text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3 OJ L 350, 30.12.2008, p. 60. 4 COM (2013) 716 final.

text: See Court of Justice cases

text: of 8 April 1992, Commission/Allemagne, para. 23, and

text: of 5 October 1994, X/ Commission, para 17; ECHR 17 July 2008, I v Finland (appl. No 20511/03), paragraph 38 and ECHR 25 November 2008, Armonas v Lithuania (appl. No 36919/02), paragraph 40.

text: Council of Europe, ETS No 5, 4.11.1950.

text: Council of Europe, ETS No 108/1981, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, 28.01.1981.

text: See Communication page 17, priority 4, task 1.

text: International instrument to Enable States to Identify and Trace, in a Timely and Reliable Manner, Illicit Small Arms and Light Weapons, adopted by the United Nations General Assembly on 8 December 2005. 10 See page 12, task 3, second paragraph of the Communication.

text: See Priority 1, task 3, page 12. 12 See Priority 2, task 2, page 14.

text: Opinion 3/2012 on developments in biometric technologies, 00720/12/EN

text: adopted on 27th April 2012. 14 See opinion 3/2012, page 13. 15 See priority 3, task 1. 16 See footnote 53, page 14.

text: See page 13 of the Council recommendation on a standard procedure in Member States for cross-border enquiries by police authorities in investigating supply channels for seized or recovered crime-related firearms. http://register.consilium.europa.eu/doc/srv?l=EN&t=PDF&gc=true&sc=false&f=ST%2010000%202007%20IN IT&r=http%3A%2F%2Fregister.consilium.europa.eu%2Fpd%2Fen%2F07%2Fst10%2Fst10000.en07.pdf. 18 See priority 3, task 2. 19 See in particular EDPS Opinion of 18 July 2013 on the proposals for a Regulation establishing an Entry/Exit System (EES) and a Regulation establishing a Registered Traveller Programme (RTP), available in the Consultation section of EDPS website at www.edps.europa.eu

text: See priority 4: Building a better intelligence picture. 21 INTERPOL Illicit Arms Records and tracing Management System.

text: Regulation (EC) No 1987/2006

text: of the European parliament and of the Council of 20 December 2006 on the establishment, operation and use of the second generation Schengen Information System. 23 Council decision 2007/533/JHA of 12 June 2007 on the establishment, operation and use of the second generation Schengen Information System (SIS II),

text: Articles 10

text: (b) and (f). 24 See priority 4, task 1, page 18. 25 See priority 4, task 1, page 18.

identifier: EDPS yttrande (2014)

amnesord:
Large-Scale IT Systems
SIS
Security

title: Firearms and the internal security of the EU: protecting citizens and disrupting illegal trafficking

text: Opinion of the European Data Protection Supervisor

text: on the Communication from the Commission to the Council and the European Parliament on "Firearms and the internal security of the EU: protecting citizens and disrupting illegal trafficking"

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 28(2)

text: thereof,

text: Having regard to Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 21 October 2013, the Commission adopted the Communication to the Council and the European Parliament on "Firearms and the internal security of the EU: protecting citizens and disrupting illegal trafficking" (hereafter 'the Communication') . The EDPS welcomes the fact that he was consulted on this Communication prior to its adoption and that he was given the possibility to provide informal comments to the Commission. 1.2. Objective and scope of the Communication

text: 2. The Communication establishes the strategy of the EU to tackle illegal firearms trafficking. To that extent, it proposes an integrated policy focusing on four priorities: - safeguarding the licit market for civilian firearms; - reducing diversion of firearms into criminal hands; - increasing pressure on the criminal markets; - building better intelligence.

text: 3. To achieve these priorities, different tasks are envisaged some of which may involve the processing of personal data and, therefore, impact the right of individuals to data protection: - the establishment of an EU standard on marking: personal data could be part of the data marked on the firearm; - a simplification of the rules for firearms licensing and the eventuality to require medical and criminal checks as a condition for the lawful purchase and ownership of any firearm. Medical checks imply processing of health data on individuals. Health data is sensitive data in the meaning of

text: Article 8 of Directive 95/46/EC

text: , which requires specific protection , and is therefore subject to even stricter data protection requirements. Criminal checks imply the processing of data relating to offences, criminal convictions or security measures and access to criminal records, which may be carried out only under the control of an official authority (as set forth in

text: Article 8(5) of Directive 95/46/EC

text: ). the compulsory registration and screening of brokers: the creation of a new database including the processing of brokers' personal data shall respect data protection key principles including justification of the necessity of its creation and the proportionality of the processing as well as its intrusion into privacy; - the exploration of technological solutions, such as biometric sensors where personal data is stored in the firearm to prevent use by other people than the owner. The processing of biometric data is subject to strict data protection safeguards and security requirements that will be explained in this Opinion; - the promotion of cross-border cooperation to stop illegal possession and circulation of firearms through, amongst others, coordinated collection and sharing of information on firearms crime involving police, border guards and custom authorities. Access to police and customs databases is strictly regulated as will be recalled below; - the traceability of firearms used by criminals to identify them and those who acquired the firearm. This measure, if it involves the processing of personal data, will have to provide for specific data protection safeguards; - the gathering of more accurate and comprehensive data on firearms-related crime by using jointly existing IT tools such as the Schengen Information System II, the Customs Information System, Europol information sharing tools and iArms, Interpol's tool. As mentioned above, access to existing police and customs database is subject to strict data protection rules.

text: 4. Data protection therefore appears as one of the core issues deriving from this Communication. 1.3. Objective and scope of the Opinion

text: 5. In view of the Commission’s intention to present legislative proposals in 2015, the EDPS will, in this Opinion, highlight and explain the data protection implications of the measures envisaged in the Communication. In doing so, the EDPS wishes to ensure that data protection aspects are duly taken into account in future legislative proposals in this area. To this end, he will recall the applicable EU data protection legal framework, give indications on when its consideration is most relevant, and specify the consequences of the required compliance, measure by measure.

text: 2. GENERAL REMARKS 2.1. The applicable European data protection framework 2.1.1. The protections enshrined in Articles 7 and 8 of the Charter

text: 6. As explained above, some of the priorities and tasks set out in the Commission's Communication, will require new processing operations to be put in place and/or existing processing operations to be modified. The sharing of personal data, including sensitive data, will be encouraged.

text: 7. Such collection of personal data will therefore interfere with the right to respect for private life and to the protection of one's personal data as enshrined in Articles 7 and 8 of the EU Charter of Fundamental Rights (hereinafter: "the Charter"). Article 7 of the Charter, which is similar to Article 8 of the European Convention on Human Rights (ECHR) , provides for a general right to respect for private and family life, and protects the individual against interference by public authorities. Article 8 of the Charter gives the individual the right that his or her personal data may only be processed if certain essential requirements are fulfilled. These essential requirements are laid down in

text: Article 8 (2)

text: and (3) of the Charter: - personal data must be processed fairly and lawfully, for specified purposes, - transparency must be ensured, by giving the data subject rights to access and rectify data concerning him or her, - compliance with the rules must be subject to control by an independent authority.

text: 8. Whilst

text: Article 7

text: protects the individual against interference by the EU and by Member States where they are implementing Union law,

text: Article 8

text: entitles the individual to ex ante protection according to certain standards whenever and by whomever his or her data are processed. The two approaches are different and complementary.

text: 9. In this respect, the EDPS welcomes that it is mentioned, in conclusion of the Communication, that the tasks envisaged will be carried out in respect of the fundamental rights and freedoms enshrined in the Charter, including the rights to privacy and to the protection of personal data. 2.1.2. The data protection law applicable to the measures proposed by the Commission concerning firearms

text: 10. It is essential that an explicit reference is made to the applicable EU data protection law in all future EU legislations that will be put forward following the Communication, whenever they contain measures involving the processing of personal data. The EDPS advises that such reference is inserted in a substantive provision of these proposals.

text: 11. Most of the proposals to be put forward further to this Communication would involve the processing of personal data by police and customs authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences. Whenever such processing takes place in the context of the cooperation between authorities of several Member States, Council Framework Decision 2008/977 /JHA applies. When the processing is carried out at national level only, the national data protection rules apply. They may be derived from Directive No

text: if the Member State has applied data protection rules to criminal matters, or they would otherwise be derived from the principles set forth in the 7 Council of Europe Convention No 108/1981 .

text: 12. Furthermore, if European databases are created for which EU institutions and bodies will be carrying out part or whole of the processing (e.g. the brokers’ database), the rules set forth in

text: Regulation (EC) No 45/2001

text: will also apply. 2.2. The necessary timely consideration of data protection key principles

text: 13. Data protection requirements must be considered, where possible, at an early stage of the legislative process.

text: 14. The EDPS understands that the aim of this Communication is not to address in detail specific issues. However, as already mentioned, since this Communication proposes measures that will entail the creation of new personal data processing operations or the modification of existing ones, it would be helpful that it raises awareness to the data protection considerations at stake. This would help ensuring that these issues are discussed sufficiently in advance so that, in turn, the measures to be adopted following the communication comply with data protection law.

text: 15. The stakeholders’consultation, that the Commission intends to carry out before presenting its legislative proposals in 2015, is another good opportunity to put key data protection principles in practice. The EDPS recommends that for instance the following issues are discussed: the necessity of the processing, the categories of data necessary to achieve the purposes pursued, the determination of the relevant persons with "a need to know" who may access to data. Professionals involved in fighting firearms trafficking on a daily basis are, indeed, the best positioned to determine, with certainty, which data is considered necessary and which seems useless to the achievement of their aim. The EDPS also recommends consulting the European Firearms Expert group on such data protection issues.

text: 16. The EDPS is available to give advice, in particular during these stakeholder consultations. In this perspective, he welcomes that his consultation is foreseen on the gathering of more accurate and comprehensive data on firearms-related crime in the EU and globally .

text: 17. Besides, he recalls that he must be consulted on every legislative act that will be drafted pursuant to this Communication as soon as it involves the processing of personal data, pursuant to

text: Article 28(2) of Regulation (EC) No 45/2001

text: 18. Moreover, for each legislative proposal envisaged, the impact of the proposed measures on the right to the protection of personal data should be measured on the basis of a specific data protection impact assessment. The results of this data protection impact assessment will help defining the data protection requirements that must be specified in each proposal, where necessary. 2.3. The necessary specification of these data protection requirements in future legislations

text: 19. When, pursuant to this Communication, the Commission is to propose legislation involving the processing of personal data, it will have to respect data protection requirements and specify data protection safeguards, with due account of the applicable data protection law for that proposal. More precisely:  For any situation in which personal data processing is envisaged, the EDPS recommends assessing in the impact assessment the necessity and the proportionality of the processing taking into account the interference with the individual's right to respect for private life and the requirements for the protection of personal data. For instance, before the creation of a new database is considered, it must be assessed whether an existing tool or a less intrusive means would not fulfil the purpose pursued, whether personal data are necessary or anonymised data would be sufficient. If there are plans to have a database accessible to the public, it must be considered whether a less intrusive mean could achieve the same purpose.  Further to this assessment, pursuant to the purpose limitation principle, the purpose for which data is collected, must be specified in the legislation and if necessary further defined. Attention must be given to the fact that the data collected for one purpose should not be used for any incompatible purposes, without appropriate legal authority. For instance, in the context of fighting against firearms trafficking, if a database of brokers is set up to fight against illegal brokering, this concept should be clearly defined, and the database should not be used for other purposes. For instance, it would not be acceptable to use it to ensure fair competition between brokers.  Concrete safeguards should be inserted in the legislation to ensure the respect of data protection principles. For instance, the list of the data to be collected should be specified as much as possible, bearing in mind that only data strictly necessary to achieve the purpose pursued should be collected (data minimisation principle). In this perspective, if the creation of a database of firearms brokers is decided as the most relevant tool to achieve the purpose of fighting against illegal brokering of firearms, only the data necessary to identify those brokers should be stored in the database. Data relating to their health history or to the religion or even ethnic origin is not necessary to achieve such purpose. Consequently, this data must not be processed in the database.  As already mentioned, when sensitive data processing is envisaged, stricter safeguards apply. For instance, if the processing of health data is foreseen in the framework of firearms licensing, access to this data must be restricted to a health professional subject to professional secrecy.  Data should not be stored for longer than is necessary to achieve the purpose defined: therefore, retention periods should be set up and the choice for a given length of retention should be justified. To follow up on the example of a brokers' database, the future legislation will have to specify the retention period needed to achieve the purpose pursued. It could, for instance, state that data will be kept for the time the individual is working as a broker and up to X years after he does not work as a broker anymore.  The authority/body responsible for the data processing -the “controller”should be identified. This controller will, as a result, be in charge of updating the data and ensuring its security. In the brokers' database example, this would translate into the identification of the authority/body responsible for the management of the database and its security. This authority/body would also be the contact point for data subjects exercising their rights.  Substantive provisions should be inserted to define the modalities according to which the rights of the data subject (in particular, access, modification, and deletion) will be exercised. In our example, this would mean inserting a specific provision stating that the broker whose data is processed has a right to access, modify and delete -under specific circumstances- the data that is processed about him. The provision should specify the contact point and give its contact details or ensure that those are accessible easily to the broker.  Access to data processed should be limited to those persons of the authority/body having a "need to know". As regards the brokers' database, the future legislation should specify that only authorised officers have access to the data.  Physical and logical security of the data processed should be ensured. 2.4. The implementation of international instruments at EU level

text: 20. The EDPS notes that the implementation of the Arms Trade Treaty (hereinafter "ATT") and of the United Nation's International Small Arms Control Standards (hereinafter "the ISACS") and the building on the International Tracing Instrument are foreseen in the Communication.

text: 21. These instruments encourage the processing of personal data such as, for example, registers of firearms brokers and national records of export authorizations for the ATT and centralized collection and analysis of data on recovered illicit small arms and light weapons useful to trace those for the ISACS.

text: 22. The EDPS insists that the implementation of these international instruments at EU level should comply with EU data protection legislation, where relevant.

text: 3. SPECIFIC COMMENTS 3.1. The future establishment of an EU standard on marking

text: 23. The Commission intends to investigate the feasibility of an EU marking standard for all weapons (Priority 1, task 2). The EDPS notes that the common marking standard will consist in impressing or engraving a common marking on firearms, which will enable recognition and traceability. He notes that footnote 40, which specifies which elements are included in markings, depending on the manufacturer's choice and national legal requirements, does not refer to personal details of the owner but mentions the manufacturer.

text: 24. The EDPS advises the Commission to specify in the relevant legislative proposal if any personal details, and if so, whose personal details will be processed under this marking. This is of particular importance since no further specification is given regarding personal data to be collected and stored following this marking procedure and since the International Tracing Instrument to which this initiative refers does not list any. 3.2. Firearms licensing and the processing of health and criminal data

text: 25. As mentioned above, the timely consideration of data protection requirements and their specification in the future legislation is of particular importance with regard to some of the processing envisaged in the Communication, which involve the collection of sensitive data.

text: 26. The Commission intends to evaluate the benefits of requiring medical checks as well as criminal records checks as a condition for the lawful purchase and ownership of any firearm .

text: 27. The EDPS wishes to draw the Commission's attention to the fact that health data and data on ethnic origin (as mentioned in Priority 3) are considered sensitive data (Article 6 of the Council Framework Decision 2008/977/JHA and Article 8 of Directive No

text: ) and are, as such, subject to strict processing conditions. Furthermore, the processing of criminal data is restricted to competent official authorities, and may in exceptional cases be carried out by a third party only if it is acting under their control (as set forth in Article 8(5) of Directive No

text: ). The EDPS recommends taking these specific conditions into account when drafting legislation on firearms licensing. In any case, the processing of health, ethnic and criminal data should be foreseen by law and meet the requirements of Article 6 of Council Framework Decision 2008/977/JHA and Article 8 of Directive No

text: 28. The EDPS therefore insists on the necessity to ensure that data protection safeguards are concretely applied to this specific area and that such safeguards are clearly laid down in the future legislation. In particular, if the project is confirmed, the proposed legislation should specify strictly the purpose of the processing and the restriction of access to data only to the relevant persons who need to know and who are subject to professional secrecy obligations.

text: 29. In addition, the EDPS suggests that the legislative proposal should contain the following elements: - A definition should be given of "medical checks" and "criminal records checks". The data that can be processed for these purposes should be strictly listed and procedures to carry out checks should be clearly specified. - The medical/criminal grounds for refusing a license should be clearly stated. - It should be ensured that no decisions are taken without human intervention and that data subjects' rights (as developed above) are respected. - Medical checks and resulting certification should be only carried out and issued by a health professional. Only authorised official authorities should carry out criminal record checks. 3.3. The compulsory registration and screening of firearms brokers

text: 30. The EDPS recommends that the necessity and proportionality of this measure be sufficiently established before putting it into place. He also advises that a data protection impact assessment be carried out, on the basis of which adequate safeguards should be inserted in the future legislation. 3.4. "Smart guns": the possible use of biometric sensors

text: 31. The EDPS notes that the Commission will "explore technological solutions, such as biometric sensors, where personal data is stored in the firearm, for ensuring that purchased firearms may only be used by their legal owner." Such a technology could be obligatory for firearms lawfully sold in the EU to prevent unlawful use due to theft and loss.

text: 32. Biometric data, by their very nature, relate directly to an individual and therefore constitute personal data. A prerequisite to using biometrics is a clear definition of the purpose for which the biometric data are collected and processed, taking into account the risks for the protection of fundamental rights and freedoms of individuals. In its opinion on developments in biometric technologies , the

text: Article 29

text: Working Party insisted that "the use of biometrics for general security requirements of property or individuals cannot be regarded as legitimate interest overriding the interests or fundamental rights and freedoms of the data subject. On the other hand, biometric data such as fingerprint and/or iris scan could be used for the security of a high-risk area such as a laboratory doing research on dangerous viruses, provided that the controller has demonstrated concrete evidence of a considerable risk. To that end the controller needs to prove that specific circumstances pose a concrete, considerable risk, which the controller is required to assess with special care. In order to comply with the proportionality principle, the controller, in presence of these high risk situations, is obliged to verify if possible alternative measures could be equally effective but less intrusive in relation to the aims pursued and choose such alternatives. The existence of the circumstances in question should also be reviewed on a regular basis. Based on the outcome of this review, any data processing operation that is found not to be justified any longer must be terminated or suspended" .

text: 33. The EDPS notes that the Commission evokes the considerable risk linked to firearms diversion as a justification for the processing of biometric data. Such a justification may allow for the processing of fingerprints, provided however that the Commission demonstrates concrete evidence of this risk in the relevant proposal. Similarly, the EDPS welcomes the intention that the modalities of storage of the biometric data, i.e. in the firearm, will be specified. This solution, which does not imply the creation of a central database of firearms owners' digital prints, seems legitimate and acceptable whereas storage in a central database would have required a stronger justification.

text: 34. The EDPS still recommends a careful assessment of data protection consequences of this proposed processing. Amongst others, he insists on the necessity to identify the type of biometric data designed to identify the owner. He also recommends specifying in the proposal the security measures that should be set up to secure access to the data stored and to prevent manipulation, as well as defining the way the stored fingerprint will be changed in case of a change of owner of the firearm. 3.5. Guidance to law enforcement officers and the processing of data relating to the ethnic origin of the possessor of the firearm

text: 35. The EDPS recommends that the application and, if necessary, the update of the guidelines issued by the Council to standardise procedures concerning crossborder investigations into seized or recovered crime-related firearms , complies with data protection requirements for any situation where personal data processing is envisaged. In particular, he notes that the procedures presented by the Council, and the templates suggested, involve the collection of personal data relating to the possessor of the firearm and, more precisely, the collection of his or her "ethnic 17 origin" and references to his or her criminal background (which are special categories of data, as explained in section 3.2 above). Yet, there is no reference to data protection in these guidelines, although Council Framework Decision 2008/977/JHA applies.

text: 36. In particular, due account should be taken of Article 6 of the Council Framework Decision which relates to the processing of special categories of data, which states that "processing of personal data revealing racial or ethnic origin […] shall be permitted only when this is strictly necessary and when the national law provides adequate safeguards". In this regard, the EDPS recommends assessing the necessity of the processing of data relating to the ethnic origin of the possessor of the firearm to achieve the purpose pursued. He also advises that references to the rules set forth in the Council Framework Decision are inserted in those guidelines when they are updated. 3.6. Cross border cooperation to stop illegal possession and circulation of firearms

text: 37. The EDPS notes that the plan for cross border cooperation to stop illegal possession and circulation of firearms will include coordinated collection and sharing of information on firearms crime involving police, border guards and custom authorities, both within Member States and across borders . He understands that it will most probably involve the collection and sharing of personal data relating to suspects, victims and possibly brokers within crossborder national and EU level databases.

text: 38. As a consequence, the EDPS wishes to emphasize that Council Framework Decision 2008/977/JHA will apply to these operations and specific safeguards must be developed when transfers of data to third States are foreseen. Personal data processing set up at EU level will, on the other hand, have to comply with data protection guarantees set up by

text: Regulation (EC) No 45/2001

text: 39. Similarly, the Commission encourages concerted follow-up to firearms-related alerts in the Schengen Information System.

text: 40. The EDPS welcomes the aim thus pursued by the Commission to encourage and improve the use of existing databases rather than suggest the creation of others, in line with the underlying consideration that new databases should be created only when found necessary for the purpose pursued .

text: 41. In this regard, he stresses that the cross-border exchange of information between official authorities within the EU should involve, as much as possible, the use of existing secured channels. 3.7. A central online repository of factual data on ballistics and weapons types

text: 42. The EDPS notes the possibility to establish a central online repository of factual data on ballistics and weapons types to be maintained by Europol. He understands that this repository will not involve the processing of personal data, and therefore recommends that this is specified where relevant, if this is translated into concrete legislative action. 3.8. Firearms data collection plan

text: 43. The Communication notes that information on seized firearms can be logged by the police in police databases, and by customs in customs databases. Furthermore, Customs Risk Management System, the Customs Information System and the Europol Information System are not interoperable. The tasks proposed by the Commission to tackle the resulting firearms' tracing failure include the development of a firearms data collection plan and a practical solution allowing firearms experts to check against all databases of lost or stolen firearms in a single transaction.

text: 44. Regarding the first task of developing a firearms data collection plan, the EDPS considers that this will necessarily involve the collection of personal data and therefore welcomes that his consultation is foreseen, amongst other stakeholders. This will ensure that data protection requirements, including the data minimisation principle (only data strictly necessary to the purpose pursued shall be collected) and the need to define a common and justified data retention period, are taken into account upstream and when establishing the data collection plan.

text: 45. Regarding the second task of checking databases of lost or stolen firearms including Europol, CIS, SIS II and iARMS , the EDPS recognizes the legitimacy of the need to exchange information between firearms experts, whether they are police, border guards or customs agents.

text: 46. The Commission suggests that national law enforcement applications should be updated to allow the case officer to create, update or delete records in a single transaction, which ensures that records are correct in national registers, SIS II and iArms. The EDPS understands the aim pursued which would most probably improve data accuracy, but wishes to emphasize that these developments must be made in compliance with existing rules on access to the aforementioned databases.

text: 47. The EDPS insists on limiting access to those databases to the competent authorities and within those, to the only agents who have a "need to know". He also recommends that traceability of these designated agents' access to databases is ensured through the attribution of individual logging and passwords. In this regard, he welcomes that

text: Regulation (EC) No 1987/2006

text: and Council Decision 23 2007/533/JHA already limit this access and provide for traceability. He also welcomes that access to iARMS and traceability are covered by Section 3 of Interpol's rules on the processing of data.

text: 48. In addition, if access of new entities to the aforementioned databases were to be considered, this extension of access rights should take place under a specific legal basis, by way of an amendment of the current legal basis.

text: 49. Finally, the EDPS recommends clarifying the modalities of the single transaction on the basis of which the creation, update and deletion of records will be made simultaneously in national registers, SIS II and iARMS.

text: 50. According to the Communication, "any report of lost or stolen firearms should result in an alert on SIS II and iArms" . In this regard, the EDPS welcomes that those two databases involve a complete traceability of the actions taken in the register by the officer, who will react to the alert or use the search tool. This will ensure that the principle of purpose limitation is respected and that strict security measures are complied with.

text: 51. The Communication also states that "Member States should ensure that all endusers have access to search tools currently available which enable them to make one single search to query national registers, SIS II and iARMS, with all results returned to the user's screen” . The EDPS recalls that only end-users originally authorised to access the national registers, SIS II and iArms should use these search tools and that the results returned to the user's screen shall be a 'hit' or 'no hit' reply only.

text: 52. The EDPS welcomes that the Communication mentions that the measures planned will be implemented in full compliance with the rights to privacy and to the protection of personal data. He emphasises, however, that the processing of personal data should be reflected upon at an early stage of the legislative process and, preferably, also at the stage when the Commission adopts communications. This would help ensuring that data protection issues are identified sufficiently in advance so that, in turn, the measures to be adopted comply with data protection requirements.

text: 53. The EDPS recommends that the data protection aspects that are relevant for the proposed measures relating to firearms are discussed during the stakeholder consultation to be carried out by the Commission. He also advises consulting the European Firearms Expert Group on data protection issues.

text: 54. As regards future legislative proposals to be put forward by the Commission further to this Communication, the EDPS recommends that an explicit reference to the applicable EU data protection law should be inserted whenever they involve the processing of personal data. This should be done in a substantive and dedicated provision of these proposals. Pursuant to

text: , the EDPS must be consulted on those proposals that involve the processing of personal data.

text: 55. In this Opinion, the EDPS has highlighted the data protection requirements that apply to the fight against illicit firearms trafficking. He recommends that any future legislation in that area take account of data protection requirements such as necessity, proportionality, purpose limitation, data minimisation principle, special categories of data, data retention period, data subjects' rights and security of the processing. He also advises carrying out a data protection impact assessment, which will help specify the data protection safeguards to be inserted in each proposal, where necessary.

text: 56. More specifically, the EDPS recommends that:  any future legislative proposal concerning the establishment of an EU standard on marking should specify if any personal data will be processed, and if so, which ones and in relation to whom;  as concerns firearms licensing the necessity of processing medical and ethnic data as well as criminal checks is assessed, and the conditions under which those special categories of data may be processed are respected, as set forth in Article 6 of the Council Framework Decision 2008/977/JHA and Article 8 of Directive No

text: . The future legislation should contain specific safeguards, such as: indicating the purpose of the processing, listing the exact types of data that can be processed, restricting access to the sensitive data only to relevant persons with a need to know and subject to professional secrecy obligations (e.g. a health professional, authorised official authorities), ensuring that the medical/ethnic/criminal grounds for refusing a license are clearly stated, and specifying the modalities for the exercise of data subjects’ rights;  the necessity and proportionality of the compulsory registration and screening of firearms brokers is sufficiently established before this measure is put in place;  as to the possible use of biometric sensors in smart guns, evidence of the risks to security justifying the use of biometric data is provided in the relevant proposal. The proposal should indicate the types of biometric data to be processed and the security measures governing access to the data, the prevention of data manipulation and the conditions for updating the biometric data in the case of a change of owner;  the update of the guidance to law enforcement officers should include references to the rules set forth in the Council Framework Decision 2008/977/JHA, in particular as regards the processing of special categories of data. He also advises assessing the necessity of processing data relating to the ethnic origin of the possessor of the firearm;  as regards cross-border cooperation, the cross-border exchange of information between official authorities in the EU should involve, as much as possible, the use of existing secure channels;  if a central online repository of factual information on ballistics and weapons types is created, it is specified in the relevant legislation that no personal data will be processed;  as concerns firearms data collection plan, it should be ensured that new functionalities to be introduced in national registers, SIS II and iArms are in compliance with existing rules on access to these databases. Any plan for extending the access to those databases to other entities/users should require amending the current legal base. Access to the search tool in those databases should be restricted to authorised users only and the results of these searches should be in the form of a ‘hit’ or ‘no hit’ reply. Done in Brussels, 17 February 2014 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor


text: OJ L 281, 23.11.1995, p. 31 (hereinafter: "Directive

text: "). 2 OJ L 8, 12.1.2001, p. 1 (hereinafter: "Regulation 45/2001). 3 COM(2013) 846 final. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: COM(2013) 847 final. 5 In particular the Constitution, as interpreted by the Supreme Court; Section 702 of the Foreign Intelligence Surveillance Act of 1978 (FISA) (as amended by the 2008 FISA Amendments Act, 50 U.S.C. § 1881a); and Section 215 of the USA PATRIOT Act 2001 (which also amended FISA, 50 U.S.C. 1861) and Executive Order 12333. 6 On the basis of the information provided by the US in the Working Group and declassified documents, including opinions of the Foreign Intelligence Surveillance Court (hereinafter: “FISC”) and publicly available documents such as the Attorney General's Guidelines for Domestic FBI Operations.

text: The

text: Article 29

text: Data Protection Working Party, set up under Directive

text: , has an advisory status and acts independently. It is composed of representatives of EU national Data Protection Authorities, the EDPS and the Commission.

text: See p. 5, 10 and 26 of the Report, which, on the basis of declassified opinions of the Foreign Intelligence Surveillance Court, confirms that "US intelligence agencies have recourse to methods of collection under Section 702 that have a wide reach, such as the PRISM collection of data from internet service providers or through the "upstream collection" of data that transits through the US". 9 The US confirmed that there are other legal bases for intelligence collection where the data of non-US persons may be acquired, but did not provide details on the legal authorities and procedures applicable. Not all the relevant legal bases were disclosed to the WG (see p.13 of the Report). 10 See p.4-12 of the Report . 11 See p.26-27 of the Report. 12 "Liberty and Security in a Changing World", Report and Recommendations of The President’s Review Group on Intelligence and Communications Technologies, in particular recommendations 25, 29 and 30. http://www.whitehouse.gov/sites/default/files/docs/2013-12-12_rg_final_report.pdf 13 B Schneier, C Soghoian in report of 6 September 2013, http://www.theguardian.com/world/2013/sep/05/nsagchq-encryption-codes-security; B. Preneel: ISSE 2013 closing keynote: "The Cryptographic Year in Review" http://homes.esat.kuleuven.be/~preneel/preneel_isse13.pdf

text: Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters. OJ L 350, 30.12.2008, p.6. 15 Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications). OJ L 201, 31.07.2002, p.37. 16 See p.4 of the Communication. 17 Only a minority of the parties to Convention 108 have deposited declarations in accordance with

text: Article 3(2)

text: (a) stating that Convention 108 will not apply to "automated personal data files" relating to "State Security" or "State Secrets". 18 See e.g., the decision of the Bundesverfassungsgericht decision in the Rasterfahndung case (BVerfG 1 BvR 518/02 of 4.4.2006). 19 See footnote 17.

text: As in EU instruments, where Council of Europe instruments are applicable they provide for restrictions to certain rights, e.g., for national security purposes. However, such limitations must be interpreted in a restrictive way (see e.g., ECtHR, Klass and others v. Germany, judgment of 6 September 1978, Series A no.28). 21 See Articles 1 and 8 of the ECHR. 22 See Article 4(1) of Convention 108. 23 See e.g., Article 8(2) of the ECHR,

text: Article 9(2)

text: (a) and

text: Article 13(1)

text: (a) of Directive

text: . 24 ECtHR, Klass and others, above cited, at paragraph 42. 25 ECtHR, Rotaru v. Romania, judgment of 4 May 2000, application no. 28341/95, paragraph 48. 26 See Article 52(1) of the Charter. 27 Idem. 28 According to FISA, "foreign intelligence" as defined by FISA could include information concerning political activities of individuals or groups and activities of government agencies, provided that they could be of interest to the US for its foreign policy. The EU side of the WG asked for further specification of the scope of "foreign intelligence" but the US declined explaining that such clarifications would reveal specific operational aspects of the programmes. See p.5-7 of the Report. 29 Under Section 702 FISA, data of non US persons is considered "foreign intelligence" as soon as they relate to the purposes pursued. Data of US persons, on the contrary, have to be necessary for the specified purposes in order to be considered "foreign intelligence". See p.26 of the Report. 30 See

text: Article 4(1)

text: (a) of Directive

text: . 31 See

text: Article 4(1)

text: (b-c) of Directive

text: and its interpretation by the

text: Article 29

text: Working Party in the Opinion 8/2010 on applicable law (

text: WP 179

text: ), available on http://ec.europa.eu/justice/data-protection/article- 29/documentation/opinion-recommendation/index_en.htm...

text: See Art.1 ECHR. 33 See Art.8 ECHR. 34 Big Brother Watch and Others v. the United Kingdom, application no. 58170/13, available on http://hudoc.echr.coe.int/sites/eng/pages/search.aspx?i=001-140713, last accessed on 17.02.2014. 35 See footnote 29.

text: See p.17, first para. of the Communication on Safe Harbour. 37 See annex I, Safe Harbor Privacy Principles, paragraph 4. 38 See footnote 29. 39 See also the decision of the EU Court of Justice in the Huber case,

text: Council Decision 2009/820/CFSP of 23 October 2009 on the conclusion on behalf of the European Union of the Agreement on extradition between the European Union and the United States of America and the Agreement on mutual legal assistance between the European Union and the United States of America, OJ L 291, 7.11.2009, p. 40. Agreement between the European Union and the United States of America on the processing and transfer of passenger name records to the United States Department of Homeland Security (Council Decision

text: Council Decision 2012/472/EU of 26 April 2012

text: , OJ L 215, 11.8.2012, p. 4). Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program (Council Decision of 13 July 2010, OJ L 195, 27.7.2010, p. 3). Agreement Between the United States of America and the European Police Office of 6 December 2001 and Supplemental Agreement between the Europol Police Office and the United States of America on the exchange of personal data and related information of 20 December 2002.. The Communication states that neither the joint review of the implementation of the PNR Agreement nor the formal consultations opened by the Commission on the TFTP Agreement "revealed any elements proving a breach of these agreements", and that the US have provided written assurance that no direct data collection has taken place contrary to the provisions of the TFTP Agreement. Report of the JSB of 18 March 2013 on the implementation of the TFTP agreement. Joint press release of Belgian and Dutch Data Protection Authorities of 14 November 2013. See the EDPS Opinion of 30 September 2013 on the Proposals for Council Decisions on the conclusion and the signature of the Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data; Opinion of 9 December 2011 on the Proposal for a Council Decision on the conclusion of the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security; Opinion of 15 July 2011 on the Proposal for a Council Decision on the conclusion of an Agreement between the European Union and Australia on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the Australian Customs and Border Protection Service; Opinion of 19 October 2010 on the global approach to transfers of Passenger Name Record (PNR) data to third countries; Opinion of 15 June 2005 on the Proposal for a Council Decision on the conclusion of an agreement between the European Community and the Government of Canada on the processing of Advance Passenger Information (API) / Passenger Name Record (PNR) data; all available on www.edps.europa.eu.

text: See also

text: Article 29

text: Working Party Opinions on PNR agreements between the EU and third countries, available on http://ec.europa.eu/justice/data-protection/article-29/documentation/opinionrecommendation/index_en.htm. 49 Proposal for a Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data (COM(2012)11) final and Proposal for a Directive on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data (COM(2012)10 final). 50 See p.5-6 of the Communication on rebuilding trust. 51 See Annex III, p. 4 of the Impact Assessment accompanying the proposals (SEC(2012) 72 final).

text: See p.7.

text: See p.8. 54 See the EDPS Opinion of 11 November 2008 on the Final Report by the EU-US High Level Contact Group on information sharing and privacy and personal data protection, available on www.edps.europa.eu. 55 See, e.g., the EDPS Opinion on the Communication from the Commission on the global approach for transfers of Passenger Name Record (PNR) data to third countries, cited above.

text: See the EDPS Opinion of 7 March 2012 on the data protection reform package, available on www.edps.europa.eu. 57 See p.9.

text: See "Consumer Data Privacy in a Networked World: a Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy", White House, February 2012, available at: http://www.whitehouse.gov/sites/default/files/privacy-final.pdf 59 See the comments of the Commission in p.4 of the report on the Civil Society Dialogue - Update on the TTIP of 16.07.2013, available on http://trade.ec.europa.eu/doclib/docs/2013/july/tradoc_151656.pdf, last accessed on 31.03.2014.

text: See the comments of the Commission in p.2 of the report on the TTIP Stakeholders Event of 12.06.2013, http://ec.europa.eu/digital-agenda/en/news/ttip-ict-stakeholders-event-report last accessed on 31.03.2014. 61 See the Commission press release of 20.12.2013 on the third round of negotiations, available on http://trade.ec.europa.eu/doclib/press/index.cfm?id=1007, last accessed on 31.03.2014. 62 See p.9 of the Communication on rebuilding trust. 63 See the Resolution on Anchoring Data Protection and the Protection of Privacy in International Law, adopted by the International Conference of Data Protection and Privacy Commissioners (Warsow, 23-26 September 2013). 64 See letter of the WP29 to the Cybercrime Committee of the Council of Europe of 5 December 2013, available on http://ec.europa.eu/justice/data-protection/article-29/documentation/otherdocument/files/2013/20131205_wp29_letter_to_cybercrime_committee.pdf. 65 See the Resolution on International Enforcement Coordination, adopted by the International Conference of Data Protection and Privacy Commissioners (Warsow, 23-26 September 2013).

text: Vancouver IETF, https://www.ietf.org/media/2013-11-07-internet-privacy-and-security.html; 67 https://www.w3.org/2014/strint/papers/64.pdf

amnesord: Electronic Communications, Information Society

publisher: Europeiska datatillsynsmannen

sprak: en

title: Rebuilding Trust in EU-US Data Flows

serie: yttranden

text: Opinion of the European Data Protection Supervisor

type: stycke

text: on the Communication from the Commission to the European Parliament and the Council on "Rebuilding Trust in EU-US Data Flows" and on the Communication from the Commission to the European Parliament and the Council on "the Functioning of the Safe Harbour from the Perspective of EU Citizens and Companies Established in the EU"

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 41

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: I. INTRODUCTION

text: I.1. Consultation of the EDPS

text: 1. On 27 November 2013, the Commission adopted the Communication from the Commission to the European Parliament and the Council on "Rebuilding Trust in EU-US Data Flows" (hereinafter: "the Communication on rebuilding trust"). This Communication is accompanied by a Report on the Findings by the EU Co-chairs of the ad hoc EU-US Working Group on Data Protection (hereinafter: “the Report" and "the Working Group”).

text: 2. On the same date, the Commission adopted a Communication from the Commission to the European Parliament and the Council on "the Functioning of the Safe Harbour from the Perspective of EU Citizens and Companies Established in the EU" (hereinafter: "the Communication on Safe Harbour").

text: 3. The EDPS welcomes that he was given the possibility to provide informal comments to the Commission before the adoption of the above-mentioned documents. These documents were adopted by the Commission in the aftermath of the revelations about the surveillance programmes carried out by US intelligence services. Considering the impact of these surveillance programmes on individuals’ rights to privacy and to the protection of their personal data in the EU, he has decided to adopt this Opinion on his own initiative. I.2. Objective and scope of the Commission documents a) The Communication on rebuilding trust and the Report

text: 4. The Communication proposes a way forward following the revelations on large-scale US intelligence collection programmes (hereinafter: "the programmes" or "the revealed programmes") and their impact on trust between the EU and the US. It does not refer to revelations on the conduct of similar activities and/or collaboration with the US by EU Member States or by other third countries.

text: 5. The Report collates the findings of the EU Co-chairs of the ad-hoc EU-US Working Group on Data Protection that was created further to the COREPER meeting of 18 July 2013 to establish the facts about the programmes and their impact on fundamental rights in the EU and personal data of EU citizens. It analyses the US 5 6 legal framework , how the collection and further processing of data takes place and the existing oversight and redress mechanisms.

text: 6. The Report mentions a “second track” that was also established during the COREPER meeting of 18 July 2013. It states that, under that “second track” EU institutions may raise with the US authorities questions relating to the alleged surveillance of EU institutions and diplomatic missions, whilst Member States may discuss with the US authorities, in a bilateral format, matters relating to their national security.

text: 7. The Report also states that this division set some limitations to the discussion in the Working Group and the information provided therein. The EDPS has not been provided with any information on the “second track” or on the creation of a parallel working group in this regard. The Commission is therefore requested to inform the EDPS about the findings of the “second track”, in particular as regards the alleged surveillance of EU institutions and diplomatic missions. b) The Communication on Safe Harbour

text: 8. The Communication on Safe Harbour analyses the functioning of the Safe Harbour, identifies shortcomings and proposes possible improvements. It acknowledges the increasing amount of data transferred between the EU and the US and the growing number of companies adhering to the Safe Harbour principles. After recalling the structure and the functioning of the Safe Harbour, the Commission insists on the need to improve the enforcement of the principles on adhering companies and their subcontractors. According to the Communication, this would require that the Safe Harbour principles are incorporated in adhering companies' privacy policies more effectively and are made available to the public. The FTC should enforce their compliance more proactively. Besides, data protection authorities should participate in raising awareness of Safe Harbour in the EU and in particular on the existence of the EU data protection panel. The Commission also gives solutions to improve alternative dispute resolution mechanisms.

text: 9. Regarding access to data transferred in the framework of the Safe Harbour scheme and further processed by US authorities, the Commission insists that it should be limited to what is strictly necessary and proportionate. It also requires that the use of limitations to privacy policies to meet national security, public interest or law enforcement requirements be carefully monitored so that it does not undermine the protection afforded. It also encourages adhering companies to be transparent on these limitations and their effect on the confidentiality of communications to raise citizens' awareness. I.3. Scope and aim of the present Opinion

text: 10. The present Opinion focuses on the Communication on rebuilding trust, and within that context also on the Communication on Safe Harbour. In consequence, it does not comment directly on revelations regarding EU Member States, be it in collaboration with the US or on their own; or on surveillance activities by third countries other than the US.

text: 11. The Opinion starts by commenting on the general approach of the Communication on rebuilding trust. Part II briefly analyses the applicability of the relevant legal framework and its consequences, including comments on the Communication on 7 Safe Harbour. Since the

text: Article 29

text: Working Party is currently examining the applicable EU and international legal framework, the present Opinion does not go in detail in this part. Part III addresses the Commission's recommendations on the future steps to be taken. I.4. Comments on the approach of the Communication on rebuilding trust

text: 12. The Communication focuses on the fact that trust between the EU and the US as strategic partners has been negatively affected by the revelations on the programmes and needs to be restored. The EDPS welcomes this acknowledgement.

text: 13. However, the programmes, whose existence is in some cases clearly confirmed by 8 the Report affect not only trust, but also legal rights as laid down in EU and Council of Europe primary and secondary law, in particular the rights of privacy and data protection. They also show the large scale of foreign intelligence collection that is actually taking place under the US legal framework , as interpreted by the US Supreme Court . The report also confirms the lack of safeguards, protections, rights, oversight and redress possibilities available for EU citizens under the US framework .

text: 14. As repeatedly underlined by the Commission, citizens’ and businesses’ trust in Internet communications depends on the availability of effective technical protection tools for privacy, and more specifically the confidentiality of communications. This need has also been recognized in the US Review Group on Intelligence and Communications Technologies which made several recommendations to restore the trust in encryption tools and commercial software, as well as in the functioning of rapid mechanisms to fix software vulnerabilities. The weakening of trust in these systems has been considered one of the most damaging effects of the recent discussions about signal intelligence operations by some of the most recognized 13 security experts . In view of the importance of effective cybersecurity for Europe, a response to this technical and political challenge should be developed at EU level, based on an initiative by the Commission.

text: 15. In section 3 of the Communication, the Commission addresses the future steps that need to be taken to restore trust in data transfers between the EU and the US. The EDPS welcomes this section, which focuses on the improvement of the existing legal framework and proposes new instruments. However, the Commission does not address how applicable national, EU and Council of Europe instruments have been affected by the programmes. The EDPS considers that the impact on existing legal instruments should have received more attention in the Communication. II. COMMENTS ON THE APPLICABLE LEGAL FRAMEWORK II.1. EU and Council of Europe data protection legal frameworks

text: 16. The rights to privacy and data protection are enshrined in primary law in Article 8 of the Council of Europe Convention on Human Rights and Fundamental Freedoms (hereinafter: "the ECHR"), Articles 7 and 8 of the EU Charter of Human Rights (hereinafter: "the Charter") and Article 16 of the Treaty on the Functioning of the EU (hereinafter: "the TFEU"). Article 17 of the International Covenant on Civil and Political Rights (hereinafter: "the ICCPR"), which has been ratified by the US also provides for the right not to be subject to arbitrary or unlawful interference with one's privacy. Council of Europe Convention 108 for the protection of individuals with regard to automated processing of personal data provides more details on the right to data protection.

text: 17. Under secondary law, Directive

text: , Council Framework Decision 2008/977 ,

text: Regulation (EC) 45/2001

text: and Directive

text: , as interpreted by the EU Court of Justice, regulate the exercise of such rights. Together with Article 8(2) of the ECHR and Article 52(1) of the Charter, they specify the criteria and conditions to limit their exercise.

text: 18. The above provisions of EU law do not apply to the national security of EU Member States since, according to Article 4(2) of the Treaty of the European Union (hereinafter: “TUE”), this is an “essential state function” of the Member States, which remains their “sole responsibility” and is thus regulated at national level. II.1.1. Scope of national security exceptions a) National security limiting the scope of application of EU instruments

text: 19. The Communication states that "whilst the EU can take action in areas of EU competence, in particular to safeguard the application of EU law, national security 16 remains the sole responsibility of each Member State" . The EDPS welcomes this assertion of the EU's competence to safeguard the application of EU law. The EDPS also points out that the national security of third countries is not an essential function or sole responsibility of EU Member States and thus not covered by this exemption.

text: 20. In any case, the exclusion of Member States' national security from the scope of application of EU law does not mean that national security remains an unregulated area, in particular as regards the protection of fundamental rights: the Council of Europe instruments mentioned above and national laws are in most situations fully applicable to this field .

text: 21. In particular, even where EU law does not apply, the European Convention of Human Rights and Convention 108 apply to many of the processing operations in 19 question as their general application to most of their parties does not exclude national security as a whole . These instruments also create a positive obligation for their parties to secure privacy and data protection rights to everyone within their 21 22 jurisdiction and to adopt domestic law giving effect to data protection principles . b) National security limiting rights granted by EU and Council of Europe instruments

text: 22. Where the above mentioned EU and Council of Europe instruments apply, the rights to privacy and data protection can be restricted if necessary to safeguard national 23 security or State security , among other reasons. However, such restrictions have to be interpreted in a restrictive way and any limitation to the rights these instruments 25 26 grant can only be allowed if it is laid down by a foreseeable and accessible law 27 and only if it is necessary in a democratic society .

text: 23. The exceptions provided by the aforementioned instruments for national security purposes can therefore not justify massive limitations to fundamental rights as the ones provided by the programmes, for purposes which can go beyond national security, mostly relate to interests of a third country , and are not strictly necessary to safeguard national security . II.1.2. Enforceability of the EU and Council of Europe legal framework a) Enforceability on controllers

text: 24. National laws implementing Directive

text: are applicable to processing operations in the context of the activities of an establishment of controllers in the 30 EU . They are also applicable where a non EU controller is established in a place where a Member State's national law applies by virtue of international law or if the controller is using equipment in the EU . EU Data Protection Authorities have thus competence in these cases to directly enforce their national data protection laws against organisations that have provided access to or disclosed personal data to third country governments in breach of national data protection laws.

text: 25. Since Regulation 45/2001 is also applicable, the EDPS has initiated a discussion with EU institutions and bodies on risks to confidentiality of communications and security of processing and the adoption of appropriate and effective technical security measures. b) Enforceability on Parties to the ECHR

text: 26. Articles 1 and 8 of the ECHR create a positive obligation for Parties to the Convention to protect privacy and data protection rights. As a consequence of the programmes, this obligation has not been fulfilled. Convention 108, which applies to processing operations in the States party to that Convention by the public and by the private sector, has in that context not been respected either.

text: 27. EU Member States, as well as any Party to the ECHR, can be brought to the European Court of Human Rights (hereinafter: "ECtHR") for not complying with their obligation to "secure to everyone within their jurisdiction the rights and 32 33 freedoms provided in the Convention" , in particular the right to privacy . On 4 September 2013, a complaint was lodged against the United Kingdom by Big Brother Watch and others . II.2. Instruments regulating transfers a) Instruments regulating transfers from the EU to the US within the private sector

text: 28. Exchanges of personal data between EU and US private companies and organisations are facilitated by several instruments adopted on the basis of Articles

text: and

text: of Directive 95/46/EC:

text: Commission Decision 2000/520/EC

text: (hereinafter: "the Safe Harbour Decision"); Commission Decisions

text: and

text: (hereinafter: "the Standard Contractual Clauses") and a series of

text: Article 29

text: Working Party documents on Binding Corporate Rules (hereinafter: "BCR").

text: 29. Some of these instruments (Safe Harbour and Standard Contractual Clauses) allow for a derogation of the principles they provide where necessary in a democratic society, e.g. for national security purposes. In some cases (Safe Harbour, Standard Contractual Clauses and Binding Corporate Rules) they include a requirement to inform the EU transferor or the relevant EU Data Protection Authority where national laws in the recipient's country conflict with the principles these instruments provide for.

text: 30. However, the programmes go beyond what is necessary, at least as regards data of non US persons . In any case, such instruments were not designed to protect against massive onward transfers to or access by the government of the recipient organisation. The EDPS therefore recommends that they should be improved, in particular the Safe Harbour, which has been discussed both in the Communication on rebuilding trust and more extensively in the Communication on Safe Harbour. b) Implementation of Safe Harbour

text: 31. The EDPS welcomes the analysis and the recommendations made by the Commission on the implementation of the Safe Harbour. The Communication on Safe Harbour states that the Commission has identified weaknesses such as a lack of transparency and of enforcement. It further notes that some self-certified Safe Harbour companies do not, in practice, comply with its principles, which has, among other consequences, a negative impact on EU citizens' fundamental rights.

text: 32. The Communication on Safe Harbour also addresses the issue of 'access to data transferred in the framework of the Safe Harbour Scheme'. The Communication on rebuilding trust raises the question of whether the large-scale collection and further processing of personal data under the programmes fulfils the Safe Harbour requirements of necessity and proportionality. The Commission finds that Safe Harbour acts as "a conduit for the transfer of the personal data of EU citizens from the EU to the US by companies required to surrender data to US intelligence agencies".

text: 33. In this respect, the EDPS also welcomes the reaffirmation by the Commission that: "in order for limitations and restrictions on the enjoyments on fundamental rights to be valid they must be narrowly construed; they must be set forth in a publicly accessible law and they must be necessary and proportionate in a democratic 36 society" . Any limitation to data protection rules for national security should meet these conditions. This "necessity" requirement is already set out in the Safe Harbor Decision which states that: “Adherence to these Principles may be limited: (a) to the extent necessary to meet national security, public interest, or law enforcement requirements”.

text: 34. However, the EDPS regrets that the Commission concludes that "large scale access by US authorities to data processed by Safe Harbour self-certified companies" only "risks undermining the confidentiality of electronic communications", without specifying that such access goes beyond the limits referred to in the Safe Harbour principles. The EDPS considers that both the large scale of the programmes and the fact that under US law the "necessity" requirement only applies to data of US persons show that the programs do not fulfil the condition of necessity as regards 39 non US persons . c) Instruments regulating transfers from the EU to the US for law enforcement purposes

text: 35. In addition to the above mentioned instruments, several agreements regulate the exchange of personal data between the EU and the US for law enforcement purposes, including the prevention and combating of terrorism: - the Mutual Legal Assistance Agreement (hereinafter: "the MLAA") , - the Agreement on the use and transfer of Passenger Name Records (hereinafter: "the PNR Agreement") , - the Agreement on the processing and transfer of Financial Messaging Data for the purpose of the Terrorist Finance Tracking Program (hereinafter: "the TFTP Agreement") , and - the Agreement between Europol and the US .

text: 36. Access by US authorities to data processed under EU jurisdiction should exclusively take place under these agreements.

text: 37. The revelations on the programmes include allegations that the PNR agreement and the TFTP agreement may have been breached. According to the Commission, there is no evidence proving such allegations . However, recent developments would require a more prudent judgment, especially as far as TFTP is concerned, in view of the concerns raised by the Europol Joint Supervisory Board and the joint investigation by the Dutch and Belgian Data Protection Authorities .

text: 38. As regards exchanges of information for law enforcement purposes, the Communication asserts that the PNR Agreement and the TFTP Agreement provide "a high level of protection of personal data". As explained on a number of occasions , the level of protection provided by these agreements is questionable and such a 48 statement can therefore not be made without reservations .

text: 39. While the allegations that the PNR and the TFTP agreements may have been breached are not confirmed, there is no evidence either of any investigation being conducted in this regard. The EDPS may react separately to the US PNR joint review report, the TFTS Communication and the TFTP joint review report. III. SPECIFIC COMMENTS ON THE FUTURE STEPS TO TAKE III.1. A swift adoption of the EU data protection reform

text: 40. The EDPS shares the views of the Commission on the importance of the proposals for a new data protection framework (hereinafter: "the proposals") in this context. The Communication mentions in particular five elements of the proposals: the extension of the territorial scope of application, the clarification of the conditions for transfers, the harmonisation and reinforcement of the enforcement powers of EU Data Protection Authorities, the inclusion of clear rules on the obligations and liabilities of processors, and the establishment of "comprehensive rules" for the protection of personal data in the law enforcement area.

text: 41. In this respect, the EDPS would highlight two further elements that are being discussed by the co-legislators: (i) addressing the processing for law enforcement purposes of personal data initially collected for commercial purposes, and (ii) addressing international conflicts of law.

text: 42. The first of these further elements relates to the fact that, despite the possibilities offered by the new legal basis provided by

text: Article 16

text: TFEU, the data protection package does not consist of a single comprehensive proposal but of two proposals with different material scope. This is likely to create legal uncertainty for situations where personal data initially subject to the proposed Data Protection Regulation are subsequently processed for purposes and by authorities subject to the proposed Data Protection Directive. This problem was already highlighted by the Commission in the Impact Assessment but not solved by the proposals. The EDPS recommends that the co-legislators correct this omission and regulate these situations.

text: 43. As regards international conflicts of law, it should be made clear that all processing activities which fall within the scope of the data protection package should comply with it, unless a binding international agreement granting adequate data protection safeguards has provided otherwise, or unless a judicial or a data protection authority has granted an exemption.

text: 44. The EDPS supports the conclusive remark of the Communication insisting on the fact that recent events constitute a "wake-up call" for the EU and its Member States "to advance swiftly and with ambition on the data protection reform". III.2. Strengthening the Safe Harbour

text: 45. In the Communication on rebuilding trust the Commission proposes strengthening the Safe Harbour. The EDPS welcomes this proposal but he would have favoured the use of more affirmative language. As stated above, the EDPS also underlines the need to draw the appropriate legal conclusions regarding the insufficient respect for the Safe Harbour principles.

text: 46. In particular, the strengthening of the scheme should be the outcome of the review of its functioning, rather than the other way around. Even if the Communication on rebuilding trust brings forward several justifications for maintaining the scheme, the final choice should depend on the way the recommendations made in the Report are effectively implemented. In case of failure, the suspension or revocation of the scheme might still be envisaged.

text: 47. Different scenarios could be envisaged, including possible actions depending on the outcome of the review. Such scenarios should provide for an in-depth analysis of the possible application of

text: Article 3

text: and/or Article 4 of the Safe Harbour Decision, and explain in which cases and under what conditions suspension could be an option, and where

text: Article 4

text: would be the basis for better defining the Safe Harbour principles, and in particular the exact scope of the exception for national security as opposed to other interests which fall outside the exception.

text: 48. In this respect, the EDPS considers that the Communication on rebuilding trust would have benefitted from more ambition when defining the next steps to be taken. The text does not provide for any precise deadline except for the identification of 52 "remedies" by summer 2014, to be implemented "as soon as possible" . It is not clear to what these remedies refer. Both the Report and the Communication identify steps to be taken to improve the functioning of the scheme, and the EDPS recommends that the Commission indicates more precisely how such steps could be implemented in practice. In addition, the substance and schedule of the "broader review process" should be better defined.

text: 49. As regards the possible ways to improve the Safe Harbour, the EDPS shares with the Commission the opinion that any reform should address the structural shortcomings related to transparency and enforcement, the substantive Safe Harbour principles and the operation of the national security exception.

text: 50. In particular, the EDPS welcomes the statements that (a) the monitoring and supervision by US authorities of compliance with the Safe Harbour principles should be more effective and systematic, (b) the transparency of certified organisations' privacy policies should be improved, (c) the availability and affordability of dispute resolution mechanisms for EU citizens should be ensured, and (d) the national security exception should only be used where strictly necessary and proportionate.

text: 51. Independently of the policy option chosen, currently self-certified Safe Harbour organisations should comply with all the scheme's principles, including transparency. At the same time, US intelligence agencies should not address requests to Safe Harbour members beyond what is strictly necessary and proportional for national security purposes.

text: 52. The EDPS also finds it necessary to : a. review the FAQ of the Safe Harbour principles in order to clarify their application and explain their practical implications for companies who choose to adhere to them. This will also be the occasion to clarify the modalities of application to processors, in particular in the case of onward transfer and increase the degree of liability of European data controllers for checking that companies located in the US which claim to comply with the Safe Harbour principles effectively do so; b. involve European data protection authorities in an extensive communication campaign on the Safe Harbour once the FAQ have been reviewed; c. encourage the FTC to conduct more on-site inspections and increase the level of sanctions for non-compliance; d. insist on the fact that the Safe Harbour principles have not been designed for large-scale access of US intelligence authorities to data transferred under them. III.3. Strengthening data protection safeguards in law enforcement cooperation

text: 53. According to the Communication on rebuilding trust , the Council decision authorising the Commission to negotiate a general EU-US agreement for the exchange of data for law enforcement purposes (hereinafter: "the umbrella agreement"), which is not public, aims at ensuring "a high level of protection in line with the EU data protection acquis".

text: 54. The EDPS welcomes this objective, as such an agreement could potentially establish a clearer framework for the exchanges of data that are or will be taking place, and provide stronger data protection safeguards. However, as the EDPS has previously warned, "such a framework could legitimise massive data transfers in a field - law enforcement - where the impact on individuals is particularly serious and where strict 54 and reliable safeguards and guarantees are all the more needed" .

text: 55. As the EDPS has also previously stated , in order to ensure consistency the EU should first agree on the reform of its internal data protection instruments, and on the basis of this framework it should negotiate agreements with third countries. Subsequently, a general EU-US agreement on the exchange of personal data for law enforcement purposes should be the basis to negotiate sector-specific agreements (e.g. PNR and TFTP), rather than the other way round.

text: 56. Taking into account the current context, the EDPS recommends ensuring that the future data protection framework applies to existing agreements on the exchange of personal data for law enforcement purposes, both at general and sectoral level. In particular, as stated in his opinion on the data protection reform, the EDPS recommends restricting in time the non-applicability of the data protection package, which should only refer to existing international agreements. Furthermore, the proposed Regulation and the proposed Directive should include a transitional clause providing for the review of international agreements within a set time in order to align them with the package. Such clauses should be included in the substantive provisions of both proposals and not only in their Preamble .

text: 57. As stated above, the EDPS also questions the statement repeated in the Communication on rebuilding trust that the PNR and TFTP Agreements set strict conditions for transfer of data and safeguards for EU citizens.

text: 58. The Communication on rebuilding trust states that "the negotiations provide an opportunity to clarify that personal data held by private companies and located in the EU will not be directly accessed by or transferred to US law enforcement authorities outside of formal channels of co-operation". The EDPS welcomes this assurance. However, the text further states that "access by other means should be excluded unless it takes place in clearly defined, exceptional and judicially reviewable situations". The EDPS recommends that the Communication should specify that any exception should only be allowed if it is strictly necessary, proportional and in line with the established case law of the European Court of Human Rights and the Court of Justice.

text: 59. As regards the scope of the concept of national security, which may differ across the Atlantic, the EDPS welcomes the statement that derogations based on national security needs should be narrowly defined and that safeguards and limitations should be agreed in this respect.

text: 60. As regards the safeguards mentioned in the Communication and those missing, such as judicial redress, the EDPS supports the aim of the Commission of obtaining commitments on enforceable rights including judicial redress mechanisms for EU citizens not resident in the US. III.4. Addressing European concerns in the on-going US reform process

text: 61. The Communication on rebuilding trust cites possible improvements in the US legal framework, especially with a view to extend safeguards available to US citizens and residents to EU citizens not resident in the US. It also argues for more transparency and better oversight. Such changes should of course be welcomed and encouraged where they are likely to provide more and better protection to EU citizens and the fundamental rights at stake, in particular as regards redress possibilities.

text: 62. In this regard, the report of the Privacy and Civil Liberties Oversight Board of 23 January 2014, the speech of president Obama of 17 January 2014 and the Presidential Directives of the same date are good signals. However, further changes as just called for would not only increase trust and reduce the extent to which Europeans are affected by the programmes, as stated in the Communication, but would also reduce the situations where organisations may be caught in a conflict of jurisdictions.

text: 63. The Communication states that such changes "would reduce the processing of personal data of Europeans that are not relevant for national security purposes". As stated above, the EDPS notes that this standard is inadequate and that personal data of Europeans should only be processed for national security purposes if this is strictly necessary and proportionate.

text: 64. The EU should also encourage and support efforts by the US Administration and the US Congress to enact a general privacy act, providing for strong safeguards and adequate oversight, particularly in areas where any substantial protection of privacy rights is currently lacking.

text: 65. Like the Commission, the EDPS would welcome the strengthening of the US domestic legal framework, including the passage of the "Consumer Privacy Bill of Rights" announced in February 2012 by President Obama . The EDPS encourages the EU institutions to actively support the enactment of a comprehensive data protection framework in the US that would facilitate trans-border data flows while providing a high level of protection.

text: 66. Being relevant stakeholders, the US government and the US private sector have contributed to the debate on the reform of the EU data protection framework. In order to increase understanding and trust, and taking into account the importance of transfers between the EU and the US, EU institutions should also actively provide their views on the legislative debates on privacy in the US. III.5. Negotiations on the TTIP

text: 67. The Commission refers to the negotiations between the EU and the US on a Transatlantic Trade and Investment Partnership (hereinafter: "TTIP") and states that data protection standards will not be negotiated within the TTIP, "which will fully respect the data protection rules".

text: 68. The EDPS calls on the Commission to ensure that this commitment is respected and that issues that might be negotiated under the TTIP, such as "trans-border data 59 60 61 flows" , standards and certificates for the cloud or data security requirements do not have a negative impact on the protection of personal data. In particular, on the basis of Article XIV of the GATS, the text of the agreement should include a provision stating that it will apply without prejudice to the applicable data protection legislation.

text: 69. At the same time, the Commission should consider setting a common goal of gradual development towards greater interoperability of legal frameworks for privacy and data protection, to which goal the US might contribute in ways mentioned in points 63 and 64. III.6. Promoting privacy standards internationally

text: 70. The EDPS supports the intention of the Commission of internationally promoting EU rules on collection, processing and transfer of data. In particular, the EDPS supports the adoption of an international instrument requiring the respect of data protection standards by intelligence activities. This could be adopted at UN level on the basis of Article 17 of the International Covenant on Civil and Political Rights .

text: 71. As regards the current discussions with regard to the Council of Europe Cybercrime Convention, the EDPS stresses that access of law enforcement authorities of third countries to data under EU jurisdiction should comply with EU data protection 64 requirements .

text: 72. The EDPS supports the view of the Commission that, in order to promote privacy standards internationally, the US should preferably accede to the Council of Europe’s Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (“Convention 108”), which is open to countries which are not member of the Council of Europe.

text: 73. The EDPS considers that these efforts should be complemented with the improvement of cooperation among data protection authorities and privacy 65 enforcement authorities around the world . The development of international enforcement cooperation mechanisms should facilitate the enforcement of national, regional and international privacy and data protection laws in cross-border situations. III.7. The need to subject intelligence activities to appropriate safeguards

text: 74. Intelligence services and related entities are operating in a loose framework within which the requirements for necessity and proportionality are more important than ever, but at the same time not always sufficiently addressed with legal safeguards and arrangements for adequate accountability and oversight. The ever growing use of telecommunications networks by users worldwide and the deployment of ever more powerful technical means for massive data collection and storage have considerably increased the capacities of intelligence agencies to gather data. The establishment of strong safeguards at all relevant levels is crucial to restrain this increased power and ensure that surveillance is necessary and interference in the right to the protection for private life is proportionate.

text: 75. In the EDPS' view, one of the safeguards for ensuring that surveillance activities do not go further than what is necessary and proportionate consists in strengthening the supervision of those intelligence activities. Supervision should take place in different forms at different stages: - At the moment of implementing a surveillance activity which involves a new processing operation, the need for an authorisation of the activity by a judge or another independent authority would reduce the risk of abuse by ensuring that necessity and proportionality are determined at the moment that decisions are taken that affect the private life of citizens. The authorisation should contain an assessment of the necessity and proportionality of the measure, provide for appropriate safeguards where necessary, and be limited in time. - The whole processing operation should be subject to the appropriate and effective oversight by Parliaments or other competent independent bodies. The mandate of oversight bodies should be broadened to ensure they can inspect all aspects of the data processing carried out by all intelligence agencies. - The exchange of data between intelligence agencies of different countries should also be subject to independent oversight.

text: 76. Oversight bodies should be entrusted with the task of supervising the application of data protection principles to intelligence activities; they should also be given the appropriate powers to do so. The supervision of the application of data protection principles should include the following elements: - The establishment of strong data quality checks: risk of errors can emerge when mixing private and public databases (cf. PNR) and data mining raises an accuracy problem that must be addressed. - Regular examinations of personal data exchanges should be conducted to control the destination of the data, the purpose of the exchange, the quality of the recipients of the data, and the proportionality of the exchange in view of its interference on fundamental rights. - Oversight bodies should cooperate with each other. This requires assisting the existing network of oversight bodies to meet and exchange information with each other on common problems and solutions found to this problem. III.8. Ensuring effective IT security

text: 77. The community of Internet engineers has recognized the dangers of mass surveillance and pledged to design and implement infrastructures that should be more resilient to interception . European researchers have provided the foundations for many of the most important cryptographic mechanisms. In addition to encryption, developers of software, in particular on the Internet, should be aware of privacy risks of their products and use concrete design methods to avoid or at least reduce them.

text: 78. The EU should analyse its strengths and weaknesses in this domain and review its research, development and education initiatives to ensure the availability of effective and trustworthy security tools for everyone and training developers able to design privacy-protecting systems. The EDPS fosters exchanges on this subject with relevant stakeholders . IV. CONCLUDING REMARKS

text: 79. The EDPS welcomes the measures considered by the Commission, but highlights that the revealed surveillance activities of US intelligence agencies not only affect trust in EU-US data flows. They also have an impact on the existing and enforceable rights of EU citizens to respect for privacy and to the protection of their personal data. These rights are enshrined in both EU and Council of Europe primary and secondary law. Therefore, the EDPS regrets that the Communication on rebuilding trust has not given more attention to the impact on existing legal instruments.

text: 80. The EDPS would favour on several points that the Commission be more ambitious when defining the next steps to be taken and finds that: - A correct application and enforcement of the current European data protection legal framework is not only required by law, but would also be an essential contribution to restoring trust. This also applies to the instruments regulating international transfers between the EU and the US, including the existing Safe Harbour principles. - The Commission should recall that exceptions or restrictions to fundamental rights allowed for national security purposes are only justified and permissible if they are strictly necessary, proportionate and in line with the jurisprudence of the ECtHR and the Court of Justice. - The EDPS entirely agrees that consolidation and improvement of the EU data protection framework requires a swift adoption of the data protection reform proposals with adequate substance so as to provide for stronger, more effective and more consistent protection of personal data and privacy within the full scope of EU law. This should also provide for adequate protection of data in the case of their further use for law enforcement purposes and international conflicts of jurisdictions. - The Safe Harbour principles should be reviewed and strengthened along the lines indicated by the Commission. The EDPS recommends setting up stricter deadlines within which these actions must be taken, including adequate follow up in case of any remaining deficiencies. - Data protection safeguards applying to EU-US law enforcement cooperation have to be reinforced. Current negotiations on an "umbrella agreement" should not legitimise massive data transfers of data but comply with the existing data protection framework and with the outcome of its current review process. In particular, effective redress mechanisms should be accessible to all data subjects, regardless of their nationality. This should in due course also apply to existing international agreements, where necessary on the basis of appropriate transition clauses. - The Commission should support efforts by the US Administration and US Congress to enact a general privacy act, providing for strong safeguards and adequate oversight, in particular in areas where any substantial protection of privacy is currently lacking. - The negotiations currently taking place to adopt a TTIP should not have an adverse impact on the protection of personal data of citizens. At the same time, the Commission should consider setting a common goal of gradual development towards greater interoperability of legal frameworks for privacy and data protection, to which goal the US might contribute as just mentioned above. - The international promotion of privacy standards should include: i. promoting full consistency of new international instruments with the European data protection framework; ii. promoting the adhesion of third countries, and in particular the US, to Council of Europe Convention 108; iii. supporting the adoption of an international instrument requiring the respect of data protection standards by intelligence activities. This could be adopted at UN level on the basis of Article 17 of the ICCPR. - Surveillance activities should at all times be obliged to respect the rule of law and the principles of necessity and proportionality in a democratic society. Legal frameworks at all relevant levels should therefore be clarified and where necessary supplemented. These frameworks should include appropriate and sufficiently strong oversight mechanisms. - EU institutions and all relevant entities in the Member States are, as data controllers, also directly responsible for ensuring effective IT security. This involves carrying out a data security risk assessment at the appropriate level. It also requires encouraging research on encryption mechanisms and raising data controllers and citizens' awareness on privacy risks of the products sold or used, and requiring that developers use concrete design methods to avoid or, at least, reduce these risks. The EU should lead education initiatives on security of data processed on the Internet. Done in Brussels, 20 February 2014 (signed) Peter HUSTINX European Data Protection Supervisor

type: vagledning

utgivare: edps