# C_2013253EN.01000801.xml

| 3.9.2013 | EN | Official Journal of the European Union | C 253/8 |
| -------- | -- | -------------------------------------- | ------- |

---

Executive summary of the Opinion of the European Data Protection Supervisor on the Commission Proposal for a regulation of the European Parliament and the Council on market surveillance of products and amending various legislative instruments of the European Parliament and of the Council

(The full text of this Opinion can be found in English, French and German on the EDPS website http://www.edps.europa.eu)

2013/C 253/04

1.   Introduction

| 1. | On 13 February 2013, the Commission adopted its Product Safety and Market Surveillance Package, including a proposal for a regulation of the European Parliament and of the Council on market surveillance of products and amending Council Directives 89/686/EEC and 93/15/EEC, and Directives 94/9/EC, 94/25/EC, 95/16/EC, 97/23/EC, 1999/5/EC, 2000/9/EC, 2000/14/EC, 2001/95/EC, 2004/108/EC, 2006/42/EC, 2006/95/EC, 2007/23/EC, 2008/57/EC, 2009/48/EC, 2009/105/EC, 2009/142/EC, 2011/65/EU, Regulation (EU) No 305/2011, Regulation (EC) No 764/2008 and Regulation (EC) No 765/2008 of the European Parliament and of the Council (hereinafter ‘the Proposal’)( 1 ). On the same day, the Proposal was sent to the EDPS for consultation. |
| -- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

1.1.   Consultation of the EDPS

| 2. | Before the adoption of the Proposal, the EDPS was given the opportunity to provide informal comments. The EDPS welcomes the reference to the present consultation in the preamble of the Proposal. |
| -- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 3. | In the present Opinion, the EDPS wishes to highlight those elements of the Proposal which have personal data processing implications and to reiterate some of his earlier comments which, if taken on board, would further improve the text from a data protection perspective. |
| -- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

1.2.   General background

| 4. | The Proposal is part of the ‘Product Safety and Market Surveillance Package’ which also includes a proposal for a Regulation on consumer product safety( 2 ) (replacing the General Product Safety Directive 2001/95/EC, the ‘GPSD’) and a multi-annual action plan for market surveillance covering the period 2013-15. The overall objective is to clarify the regulatory framework for market surveillance in the field of non-food products (both for harmonised and non-harmonised products, whether intended for consumers or for professionals) and consolidate it in a single instrument. To this end, the Proposal merges the rules on market surveillance of the GPSD, Regulation (EC) No 765/2008( 3 ) and several sector-specific instruments of EU harmonisation legislation. |
| -- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

| 5. | In particular, the provisions regarding the functioning of the EU Rapid Information System (RAPEX)( 4 ) that are currently contained in the GPSD have been transferred to the Proposal, according to which RAPEX would become the single alert system regarding products presenting a risk to EU consumers. |
| -- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 6. | The Proposal will also formally establish the Information and Communication System for Market Surveillance (ICSMS)( 5 ) which will serve as a database of market surveillance information as well as a communication channel for market surveillance authorities. |
| -- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

3.   Conclusions

| 28. | The EDPS appreciates that data protection issues have been taken into account in the Proposal to a certain extent. However, in the present Opinion he gives some recommendations on how the Proposal could be further improved from a data protection perspective. |
| --- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

| 29. | In particular, the EDPS recommends:
—
including a substantive provision to clarify that the Proposal is not meant to provide for general derogations from data protection principles and that relevant personal data processing legislation (i.e. national rules implementing Directive 95/46/EC and Regulation (EC) No 45/2001) remain fully applicable in the market surveillance context. In addition, recital 30 would benefit from some redrafting, —
amending Articles 19 and 21 of the Proposal so as to ensure that only personal information which is strictly necessary is processed for market surveillance purposes in RAPEX and ICSMS, respectively, in accordance with the principles of proportionality and data minimisation, —
providing in the proposed Regulation (e.g. in Articles 19 and 21) for fixed retention periods for the personal data processed in RAPEX and ICSMS, keeping in mind that an unlimited retention period for personal data would be difficult to justify under EU data protection law (even though it may be justifiable in case of information about products), —
maintaining the approach by which the public is informed about unsafe products (via the RAPEX website) without rendering personal information of economic operator(s) responsible for those products public, and applying a similar approach in all instances where information is published by market surveillance authorities in the context of the Proposal, —
should it be the intention of the legislator to provide for the publication of personal information of economic operators (for example as a sanction in cases of repeated breaches or an additional deterrent), including explicit substantive provisions that would at least specify what kind of personal data may be made public and for what purpose(s): in this context, attention is drawn to the need to consider modalities of publication which would cause less interference with an individual’s right to respect for their private life and to protection of their personal data, in line with the Schecke judgment( 6 ) of the Court of Justice, —
supplementing the provisions on participation of applicant countries, third countries or international organisations in RAPEX (Article 19(4)), as well as on international exchange of confidential information (Article 22) with explicit references to specific provisions about personal data protection corresponding to those applicable in the Union, as required by Article 25 of Directive 95/46/EC and Article 9 of Regulation (EC) No 45/2001. | — | including a substantive provision to clarify that the Proposal is not meant to provide for general derogations from data protection principles and that relevant personal data processing legislation (i.e. national rules implementing Directive 95/46/EC and Regulation (EC) No 45/2001) remain fully applicable in the market surveillance context. In addition, recital 30 would benefit from some redrafting, | — | amending Articles 19 and 21 of the Proposal so as to ensure that only personal information which is strictly necessary is processed for market surveillance purposes in RAPEX and ICSMS, respectively, in accordance with the principles of proportionality and data minimisation, | — | providing in the proposed Regulation (e.g. in Articles 19 and 21) for fixed retention periods for the personal data processed in RAPEX and ICSMS, keeping in mind that an unlimited retention period for personal data would be difficult to justify under EU data protection law (even though it may be justifiable in case of information about products), | — | maintaining the approach by which the public is informed about unsafe products (via the RAPEX website) without rendering personal information of economic operator(s) responsible for those products public, and applying a similar approach in all instances where information is published by market surveillance authorities in the context of the Proposal, | — | should it be the intention of the legislator to provide for the publication of personal information of economic operators (for example as a sanction in cases of repeated breaches or an additional deterrent), including explicit substantive provisions that would at least specify what kind of personal data may be made public and for what purpose(s): in this context, attention is drawn to the need to consider modalities of publication which would cause less interference with an individual’s right to respect for their private life and to protection of their personal data, in line with the Schecke judgment( 6 ) of the Court of Justice, | — | supplementing the provisions on participation of applicant countries, third countries or international organisations in RAPEX (Article 19(4)), as well as on international exchange of confidential information (Article 22) with explicit references to specific provisions about personal data protection corresponding to those applicable in the Union, as required by Article 25 of Directive 95/46/EC and Article 9 of Regulation (EC) No 45/2001. |
| --- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| — | including a substantive provision to clarify that the Proposal is not meant to provide for general derogations from data protection principles and that relevant personal data processing legislation (i.e. national rules implementing Directive 95/46/EC and Regulation (EC) No 45/2001) remain fully applicable in the market surveillance context. In addition, recital 30 would benefit from some redrafting, | | | | | | | | | | | | |
| — | amending Articles 19 and 21 of the Proposal so as to ensure that only personal information which is strictly necessary is processed for market surveillance purposes in RAPEX and ICSMS, respectively, in accordance with the principles of proportionality and data minimisation, | | | | | | | | | | | | |
| — | providing in the proposed Regulation (e.g. in Articles 19 and 21) for fixed retention periods for the personal data processed in RAPEX and ICSMS, keeping in mind that an unlimited retention period for personal data would be difficult to justify under EU data protection law (even though it may be justifiable in case of information about products), | | | | | | | | | | | | |
| — | maintaining the approach by which the public is informed about unsafe products (via the RAPEX website) without rendering personal information of economic operator(s) responsible for those products public, and applying a similar approach in all instances where information is published by market surveillance authorities in the context of the Proposal, | | | | | | | | | | | | |
| — | should it be the intention of the legislator to provide for the publication of personal information of economic operators (for example as a sanction in cases of repeated breaches or an additional deterrent), including explicit substantive provisions that would at least specify what kind of personal data may be made public and for what purpose(s): in this context, attention is drawn to the need to consider modalities of publication which would cause less interference with an individual’s right to respect for their private life and to protection of their personal data, in line with the Schecke judgment( 6 ) of the Court of Justice, | | | | | | | | | | | | |
| — | supplementing the provisions on participation of applicant countries, third countries or international organisations in RAPEX (Article 19(4)), as well as on international exchange of confidential information (Article 22) with explicit references to specific provisions about personal data protection corresponding to those applicable in the Union, as required by Article 25 of Directive 95/46/EC and Article 9 of Regulation (EC) No 45/2001. | | | | | | | | | | | | |

Done at Brussels, 30 May 2013. Giovanni BUTTARELLI Assistant European Data Protection Supervisor

---

( 1 )  COM(2013) 75 final.

( 2 )  Proposal for a regulation of the European Parliament and of the Council on consumer product safety and repealing Council Directive 87/357/EEC and Directive 2001/95/EC (COM(2013) 78 final).

( 3 )  Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93 (OJ L 218, 13.8.2008, p. 30).

( 4 )  http://ec.europa.eu/consumers/safety/rapex/index_en.htm

( 5 )  https://www.icsms.org/icsms/App/index.jsp

( 6 )  CJEU, Schecke (C-92/09 and C-93/09), [2010] ECR I-11063.

---