text: OJ L281, 23.11.1995, p. 31. 2 OJ L8, 12.1.2001, p. 1. 3 COM(2014) 6 final. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: Explanatory Memorandum, Section 1.1. 5 See https://ec.europa.eu/eures/home.jsp?lang=en. 6 Explanatory Memorandum, Section 1.4.

text: As noted in para 8, profiles will include data categories such as the occupation or skill concerned, level of academic achievement, language skills, driving license, the number of years of work experience, the nature of the contract (permanent or temporary) and the location of employment will be accessible in EURES. 8 With that said, it appears that applicants can also decide to make available their entire CVs to the portal. Further, they can also add information in a free-text field to accompany the codified standard information that will appear in the results when the matching tool is used. 9 Paragraphs (4) to (7) of the same

text: Article 14

text: contain additional provisions related to the protection of personal data.

text: See also related recommendations in Section 2.6, para 34 below.

text: In the context of the present opinion, the term ‘web-crawling’ refers to practices whereby an employment service uses an automated script or program that systematically browses the World Wide Web and analyses web pages for the purpose of retrieving and continuously updating any publicly available job postings.

text: While web-crawling used for populating job databases, as mentioned above in Section 2.4, could compromise the quality of data available accessible via the portal, web crawling on the portal could undermine any purpose limitation on the data accessed.

text: The issue of unsolicited marketing may be relevant in cases where the workers choose to post their CV information and contact information for everyone to see via the EURES portal.

identifier: EDPS yttrande (2014)

amnesord:
Privacy by Design
Information Security
eGovernment

publisher: Europeiska datatillsynsmannen

sprak: en

title: European network of Employment Services

serie: yttranden

text: Opinion of the European Data Protection Supervisor

type: stycke

text: on the Commission Proposal for a Regulation of the European Parliament and of the Council on a European network of Employment Services, workers' access to mobility services and the further integration of labour markets

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 17 January 2014, the Commission adopted a proposal for a Regulation of the European Parliament and of the Council on a European network of Employment Services, workers' access to mobility services and the further integration of labour 3 markets ('the Proposal'). On the same day, the Commission sent the Proposal to the EDPS for consultation.

text: 2. We welcome the fact that we were consulted on this Proposal prior to its adoption and that we were given the possibility to provide informal comments to the Commission. The Commission took into account several of these comments. As a result, the data protection safeguards in the proposed Regulation have been strengthened. We also welcome the reference in the preamble to the consultation of the EDPS. 1.2. Objective and scope of the Proposal

text: 3. The objective of the Proposal is to 'enhance access of workers to intra-EU labour mobility support services, thus supporting fair mobility and increasing access to employment opportunities throughout the Union'.

text: 4. The Proposal aims at providing a revised and updated legal framework for the 5 functioning of the EURES job mobility portal , which has already been in place for some time. The proposed rules will also fundamentally change the way how the portal currently works.

text: 5. As it stands now, the portal offers a tool to help jobseekers find employers and employers find jobseekers across the EU directly through the portal, much like other, privately-operated, job search sites. Jobseekers can register and post their resumes on the portal. Potential employers, in turn, can access, browse and search the site for matching profiles when they are looking to fill vacancies. The EURES job portal is managed by the Commission and hosted on Commission servers.

text: 6. The changes proposed include measures to help increase the number of job vacancies as well as the pool of candidates available in EURES. Further, they also increase the capabilities of the portal to automatically match job vacancies with job applications.

text: 7. To this end the current system of direct registration of CVs and job vacancies will be replaced/complemented by a system where public employment services and other 'authorised' employment services (so-called 'EURES-partners') will make available via EURES a limited and select set of 'matchable' and codified data obtained from the CV and job vacancy databases they hold.

text: 8. To illustrate, these would include data categories such as the occupation or skill concerned, level of academic achievement, language skills, driving license, the number of years of work experience, the nature of the contract (permanent or temporary) and the location of employment. Making these data available to EURES, on the applicant side (data derived from CV data), will be subject to explicit consent of the individuals concerned.

text: 9. The list of organisations systematically feeding data into the system will include not only 'public employment services of the Member States', but also other 'authorised' EURES partners. In other words: participation in the EURES network will be open to all employment services, whether public or private, which fulfil a specified minimum set of criteria (set forth in Annex 1 of the Proposal).

text: 10. Thanks to its matching tool, it is expected that the Regulation will enable the EURES portal to 'carry out a good automated matching between job vacancies and CV's across Member States, translating in all EU languages and understanding skills, competencies, 6 occupations and qualifications acquired at national and sectoral level'.

text: 11. The process leading to a match can be initiated by any of the EURES partners. If a match is positive, the organisation requesting the match will receive a list of matching applicant profiles. However, as a rule, the list will not contain the names, the actual CVs or any other personal data of the applicants concerned. These can be obtained, on request, from the EURES partner that made the data available to the EURES portal.

text: 2. ANALYSIS OF THE PROPOSAL 2.1. References to applicable data protection law (Recital 33 and

text: Article 31

text: 12. We welcome the references to data protection legislation, including Directive

text: , the national implementing measures thereto and

text: Regulation (EC) No 45/2001

text: . In particular, it is welcome that these references are set forth not only in a recital but also in a substantive article in the main body of the Regulation.

text: 13. We also welcome the fact that the Annex to the Regulation, which sets forth the 'Common criteria for the authorisation of organisations to act as EURES Partners', under its first point, also specifically refers to data protection law. This provision requires the 'existence of adequate mechanisms and procedures to verify and ensure full respect for applicable labour standards and legal requirements, including applicable data protection law and requirements and standards on quality of job vacancy data'. 2.2.

text: Articles 14

text: (b) and 17: explicit consent of the workers, information provided to them, and their access to their own data well as those provided by its EURES partners, provided that the workers concerned have consented to making the information also available to the EURES portal under the terms defined in paragraph 3'.

text: Article 14(3)

text: specifies that 'the consent of workers ... shall be explicit, unambiguous, freely given, specific and informed. Workers shall be able to withdraw at any time their consent and require the deletion or modification of any or all of the data made available. Workers shall be able to choose from a number of options to restrict access 9 to their data or to certain attributes' .

text: Article 17(1)

text: in turn provides that ‘the public employment services shall ensure that workers using their services, by making available job applications and/or CV’s with them, can choose to have those employment services assist those workers with their registration on the EURES portal…’.

text: 17. Further,

text: Article 17(4)

text: provides that ‘workers and employers shall have access to general information on how, when and where they can update, revise and withdraw the data concerned’.

text: 18. The EDPS welcomes:  that making available CVs and job applications is subject to 'explicit, unambiguous, freely given, specific and informed consent', and that consent should be sufficiently granular;  the requirement to provide information to the workers, including information on how to update or delete their data (we note here that provision of information is also a prerequisite for the individuals to consent in the first place; if CV and contact information of the workers will be made publicly available via the EURES portal, it 10 is essential that the individuals have sufficient information in this regard) ;  that workers may at any time withdraw their consent and also require the deletion or modification of any or all of their data from EURES.

text: 19. To further improve these provisions, and in particular, to help ensure both the accuracy of the database and the respect of the autonomy and self-determination of the data subjects, we would recommend the following:  We take note that the last sentence of

text: Article 14(3)

text: provides that 'workers shall be able to choose from a number of options to restrict access to their data or to certain attributes'. We welcome the fact that the workers may decide among some options, and we also acknowledge the need to keep this provision sufficiently flexible to cater for the different needs that may arise during the implementation of the EURES portal. At the same time, it could be helpful to add a recital providing some nonexhaustive examples of the types of choices that workers may be provided with. For example a recital could explain that workers may be able to designate in which Member States they wish to work and will therefore be matched for job vacancies; 

text: Article 17(4)

text: should refer to 'access to information' rather than 'access to general information';  in

text: Article 15(3)

text: after the words 'job applications, and CV's made available on the EURES portal' the words 'in accordance with

text: Article 14

text: ' could be added.

text: 20. We welcome the fact that additional provisions are included on various aspects of data protection in Article14 (4) to (8), in particular, that there are references to the quality of data and to data security. To complete, we recommend adding a substantive provision or a recital to require that the principle of data protection by design be applied for the development of the EURES portal. This requirement could also be specified with a number of obligations, either in a substantive provision or in recitals such as:  the central and national systems should apply appropriate security measures and standards for security measures might be the subject of implementing measures;  measures to contribute to the quality of personal data in EURES and that  jobseeker (CV etc) and vacancy data are automatically deleted from the system once no longer required for the purposes of job matching (on other aspects of purpose limitation, please see Sections 2.7 and 2.8 below). 'web-crawling'

text: Article 14 (1)

text: (a) provides that 'each Member State makes available to the EURES portal ... all job vacancies available with its public employment services, as well as those provided by its EURES partners'.

text: 22. In this respect we would emphasise that data sharing remains subject to applicable provisions of data protection law. For example, it must be ensured that personal data that may be found in the job vacancies are obtained by lawful means by the organisation that provided the data to the EURES portal, on an appropriate legal ground (such as consent, legal obligation, or public task of the controller) and that the data shared via the EURES portal are proportionate. A correct interpretation, case by case, of

text: Article 14

text: (a), read in light of

text: Article 31

text: referring to applicable data protection law, should ensure that this will be the case.

text: 23. Such a case by case analysis of what data to share via EURES is particularly important regarding web-crawling for data 'available in the public domain'. Indeed, the Commission itself, on page 10, Section 5.3 of the Explanatory Memorandum reflects on these concerns. It provides in particular that 'taking into account the relatively recent technological developments on web crawling, the limited number of Member States which make use of such tools and possible data protection concerns, at this stage it is not proposed to require Member States to make available to the EURES portal any data harvested with web crawlers in accordance with national law'.

text: 24. This consultation procedure does not assess the compliance of any national 'webcrawling' practices with EU and national data protection law. However, as a general observation, we point out that practices such as web-crawling, in principle, may only be regarded acceptable as methods to populate the EURES database subject to appropriate safeguards .

text: 25. Indeed, harvesting data via web-crawlers raises very significant data protection concerns, including questions of purpose limitation as well as accuracy of the database so populated.

text: 26. Further, unless the employers are subsequently contacted to confirm and update their data, the accuracy of the data is not guaranteed. An employer may have posted an announcement on the web and may have simply failed to remove it when the vacancy has been filled.

text: 27. On these grounds, we welcome the fact that the Proposal does not specifically require or encourage web-crawling and indeed raises relevant data protection concerns about this in the Explanatory Memorandum. 2.5.

text: Article 15

text: : Access at national level to the common platform

text: Article 15(1)

text: provides that 'the public employment services shall ensure that the EURES portal is linked to, clearly visible and intuitively searchable through all the job search portals they manage, be them at central, regional or local level'.

text: 29. This language suggests that not only public employment services, or other authorised employment services (‘EURES partners’) may have access to EURES, but also any potential employer, and that this access may be given via a variety of different job search portals in the different Member States.

text: 30. The EDPS recommends that the Regulation clearly specifies who can have access to the database and subject to what safeguards: e.g. if access is given broadly to any employment services in Member States and any potential employers in Member States via a variety of portals, it may be provided that access is subject to registration and acceptance of terms and conditions.

text: 31. Technical and organisational measures must also be in place to ensure that the contents of the entire database or large parts of it cannot be massively ‘harvested’ by automated means for further (possibly incompatible) use. 2.6.

text: Article 16

text: : Automated matching through the common platform

text: Article 16(1)

text: provides that ‘the Commission shall develop a European classification of skills, competences, qualifications and occupations’ and that this classification will facilitate, among others, job-matching.

text: Article 16(5)

text: calls for the 'adoption, by means of implementing acts, the technical standards and formats necessary for the operation of the classification’.

text: 33. As this potentially involves processing large amounts of data and the fact whether a worker will or will not be automatically matched will have significant consequences for him/her, the EDPS would welcome further clarification in the text of the Regulation on how the automated matching works. Clarification in the Proposal itself of what the automated matching is would be all the more useful also in light of

text: Article 12

text: (a) of Directive

text: , which gives data subjects the right to obtain from the controller 'the knowledge of the logic involved in any automated processing of data concerning him'.

text: 34. In any event, the Regulation should specify that -unless a worker made an informed choice to make his/her entire CV available on EURES- those searching the EURES portal will not have direct access to the names, CVs or any other directly identifiable personal data of the applicants, only to the list of a limited and select set of 'matchable' and codified data obtained from the CV databases they hold. These would include data categories such as the occupation or skill, educational background, language skill, driving license, years of work experience, as well as the nature of the contract (permanent or temporary) and the location of employment that applicants are interested in. In other words, workers should be able to make an informed decision on whether they wish their CV data be made available via EURES to everyone who registers as a potential employer on the site or whether they prefer that their data are searchable only via general data categories (e.g. an individual may be an English-speaking qualified doctor in Poland looking for employment in the UK) while keeping their detailed CV as well as their name and contact information confidential and with the employment agency they are working with. 2.7.

text: Article 29

text: : Data Collection and indicators

text: Article 29

text: calls for collection of data including, among others, on placement and recruitment resulting from EURES activity.

text: 36. We recommend that a substantive provision in the Proposal specify that these activities should not result in storage of personal data for periods longer than necessary for the initial purposes of the data processing, and that instead aggregated statistical data that contains no personal data may be stored for these purposes. It should remain clear that

text: Article 29

text: does not create a legal base for retaining personal data for longer than would be legal under the other provisions of the Proposal. 2.8. Additional comments: purpose of processing and restrictions on unsolicited marketing

text: 37. As with any large-scale databases, portals, or other IT tools operated by the Commission, we recommend that the purpose of the processing and the acceptable range of further use of the data be clearly specified in the proposed Regulation. Preferably, such a provision should be set forth in a substantive article. For example, a substantive article may provide that the data obtained via EURES will only be used for the purposes of filling in existing job vacancies, or for other purposes that are compatible with this purpose, subject to appropriate safeguards. An additional provision, in turn, may specifically exclude that any data (including CV data specifically agreed by the applicants to be also made available via EURES) be used for purposes of unsolicited marketing.

text: 3. CONCLUSIONS

text: 38. We welcome the careful consideration by the Commission of the right to the protection of personal data when drafting the Proposal. In particular, the Proposal requires explicit consent from the workers concerned and takes due account of the rights of data subjects, including their right to access and correct their data. In addition, the Proposal does not specifically require or encourage web-crawling and indeed raises relevant data protection concerns in this regard in the Explanatory Memorandum.

text: 39. In the present Opinion we recommend certain further improvements:  in

text: Article 15(3)

text: Article 14

text: ' could be added; 

text: Article 17(4)

text: should refer to 'access to information' rather than 'access to general information';  a specific substantive provision or a recital could be added to the draft Regulation, requiring that the principle of data protection by design be applied for the development of the EURES portal. In addition, it could also be helpful to provide some further guidance in substantive provisions or at least in recitals, as outlined in this Opinion;  the Regulation should more clearly specify who can have access to the database and subject to what safeguards;  There should also be further clarification in the text of the Regulation on how the automated matching works. In any event, the Regulation should specify that - unless a worker choses to make his/her entire CV available on EURES - those searching the EURES portal will not have direct access to the names, CVs or any other directly identifiable personal data of the applicants, only to the list of a limited and select set of 'matchable' and codified data obtained from the CV databases they hold;  Finally, the purpose of the processing and the acceptable range of further use of the data should be clearly specified in the proposed Regulation. Done in Brussels, 3 April 2014 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor

type: vagledning

utgivare: edps


text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3 See below para [8] of this Opinion.

text: Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: The transitional provisions cease to apply on 1 December 2014;

text: Article 10

text: , Protocol 36 on transitional provisions, attached to the Lisbon Treaty. 5 See in this context the judgments of the Court (Grand Chamber) of 9 November 2010 in Schecke and Eifert (Joined Cases

text: and

text: ) and in particular of 8 April 2014 in Digital Rights Ireland and Seitlinger (Joined cases

text: and

text: ). In the first case the Court also emphasised the need for the legislator to consider sufficiently less intrusive alternatives for a particular measure. 6 COM(2012)11 final; COM(2012)10 final. 7 Directive

text: , OJ L 105/54. 8 The first reading resulted in the European Parliament legislative resolution of 12 March 2014 on the proposal for a regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (COM(2012)0011 – C7-0025/2012 – 2012/0011(COD)) (Ordinary legislative procedure: first reading). 99 See the EDPS Opinion of 18 July 2013 on the Proposals for a Regulation establishing an Entry/Exit System (EES) and a Regulation establishing a Registered Traveller Programme (RTP). 10 This includes an EU system for passenger name records (COM(2011) 32 final) and a possible proposal on the transfer of passenger data to third countries (http://ec.europa.eu/smartregulation/impact/planned_ia/docs/2014_home_004_transfer_pnr_data_3rd_countries_en.pdf [accessed 3 June 2014]).

text: See on this approach more in general the 2014 EDPS policy paper "The EDPS as an advisor to EU institutions on policy and legislation: building on ten years of experience", published on the EDPS website. . 12 OJ 2010, C 115/01. 13 COM(2009) 262 final. 14 EUCO 217/13. While previous multi-annual programmes have applied for five year periods which by and large coincide with the mandates of colleges of Commissioners and European Parliamentary terms, the timescale for the envisaged set of strategic guidelines is unclear. The Council has discussed the option of aligning the new guidelines with the current seven-year multiannual financial framework 2014-2020. 15 COM(2014) 144 final.

text: COM(2014) 154 final. 17 European Parliament resolution of 2 April 2014 on the mid-term review of the Stockholm Programme (2013/2024(INI)).

text: Opinion of the EDPS on the data protection reform package, 7 March 2012. 19 COM(2012) 735 final. 20 Paragraph 66, Resolution 2013/2024(INI)).

text: See footnote 5 above. 22 See Commission Staff Working Paper, SEC(2011) 438 final. 23 See e.g. the Opinions of the EDPS of 15 December 2010 on the establishment of 'EURODAC' for the comparison of fingerprints, Eurodac, and Opinion of 18 July 2013 on the Proposals for a Regulation establishing an Entry/Exit System (EES) and a Regulation establishing a Registered Traveller Programme (RTP). . 24 COM(2014) 144 final, p. 3. 25 Opinion of the EDPS on the Communication from the Commission to the European Parliament and the Council entitled 'Strengthening law enforcement cooperation in the EU: the European Information Exchange Model (EIXM)’ of 29 April 2013.

text: In line with the CJEU judgment in Schecke and Eifert, paragraphs 81 and 86. 27 COM(2014) 154 final, p.9 28 European Parliament resolution of 12 March 2014 on the US NSA surveillance programme, surveillance bodies in various Member States and their impact on EU citizens’ fundamental rights and on transatlantic cooperation in Justice and Home Affairs (2013/2188(INI)), paragraphs 131-133. 29 COM(2014) 144 final, pp.5-8; COM(2014) 154 final, p. 13. 30 Fundamental Rights Agency, Access to data protection remedies in EU Member States, 2013. 31 COM(2014) 144 final, p. 6.

text: COM(2014) 154 final, p. 9 33 Judgments of the Court (Grand Chamber) of 9 March 2010 - Commission v Germany (

text: Case C-518/07

text: ), of 16 October 2012 - Commission v Austria (

text: Case C‑614/10

text: ) and of 8 April 2014 —Commission v Hungary (Case C- 288/12). 34 COM(2014) 144 final, pp.8-9. 35 COM(2014) 154 final p. 6. 36 Digital Rights Ireland paragraph 59.

text: On the risks of developing profiles on the basis of unknown and evolving assessment criteria, see Opinion of the EDPS of 25 March 2011 on the Proposal for a Directive of the European Parliament and of the Council on the use of Passenger Name Record data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. 38 COM(2014) 154 final, p.10.

text: See Opinion of the EDPS on the Proposals for Council Decisions on the conclusion and the signature of the Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data, 30 September 2013. 40 See CJEU judgment in Joined Cases

text: P and

text: P, Kadi and Al Barakaat International Foundation v./ Council and Commission, 3 September 2008; see also European Parliament resolution 2013/2188(INI), paragraph 132. 41 In accordance with CJEU judgment in Schecke and Eifert, paragraphs 81 and 86.

text: See note 11. 43 The EDPS Policy Paper includes an offer to agree MoUs with each of the institutions to help improve quality of legislation. 44 Digital Rights Ireland, paragraphs. 54, 60, 62, 65 and 67.

amnesord:
Judicial Cooperation
Police Cooperation

title: Future development of the area of freedom, security and justice

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 41(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION

text: 1. The purpose of this Opinion is to contribute to the further development of the EU policies in the area of freedom, security and justice through fuller integration of privacy and data protection into the activities of all EU institutions. It responds to two communications 3 adopted by the Commission on 11 March 2014 on the future of justice and home affairs, the Resolution adopted by the European Parliament on 2 April 2014 reviewing the Stockholm Programme, and discussions in the Council, with a view to the conclusion by the European Council, for the first time, of strategic guidelines for legislative and operational planning in accordance with

text: Article 68

text: TFEU.

text: 2. This is a critical moment for the EU’s role in justice and home affairs. We are approaching the end of the transitional period set out in the Lisbon Treaty after which the powers of the Commission to bring infringement proceedings and the powers of the European Court of Justice become fully applicable to EU laws on police and judicial cooperation in criminal matters. Under the Treaty, the Charter for Fundamental Rights has assumed the status of primary law, and the Court of Justice has in recent judgments clarified the restrictions on the legislator’s room for manoeuvre wherever a measure implies interference with those rights.

text: 3. Moreover, during the last five years concerns about privacy and data protection have arguably become more intense than ever before. In January 2012, the Commission proposed a package of legislative reforms of data protection in the EU. Since June 2013 revelations of mass surveillance of individuals in the EU by US and other intelligence agencies have greatly damaged the trust in confidentiality of personal information. Most recently, the Court of Justice in April 2014 - in one of the two judgments just referred to annulled the Data Retention Directive due to its excessive interference with fundamental rights. Action at EU level on data protection has taken on a truly global significance, as attested for instance by the degree of international coverage and lobbying on the reform of the data protection framework, which led to around 4000 amendments submitted during first reading in the European Parliament .

text: 4. The legal, technological and societal challenges for policymakers and legislators in the area of justice and home affairs are certain to intensify over the period to be covered by the strategic guidelines. Furthermore, the new guidelines by the European Council are an opportunity to state an intention to restore trust in the EU’s capacity to protect individuals effectively. For that reason, we suggest that the European Council addresses explicitly the following themes in the new guidelines: a. the huge volumes of personal data processing that is required by many of the EU laws and policies in the area of freedom, security and justice; b. the fragility of any measure which fails to respect fundamental rights, as has been witnessed in the Data Retention Directive, but may also apply to other ongoing initiatives such as the ‘smart borders’ package, and the various instruments relating to passenger name records; c. the importance of adopting as soon as possible a strong and modernised data protection framework in the EU, which should also be used as the compass for EU external policies; and d. the need to integrate privacy and data protection considerations in the development of all new policies and legislation in the area of freedom, security and justice.

text: 5. Having contributed to a similar exercise five years ago, we offer in this Opinion to work with the EU institutions in improving the quality of legislation from a data protection perspective, as part of a new template for cooperation.

text: 2. INSTITUTIONAL PERSPECTIVES ON THE FUTURE OF THE AREA OF FREEDOM, SECURITY AND JUSTICE

text: 6. ‘The Stockholm Programme - An Open and Secure Europe Serving and Protecting 12 Citizens’ (‘the Stockholm Programme’), adopted under conclusions of the European Council on 10/11 December 2009, was the third successive multi-annual statement of intent in the area of justice and home affairs. It was informed by a communication of the Commission in June 2009 entitled ‘An area of freedom, security and justice serving the citizen’. The EDPS Opinion published on 13 July 2009 acknowledged the emphasis placed by the Commission on the protection of fundamental rights, and in particular the protection of personal data in the context of EU action on citizenship, justice, security, asylum and immigration. Specifically, we welcomed the call for a comprehensive data protection scheme covering all areas of EU competence and the reaffirmation of basic principles such as purpose limitation. The Commission envisaged developing a ‘European information model’ and an ‘EU Information Management Strategy’, which as we hoped would properly reflect these principles and best practices.

text: 7. On 19 and 20 December 2013, the European Council, in line with its function under

text: Article 68

text: TFEU, announced its intention - for the first time under the current treaties - to define ‘strategic guidelines for further legislative and operational planning in the area of freedom, security and justice ("post-Stockholm")’.

text: 8. On 11 March 2014, two communications from the Commission to the European Parliament and the Council, the European Economic and Social Committee and the Committee of the Regions were adopted addressing these issues: the first communication, ‘The Justice Agenda for 2020: Strengthening Trust, Mobility and Growth within the 15 Union’ was organised according to the concepts of ‘consolidation’ of existing measures through, for example, more judicial training, ‘codification’ of civil and commercial laws, consumer rights and criminal laws, and identifying measures to ‘complement’ mutual trust, economic growth and citizenship rights. The second communication, ‘An Open and 16 secure Europe: making it happen’, contained more subject-specific suggestions on legal migration, such as coordinating assessments on labour migration, on irregular migration, on amending the EU visa code, on asylum – such as mutual recognition of decisions – and on security such as new laws on firearms control and international treaties on passenger name records. It would appear that the Commission, unlike the Parliament and the Council, no longer sees merit in a single, coherent vision on the future of the area of freedom, security and justice.

text: 9. The European Parliament on 2 April 2014 adopted a resolution on the Stockholm Programme. The resolution included calls for the European Council to implement a ‘European Digital Habeas Corpus’ on fundamental rights, for speeding up accession to the European Convention on Human Rights, for the Parliament to have a central role in evaluating and defining internal security policies in a new Internal Security Strategy from 2014, and for a ‘future-oriented vision of how to shape and optimise law enforcement data sharing in the EU while guaranteeing fundamental rights , including a robust level of data protection’. More generally, the Parliament called for ‘closer cooperation and better information-sharing between the European institutions and agencies and the Member States [in order to] improve the creation and implementation of policy’, and argued that ‘improving the quality of EU legislation […] requires a joint effort by the Member States and the European institutions’.

text: 10. The Council has in the meantime held a series of discussions on the future of justice and home affairs, which will also be a subject of the newly elected European Parliament’s . deliberations. Like the Commission, the Council has tended towards broad political priority setting rather than the detailed programming of the last 10 years, consolidation or simplification of existing measures rather than new legislation, and evidence-based approaches based on impact assessments.

text: 3. DATA PROTECTION AND THE STOCKHOLM PROGRAMME Persisting urgency for a comprehensive and robust framework

text: 11. Since the adoption of the Stockholm Programme, the EU has taken considerable steps to strengthen fundamental rights, in particular the rights to privacy and data protection. The Charter became legally binding with the entry into force of the Lisbon Treaty, and there is a requirement under

text: Article 16

text: TFEU for the EU to set down data protection rules applicable to all activities falling within the scope of EU law. The adoption of a new and comprehensive legal framework for data protection is particularly acute. The key milestones for data protection during the period of implementation of the Stockholm Programme have been the Commission proposals of January 2012 for reforming the data protection framework and the legislative resolution in March 2014 on the reform by the European Parliament. It is regrettable that progress has been slower at Council level, and the EDPS continues to urge all parties to move towards agreement as soon as possible.

text: 12. The ambitious proposal to replace the central piece of existing legislation on data protection, Directive

text: , with a directly applicable regulation – the ‘General Data Protection Regulation’– promises to strengthen individual rights, to increase accountability of data controllers, to reinforce national supervision of compliance and to provide greater legal certainty for businesses.

text: 13. Directive

text: does not apply to the activities of the State in areas of criminal law (

text: Article 3(2)

text: ) and it provides for Member States the possibility to restrict the rights and obligations where necessary to safeguard, among other things, ‘the prevention, investigation, detection and prosecution of criminal offences’ (

text: Article 13(1)

text: ). Data processing in the framework of police and judicial cooperation in criminal matters can have a particularly high impact on an individual’s life. The current instrument however, Council Framework Decision 2008/977/JHA, only covers cross-border data processing and allows wide discretion to Member States in how principles are applied. The proposed directive replacing Framework Decision 2008/977/JHA would apply to domestic processing, though without affecting or improving the various existing rules contained in police and judicial cooperation instruments.

text: 14. The EDPS has consequently expressed regret that the Commission missed a unique opportunity to propose a single comprehensive framework with a high level of protection. If the legislator insists on a separate instrument for police and judicial cooperation, then the proposed directive must offer a level of protection equivalent to that in the proposed regulation. Evident gaps between the two instruments, such as the lack of clarity on responsibilities where there is a mix of actors and purposes in data processing, must be addressed. First efforts to evaluate

text: 15. In home affairs, the Commission presented in December 2012 a ‘European Information Exchange Model’, as the information management strategy promised by the Stockholm programme. This document, which contained the conclusion that neither new EU-level law enforcement databases, nor new EU information exchange instruments were needed, represented a welcome first step in the full evaluation of effectiveness of the use of data in the fight against crime which EDPS has long called for.

text: 16. Overall, however, data protection standards in justice and home affairs activities remain a patchwork which in the words of the European Parliament is ‘complicated and scattered, leading to inefficient use of the instruments available and to inadequate democratic oversight and accountability at EU level’. Specific measures

text: 17. The need for strict and specific conditions for disclosure of personal data from private parties to law enforcement authorities has been clearly underlined by the CJEU in its judgment on the Data Retention Directive. However, as was for instance illustrated by the agreement with the United States on the Terrorist Finance Tracking Programme, there is a tendency to grant law enforcement authorities access to personal data held by the private sector. This was one of the main reasons for the European Parliament’s rejection of the first agreement with the United States. Furthermore, there is a more general tendency - see for instance the Eurodac Regulation, the proposals for passenger name records and the smart borders package, to grant law enforcement authorities access to personal data of individuals that have been collected for other purposes.

text: 18. We have consistently raised concerns about these proposals. Resistance to initiatives in this area reflects heightened public sensitivity to measures which potentially interfere with fundamental rights - the European Parliament’s rejection of Anti-Counterfeiting Trade Agreement is an analogous high-profile case from outside the area of freedom, security and justice - which has become all the more acute in the wake of the National Security Agency revelations in 2013. MEPs also repeatedly criticised the Data Retention Directive before its eventual annulment by the CJEU. National laws on data retention are now susceptible to challenge on the grounds of lack of proportionality and sufficient safeguards as outlined by the Court.

text: 4. THE AREA OF FREEDOM, SECURITY AND JUSTICE AND DATA PROTECTION: RISKS AND OPPORTUNITIES Strategic evaluation of need for gathering and processing of personal data

text: 19. Revelations in the last year concerning mass surveillance programmes have evoked in the most dramatic and tangible way the urgency of addressing the interests of individuals, not simply as consumers of online services but as citizens with the fundamental rights to privacy and to the protection of personal data. A harmonised and relevant data protection framework reflects both the core values and the economic mission of the EU, and like overall justice policy should be viewed as ‘a support for economic recovery, growth and structural reforms’ Data protection can play a key role in demonstrating the added value of an EU approach within the area of freedom, security and justice.

text: 20. The EDPS has called on the Commission to assess the interference with fundamental rights in light of technological changes, the developments relating to IT large-scale systems and the growing use of data initially collected for purposes not related to the combat of crime, as well as on the effectiveness for public security of the current tendency to a widespread, systematic and proactive monitoring of non-suspected individuals and its real usefulness in the fight against crimes.

text: 21. A number of measures and proposed measures which envisage the processing of personal data have been unsuccessful due to insufficient respect for the rights to privacy and to the protection of personal data which in turn, in our view, results from the lack of strategic and systematic evaluation of future needs and policy objectives. This should be done via the integration of data protection concerns in general impact assessments, consideration of whether goals could be achieved through better implementation of existing measures or through alternative less intrusive means and strengthening data quality and data subject rights and redress.

text: 22. The Commission intends to review and update the integrated border management strategy, with the possibility of ‘integrated’ systems and platforms. It further envisages a joint review by the Parliament, Commission and Member States of the Internal Security Strategy . The Council for its part has discussed the need to explore a ‘comprehensive inter-connectedness of information, communication and data systems’ in the area of internal security. These exercises will provide an opportunity to evaluate home affairs policies, including initiatives like smart borders which have been under discussion for several years. The impact on data protection must be an integral part of that evaluation. As part of this, and in the light of the EP’s call for a European Digital Habeas Corpus, the EU should gather views on mass surveillance , with particular reference to relevant CJEU judgments. Understanding the real impact on citizens of specific measures

text: 23. The Commission recognises the need to continue a citizen-centred approach to the area of freedom, security and justice. The Commission in its communications on the future of justice and home affairs, reflects the view of several Member States that the EU should consolidate progress so far, monitor and evaluate existing measures, rather than seek to adopt more legislation for the sake of it. A citizen-centred approach which addresses the interests and fundamental rights of citizens would appear entirely sensible, especially given the difficult political and legal challenges to the EU’s policy. Part of the overall policy objectives should always be to reduce interference with the right to privacy and to better ensure the protection of personal data.

text: 24. However, as the recently published report from the Fundamental Rights Agency on judicial remedies has demonstrated, the ordinary citizen is hampered by lack of 30 information and prohibitive costs from obtaining redress for illegal data processing. Although the Commission notes that ‘Close cooperation between national authorities or administrative bodies is particularly important for the effectiveness of certain EU rights,’ the new strategic guidelines must make it a priority to identify practical steps which empower individuals to enforce the protection of their personal data. This would be in line with the Commission’s call for ‘complementary initiatives’ which will ‘facilitate citizens’ lives’.

text: 25. Impact assessments and evidence-based evaluation should address the real effect of measures which involve processing of personal data, in terms of number of people affected, risks of and safeguards against misuse of those data, and the remedies available to the individual data subject in the event of abuse. Implementation of measures and operational activities which depend heavily on data processing including those taking place under the EU policy cycle on Serious and Organised Crime should also take into 32 account any instances or allegations of abuse, and training needs addressed. An overall consideration here is the independence of national supervisory authorities, the importance of which has been reinforced by the CJEU in several recent judgments, and how supervision can be coordinated as is currently the practice with Eurodac, Customs, VIS and SIS II. Codification and standardisation: a chance to repair the patchwork

text: 26. For the justice area, the Commission argues in favour of codification of existing laws, practices and case law in the areas of civil and commercial law, consumer rights law and criminal law, on the grounds that this would simplify, raise awareness and enhance mutual trust, and eliminate inconsistencies and conflicting rules of interpretation in the area of freedom, security and justice. It is unclear what such a codification would entail. The EDPS has argued repeatedly for a more consistent standard for data protection in this area, rather than the current panoply of norms which militates against legal certainty for all concerned, whether competent authorities, industry or citizens. Any codification exercise ought to be extended to all instruments in the area of freedom, security and justice which have an impact on the right to personal data protection, whilst providing sufficient flexibility for legitimate public interests to be served.

text: 27. On home affairs, the Commission refers to the role of the Schengen Information System in safeguarding security and free movement, and to the need to revise the Schengen Visa Code and to complete ‘the world-wide roll out of the Visa Information System.’ The Commission is considering an evaluation of the impact of a system ‘based more on the assessment of individuals that [sic] on nationalities’. A more calibrated approach to personal data processing such as occurs through VIS and SIS II is sensible. Among the CJEU’s criticisms of Directive

text: was that it did not require any relationship between the data and a threat to public security, and was not restricted to specific individuals, time periods and places where data processing was likely to assist in the prevention, detection or prosecution of serious crime.

text: 28. A move towards individual risk assessment would presumably imply the gathering and analysis of information on certain individuals from multiple sources. As well as an implied need for mechanisms to monitor data quality, careful attention as part of the envisaged evaluation of such an approach would need to be paid to weighing the interference with those individuals’ rights to privacy and to protection of personal data. It will be essential to ensure clear and precise rules for such a policy change, setting out the responsibilities of data controllers especially if there is a possibility of subcontracting the collection of visa information. Cooperation with the private sector

text: 29. There is a clear emphasis in the Commission’s communication on the role of the private sector in the implementation of home affairs aims. This includes multiple measures, including the proposed EU framework for processing passenger name record data, how to address access to and use of telecommunications data following the annulment of Directive

text: , ‘stepping up’ cooperation on cybercrime through the European Cybercrime Centre, the proposed new anti-money laundering package, and cooperation between Europol and the private sector under a new Europol regulation.

text: 30. Access by law enforcement authorities to personal data which has been collected for other purposes has raised major concerns. It is an exception to the purpose limitation principle, and therefore it must respect strict criteria under data protection law and Articles 7 and 8 of the Charter. This requires that policy objectives must be clearly defined and procedural precision and sufficient safeguards against abuse must be foreseen. The danger to the citizen of increased cooperation between private and public sector in law enforcement matters, combined with a dual framework, is a diminution in accountability and transparency. This is even more evident if the cooperation takes place on a voluntary basis. The identity of the data controller responsible for ensuring compliance must be clear, as must be the data protection rules which are applicable. There must be a more explicit legal basis for such cooperation and a clearly specified and legitimate purpose for data processing. Third country cooperation

text: 31. Both the Commission and the Council lay significant emphasis on interaction with third countries, such as on cybercrime and human trafficking. The Commission intends to assess the effectiveness of existing arrangements for law enforcement information 38 exchange with third countries. Meanwhile, it continues to work towards an EU-US Umbrella Agreement on privacy and data protection and redress mechanisms for EU citizens, and it is reviewing the agreement with Canada on provision of passenger name records.

text: 32. The EDPS supports the objective of concluding agreements which establish clear legal frameworks for those exchanges of data between law enforcement authorities which are necessary and provide stronger data protection safeguards. However, any obligations imposed by an international agreement cannot prejudice the principle that EU measures must respect fundamental rights which cannot be violated by excessive surveillance activities. Agreements must not legitimise massive data transfers in a field - law enforcement - where the impact on individuals is particularly serious and where strict and reliable safeguards and guarantees are thus all the more needed, in particular preventing further processing for incompatible purposes, setting clear conditions for transfers to other authorities or third countries, and ensuring enforceable rights, including judicial redress mechanisms for data subjects in the EU. In cases where the national security exception is invoked, exceptions should be narrowly defined and with appropriate safeguards and limitations agreed. Recommendations on how to integrate privacy and data protection considerations

text: 33. For us, it is crucial that privacy and data protection considerations are fully integrated in the development of all new policies and legislation in the area of freedom, security and justice. Ways forward could in this context be:  integrating data protection concerns in general impact assessments;  assessing alternative less intrusive means to achieving policy objectives;  strengthening data quality and data subject rights and redress;  evaluating the exchange of information against policy objectives;  ensuring international agreements with third countries respect EU individuals' right to data protection.

text: 5. TOWARDS A NEW TEMPLATE FOR COOPERATION

text: 34. Over the coming years EU institutions will require a more sophisticated range of policymaking tools, ensuring that any measures in the area of freedom, security and justice which encroach on the rights to privacy and to data protection are proportionate to their aims, precise in their drafting and comprehensive in their safeguards against abuse. We recommend that references to these tools be mentioned in the European Council’s strategic guidelines. In our Policy Paper ’The EDPS as an advisor to EU institutions on policy and legislation: building on ten years of experience’ we announced that we will develop a ‘policy toolkit’, including general guidance to the legislator in the form for instance of thematic or sectoral guidelines. The toolkit would be designed to help the institutions make informed decisions on the data protection impacts of new proposals, and could be particularly helpful in the area of freedom, security and justice.

text: 35. We remain available to work with the institutions to devise a strategy and practical methodology for safeguarding data protection to enable the EU to meet legitimate objectives in more effective and efficient ways. Sector-specific guidance could set out the practical steps in assessing legitimacy of purpose and proportionality and in identifying minimum safeguards. The purpose of these guidelines would be to provide sufficient guarantees to individuals whose data are processed against the risk of abuse and against any unlawful access and use. The guidelines should also assist the quality of law-making at all stages where a proportionate interference with fundamental rights may be justified on grounds of legitimate public interest. This effort will take account of developing case law laying out criteria for assessing necessity and proportionality of a measure, and of course sufficient progress towards adoption of the revised data protection framework.

text: 6. CONCLUSIONS AND RECOMMENDATIONS

text: 36. The added value of the EU’s action in the area of freedom, security and justice is frequently queried, especially by Member States. The benefit lies in ensuring a consistent approach, for example through designing proportionate interoperable systems which can be, at the same time, good for security and for data protection. The new strategic guidelines are in our view an excellent opportunity for the institutions to bank the lessons learned and develop a toolkit for remedying the often insufficient safeguards for the fundamental right to personal data protection.

text: 37. The EU needs to demonstrate that it has learnt the lessons from the last five years, that it cannot adopt measures which, on close examination, interfere with fundamental rights and fail the tests of necessity and proportionality. As the Commission has reiterated many times, the Charter must now be the compass for EU policies and laws. The EDPS stands ready to assist in that process.

text: 38. The new guidelines by the European Council are a good occasion for the Union to show its intention to restore trust in its capacity to effectively protect individuals. For that reason, we suggest that the European Council addresses explicitly the following themes in the new guidelines: a. the huge volumes of personal data processing that is required by many of the EU laws and policies in the area of freedom, security and justice; b. the fragility of any measure which fails to respect fundamental rights, as has been witnessed in the Data Retention Directive, but may also apply to other ongoing initiatives such as the ‘smart borders’ package, and the various instruments relating to passenger name records; c. the importance of adopting as soon as possible a strong and modernised data protection framework in the EU, which should also be used as the compass for EU external policies; and d. the need to integrate privacy and data protection considerations in the development of all new policies and legislation in the area of freedom, security and justice.

text: 39. Ways forward to ensuring that privacy and data protection considerations are fully integrated in the development of all new policies and legislation in the area of freedom, security and justice could be:  integrating data protection concerns in general impact assessments;  assessing alternative less intrusive means to achieving policy objectives;  strengthening data quality and data subject rights and redress;  evaluating the exchange of information against policy objectives, and  ensuring international agreements with third countries respect EU individuals' right to data protection. Done in Brussels, 4 June 2014 (signed) Peter HUSTINX


text: Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

title: European Council strategic guidelines for the future development of justice and home affairs in the EU. Data protection aspects

text: PETER HUSTINX

type: rubrik

text: Herman VAN ROMPUY President of the European Council Rue de la Loi 175 1048 Brussels

text: Brussels, 17 June 2014 PH/AB/cpl D(2014)1335 C 2014-0146

text: Subject: European Council strategic guidelines for the future development of

text: Dear Mr President,

text: At its next meeting on 26-27 June, the European Council intends to agree strategic guidelines for the future development of justice and home affairs in the EU.

text: I agree that this document should be concise and focus on the main strategic challenges facing freedom, justice and security. However, I am concerned that the Commission communications and the Council’s recommendations barely acknowledge the role of data protection in ensuring the EU’s activities are appropriate and proportionate.

text: The importance of data protection in building the European area of freedom, security and justice cannot be overstated. The allegations of mass surveillance by security services have rocked the trust in the ability and willingness of governments and businesses to protect individual’s personal information. Recent judgments from the European Court of Justice, on the Data Retention Directive and on the right to request removal of data on search engines, have banished any lingering doubts over the need for EU activities to uphold the fundamental rights to privacy and to data protection. This is of strategic relevance not only for future policies in justice and home affairs but for the EU’s wider agenda for growth and investment in the digital economy.

text: In our Opinion on the future development of freedom, justice and security (a copy attached for ease of reference), we recommend that European Council use these strategic guidelines on freedom, justice and security as the opportunity for the Union to show its intention to restore trust in its capacity to effectively protect individuals. We recommend an explicit acknowledgment that many EU laws and policies in this area require personal data processing on a large scale and that failure to respect fundamental rights could lead to severe delays or abandonment of the priority measures for many Member States - as has been

text: witnessed in the Data Retention Directive, ‘smart borders’ package and passenger name records. It is therefore vital for a strong and modernised data protection framework in the EU to be adopted as soon as possible, and for privacy and data protection considerations to be mainstreamed into all new policies and legislation.

text: I recognise that the time available between now and the next meeting of the European Council is very short. Nevertheless, I would be very pleased to meet you briefly to discuss this, diaries permitting.

text: Yours sincerely,

text: (signed)

text: Peter Hustinx

text: Annex: Opinion

text: Cc: Mr Uwe CORSEPIUS, Secretary-General Mr Theodoros N. SOTIROPOULOS, Permanent Representative of Greece Mr Guy STESSENS, Secretariat General of the Council