry into force of the draft decision, the Commission should report on the implementation of the data protection principles. Done in Brussels, 14 March 2014 (signed) Peter HUSTINX European Data Protection Supervisor