text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3 Proposal for a Regulation of the European Parliament and of the Council establishing the European Voluntary Humanitarian Aid Corps - EU Aid Volunteers, COM(2012) 514 final. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: See also http://ec.europa.eu/echo/euaidvolunteers/index_en.htm.

text: http://evhac.vsointernational.org/about/; http://ec.europa.eu/echo/euaidvolunteers/index_en.htm.

text: Directive

text: of the European Parliament and of the Council of 25 November 2009 amending Directive

text: on universal service and users' rights relating to electronic communications networks and services, Directive

text: concerning the processing of personal data and the protection of privacy in the electronic communications sector and

text: Regulation (EC) No 2006/2004

text: on cooperation between national authorities responsible for the enforcement of consumer protection laws.

amnesord:
Transfers of data
Privacy in the EU Institutions
Technologies

title: European Voluntary Humanitarian Aid Corps

text: Opinion of the European Data Protection Supervisor

text: on the Proposal for a Regulation establishing the European Voluntary Humanitarian Aid Corps

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 19 September 2012, the Commission adopted a Proposal for a Regulation establishing the European Voluntary Humanitarian Aid Corps ('the Proposal').

text: 2. Before the adoption of the Proposal, the EDPS was given the possibility to provide informal comments. The EDPS welcomes the fact that the Commission also consulted him formally after the Proposal was adopted and that this Opinion is referred to in the preamble of the Proposal. 1.2. Objectives and scope of the Proposal

text: 3. Pursuant to Article 214(5) of the Treaty on the Functioning of the European Union, this Proposal establishes the rules and procedures for the European Voluntary Humanitarian Aid Corps.

text: 4. On the basis of the Proposal, trained volunteers are to be deployed as ‘EU Aid Volunteers’ in humanitarian projects worldwide. The EU AID Volunteers are to be selected and deployed by certified humanitarian organisations that adhere to a set of European standards on managing humanitarian volunteers. These standards as well as the certification procedure are to be developed by the Commission. The Commission is also foreseen to provide funding, a European training programme, a central registry to include all trained volunteers, as well as an IT network for volunteers to interact online before, during, and after deployment. 1.3. Relevance of data protection; objectives and focus of the Opinion

text: 5. While it is not the main objective of the Proposal to process personal data, the Proposal nevertheless requires the processing of a personal data. These include personal data of volunteers registered in the Register of EU Aid Workers (

text: Article 13

text: ) as well as personal data (of volunteers or third parties) that may be posted on the IT network provided for their on-line interactions (

text: Article 16

text: ). The selection process of the candidates by the certified humanitarian organisations, as well as their subsequent management, which are to be standardized under

text: Article 9

text: , also requires processing of personal data.

text: 6. These processing activities require adequate data protection safeguards. The practical implementation of these safeguards could and should be further developed in the standards to be set under

text: Article 9

text: and in the data protection policies to be developed by the Commission and by the certified humanitarian organisations.

text: 7. Articles

text: and

text: provide that the Commission shall adopt delegated acts to set the standards for the identification, selection and preparation of candidate volunteers' as well as for their subsequent management and deployment. The EDPS recommends that these standards should in particular be used to help ensure that data protection provisions are appropriately considered during the selection procedure, registration, as well as during deployment of the volunteers and that in these regards, a consistent approach be taken by the certified humanitarian organisations across Europe.

text: 8. That said, certain essential elements regarding the application of the appropriate data protection safeguards should already be set forth in the proposed Regulation itself. To address these essential elements, Section 2 of the Opinion provides recommendations on Articles 13 and 16 of the Proposal.

text: 9. Section 3 of the Opinion, in turn, calls for the consultation of the EDPS when developing the standards under Articles 9 and 25 of the Proposal. Section 3 also already briefly calls attention to some of the data protection issues that should be taken into account when developing the standards, as well as at the practical level, when implementing the proposed Regulation.

text: 2. ESSENTIAL SAFEGUARDS TO BE SET FORTH IN THE PROPOSAL

text: 10. The EDPS welcomes the references to the applicable data protection legislation in recital 22 of the Proposal, but suggests that the reference to Directive

text: is clarified by specifying that the provisions will apply in accordance with the national rules which implement Directive

text: .The EDPS furthermore recommends including a general reference to existing data protection legislation in a substantive provision of the proposal.

text: 11. In addition, he recommends that certain essential elements of the data protection safeguards to be applied should be more specifically set forth in the body of the proposed Regulation.

text: Article 13

text: - Register of European Volunteers

text: Article 13

text: foresees that the Commission shall establish, maintain and update a Register of European Volunteers, and shall regulate its access and use.

text: 13. In order to ensure legal certainty, the EDPS recommends that essential elements such as (i) the purposes of this Register, (ii) the categories of data included in it, as well as (iii) the range of entities that may have access to the Register be clarified in

text: Article 13

text: 14. In addition, the EDPS further recommends that

text: Article 13

text: specifically require the adoption of a data protection policy for the Register, which could then provide more detailed and specific provisions implementing the necessary data protection safeguards. This is all the more important as - unlike for the standards to be developed under

text: Article 9

text: in the form of delegated acts - no further delegated acts are foreseen to provide for detailed implementation of the

text: Article 13

text: Register.

text: 15. Presumably, the primary purpose of the Register is to allow the certified sending organisations to find suitable, already pre-selected, assessed and trained candidates for deployment in particular humanitarian aid missions. If this is the case, this should be specified in the Proposal. If additional purposes are foreseen, for example, if the Register were to also serve as a tool for receiving and processing on-line applications, this should also be clearly set forth in the proposed Regulation itself.

text: 16. Once the purpose or purposes of the Register have been specified, it should then be also ensured and clearly specified in the Proposal that (i) the data included in the Register are relevant and proportionate for these purposes and that (ii) access be granted only on a need-to-know basis.

text: 17. For example, if the purpose of the Register is to allow the certified sending organisations to find suitable, already pre-selected, assessed and trained candidates for deployment in particular humanitarian aid missions as noted above, (i) information about the skills relevant to the aid missions, including language skills and relevant information on education and professional experience could be included in the Register and (ii) could be made available to all certified humanitarian organizations who are seeking volunteers for a particular project.

text: 18. If, in addition, the Register were to also serve the purposes of receiving on-line applications of candidates (for pre-selection, training, and ultimately inclusion in the Register), (i) it would be appropriate to include additional data in the Register that are relevant for purposes of such pre-selection, however, (ii) it would be disproportionate to give access through the Register to these additional data also to all other certified organisations who did not participate in the selection process. The purposes of processing, the categories of data to be included in the Register, as well as the recipients of such data, thus, should be clearly set forth in the Proposal.

text: 19. Further, in order to clarify the allocation of responsibilities with regard to the processing of volunteers' data in connection with the Register, the EDPS recommends an additional paragraph in

text: Article 13

text: to confirm that the Commission acts as a controller in accordance with

text: Article 3(1) of Regulation (EC) No 45/2001

text: , and the sending organisations in Member States as controllers in accordance with

text: Article 4 of Directive 95/46/EC

text: Article 16

text: - European Humanitarian Voluntary Corps Network

text: Article 16

text: requires the Commission to establish and manage an EU Aid Volunteers' Network. The objective of the Network is to facilitate interaction and knowledge sharing and to support other activities such as seminars and workshops.

text: 21. The EDPS recommends that

text: Article 16

text: specifically require the adoption of a data protection policy for the Network. Further details on how the applicable data protection safeguards should be implemented can be established in this policy.

text: Article 23

text: - Cooperation with other countries and international organisations

text: 22. Article 23 of the Proposal opens the possibility of participation to citizens and sending organisations from third countries.

text: 23. The EDPS here reminds that pursuant to Regulation EC (No) 45/2001 and Directive

text: , transfers of personal data to third countries are, in principle, only allowed if an adequate level of protection is ensured in the recipient country. The transfer to countries which do not provide for adequate protection can only be justified if any of the exceptions of Article 9 of the

text: Regulation (EC) No 45/2001

text: and

text: Article 26 of Directive 95/46/EC

text: apply, for example, if the data subject has given his or her consent unambiguously to the proposed transfer.

text: 3. STANDARDS, CERTIFICATION, AND DATA PROTECTION POLICIES Articles

text: and

text: - Delegated acts for standard setting

text: 24. Articles 9 and 25 of the Proposal, taken together, provide that the Commission shall adopt delegated acts to set the standards for the identification, selection and preparation of volunteers as well as for their subsequent management and deployment.

text: 25. The EDPS reminds the Commission that he should be consulted in the framework of the adoption of any delegated acts under

text: Article 25

text: that would have an impact on the processing of personal data. This should specifically include the delegated acts to be adopted to set standards under

text: Article 9

text: 26. With regard to the content of the standards, it is important that the standards require the organisations responsible for the selection of the candidates and subsequently, for the management and deployment of the volunteers, to have appropriate data protection policies in place.

text: 27. It would be also desirable if these data protection policies were to provide a harmonised, consistent set of safeguards across Europe. Therefore, to the extent feasible, it would be helpful if the data protection safeguards were harmonized via the standards to be adopted.

text: 28. This is particularly important for the selection process. The processing of any personal data required from candidates has to be justified and proportionate in view of the data quality principle. In this respect the EDPS refers to a pilot scheme supported by the Commission where applicants can already apply to become EU Aid Volunteers . The application forms appear to collect a large amount of data such as data about relationship status (including partner's name), information about children and other dependents, mortgages, disability. It should be carefully assessed whether the collection of all such data is clearly justified and proportionate and if so, whether their processing may require additional safeguards such as, among others, stronger measures to ensure confidentiality and security of the data, more limited retention periods, and specific arrangements to avoid unlawful discrimination on the basis of, among others, family, financial and relationship status or disability.

text: 29. As a result of this assessment, the EDPS in particular recommends that the standards to be developed specify the categories of data that can be processed during the application procedure. The EDPS suggests that this intention for specification be mentioned in recital of the proposed Regulation.

text: 30. This specification, for example, could take the form of a harmonized application form, that would clearly list all necessary information and documents that could be requested from the applicants. This application form could then constitute an appendix to the standards to be adopted. Availability of the EDPS for further guidance on certification and practical implementation

text: 31. The Commission is also encouraged to seek further guidance from the EDPS when elaborating the certification scheme under Article 10 of the Proposal.

text: 32. Further, the EDPS calls the attention of the Commission to the fact that -depending on the practical implementation foreseen for the

text: Article 13

text: Register, including, in particular, on the purposes of its use and on the categories of personal data to be included in it- the establishment of the Register might also be subject to prior checking under

text: Article 27 of Regulation (EC) No 45/2001

text: . If in doubt, the Commission is encouraged to seek guidance from the EDPS whether a prior checking notification is necessary. Indicative list of items to be included in the data protection policies

text: 33. The EDPS would like to support the creation of data protection policies and provides the following recommendations, for the development of these policies. The policies (applicable for the

text: Article 13

text: Register, the

text: Article 16

text: Network, and/or the selection process, as the case may be) may address, among others, issues such as:  The legal basis for the processing of personal data. A voluntary scheme is in principle based on the explicit consent for processing of personal data of those submitting their applications for enrolling as volunteers.  The specification of purpose. The purpose should be clear and explicit, and be limited to the purposes foreseen by the Proposal. Any personal data originally collected for a specific purpose cannot be accessed or used further for another purpose without a specific assessment of compatibility between both purposes. (See also para 12 above, which calls for specification of a purpose for the Register already in the main body of the Proposal.)  'Data minimisation'. According to this principle, personal data should be limited to the minimum necessary and should only be processed if the purpose of the processing could not be fulfilled by other means.  Disclosure of information to third parties. In principle, the personal information of volunteers included in the Register should not be disclosed to third parties and should only be used by the organizations that will deploy them. Any exceptions should be clearly explained and justified.  Use of cookies. Any use of cookies should be in line with Article 5(3) of the e-Privacy Directive , which requires information and where relevant consent of the user.  Updating registered user information:  All registered users should be able to correct, update or change their profile at any time from their profile page accessible from their user account.  Procedures should be in place to ensure that inactive users or those who wish to terminate their accounts should be deleted from the database in a timely manner and that any inaccurate information on active users is corrected promptly.  Changes to the data protection policy. Users should be informed about any change to the data protection policy.  Security policy. Appropriate technical and organisational measures should be in place designed to secure the user's personal information from accidental loss and from unauthorized access, use, alteration or disclosure.

text: 4. CONCLUSIONS

text: 34. The EDPS recommends that a reference to the applicable data protection legislation to be included as a substantive provision of the proposal.

text: 35. The EDPS would recommend the following additional clarifications in the text: 

text: Article 13

text: should specify the purposes of the Register, the categories of data included in it, as well as the range of entities that may have access to the Register, to ensure legal certainty. 

text: Article 13

text: should also clearly identify the Commission and the user organisations as separate controllers.  Articles

text: and

text: each should require the adoption of a data protection policy, for the Register and the Network respectively.

text: 36. Further, the EDPS recommends that the Commission should consult the EDPS before the adoption of any delegated acts under

text: Article 25

text: that would have an impact on the processing of personal data, in particular, on the standards to be adopted under

text: Article 9

text: . These standards should require the adoption of appropriate data protection policies by the organizations carrying out the selection process for volunteers and managing and deploying volunteers. This may include harmonization of the categories of data collected, and may possibly lead to a standard application form to be used across Europe. Done in Brussels, 23 November 2012 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor

type: vagledning

utgivare: edps


text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: EDPS Opinions of 10 February 2012, available at http://www.edps.europa.eu/EDPSWEB/edps/Consultation/Opinions.

text: See EDPS Opinions of 10 February 2012 on credit rating agencies (para 23), markets in financial instruments (MIFID/MIFIR) (para 46) and market abuse (para 26), available at http://www.edps.europa.eu/EDPSWEB/edps/Consultation/Opinions. 5 See EDPS Opinions of 10 February 2012 on credit rating agencies (para 35) and market abuse (para 33), available at http://www.edps.europa.eu/EDPSWEB/edps/Consultation/Opinions.

text: Directive

text: of the European Parliament and the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, OJ L 201, 31.7.2002, p. 37. 7 See, e.g., Joined Cases

text: and

text: , Volker und Markus Schecke GbR (

text: ), Hartmut Eifert (

text: ) v. Land Hessen, nyp, para 74.

text: Joined Cases

text: and

text: , Schecke, paras 56-64. 9 See in this regard also EDPS Opinion of 9 October 2012 on the Amendment to the Commission proposal on the financing, management and monitoring of the common agricultural policy, available at http://www.edps.europa.eu/EDPSWEB/edps/Consultation/Opinions. 10 See in this regard also EDPS Opinion of 15 April 2011 on the Financial rules applicable to the annual budget of the Union, OJ C 215, 21.7.2011, p. 13–18. 11 See EDPS Opinions of 10 February 2012 on credit rating agencies (para 48), markets in financial instruments (MIFID/MIFIR) (para 59) and market abuse (para 46), available at http://www.edps.europa.eu/EDPSWEB/edps/Consultation/Opinions.

text: See EDPS Opinion of 10 April 2007 on the financing of the Common Agricultural Policy, OJ 2007 C134/1 OJ C 134, 16.6.2007, p. 1–3. 13 See for instance, the Opinion on financial rules applicable to the annual budget of the Union of 15.04.2011, and the opinion on investigations conducted by OLAF of 01.06.2011, both available at http://www.edps.europa.eu/EDPSWEB/edps/Consultation/Opinions.

text: See Opinion on financial rules applicable to the annual budget of the Union 15/04/2011, available at http://www.edps.europa.eu/EDPSWEB/edps/Consultation/Opinions.

identifier: EDPS yttrande (2012)

amnesord: Electronic Communications, Information Society

publisher: Europeiska datatillsynsmannen

sprak: en

title: Insurance mediation, UCITS and key information documents for investment products

serie: yttranden

text: Opinion of the European Data Protection Supervisor

type: stycke

text: on proposals for a Directive on insurance mediation, a Directive amending certain provisions of Directive

text: on the coordination of laws, regulations and administrative sanctions relating to undertakings for collective investment in transferable securities and a Regulation on key information documents for investment products

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 3 July 2012, the Commission adopted a proposal for a Directive on insurance mediation (hereafter 'the IM Directive'), a proposal for a Directive amending certain provisions of Directive

text: on the coordination of laws, regulations and administrative sanctions relating to undertakings for collective investment in transferable securities (hereafter 'the UCITS Directive') and a proposal for a Regulation on key information documents for investment products (hereafter 'the KID Regulation'). These proposals were sent to the EDPS for consultation on 5 July 2012.

text: 2. The EDPS welcomes the fact that he is consulted by the Commission and recommends that a reference to this Opinion is included in the preambles of the proposed legal instruments.

text: 3. Comparable provisions to the ones referred to in this Opinion are present in several pending and future proposals, such as those discussed in the EDPS Opinions on the legislative package on the revision of the banking legislation, credit rating agencies, markets in financial instruments (MIFID/MIFIR) and market abuse . Therefore, this Opinion should be read in close conjunction with the EDPS Opinions of 10 February 2012 on the above mentioned initiatives.

text: 4. The two proposed Directives and the proposed Regulation will affect the rights of individuals relating to the processing of their personal data in different ways as they deal with the investigatory powers of competent authorities including access to existing telephone records and traffic data, databases, publication of administrative sanctions including the identity of those responsible and the reporting of breaches (so called whistle blowing schemes).

text: 5. As the issues discussed in this Opinion have been discussed in past EDPS Opinions in the Financial area, the EDPS intends to publish guidelines on these and other issues concerned in order to give guidance on how do deal with Data Protection issues in future Commission proposals in this area. 1.2. Objectives and scope of the proposals

text: 6. The Commission states that strong, well-regulated retail markets that place the best interests of consumers at their heart are necessary for consumer confidence and economic growth in the medium and longer term. Specifically, according to the Commission, the above mentioned legislative proposals introduce new, consumer-friendly standards for information about investments, raise standards for advice, and tighten certain rules on investment funds to ensure their safety.

text: 2. ANALYSIS OF THE PROPOSALS 2.1. General reference to data protection legislation

text: 7. The proposed UCITS Directive (

text: Article 104

text: a), the proposed IM Directive (

text: Article 32

text: ) and the proposed KID Regulation (

text: Article 17

text: ) all entail substantive provisions that mention Directive

text: and

text: Regulation (EC) No 45/2001

text: 8. In view of the data protection implications of the proposed Directives and the proposed KID Regulation, the EDPS suggests emphasising the full applicability of existing data protection legislation in one general substantive provision in all proposals and that the reference to Directive

text: is clarified by specifying that the provisions will apply in accordance with the national rules which implement Directive

text: . 2.2. Investigatory powers of the competent authorities

text: 9. According to Article 26 of the proposed IM Directive, Member States shall supervise insurance or reinsurance undertakings and insurance or reinsurance intermediaries. This supervision will be carried out by national competent authorities. Article 26(3) of the proposed IM Directive states that the competent authorities shall have all the investigatory powers that are necessary for the exercise of their functions. Furthermore, the competent authorities shall cooperate closely in the exercise of their sanctioning powers. It seems likely - or at least it cannot be excluded - that information exchanges will take place which include personal data within the meaning of Directive

text: and

text: Regulation (EC) No 45/2001

text: . The conditions for fair and lawful processing of personal data, as laid down in the Directive and the Regulation, should therefore be fully respected .

text: 10. The EDPS acknowledges that the aims pursued by the Commission in the proposed IM Directive are legitimate. He understands the need for initiatives aiming at strengthening supervision of financial markets in order to preserve their soundness and better protect investors and the economy at large. However, investigatory powers relating to insurance intermediaries, insurance undertakings and their employees, given their potentially intrusive nature, have to comply with the requirements of necessity and proportionality, i.e. they have to be limited to what is appropriate to achieve the objective pursued and not go beyond what is necessary to achieve it. It is therefore essential in this perspective that the provisions are clear on the circumstances in which and the conditions on the basis of which they can be used. Furthermore, adequate safeguards should be provided against the risk of abuse.

text: 11. According to the EDPS, the circumstances and the conditions for using the investigatory powers of the competent authorities should be more clearly defined in the legislative provision. Article 26(3) of the proposed IM Directive does not indicate the circumstances and the conditions under which documents and information can be requested. Nor does it provide for important procedural guarantees or safeguards against the risk of abuses. The EDPS therefore recommends limiting access to documents and information to specifically identified and serious violations of the proposed Directive and in cases where a reasonable suspicion (which should be supported by concrete initial evidence) 5 exists that a breach has been committed .

text: 12. The EDPS recommends introducing, in Article 26(3) of the proposed IM Directive, the requirement for competent authorities to request documents and information by formal decision, specifying the legal basis and the purpose of the request and what information is required, the time-limit within which the information is to be provided as well as the right of the addressee to have the decision reviewed by a court. 2.3. Power of the competent authorities to access existing telephone records and traffic data

text: Article 98(2)

text: (d) of the proposed UCITS Directive empowers the competent authorities to 'require existing telephone records and traffic data'. However it clarifies that the request is subject to the existence of a 'serious suspicion' that such records 'may be relevant to prove a breach by the UCITS, management companies, investment companies or depositories'.

text: 14. Data relating to use of electronic communication means may convey a wide range of personal information. Furthermore, processing of traffic data conflicts with the secrecy of correspondence as expressed in Article 8 of the European Convention 6 of Human Rights. In view of this, Directive

text: (the E-Privacy Directive) in

text: Article 6

text: has established the principle that traffic data must be erased or made anonymous when it is no longer needed for the purpose of the transmission of a communication. According to Article 15(1) of this Directive, Member States may include derogations in national legislation for specific legitimate purposes, but they must be necessary, appropriate and proportionate within a democratic society to achieve these purposes.

text: 15. The EDPS acknowledges that the aims pursued by the Commission in the proposed Directive are legitimate. It is therefore essential in this perspective that the provision is clearly drafted in compliance with Articles 15(1) of the E-Privacy Directive and that a reference to this Article is added to the provision in the proposed Directive. 2.3.1. Definition of telephone and data traffic records

text: 16. The EDPS welcomes the link in

text: Article 98(2)

text: (d) of the proposed UCITS Directive to the E-Privacy Directive and the definition of 'traffic data' in

text: Article 2(1)

text: (b) of the E-Privacy Directive. However, as this definition does not include a definition of 'existing telephone records', we recommend specifying the categories of telephone records which competent authorities can require. Such data must be adequate, relevant, and not excessive in relation to the purpose for which they are accessed and processed. 2.3.2. Requirement of a judicial authorisation

text: 17. The EDPS welcomes that according to Article 98(3) of the proposed UCITS Directive the power to require existing telephone records and traffic data shall require prior judicial authorisation. However, he recommends introducing the requirement for competent authorities to request telephone records and traffic data by formal decision of a judicial authority specifying the legal basis and the purpose of the request and what information is required, the time-limit within which the information is to be provided as well as the right of the addressee to have the decision reviewed by a court. 2.4. EIOPA database

text: 18. Article 3(4) of the proposed IM Directive states that the European Insurance and Occupational Pensions Authority (EIOPA) shall maintain a central database listing all insurance and reinsurance intermediaries which intend to carry out crossborder business. This database shall be publicly available on the Internet. It is unclear whether this database will include the personal data of natural persons. The wording of the Article only speaks about insurance intermediaries and reinsurance intermediaries. However, according to Article 3 of the proposed IM Directive information regarding natural persons (employees) is to be collected by national competent authorities and may be exchanged between them and EIOPA. This implies that also such information could be included in the database.

text: 19. The creation of central database which is publicly available on the Internet (and which includes personal data) constitutes processing of personal data in the sense of

text: Regulation (EC) No 45/2001

text: . The EDPS welcomes the introduction of a legal basis for the database in Article 3 of the proposed IM Directive. However, the specific access rights and management rights in relation to the processing operations are not explicitly clarified.

text: 20. The EDPS recommends the Commission to clarify the modalities of the EIOPA Database by introducing more detailed provisions in the proposed Directive. Such provisions must comply with the requirements of

text: Regulation (EC) No 45/2001

text: . In particular, the provision establishing the database must (i) identify the purpose of the processing operations and establish which are the compatible uses; (ii) identify which entities (EIOPA, competent authorities and potentially others) will have access to which data stored in the database and will have the possibility to modify the data; (iii) ensure the right of access and appropriate information for all the data subjects whose personal data may be stored and exchanged (iv) define and limit the retention period for the personal data to the minimum necessary for the performance of such purpose.

text: 21. In any event and notwithstanding the recommendation made in paragraph 19, the implementing measures to be adopted should specify in detail the functional and technical characteristics of the database and should be notified to the EDPS for consultation. 2.5. Publication of sanctions

text: Article 99

text: b of the proposed UCITS Directive, Article 27 of the proposed IM Directive and Article 22 of the proposed KID Regulation state that every administrative measure and sanction imposed for breaches shall be published without undue delay, including at least information on the type and nature of the breach and the identity of persons responsible for it, unless such disclosure would seriously jeopardise the financial markets. Recital 23 of the proposed UCITS Directive and Recital 46 of the proposed IM Directive furthermore state that the publication of sanctions should strengthen the dissuasive effect on the public at large.

text: 23. The EDPS welcomes the reference in recital 23 of the proposed UCITS Directive to the Charter of Fundamental Rights and in particular the right to protection of personal data when publishing sanctions. However, he is not convinced that the mandatory publication of sanctions, as it is currently formulated, meets the requirements of data protection as clarified by the Court of Justice in the Schecke ruling. The EDPS takes the view that the purpose, necessity and proportionality of the measure are not sufficiently established and that, in any event, adequate safeguards should be provided. 2.5.1. Necessity and proportionality of the publication

text: 24. Article 27 of the proposed IM Directive,

text: Article 99

text: b of the proposed UCITS Directive and Article 22 of the proposed KID Regulation seem to be affected by the same shortcomings highlighted by the CJEU in the Schecke ruling. It should be borne in mind that for assessing the compliance with data protection requirements of a provision requiring public disclosure of personal information, it is of crucial importance to have a clear and well-defined purpose which the envisaged publication intends to serve. Only with a clear and well-defined purpose can it be assessed whether the publication of personal data involved is actually 10 necessary and proportionate.

text: 25. After examining the proposals and the Explanatory memorandums, the EDPS is under the impression that the purpose, and consequently the necessity, of this measure are not clearly established. If the general purpose is increasing deterrence, it should be better explained in a Recital, in particular, why alternative, less privacy-intrusive measures, such as heavier financial penalties (or other sanctions not amounting to naming and shaming) are not sufficient.

text: 26. Furthermore, the proposals do not seem to take into account less intrusive methods, such as publication to be decided on a case by case basis. In the EDPS' view, the possibility to assess the case in light of the specific circumstances is more proportionate and therefore a preferred option compared to mandatory publication in all cases . 2.5.2. The need for adequate safeguards

text: 27. The proposed IM Directive, the proposed UCITS Directive and the proposed KID Regulation should all foresee adequate safeguards in order to ensure a fair balance between the different interests at stake when publishing administrative measures and sanctions imposed for breaches. Safeguards are necessary in relation to the right of the accused persons to challenge a decision before a court and the presumption of innocence. The EDPS recommends that the text of the relevant Articles in all proposals specify that competent authorities are obliged to take appropriate measures with regard to both the situations where the decision is subject to an appeal and where it is eventually annulled by a court. For example, the following measures could be considered by national authorities: to delay the publication until the appeal court has defined the case or to clearly indicate that the decision is still subject to appeal and that the individual is to be presumed innocent until the decision becomes final, to publish a rectification in cases where the decision is annulled by a court.

text: 28. The proposals should ensure that the rights of the data subjects are respected in a proactive manner. The texts should provide that data subjects are informed beforehand of the fact that the decision sanctioning them will be published, and that they are granted the right to object under

text: Article 14 of Directive 95/46/EC

text: on compelling legitimate grounds.

text: 29. The EDPS assumes that in most of the Member States the publication will take place on the Internet. Internet publications raise specific issues and risks concerning in particular the need to ensure that the information is kept online for no longer than is necessary and that the data cannot be manipulated or altered. The use of external search engines also entails the risk that the information could be taken out of context and channelled through and outside the web in ways which cannot be easily controlled.

text: 30. The EDPS recommends obliging Member States to ensure that personal data of the persons concerned are kept online only for a reasonable period of time, after which they are systematically deleted. Moreover, Member States should be required to ensure that adequate security measures and safeguards are put in place, especially to protect from the risks related to the use of external search engines. These measures and safeguards may consist for instance of the exclusion the data indexation by means of external search engines. 2.6. Reporting of breaches

text: 31. Article 30 of the proposed IM Directive and

text: Article 99

text: d of the proposed UCITS Directive require Member States to put in place effective mechanisms for reporting breaches, also known as whistle-blowing schemes. We welcome the fact that both the proposed IM Directive and the proposed UCITS Directive contain specific safeguards concerning the protection of the persons reporting on the suspected violation and more in general the protection of personal data.

text: 32. The EDPS would like to highlight, as in the case of other Opinions , the need to introduce a specific reference to the need to respect the confidentiality of whistleblowers' and informants' identity. The confidentiality of the identity of whistleblowers should be guaranteed at all stages of the procedure, so long as this does not contravene national rules regulating judicial procedures. In particular, the identity may need to be disclosed in the context of further investigation or subsequent judicial proceedings instigated as a result of the enquiry (including if it has been established that they maliciously made false statements about him/her). In view of the above, the EDPS recommends adding in

text: Article 30(2)

text: (c) of the proposed IM Directive and in

text: Article 99

text: d(1)(c) of the proposed UCITS Directive the following provision: 'the identity of these persons should be guaranteed at all stages of the procedure, unless its disclosure is required by national law in the context of further investigation or subsequent judicial proceedings'.

text: 33. The EDPS is pleased to see that both Article 30 of the proposed IM Directive and

text: Article 99

text: d of the proposed UCITS Directive requires Member States to ensure the protection of personal data of both accused and the accusing person, in compliance with the principles laid down in Directive

text: . He suggests however removing 'the principles laid down in', to make the reference to the data protection Directive more comprehensive and binding.

text: 3. CONCLUSIONS

text: 34. The EDPS recommends:  that references to this Opinion are included in the preambles of all proposals;  inserting provisions in all proposals emphasising the full applicability of existing data protection legislation. The EDPS also suggests that the reference to Directive

text: be clarified by specifying that the provisions will apply in accordance with the national rules which implement Directive

text: ;  in the case of the proposed IM Directive, limiting competent authorities´ access to documents and information to specifically identified and serious violations of the proposed Directives and in cases where a reasonable suspicion (which should be supported by concrete initial evidence) exists that a breach has been committed;  in the case of the proposed IM Directive, introducing a requirement for competent authorities to request documents and information by formal decision by a judicial authority, specifying the legal basis and the purpose of the request and what information is required, the time-limit within which the information is to be provided as well as the right of the addressee to have the decision reviewed by a court of law;  in the case of the proposed UCITS Directive, introducing the requirement for competent authorities to request telephone records and traffic data by formal decision of the competent authority specifying the legal basis and the purpose of the request and what information is required, the time-limit within which the information is to be provided as well as the right of the addressee to have the decision reviewed by a court;  in the case of the proposed IM Directive, clarifying the modalities of the EIOPA database by introducing more detailed provisions in the proposed Regulations. Such provisions must comply with the requirements of

text: Regulation (EC) No 45/2001

text: . In particular, the provision establishing the database must (i) identify the purpose of the processing operations and establish which are the compatible uses; (ii) identify which entities (EIOPA, competent authorities, Commission) will have access to which data stored in the database and will have the possibility to modify the data; (iii) ensure the right of access and appropriate information for all the data subjects whose personal data may be stored and exchanged (iv) define and limit the retention period for the personal data to the minimum necessary for the performance of such purpose;  assessing the necessity of the proposed system for the mandatory publication of sanctions in all proposals and verify whether the publication obligation does not go beyond what is necessary to achieve the public interest objective pursued and whether there are not less restrictive measures to attain the same objective. Subject to the outcome of this proportionality test, the publication obligation should in any event be supported by adequate safeguards to ensure respect of the presumption of innocence, the right of the persons concerned to object, the security/accuracy of the data and their deletion after an adequate period of time;  with regard to the reporting of breaches in all proposals (i) inserting provisions in the proposed Directives saying that: ‘the identity of these persons should be guaranteed at all stages of the procedure, unless its disclosure is required by national law in the context of further investigation or subsequent judicial proceedings’; (ii) adding a paragraph requiring Member States to put in place ‘appropriate procedures to ensure the right of the accused person of defence and to be heard before the adoption of a decision concerning him and the right to seek effective judicial remedy against any decision or measure concerning him’; (iii) removing ‘the principles laid down’ from the provisions. Done in Brussels, 23 November 2012 (signed) Giovanni Buttarelli Assistant European Data Protection Supervisor


text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.01.2001, p. 1. 3 COM(2012) 499 final.

text: See OJ L 297, 15.11.2003, p. 1 and OJ L 343, 27.12.2007, p. 5. 5 The funding from the EU budget will be regulated in a second proposal, to be adopted soon; see Commission Working Document prefiguring the proposal for an amendment to the Financial Regulation introducing a new title on the financing of European political parties, COM(2012) 500. 6 See the Report of the Secretary General on party funding at European level pursuant to Article 15 of the Decision of the Bureau of the European Parliament of 29 March 2004 laying down the procedures for implementing

text: Regulation (EC) No 2004/2003

text: of the European Parliament and of the Council on the regulations governing political parties at European level and the rules regarding their funding - 18 October 2010 and Resolution of 6 April 2011, A7-0062/2011. 7 See recitals 10 and 11 of the Proposal and p. 6 of the Explanatory Memorandum to the Proposal. 8 See

text: Article 12

text: and recital 12 of the Proposal and p. 6 of the Explanatory Memorandum to the Proposal. 9 See p. 6 of the Explanatory Memorandum to the Proposal.

text: See Article 7 of the Proposal. 11 The European Parliament, the Council and the Commission. 12 See Article 7(2) of the Proposal. 13 For the purposes of

text: Article 3(1) of Regulation (EC) No 45/2001

text: . 14 The references made in Article 25(1) and 25(2) of the Proposal could serve for this purpose.

text: Article 4(2)

text: (f) of the Proposal. 16 CJEU, Bavarian Lager (

text: P), [2010] ECR I-06055. 17 CJEU, Schecke (

text: and

text: ), [2010] ECR I-11063. 18 The transparency principle can be found in Articles

text: and

text: TEU and 15 TFEU, the rights to privacy and data protection are enshrined in Articles 7 and 8 of the Charter of Fundamental Rights. The right to data protection can furthermore be found in

text: Article 39

text: TEU and

text: Article 16

text: TFEU. 19 See para. 23 of the Opinion of the EDPS on the proposal for a Regulation of the European Parliament and of the Council on the financial rules applicable to the annual budget of the Union, 15.04.2011, available at: http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2011/11- 04-15_Financial_Rules_EN.pdf. 20 See the EDPS background paper of 24 March 2011 on public access to documents containing personal data after the Bavarian Lager ruling, available at: http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/EDPS/Publications/Papers/Back groundP/11-03-24_Bavarian_Lager_EN.pdf., in particular p. 6 and 7.

text: See CJEU, Schecke (

text: and

text: ), [2010] ECR I-11063, para. 85. 22 ECtHR, Von Hannover v. Germany (app. 59320/00), [2004] ECHR 294, para 25. 23 See CJEU, Schecke (

text: and

text: ), [2010] ECR I-11063, para. 81. 24 See, for example, Opinion of the EDPS on the proposal for a Regulation of the European Parliament and of the Council on the financial rules applicable to the annual budget of the Union, 15.04.2011; Opinion of the EDPS on the Financial Regulation applicable to the general budget of the European Communities; Opinion of the EDPS on the Amendment to the Commission proposal COM(2011) 628 final/2 for a Regulation of the European Parliament and of the Council on the financing, management and monitoring of the common agricultural policy, 09.10.2012; a package of 4 Opinions of the EDPS relating to the financial sector, 10.02.2012, all available at http://www.edps.europa.eu/EDPSWEB/edps/Consultation/OpinionsC. 25 See e.g. para. 25 of the Opinion of the EDPS on the proposal for a Regulation of the European Parliament and of the Council on the financial rules applicable to the annual budget of the Union, 15.04.2011, available at: http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2011/11- 04-15_Financial_Rules_EN.pdf. 26 See

text: Article 10(1) of Regulation (EC) No 45/2001

text: and

text: Article 8(1) of Directive 95/46/EC

text: See also special provisions in

text: Article 10(2)

text: (e) of Regulation 45/2001 and

text: Article 8(2)

text: (d) of Directive

text: on data processing "carried out in the course of its legitimate activities with appropriate safeguards by

text: the processing relates solely to the members of this body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed to a third party without the consent of the data subject." 28 See CJEU, Schecke (

text: and

text: ), [2010] ECR I-11063, paras. 79, 81, 89 and 92.

text: See notably the second part of those provisions. 30 See also part II.2.2. of the current Opinion. 31

text: Article 10(5) of Regulation (EC) 45/2001

text: and

text: Article 8(5) of Directive 95/46/EC

text: . 32 Article 22(1) of the Proposal. 33 Article 22(6) of the Proposal.

text: Article 24(3) of the Proposal. 35 See, for example, para. 8 of the Opinion of the EDPS on the Financial Regulation applicable to the general budget of the European Communities (OJ C 94, 28.4.2007, p. 12-18). See also Chapter III on proactive approach of the EDPS background paper: public access to documents containing personal data after the Bavarian Lager ruling, 24.03.2011, available at: http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/EDPS/Publications/Papers/Back groundP/11-03-24_Bavarian_Lager_EN.pdf.

text: Article 4(1)

text: (c) of

text: Regulation (EC) 45/2001

text: and

text: Article 6(1)

text: (c) of Directive

text: . 37

text: Article 24(1)

text: (a) of the Proposal requires updating the website within four weeks after any amendments have been notified to the European Parliament.

amnesord:
Regulation 45/2001
Rights of the Individual
Right of Information
Transparency

title: Statute and funding of European political parties

text: Opinion of the European Data Protection Supervisor

text: on the Proposal for a Regulation on the statute and funding of European political parties and European political foundations

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such 2 data ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: I. INTRODUCTION

text: I.1. Consultation of the EDPS

text: 1. On 12 September 2012, the Commission adopted a Proposal for a Regulation of the European Parliament and of the Council on the statute and funding of European political parties and European political foundations ("the Proposal") . On the same day, the Proposal was sent by the Commission to the EDPS for consultation.

text: 2. The EDPS welcomes the fact that he is consulted by the Commission in accordance with

text: Article 28(2) of Regulation (EC) 45/2001

text: and that a reference to the EDPS consultation has been included in the preamble of the Proposal.

text: 3. The EDPS is pleased that also before the adoption of the Proposal, he was given the possibility to provide comments to the Commission. The EDPS believes that the level of data protection in the Proposal has increased as a result. I.2. Context and objectives of the Proposal

text: 4. The aim of the Proposal is to strengthen and facilitate the role of the European political parties and foundations since they contribute to forming European political awareness and to expressing the will of citizens of the Union, as foreseen in

text: Article 10(4)

text: TEU and Article 12(2) of the Charter of Fundamental Rights. The Proposal envisages improving the funding and regulatory frameworks of the political parties at European level. It intends to replace the current

text: Regulation (EC) No 2004/2003

text: on the regulations governing political parties at European level and the rules regarding their funding (which was revised in 2007). The recognition as a European political party or foundation is a precondition under the Proposal for eligibility for funding from the EU budget.

text: 5. The Commission considered that it was necessary to replace

text: Regulation (EC) No 2004/2003

text: after an assessment of the current financing and regulatory framework of European political parties and foundations, following the report by the Secretary General of the European Parliament on party funding at European level and the European Parliament's resolution of 6 April 2011 on the application of

text: Regulation (EC) No 2004/2003

text: ("the Ginnakou report") .

text: 6. The central element of the Proposal is the introduction of a European legal statute, giving the European political parties and foundations legal personality based on EU law, which should help them to overcome current obstacles in recognition and functioning under different national legal systems. In order to benefit from the status of a legal person under EU law, the European political parties and foundations will have to meet high standards on internal democracy, governance, accountability, transparency, and respect for the values on which the Union is founded . Only those European political parties and foundations that have been recognised as such will be 8 eligible for funding from the general budget of the EU .

text: 7. The Proposal also foresees that the European political parties and foundations are subject to a comprehensive and transparent regulatory and control framework to reinforce public control and the principle of transparency. The transparency foreseen by the proposal includes the compulsory publication of certain personal data. II. ANALYSIS OF THE PROPOSAL II.1. General Comments II.1.1. Provisions on data protection

text: 8. The EDPS welcomes the references to Directive

text: Regulation (EC) No 45/2001

text: and Articles 7 and 8 of the Charter of Fundamental Rights in Recital 20. He also welcomes the references to the applicability of Directive

text: and

text: Regulation (EC) No 45/2001

text: in the Preamble and in the legislative part of the Proposal.

text: 9. Recital 21 and

text: Article 25(1)

text: specify that

text: Regulation (EC) No 45/2001

text: applies to the processing of personal data carried out by the European Parliament and by the “committee of independent eminent persons” (hereinafter: "the committee") that will issue opinions on the verification of the criteria to be met by European political parties and foundations .

text: 10. The EDPS welcomes this clarification. As its members will be appointed by EU 11 institutions and its secretariat and funding will be provided by the European 12 13 Parliament , the committee will be an emanation of EU institutions and as such, its processing operations will be subject to

text: Regulation (EC) No 45/2001

text: 11. Recital 23 refers to both

text: Regulation (EC) No 45/2001

text: and Directive

text: , and recital 22 notes that Directive

text: applies in the application of the Proposal. Neither of the recitals make it clear which legislation is applicable in which case.

text: Article 25(1)

text: and recital 21 specify that the European Parliament and the committee shall comply with

text: Regulation (EC) No 45/2001

text: and

text: Article 25(2)

text: specifies that European political parties, European political foundations and national authorities competent for controlling their financing, as well as independent bodies or experts authorised to audit their accounts shall comply with Directive

text: and national provisions implementing it. The EDPS welcomes this clarification and recommends clarifying recitals 22 and 23 accordingly.

text: Article 25

text: also contains more detailed provisions on data protection. The EDPS welcomes the designation of the data controllers laid down in Article

text: and

text: and the specification of the maximum data retention periods allowed in subparagraphs (3) to (5) of

text: Article 25

text: 13. However, subparagraphs (6) to (8) of

text: Article 25

text: only repeat provisions of Directive

text: and

text: Regulation (EC) No 45/2001

text: . These subparagraphs would only provide added value if they specified how the relevant data protection provisions will be implemented, e.g. which type of security measures should be implemented by controllers or how data subjects will be able to exercise their rights in practice. The EDPS recommends specifying this in the Proposal at least to some extent or replacing these subparagraphs by a general reference to Directive

text: and

text: Regulation (EC) No 45/2001

text: 14. Additionally, the EDPS welcomes the introduction of an obligation to include in the statute of a European political party rules on internal party policy covering, among other things, the party's approach to transparency, including privacy and the protection of personal data . II.1.2. Transparency, privacy and data protection

text: 15. The EDPS recognises the effort of the Commission to strike a balance between the principle of transparency and control over the funding of the European political parties and foundations and the data subjects' rights to privacy and personal data protection.

text: 16. Before moving to a more detailed analysis of the Proposal, the EDPS wishes to provide some more general reflections on the relation between transparency and data protection, in order to better understand the Proposal and the issues therein in its proper context.

text: 17. The possible collision between transparency requirements on the one hand and privacy and data protection requirements on the other hand, has already led to several cases before the Court of Justice of the European Union. In two leading rulings, Bavarian Lager and Schecke , the Court dealt with this issue and provided further guidance on how to come to a solution which does justice to the fundamental nature of both the principle of transparency and the rights to privacy and the protection of personal data .

text: 18. The EDPS has also provided guidance on how to reconcile the underlying interests. The EDPS has stated that the role of privacy and data protection is not to prevent public access to information whenever personal data is involved nor to unduly limit transparency . Privacy and data protection should ensure that public disclosure of personal data is achieved only when duly justified and in an appropriate manner which does justice to the different interests at stake.

text: 19. After the Bavarian Lager and Schecke rulings, in March 2011, the EDPS also published a background paper on the matter in which a proactive approach was encouraged. Such an approach implies an ex ante assessment of the question whether and to what extent disclosure of information includes or might include the public disclosure of personal data. If such disclosure is envisaged, it should be made clear to the persons involved before or at least at the moment the data are collected. The proactive approach ensures that data subjects involved are well-informed and are 20 enabled to invoke their rights under the data protection rules .

text: 20. The decision to disclose personal data should be based on a proper balance of the different interests at stake. In this respect, the Court of Justice, in Schecke, considered that no automatic priority can be conferred on the objective of transparency over the right to protection of personal data . The ECtHR has also referred to the balance between the public's right to know and the protection of privacy and personal data. In Von Hannover, the ECtHR considered that a fair balance must be sought between the 22 competing interests of the individual and of the community as a whole .

text: 21. In Schecke, the Court of Justice underlined that the institutions should explore different methods of publication to find the one which would be consistent with the objective of publication, while causing the least interference with the beneficiaries' right to private life and to protection of personal data .

text: 22. The EDPS has issued several opinions on legislative proposals in which the active publication of personal data was envisaged . The EDPS has repeatedly emphasised that the purpose of the publication of the data should be clearly defined, the necessity of having the data disclosed should be established, which includes a balance of the different interests involved, and that information should be provided on when and how the data will be disclosed in order to enable the data subjects to invoke their rights as 25 contained in EU data protection legislation .

text: 23. The transparency obligations foreseen in the present Proposal on political parties and foundations include the publication of certain personal data (i.e. information relating to an identifiable natural person), namely the names of members of political parties and foundations and their contributions, the names of donors and their corresponding donations and the names of legal representatives of the parties and foundations.

text: 24. When weighing the different interests at stake, it should be borne in mind that while there is an obvious public interest in the transparency of political parties and foundations, the personal data involved reveals the political opinions and views of persons which are considered as a special category of personal data the processing of which is, in principle, prohibited . Only under certain strict conditions such data may be processed.

text: 25. In general, the EDPS welcomes the approach taken by the Commission in the present Proposal, which clearly envisages to achieve transparency with due respect for the privacy and data requirements. Still, the EDPS would like to draw attention to some aspects that should be improved. II.2. Transparency and data protection in the Proposal II.2.1. Weighing the different interests at stake

text: 26. Article 24 of the Proposal foresees creating a website where information about the European political parties and foundations, including personal data of certain persons, is published. As stated it concerns names of members of a European political party (

text: Article 24(2)

text: ) and their contributions (

text: Article 24

text: (f)), the names of donors and their corresponding donations (

text: Article 24(1)

text: (e)) and the names of (legal) representatives (

text: Article 24(1)

text: (a) and (b) read in conjunction with

text: Article 4(1)

text: (g) and (i) and

text: Article 5

text: (i) of the Proposal). Also information related to offences to be published (

text: Article 24(1)

text: (g)) might lead to the disclosure of personal data. Names of members or donors and their contributions or donations

text: 27. It is stated in recital 19 of the Proposal that proportionality between transparency and privacy and data protection is achieved by the fact that natural persons have to give consent for their name to be published in the members list of the party or foundation on the website.

text: 28. The EDPS welcomes the fact that according to

text: Article 24(2)

text: , the names of natural persons who are members of political parties will not be published without their express written consent. This acknowledges the sensitivity of such data and is in conformity with the legitimate ground for processing of sensitive personal data in

text: Article 10(2)

text: (a) of

text: Regulation (EC) No 45/2001

text: and

text: Article 8(1)

text: (a) of Directive

text: . To ensure consistency and clarity in the text of the Proposal, the EDPS recommends also adding the word "written" to the text of recital 19 to align it with

text: Article 24(2)

text: 29. However, following

text: Article 24(1)

text: (f) of the Proposal, the contributions of Members will be published with their name, as long as the contribution exceeds a value of EUR 1000 per year. This provision, read together with

text: Article 24(2)

text: , seems to imply that names of members who contribute to the political party or foundation more than EUR 1000 per year, will be disclosed anyway, despite the absence of their express written consent. The EDPS recommends clarifying this.

text: 30. The publication of the names of donors (and their donation), as required by

text: Article 24(1)

text: (e), is not based on the explicit written consent of the natural persons concerned. However, here as well, the names of natural persons whose donation is equal to or below EUR 1 000 per year will not be published.

text: 31. The purpose for disclosing the names of donors and their donation as well as the contributions of members above EUR 1000 per year is further explained in recital 15 of the Proposal: "in order to encourage a European political culture of independence, accountability and responsibility, certain types of donations and contributions to European political parties and foundations from sources other than the budget of the EU should be prohibited or subject to limitations and reinforced transparency requirements".

text: 32. In recital 19 of the Proposal it is stated that information considered to be of substantial public interest, including the donors, donations and contributions, should be made publicly available as it is "the most effective means of promoting a level playing field and fair competition between political forces, and of upholding open, transparent and democratic legislative and electoral processes, thereby strengthening the trust of citizens and voters in European representative democracy, and, more broadly, preventing corruption and abuses of power".

text: 33. There is no doubt that the aim of the publication is in itself legitimate. However, the question is whether the requirement as it is currently provided reflects a proper balance between this aim and the interests of the persons concerned. It should be noted that under

text: Regulation (EC) No 45/2001

text: , if no explicit consent is requested, the only possible other ground for such disclosure of sensitive data would be for reasons of substantial public interest, subject to the provision of appropriate safeguards (see Article 10(4) of that Regulation). The same applies under Directive

text: (see Article 8(4) of that Directive .

text: 34. In this respect, the EDPS welcomes the insertion of a threshold which seems to imply that only publication of larger donations and contributions would meet the criterion of substantial public interest. Under

text: Article 24(1)

text: (e) and (f), the names of donors and their corresponding donations and contributions of members are disclosed, with the exception for natural persons if the amount does not exceed a value of EUR 1 000 per year and per donor or member.

text: 35. The option of only publishing personal data above a certain threshold was also suggested by the Court of Justice in Schecke in order to achieve a proper balance between the principle of transparency and the fundamental rights to privacy and personal data protection .

text: 36. In the present situation, setting a threshold per year would indeed enable to protect people whose donations or contributions are smaller and, for this reason, are not presumed to have a (decisive) impact on the decisions of the political party or foundation.

text: 37. However, the EDPS has questions on how the threshold of 1000 Euro per annum has been established and why not a higher threshold has been chosen. Furthermore, it is unclear whether other means to achieve transparency have been considered. In this respect, the proposal does not show that the Commission considered several options to find the one most consistent with the objective of publication, while causing the least interference with the beneficiaries' right to private life and to protection of personal data as required by the Court of Justice in Schecke.

text: 38. The EDPS therefore recommends to better justify the threshold of 1000 Euro per annum in light of the Schecke ruling. This could be done in the recitals. Names of (legal) representatives

text: 39. As for the (legal) representatives of the European political party or foundation, according to

text: Article 4(1)

text: (g) and (i) and

text: Article 5

text: (i) of the Proposal, information on the party's and foundation's (legal) representation has to be included in the statute of the party or foundation and, thus, also be published in accordance with

text: Article 24(1)

text: (a) and (b).

text: 40. The EDPS notes that these people have deliberately taken up a representative position in the political party or foundation. The disclosure of such information could be considered as necessary for establishing, exercising or defending legal claims towards the legal person and would thus fall within the exceptions of

text: Article 10(2)

text: (d) of

text: Regulation (EC) 45/2001

text: and

text: Article 8(2)

text: (e) of Directive

text: . Still, such data remains sensitive and appropriate safeguards, e.g. by taking a proactive approach and ensuring that the persons have sufficient information about the publication of their data, should be put in place .

text: 41. The EDPS recommends specifying in the Proposal that the obligation to provide information about the publication and processing of personal data, as provided in Article 24(3) of the Proposal for potential members and donors, applies to the potential (legal) representatives of the parties and foundations, as well. Personal data relating to offences

text: 42. The EDPS notes that also data relating to offences are considered to be sensitive . Therefore, the data published under

text: Article 24(1)

text: (g) of the Proposal may also be sensitive as the details of and reasons for a decision taken pursuant to

text: Article 22

text: , which concerns penalties, may include personal data of persons that were involved in or who can be linked to the offences committed. That may be especially so when the European political party or foundation has been the subject of a judgement which has the force of res judicata for illegal activities detrimental to the financial interests of the Union as defined in the Financial Regulation or in case of exclusion from 33 funding because of grave professional misconduct .

text: 43. In addition, published lists of party and foundation members can also be linked to the party's or foundation's offences. Although the influence of the latter is probably limited in case of large political parties and foundations, it may have an impact for smaller parties and foundations. In the latter case, the small number of members would facilitate linking persons, based on their role and tasks in the party, to the offences, even when no specific names are mentioned in the details and reasons for the final decision. This may have a negative impact on the persons concerned, who might feel named and shamed.

text: 44. The EDPS welcomes the requirement in

text: Article 24(1)

text: (g) for any such publication to have due regard to the provisions of

text: Regulation (EC) No 45/2001

text: . Nevertheless, the EDPS recommends clarifying in the provision the details and the form of publishing the penalties and whether it, directly or indirectly, also foresees publishing personal data of natural persons. The EDPS also recommends clarifying in a recital which provisions of

text: Regulation (EC) 45/2001

text: are particularly relevant in this respect.

text: 45. However, the EDPS is not convinced that the publication of information relating to identified or identifiable natural persons in final decisions taken by the European Parliament pursuant to Article 22 of the Proposal, is actually necessary to achieve the purposes of the Proposal. Therefore, the EDPS would recommend stating explicitly in

text: Article 24(1)

text: (g) that personal data shall be excluded from publication on the website.

text: 46. As regards smaller parties, for the reasons mentioned in paragraph 39 above, the EDPS would recommend to explicitly state in

text: Article 24(1)

text: (g) that before deciding to disclose the final decisions taken by the European Parliament pursuant to

text: Article 22

text: , due account should be taken of the effect such publication may have on the members of the party or foundation concerned.

text: 47. The EDPS wishes to note that processing of personal data relating to offences is considered to present specific risks to the rights and freedoms of data subjects and will, therefore, be subject to prior checking by the EDPS under

text: Article 27 (1)

text: and (2)(a) of

text: Regulation (EC) No 45/2001

text: . II.2.2. Further safeguards Information to the data subject

text: 48. The EDPS welcomes the obligation on the European political parties and foundations in Article 24(3) of the Proposal to provide potential members and donors with the information required by

text: Article 10 of Directive 95/46/EC

text: and inform them that their personal data may be made public and may be processed for auditing and control purposes by the European Parliament, OLAF, the Court of Auditors, competent national authorities and external bodies or experts authorised by these in a publicly available privacy statement; and the obligation of the European Parliament to include the same information in the calls for contributions or proposals referred to in

text: Article 34

text: 13(1) in the application of

text: Article 11 of Regulation (EC) 45/2001

text: 49. That obligation is in line with the proactive approach, encouraged by the EDPS, to inform the data subjects beforehand, at the time the personal data are collected, that these data might be made public .

text: 50. The EDPS would like to note that informing the data subjects about the possibility to access, rectify and delete their data is especially important because of the consequences that not keeping the sensitive data up to date and accurate might bring about, especially when it comes to the membership of political parties.

text: 51. The EDPS also notes that, considering that the Proposal grants European political parties and foundations a European legal statute, a reference to Article 11 of Duration of the publication

text: 52. The EDPS welcomes the fact that

text: Article 25(3)

text: and (5) of the Proposal set a maximum time limit for storing the personal data collected (24 months after publication of the relevant parts in accordance with Article 24 of the Proposal, unless necessary for the purposes of legal or administrative proceedings).

text: 53. However, the EDPS recommends justifying in a recital the reason why this specific period has been chosen in the light of striking a balance between the principle of transparency, and the right to protection of privacy and personal data. Access to the published information

text: 54. The EDPS recommends adding in Article 24 of the Proposal an obligation for the European Parliament to ensure that the information published on the Registry's website that includes personal data will only be accessible through Internet search engines if necessary for the purposes of the Proposal. Exclusion from such search engines will alleviate the impact of the publication on sensitive data by excluding, e.g. the possibility to do research on people's political opinions before hiring them or using it in another way against them while at the same time still ensuring transparency of political parties and foundation which is, in fact, the aim of the publication. Quality of the data

text: 55. The data quality principle requires data to be adequate, relevant and not excessive in relation to the purposes for which they are collected. As a consequence, the data processed should be properly and frequently checked. According to Article 6(7) of the Proposal, the updated lists of members of a European political party have to be sent to the European Parliament on an annual basis. It means that the Registry of the European Parliament, as well as the website created for the purpose, can be updated no more frequently than on an annual basis, too .

text: 56. If a person is no longer a member of a political party but is still in the list, it may have unwanted consequences to that person. Because of the sensitivity of the information and the need to have accurate data, the EDPS recommends assessing whether an annual update is sufficient to ensure the quality of the data. The EDPS recommends considering whether, at least in case of members leaving the party or foundation, an immediate notification to the Registry would not benefit the aim of data quality better. III. CONCLUSION

text: 57. The EDPS welcomes the approach taken by the Commission in the present Proposal, which clearly envisages to achieve transparency with due respect to the privacy and data requirements.

text: 58. However, he recommends the following improvements:  to clarify in recitals 22 and 23 of the Proposal in which case

text: Regulation (EC) 45/2001

text: and in which case Directive

text: is applicable, and to delete or specify subparagraphs (6) to (8) of Article 25 of the Proposal since the present text merely repeats obligations under Directive

text: and

text: Regulation (EC) No 45/2001

text: ;  to add the word "written" to the text of recital 19 to align it with

text: Article 24(2)

text: and ensure consistency in the text of the Proposal;  to clarify the publication of names of contributors of more than EUR 1000 per year under

text: Article 24(1)

text: (f) of the Proposal without their express written consent pursuant to Article 24(2) of the Proposal;  to explain in the recitals, in light of the Schecke ruling, whether other means to achieve transparency have been considered and to better justify the chosen threshold of EUR 1000 per year for publishing the names of donors and contributors;  to specify that the obligation to provide information about the publication and processing of personal data, as provided in Article 24(3) of the Proposal for potential members and donors, also applies to potential (legal) representatives of the parties and foundation;  to state explicitly in

text: Article 24(1)

text: (g) that personal data shall be excluded from publication on the website; or at least to clarify the details and the form of publishing the penalties and whether it, directly or indirectly, also foresees publishing personal data of natural persons;  to clarify in a recital which provisions of

text: Regulation (EC) 45/2001

text: are particularly relevant in the given context;  as regards smaller parties, to state explicitly in

text: Article 24(1)

text: (g) that due account should be taken on the effect such publication may have on the members of the party or foundation concerned;  to justify in a recital the reason why the respective maximum time limit for storing personal data collected in

text: Articles 25(3)

text: and (5) has been chosen;  to add in Article 24 of the Proposal an obligation for the European Parliament to ensure that the information published on the Registry's website that includes personal data will only be accessible through Internet search engines if necessary for the purposes of the Proposal;  to assess whether an annual update of the party's and foundation's members list, as foreseen in Article 6(7) of the Proposal is sufficient to ensure the quality of the personal data;  to consider whether, at least in the case of members leaving the party or foundation, an immediate notification to the Registry would not benefit the aim of data quality better.

text: 59. The EDPS notes that processing of personal data relating to offences will be subject to prior checking by the EDPS under

text: Article 27(1)

text: and (2)(a) of

text: Regulation (EC) No 45/2001

text: . Done in Brussels, 13 December 2012 (signed) Giovanni Buttarelli Assistant European Data Protection Supervisor