# EUR-Lex - 52012SC0072 - EN

*|*

# 52012SC0072

**COMMISSION STAFF WORKING PAPER Impact Assessment /* SEC/2012/0072 final */**

			*

			*

COMMISSION STAFF WORKING PAPER

Impact Assessment

Accompanying the document

Regulation of the European
Parliament and of the Council on the protection of individuals with regard to
the processing of personal data and on the free movement of such data (General
Data Protection Regulation)
and 
Directive of the European Parliament and of the Council on the protection of
individuals with regard to the processing of personal data by competent
authorities for the purposes of prevention, investigation, detection or
prosecution of criminal offences or the execution of criminal penalties, and
the free movement of such data

Disclaimer

This impact
assessment report commits only the Commission's services involved in its
preparation and the text is prepared as a basis for comment and does not
prejudge the final form of any decision to be taken by the Commission.

Article 29
Working Party (WP 29): Data Protection Working
Party established by Article 29 of Directive 95/46/EC. It provides the European
Commission with independent advice on data protection matters and supports the
development of harmonised policies for data protection in the EU Member States.

Binding
corporate rules (BCR): Codes of practice based on
European data protection standards, approved by at least one Data Protection
Authority, which multinational organisations draw up and follow voluntarily to
ensure adequate safeguards for transfers or categories of transfers of personal
data between companies that are part of a same corporate group and that are bound
by these corporate rules.

Controller* or Data controller: Natural or legal person, public authority, organisation, agency or
any other body which alone or jointly with others determines the purposes and
means of the processing of personal data.

Data Protection
Authority (DPA)*: National supervisory
authority, acting with complete independence, responsible for monitoring the
application of data protection rules at national level (e.g. handling
complaints from individuals, carrying out investigations and inspections of
data controllers' activities, engage in legal proceedings against violations of
data protection rules).

Data Protection Impact Assessment (DPIA): A process whereby a conscious and systematic effort is made to
assess privacy risks to individuals in the collection, use and disclosure of
their personal data. DPIAs help identify privacy risks, foresee problems and
bring forward solutions.

Data Protection Officer (DPO): A person responsible within a data controller or a data
processor to supervise and monitor in an independent manner the internal
application and the respect of data protection rules. The DPO can be either an
internal employee or an external consultant.

Data
subject: An identified or identifiable person to
whom the "personal data" relate.

Personal
data* (sometimes simply referred to as "data"): Any information relating to an identified or identifiable natural
person (“data subject”); an identifiable person is one who can be identified,
directly or indirectly, in particular by reference to an identification number
or to one or more factors specific to his physical, physiological, mental,
economic, cultural or social identity.

Personal
data breach**: A breach of security leading to the accidental or unlawful
destruction, loss, alteration, unauthorised disclosure of, or access to,
personal data transmitted, stored or otherwise processed in connection with the
provision of a publicly available electronic communications service in the
Union.

Processing of personal data*:
Processing of personal data means any operation or
set of operations which is performed upon personal data, whether or not by
automatic means, such as collection, recording, organisation, storage,
adaptation or alteration, retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or combination,
blocking, erasure or destruction.

Processor* or Data processor:
The processor is the natural or legal person,
public authority, agency or any other body which processes personal data on
behalf of the controller.

Sensitive data: Data revealing racial or ethnic origin, political opinions,
religious or philosophical beliefs or trade union membership, data concerning
health or sex life, and data relating to offences, criminal convictions or
security measures.

Table of
contents

List of Annexes. vi

1........... Introduction. 7

2........... Procedural Issues and Consultation
of Interested Parties. 8

2.1........ Identification. 8

2.2........ Organisation
and timing. 8

2.3........ Consultation
of the IAB.. 8

2.4........ Consultation
and expertise. 9

3........... Problem definition.. 10

3.1........ Evaluation
of the EU data protection framework. 10

3.2........ Problem 1
– Barriers for business and public authorities due to fragmentation, legal
uncertainty and inconsistent enforcement 11

3.2.1..... Description
of the problem.. 11

3.2.2..... Who
is affected and to what extent?. 19

3.3........ Problem 2
– Difficulties for individuals to stay in control of their personal data. 21

3.3.1..... Description
of the problem.. 21

3.3.2..... Who
is affected and to what extent?. 29

3.4........ Problem 3
– Gaps and inconsistencies in the protection of personal data in the field of
police and judicial cooperation in criminal matters. 31

3.4.1........ Description of the problem.. 31

3.4.2..... Who
is affected and to what extent?. 35

3.5........ The
drivers behind the identified problems. 35

3.6........ Baseline
scenario: How would the problem evolve?. 36

3.6.1..... Fragmentation,
legal uncertainty and inconsistent enforcement 36

3.6.2..... Difficulties
for individuals in exercising their data protection rights effectively. 37

3.6.3..... Inconsistencies
and gaps in the protection of personal data in the field of police and judicial
cooperation in criminal matters and inconsistency of the rules. 37

3.7........ SUBSIDIARITY
AND PROPORTIONALITY.. 37

3.7.1..... Subsidiarity. 37

3.7.2..... Proportionality. 38

3.8........ Relation
with fundamental rights. 39

4........... Policy Objectives. 40

5........... Policy options. 44

5.1........ Options
to address Problem 1: Barriers for business and public authorities due to
fragmentation, legal uncertainty and inconsistent enforcement 45

5.1.1..... Addressing
fragmentation and legal uncertainty. 45

5.1.2..... Addressing
inconsistent enforcement 48

5.2........ Options
to address Problem 2: Difficulties for individuals in exercising their data
protection rights effectively  50

5.2.1..... Addressing
individuals' insufficient awareness and loss of control and trust 50

5.2.2..... Addressing
the difficulty for individuals to exercise their data protection rights. 52

5.3........ Options
to address Problem 3: Gaps and inconsistencies in the protection of personal
data in the field of police and judicial cooperation in criminal matters. 54

5.3.1..... Addressing
gaps in the Framework Decision. 54

5.3.2..... Addressing
fragmentation. 56

6........... Analysis of Impacts. 63

6.1........ Policy
objectives 1 and 2: Enhancing the internal market dimension of data protection
and increasing the effectiveness of data protection rights. 63

6.1.1..... POLICY
OPTION 1: Interpretation, technical support tools, encouragement of
self-regulation and cooperation and standardisation. 63

6.1.2..... POLICY
OPTION 2: Legislative amendments addressing gaps in current harmonisation,
clarifying and strengthening individuals' rights and reinforcing responsibility
of data controllers and processors, reinforcement and harmonisation of DPA
powers and strengthening of their cooperation. 65

6.1.3..... POLICY
OPTION 3: Detailed harmonisation and rules at EU level in all policy fields and
sectors, centralised enforcement and EU wide harmonised sanctions and redress
mechanisms. 71

6.2........ Objective
3: Enhancing the coherence of the EU data protection framework in the field of
police and judicial cooperation in criminal matters. 74

6.2.1..... POLICY
OPTION 2: Strengthened specific rules and new instrument with extended scope. 74

6.2.2..... POLICY
OPTION 3: Extended specific rules and full integration of general principles in
former third pillar instruments. 75

7........... Comparing the Options. 79

7.1.1..... Analysis. 79

7.1.1..... Policy
Option 1. 79

7.1.2..... Policy
Option 2. 79

7.1.3..... Policy
Option 3. 79

7.2........ Summary
table comparing the policy options. 81

7.3........ Preferred
Option. 87

7.4........ Impacts
on simplification of the Preferred Option. 90

8........... Monitoring and evaluation. 92

List of Annexes

Annex 1: Current EU Legal instruments on
data protection

Annex 2: Evaluation of the implementation of the Data Protection Directive

Annex 3: Data protection in the areas of police and judicial co-operation in
criminal matters

Annex 4: Summary of replies to the public consultation on the Commission's
Communication on a Comprehensive Approach on Personal Data Protection in the
European Union

Annex 5: Detailed Analysis of Impacts

Annex 6: Detailed Assessment of Impacts of the Introduction of Data
Protection Officers (DPOs) and Data Protection Impact Assessments (DPIAs)

Annex 7: Analysis of the Impacts of Policy Options on Fundamental Rights

Annex 8: Consultation of SMEs

Annex 9: Calculation of Administrative Costs in the Baseline Scenario and
Preferred Option

Annex 10: Impacts of the preferred option on competitiveness

1. 
Introduction

The
centrepiece of EU legislation on data protection, Directive 95/46/EC[1]
(hereinafter "the Directive"), was adopted in 1995 with two
objectives in mind: to protect the fundamental right to data protection and to guarantee
the free flow of personal data between Member States. It was complemented by
several instruments providing specific data protection rules in the area of
police and judicial cooperation in criminal matters[2]
(ex third pillar), including Framework Decision 2008/977/JHA (hereinafter
"the Framework Decision")[3].

Rapid technological and business developments have brought new challenges for the protection of personal data. The
scale of data sharing and collecting has increased dramatically. Technology
allows both private companies and public authorities to make use of personal
data on an unprecedented scale in order to pursue their activities. Individuals
increasingly make personal information available publicly and globally. Technology
has transformed both the economy and social life.

Building trust in the online environment is key to economic
development. Lack of trust makes consumers
hesitate to buy online and adopt new services, including public e-government
services. If not addressed, this lack of confidence will continue to slow down
the development of innovative uses of new technologies, to act as an obstacle
to economic growth and to block the public sector from reaping the potential
benefits of digitisation of its services, e.g. in more efficient and less
resource intensive provisions of services. This is why data protection plays a
central role in the Digital Agenda for Europe[4],
and more generally in the Europe 2020 Strategy[5].

The Lisbon Treaty defines the right to data protection as a principle of the EU and
introduces a specific legal basis for the adoption of rules on the protection
of personal data[6] that
also applies to police and judicial cooperation in criminal matters. Article 8
of the EU’s Charter of
Fundamental Rights (CFR) enshrines data protection as a
fundamental right.

The
European Council invited the Commission to evaluate the functioning of EU
instruments on data protection and to present, where necessary, further
legislative and non-legislative initiatives[7]. In its
resolution on the Stockholm Programme, the European Parliament[8]
welcomed a comprehensive data protection scheme in the EU and called for the
revision of the Framework Decision among other measures.

The
Commission's broad public consultations and extensive stakeholder dialogues
have confirmed that there is general agreement that the current framework
remains sound as far as its objectives and principles are concerned. However, it
has not prevented fragmentation in the way data protection is implemented
across the Union, which causes legal uncertainty and a widespread public
perception that there are significant privacy risks associated notably with
online activity[9].

This
is why it is time to build a stronger and more coherent data protection
framework in the EU, backed by strong enforcement that will allow the digital
economy to develop across the internal market, put individuals in control of
their own data and reinforce legal and practical certainty for economic
operators and public authorities.

The
Commission highlighted the policy objectives of this reform in its
Communication on a comprehensive approach on personal
data protection in the European Union adopted on 4 November 2010[10].
It is now translating these policy objectives into concrete reform proposals.

This
impact assessment focuses on the review of the Directive and the Framework
Decision. The Commission will assess the need to adapt other legal instruments
to the new general framework at a later stage[11].

2. 
Procedural Issues and Consultation
of Interested Parties
2.1. 
Identification

Title: Impact assessment on the reform of the data protection
regulatory framework

Lead DG: Justice

Agenda
planning number: AP 2010/279, CWP 2011 Annex 1

2.2. 
Organisation and timing

The
evaluation and impact assessment process for the review of the personal data
protection regulatory framework started with a general public consultation
phase in May 2009. Evaluations of the Directive and of the Framework Decision
were carried out by the Commission services in 2010 and 2011 (see below §
3.1 and annexes 2 and 3). Two external studies[12]
supported the evaluation and impact assessment. A specific report by the
Commission evaluates the implementation of the Framework Decision by Member
States.[13]

The
inter-service impact assessment steering group was convened for the first time
on 3 March 2010 and met again on 27 May 2010, 9 March 2011 and 14 July 2011.
The following Commission services were invited to participate in the steering
group: the Secretariat-General, the Legal Service, DG AGRI, DG AIDCO, DG COMM,
DG COMP, DG EMPL, DG ENER, DG ESTAT, DG HOME, DG INFSO, DG JRC, DG MARKT, DG
MOVE, DG OLAF, DG RTD, DG SANCO, DG TAXUD, DG TRADE and the EEAS.

2.3. 
Consultation of the IAB

Following
the IAB opinion, the following changes were made to the present report:

· 
The objectives of the current legal framework
(to what extent they were achieved, to what extent they were not), as well as
the objectives of the current reform, were clarified;

· 
More evidence and additional explanations/clarification
were added to the problems' definition section;

· 
A section on proportionality was added;

· 
All calculations and estimations related to
administrative burden in the baseline scenario and in the preferred option have
been entirely reviewed and revised (including Annex 9 on administrative
burden calculations), and the relation between the costs of notifications
and the overall fragmentation costs has been clarified;

· 
Impacts on SMEs, particularly of DPOs and DPIAs
have been better specified;

· 
The analysis of impacts (especially economic
ones, on competitiveness) has been improved;

· 
The description of the options has been revised
and clarified;

· 
A table comparing the different options was
added, as well as on the preferred option;

· 
A new annex (n° 10) on competitiveness proofing
of the preferred option was added.

2.4. 
Consultation and expertise

The
evaluation included a broad-based consultation process, which lasted for more
than two years and included two phases of public consultation.

The first
general public consultation was launched in May 2009 with a conference on
personal data protection. The replies to the consultation and the summary of
the results are available at: http://ec.europa.eu/justice/news/consulting_public/news_consulting_0003_en.htm.
A second public consultation was launched following the adoption of the
Commission's Communication of 4 November 2010[14]. A summary of
the responses is included in annex 4.

Targeted consultations
were also conducted with key stakeholders; specific events were organised on 29
June 2010 with Member State authorities and on 1 July 2010 with private
stakeholders, including private companies, as well as privacy and consumers'
organisations.

In November
2010, Vice-President Reding organised a roundtable on the data protection
reform and on 28 January 2011 (Data Protection Day), the European Commission
and the Council of Europe co-organised a High-Level Conference to discuss
issues related to the reform of the EU legal framework as well as to the need
for common data protection standards worldwide (http://www.data-protection-day.net/init.xhtml?event=36).
Two Conferences on data protection were hosted by the Hungarian and Polish
Presidencies of the Council on 16-17 June 2011 and on 21 September 2011
respectively.

Dedicated workshops
and seminars on specific issues were held throughout 2011. On 24 January ENISA
(the European Network and Information Security Agency, dealing with security
issues related to communication networks and information systems) organised a
workshop on data breach notifications in Europe[15].
On 2 February the Commission convened a workshop with Member States'
authorities to discuss the implementation of the Framework Decision and, more
generally, data protection issues in the area of police cooperation and
judicial cooperation in criminal matters. On 21-22 February the Fundamental
Rights Agency held a stakeholder consultation meeting on "Data Protection
and Privacy". A discussion on key issues of the reform was held on 13 July
2011 with national Data Protection Authorities.

EU
citizens were consulted through a Eurobarometer survey held in November-December
2010[16].

The
"Article 29 Working Party" (WP29)[17] provided several
opinions and useful input to the Commission[18]. The EDPS
also issued a comprehensive opinion on the issues raised in the Commission's
November 2010 Communication[19].

A
large majority of stakeholders agreed that the general principles remain valid
but that there is a need to adapt the current framework in order to better
respond to challenges posed by the rapid development of new technologies
(particularly online) and increasing globalisation, while maintaining
the technological neutrality of the Directive. Private sector data controllers
in particular have underlined the need to increase harmonisation
within the EU and to better apply the existing data protection principles in
practice. Furthermore, they consider that the complexity of the rules on
international transfers of personal data constitutes an impediment to their
operations as they regularly need to transfer personal data from the EU to
other parts of the world.

3. 
Problem definition
3.1. 
Evaluation of the EU
data protection framework

The main and
overarching objective of the current legal framework on data protection is to ensure
a high level of data protection for all individuals in the EU.

The Directive also
aims at achieving an equivalent level of data protection in all Member States
in order to ensure the free flow of information within the internal market.

In the police and
criminal justice area, a specific aim – enshrined in the Framework Decision –
is to enhance mutual trust and thus support the exchange of personal
data between police and judicial authorities.

All
these objectives, which remain entirely valid today, have only been partially
achieved under the current legal framework.

As
to the first objective, the Directive contains principles that are still sound
and guarantee a high level of protection. However, there are today new
challenges to the protection of personal data that could not be foreseen 16
years ago, when the Directive was adopted, linked to technological developments
and globalisation. In particular, the development of the internet has greatly
facilitated and increased the scale of data collecting and sharing, across
geographical and virtual borders. The result is that personal data today may be
processed more easily and on an unprecedented scale by both private companies
and public authorities, which increases the risks for individuals' rights and
challenges their capacity of keeping control over their own data (see
Section 3.3., Problem 2 below). Moreover, there are wide divergences in the
way Member States have transposed and enforced the Directive, so that in
reality the protection of personal data across the EU cannot be considered
as equivalent today.

Differences
in national transposition and enforcement have also limited the
achievement of the "internal market objective" of the Directive, as
highlighted already in the 2003 and 2007 implementation reports[20]. Although there
is no evidence that any Member State has ever blocked the flow of personal data
to or from another Member State, these differences in approach have led to
costly legal fragmentation and uncertainty with negative consequences for
businesses, individuals and the public sector (see Section 3.2., Problem 1
below).

The
application of the EU data protection acquis in the area of police
cooperation and judicial cooperation in criminal matters, in particular
the Framework Decision, resulted in gaps and inconsistencies, which have
affected both the level of protection for individuals and the mutual trust and
cooperation between police and judicial authorities (see Section 3.4.,
Problem 3 below).

3.2. 
Problem 1 – Barriers for
business and public authorities due to fragmentation, legal uncertainty and
inconsistent enforcement
3.2.1. 
Description of
the problem

The
current divergences in the implementation, interpretation and enforcement of
the Directive by Member States hamper the functioning of the internal
market and cooperation between public authorities in relation to EU policies.
This goes against the fundamental objective of the Directive of facilitating
the free flow of personal data in the internal market. These divergences raise
the compliance costs related to data processing and transfer operations between
Member States, without any corresponding benefit in terms of data protection,
and may discourage some economically or socially beneficial activities which
would require cross-border transfers of data within the EU. It is estimated
that the fragmentation of the legal framework gives rise to administrative
burden costing EU firms close to € 3 billion per year.

The
rapid development of new technologies and globalisation further exacerbates this
problem.  A comparative study on different approaches
to new privacy challenges for the European Commission[21]
found that

"We have seen dramatic technological
change since the European Commission first proposed the Data Protection
Directive in 1990. The Internet has moved out of the university lab into 56% of
European homes and 95% of OECD businesses. Computer processing power has
continued to follow Moore’s Law, with transistor density doubling every 18-24
months – around one thousand-fold in the last two decades. Computer storage
capacity and communications bandwidth have both been increasing even more
quickly, doubling every 12 months and hence a thousand-fold each decade. These
exponential increases have radically increased the ability of organisations to
collect, store and process personal data. The physical environment is now
saturated with sensors such as CCTV cameras and mobile phones, with biometric
and electronic identifiers used to link data to individuals. In the digital
world almost every communication and Web page access leaves behind detailed
footprints. The Internet and mobile information appliances allow large
quantities of personal data to be trivially moved between jurisdictions. Data
mining tools attempt to find patterns in large collections of personal data,
both to identify individuals “of interest” and to attempt to predict their
interests and preferences. New multinational companies have sprung up around
these technologies to service a global customer base, with smaller enterprises
outsourcing employee and customer data processing to developing world
companies."

There are hardly any business transactions
today which are not supported by information technology. Online transactions
produce a trail of personal data by their very nature. With the introduction of
loyalty cards and other systems, even day-to-day retail operations in normal
supermarkets now leave a trail of personal data. Most travelling and leisure
activities and service contracts have become unthinkable without the processing
of personal data at a large scale. While for some traditional services, e.g.
payment cards, the revenue from the collection and use of data has become more
important than that from the actual consumer service, new business models have
emerged that rely exclusively on this revenue source for their financing and
profit, e.g. some search engines and social networking services monetizing
their data through targeted advertising.

Where these services are provided online,
they are generally accessible regardless of the geographic location of user and
service provider, and the operation of the service includes the transfer of
personal data across borders. Large enterprises can afford the necessary legal
expertise to ensure compliance with all relevant legislations and/or the
technical efforts to ensure that their offering is adapted for each
jurisdiction to the local requirements. Small and medium enterprises, on the
contrary, do not have the resources for such expertise or adaptation and
accordingly refrain from offering their services online altogether or choose to
refuse servicing customers outside their national jurisdiction. While data
protection legislation is not the only element contributing to these
difficulties for businesses – others include intellectual property law,
taxation and elements of civil law – it is one of the elements that need to be
addressed in a comprehensive strategy to remove remaining obstacles in the
digital single market, in line with the Commission's initiatives under the
Stockholm Action Plan and the Digital Agenda for Europe.

a)
Fragmentation and legal uncertainty

A
first cause of the existing fragmentation of the legal framework on data
protection is the fact that the Directive contains a number of provisions that
are broadly formulated, and - sometimes intentionally - leave Member States significant
room for manoeuvre in transposing them. For example, Article 5 of the Directive
states that "Member States shall [...] determine more precisely the
conditions under which the processing of data is lawful". Furthermore, there
is currently no strong mechanism to ensure a harmonised interpretation
of the Directive. The Commission’s implementing powers are limited to the
external dimension of the Directive (transfers of data to third countries). The
opinions of the Article 29 Working Party on questions covering "the
application of the national measures adopted under this Directive in order to
contribute to the uniform application of such measures"[22]
are not binding and are therefore not always followed in practice by DPAs.

As
a consequence, key provisions and concepts have been interpreted and transposed
in quite different ways by Member States, so that the same processing
is treated divergently across Member States and thus impacts cross-border
processing activities by public authorities and businesses. This concerns,
for example, the following issues[23]:

- Consent:

Consent
is currently defined in the Directive as "any freely given specific and
informed indication", of the data subject's wishes to give his/her agreement
to the processing of personal data relating to him or her[24]
which must be "unambiguously given" in order to make the processing
of personal data legitimate. National laws have transposed this concept quite differently
and consequently national DPAs apply different interpretations of consent and
of its modalities. In particular, the meaning of "unambiguously
given" consent is interpreted in a variable manner: in some Member States,
consent has to be given "expressly" and in some cases even in writing[25],
while other Member States and DPAs also accept some forms of implied consent[26].
The consequence is that a valid consent in one Member State would not be legally
valid in others, therefore creating uncertainty amongst data controllers operating
in several Member States on whether a data processing  is lawful or not.

- Sensitive data[27]:

"Sensitive
data" are special categories of data (i.e., data revealing racial or
ethnic origin, political opinions, religious or philosophical beliefs,
trade-union membership, and data concerning health or sex life) whose
processing shall in principle be prohibited, unless certain conditions are
fulfilled and safeguards provided.

Some
Member States have specified and added categories to those included in the
Directive, for example biometric data (e.g. the Czech Republic, Slovenia and
Estonia) genetic data (Bulgaria, the Czech Republic, Estonia, Luxembourg and
Portugal) or party membership (Poland). Some Member States have also included
data from the judiciary, for example information about previous convictions or
criminal behaviour (e.g. Cyprus, the Czech Republic, Estonia, Slovenia, Spain,
the Netherlands and Poland). On the other hand, some national laws do not
consider as sensitive data on ethnic origin, political opinions or
philosophical beliefs.  There is also a very varied  implementation – due to
the room for manoeuvre left by the Directive in this respect – of the
exceptions from the general prohibition of processing 'sensitive data'. For
example, in relation to the possibility of processing health-related data (an
exception to the general prohibition), some Member States (e.g. Cyprus and
Denmark) allow this only when data are processed by health professionals,
whereas in the Czech Republic and in Slovakia processing of such data is
possible also for  health insurance purposes. Also in this case, different
requirements across Member States entail legal uncertainty and costs for both
private (e.g. companies operating in the health sector) and public data
controllers (on this aspect, see Section 3.2.2 b).

-  Notification:

Currently
data controllers have the obligation to notify their processing operations to national
DPAs, unless there are grounds for being exempted[28].
A large discretion is left to Member States in deciding possible exemptions to
such obligation (and any other form of simplification), so that the same data processing
activity could involve an obligation to notify the DPA in some Member States
and not in others. For example, some Member States have made extensive use of
the possibility for exemptions from the notification requirement by increasing
the accountability of the data controller - in particular through the
appointment of a Data Protection Officer (DPO)[29] – while
others make very limited exemptions. Moreover, several DPAs charge for
notifications, whereas others do not (the charge for a single notification
ranges from about €23 to €599 and may depend on whether  a data controller is a
natural or legal person, public or private sector etc)[30].

All
of this imposes costs and cumbersome procedures on business, without delivering
any clear corresponding benefit in terms of data protection. All economic
stakeholders have confirmed in the course of the public consultation that the
current notification regime is unnecessarily bureaucratic and costly. DPAs
themselves agree on the need to revise and simplify the current system[31].

This
problem is made more acute by the current regime on applicable law as established
by the Directive[32], which allows for a
"cumulative" and simultaneous application of different national laws
to a same data controller established in several Member States. This means that
such controller will have to comply with the different national laws,
obligations and varied requirements that apply for each of its establishments.
It is important to note that the notion of "establishment", as
confirmed by the opinion of the Article 29 Working Party on the issue[33],
has generally been interpreted broadly by DPAs. In practice even an attorney
office, a one-man office or a simple agent in a Member State are often
considered as an "establishment", and thus lead to the application of
the national laws of the Member States concerned.

This
means that the fragmentation – and the costs linked to that (see Section
3.2.2 below) - caused by diverging national requirements combined with the
simultaneous application of national laws affects not only large enterprises
with physical establishment/branches in Member States but most of the companies
carrying out cross-border activities.

Example
1 below helps to show how these costs arise.

Example 1 [34]: Legal complexity and cost of notifications for a data controller processing personal data in 15 Member States

A chain of shops has its head office in Member State X and franchised shops in 14 other Member States. Data relating to clients are collected in every shop, but are transferred to the head office in Member State X where some activities related to the processing of data take place (e.g. targeted advertising). The data protection law of Member State X would therefore be applicable to the processing activities carried out by the head office. However, the individual shops remain responsible for processing of their customers' personal data, which take place in the context of the shops' activities (for example, the collection of customers' personal data). To the extent that processing is carried out in the context of each shop's activities, it is subject to the law of the Member State where that shop is established. This means that each shop must notify its personal data processing operations to the national DPA according to the data protection law of the Member State where the shop is established, if notification is required by that law. The head office in Member State X and the individual shops in the other Member States could therefore be faced with the following scenario regarding notifications: - Five Member States exempt all data controllers from notification requirements except in cases of sensitive data processing; hence the shops established in those five Member States do not have to notify their data processing operations. - Member State X and four additional Member States A, B, C and D oblige all data controllers to notify processing operations and charge a fee of €300. The head office and the shops established in those five Member States have to notify the Data Protection Authority (DPA) in the Member State where they are established. - Three Member States E, F and G exempt data controllers from notifications only if they have appointed a Data Protection Officer (DPO). If not, they have to notify and pay a charge of €150. The shops in these Member States have not appointed a DPO and therefore they have to notify their operations. - Member State H obliges data controllers to notify processing only when processing is done through automated means and charges a fee of €500. The shop has to notify. - Member State I obliges all data controllers to notify and charges a fee of €25. In all cases where the shops have to notify the data processing operations in accordance with national data protection rules, the head office of the company has to consult a local lawyer to ensure legal compliance. Taking an average legal cost across the EU of €250/hour and assuming four hours of legal work per Member State, excluding the Member States that do not oblige data controllers to notify processing, the company would incur a cost of €10,000 in order to obtain legal advice. Including the notification fees for the processing activities in Member States X and A-I, the total costs of the notification requirement would be €12,475.

The
overall cost of notifications – only in terms of administrative burden -
is of approximately €130 million per year (see Annex 9 for details). In
addition to the administrative burden, other direct and indirect costs of the
requirement and its fragmentation have to be taken into account. This includes,
inter alia, direct fees for notifications collected by some data
protection authorities.

Notifications
are, however, only one procedural element illustrating the effect of
fragmentation with particular clarity, but by far not the most important one in
terms of its economic effect. A more detailed estimation of the overall effects
of fragmentation is provided in Annex 9.

Fragmentation
also negatively affects efficiency and effectiveness of public authorities
as explained under Section 3.2.2 b) below.

- Transfers to third countries

Divergent
approaches in the transposition of the Directive also apply to the provisions
on transfers to third countries, which are additionally challenged by
the increasingly globalised nature of data flows (i.e. the fact that personal
data are being transferred across a large number of virtual and geographical
borders, such as in the framework of "cloud computing").

This
is illustrated by the following:

a) Adequacy:

One
of the criteria for transferring personal data to a third country is that the
latter provides for an 'adequate' level of protection in relation
to the data being transferred[35]. Currently, the decision
on such adequate level of protection of a third country may be taken either by
the Commission – in which case all Member States are bound by it - or by Member
States themselves. In the latter case, some Member States allow the data
controller itself to conduct the adequacy check (e.g. the UK), while others
reserve it for national authorities, in particular the DPAs (e.g. France). This
leads to a situation whereby transfers towards a certain third country may be
considered lawful (as the level of data protection is considered to be
adequate) in a Member State but not in others, and thus creates legal
uncertainty for data controllers operating in more than one Member State that
want to transfer data lawfully to a third country.

b) "Standard contractual clauses":

These
are standard data protection clauses, established by Commission Decisions, to
be included in contracts that allow data transfers from a data controller
established in the EU to data controllers and processors in third countries[36].
Although Member States are under
the obligation to recognise the standard contractual clauses approved by the
Commission as fulfilling the requirements laid down by the Directive for the
transfer of data to a third country - and can thus not refuse the transfer - some of them still
require their national DPAs to review them and give their prior authorisation
to the transfer. In such cases, data controllers are subject to unnecessary and
varied requirements/authorisations, in spite of the establishment of model
clauses aimed at facilitating the transfers while ensuring the necessary
guarantees in terms of protection.

c)
"Binding Corporate Rules" (BCRs):

"Binding
Corporate Rules" (BCRs) are internal rules followed by a multinational
corporation for transfers of personal data between the groups of companies
belonging to the same multinational corporation, approved by one (or more) DPAs.
BCRs have been developed as a matter of practice by DPAs and by the WP29[37]
on the basis of an extensive interpretation of Article 25(2) of the Directive,
in order to facilitate data transfers within multinationals operating worldwide.
In such cases, if the transfers had to be regulated via contractual clauses
(standard or not), this would require the conclusion of a myriad of contracts
between the different entities of the group, which would have to follow the
requirements provided for under the different national laws applicable. This
type of situation can be avoided via the use of BCRs, which are therefore
recognised as a useful tool by economic stakeholders, particularly by companies
operating across several Member States and third countries. There are, however,
some shortcomings that currently discourage companies from using them[38],
such as:

- 
not all Member States and DPAs recognise the decisions taken by other DPAs and
impose additional national requirements. The so-called "mutual recognition
procedure" – whereby BCRs are reviewed and approved only by the "lead
DPA", assisted by two other concerned DPAs[39]
-  is currently accepted only by 17 Member States plus the 3 EEA countries;

-
the length of the current procedure for recognising/approving BCRs: six months
as an average, but up to two years in complex cases and even longer when
several authorisations are required according to national law;

-
BCRs are currently limited to data controllers and do not cover data processors[40];

-
the uncertainty about the possibility of applying BCRs to "groups of
companies", because there is no clear definition of what this would cover.

According
to feedback from stakeholders, particularly large enterprises, the above
situation is an obstacle to business operations and reduces the attractiveness
of the EU as a business location, as companies regularly need to transfer
personal data from EU Member States to other world regions.

b) Inconsistent enforcement of data protection rules across the EU

In
the 2003 implementation report of the Directive, the Commission considered
enforcement as one of the problematic issues – mainly due to the limited
resources of DPAs and to their non-prioritisation of enforcement tasks -
stressing that "more vigorous and effective enforcement" was needed
to improve compliance with the legislation. "Closer cooperation among the
supervisory authorities" was also seen as a means – as an alternative to
the revision of the Directive – to remedy the divergences between Member
States' laws.

However, as confirmed
by a comprehensive report issued recently by the Fundamental Rights Agency[41],
the situation has not really improved since then.

– 
Limited resources available to DPAs

First of all, there are still important variations
in the level of funding of data protection authorities and the resources
available to them.  Some DPAs are still under-resourced[42]
and have thus difficulties in handling all complaints they receive, in carrying
out enforcement actions and in cooperating effectively with other DPAs[43].

– 
Different powers of national DPAs

Secondly,
in some Member States the "effective powers of intervention" of DPAs
as required by the Directive[44] are limited: for
example, not all DPAs have the power to stop processing (e.g. BE), order the
destruction or erasure of data (e.g., BE, DE, SE), access data banks and filing
systems (e.g. UK) or to refer/bring the case before the judicial authorities
(e.g., EE). Equally, not all DPAs have the power to impose fines on data controllers
(e.g. BE, DK, LT, HU, AT, PL, SE); when fines are foreseen, their amount also varies
considerably (see Annex 2 for details). In some cases, DPAs may only negotiate
amicable solutions with those having violated the law or to refer them to
courts (e.g., BE). Finally, some DPAs appear not to act with "complete
independence" as required by Article 28(1) of the Directive and interpreted
by the Court of Justice[45]. This means that the
effective level of data protection varies across the EU, with the consequence
that EU citizens’ fundamental rights – the right to privacy, for example – may
in practice differ from one Member State to the next.

– 
Lack of effective cooperation between DPAs and
absence of regulatory powers for the European Commission

The
Directive establishes a general duty of mutual cooperation and information
exchange between national supervisory authorities[46].
However, as highlighted by DPAs themselves, practical cooperation between
national supervisory authorities in cross-border cases can and should be
improved[47].

Moreover,
existing non-binding mechanisms and structures to ensure DPAs cooperation and
to contribute to the "uniform application" of national laws on data
protection – the Article 29 Working Party (WP29), in particular - are deficient
in this regard[48]. While the WP29, and
advisory body to the Commission[49], regularly adopts
opinion on the interpretation of different provisions of the Directive to help
uniform application, these are not binding and are not always followed by DPAs[50].

In
addition, the fact that the Commission also ensures the secretariat of the WP29[51]
leads to uncertainties as to the demarcation between the role of the Commission
as an Institution, on the one hand, and its role as secretariat, on the other.
For example, while the Directive states that WP29 "[shall] act independently",
some of its opinions - largely publicised in the press – have been perceived by
some stakeholders as being "the Commission's view (or
interpretation)" of a certain matter related to the Directive[52].
This misperception can be particularly problematic in cases where the opinions
openly criticise EU policies[53]. On the other side, WP29
tends to consider that its independence can be undermined by the fact that the
Commission provide for its secretariat and determine the available resources.

The
result of the above is that the existing governance system often leads to
divergent decisions of DPAs vis-à-vis the same data controller for the
same data processing, i.e. there is currently no "one-stop shop" for
data controllers. This adds further to the uncertainty and costs faced by
companies. No single DPA has a complete overview of the processing activities of
companies that are established (or, if based outside the EU, have appointed a
representative) in several Member States and are subject to different national
laws as well as to the "jurisdiction" of different DPAs.

This
clearly does not help addressing, and on the contrary exacerbates, the problem
of legal fragmentation at EU level and prevents an effective and consistent
handling of cases where the right to data protection is affected on a European
– if not global – scale.

Example
2 below illustrates the difficulties in ensuring a common and consistent
European approach in enforcing the rules vis-à-vis data
controllers affecting personal data across the EU and highlights the limits of
the current enforcement model, as well as the lack of satisfactory cooperation
between national DPAs.

Example 2: Different approaches towards online mapping services A multinational company with several establishments in EU Member States has recently deployed an online navigation and mapping system across Europe. This system collects images of all private and public buildings, and may also take pictures of individuals. The data protection safeguards applied to this service and thus the requirements imposed upon data controllers vary substantially from one Member State to another. Depending on the Member States and on their implementation of the notification requirements into national law, a notification may or may not be required for this system. In one Member State, the deployment of this service led to a major public and political outcry, and some aspects of it were considered to be unlawful. This concerned, for example, the inclusion of un-blurred pictures of persons entirely unaware that they were being photographed. The company then offered additional guarantees and safeguards to the individuals residing in that Member State after negotiation with the competent DPA. However the company refused to commit to offer the same additional guarantees to individuals in other Member States facing similar problems. Whereas in some Member States the company was sanctioned, in other Member States the DPAs considered that such a navigation or mapping system was in line with data protection requirements. The WP29 attempted, unsuccessfully, to coordinate the different DPAs positions so as to have a common EU approach and ensure a consistent enforcement of the rules vis-à-vis data controllers and individuals.

3.2.2. 
Who is affected
and to what extent?

a) Economic
operators

As the Directive leads to the simultaneous application of national
laws where the controller is established in several Member States, data
controllers operating across borders need to spend time and money (for
legal advice, to prepare the required forms/documents etc) to comply with
different, and sometimes contradictory, obligations, such as the
different requirements for notifications of data processing to DPAs. According
to stakeholders' feedback, the data controller has to bear an administrative
burden estimated to correspond to around €200 per (new)
notification to the DPA, without including the notification fees
charged by the DPA itself. This leads to an overall administrative burden of €
130 million per year due to notifications requirements (see Annex 9 for
details). In addition to the administrative burden, other direct and indirect
costs of the requirement and its fragmentation have to be taken into account.
This includes, inter alia, direct fees for notifications collected
by some data protection authorities.

As
highlighted above, notifications are only one procedural element
illustrating the effect of fragmentation with particular clarity, but by far
not the most important one in terms of its economic effect. A more detailed
estimation of the overall effects of fragmentation is provided in Annex 9.

The administrative burden resulting from the fragmentation within
the EU internal market is estimated at about € 2.9 billion per annum[54],
accounting for about half of the overall administrative burden linked to the
Directive (i.e. about  € 5,3 billion). These estimates are based on the Standard Cost Model and do not take
account of compliance costs other than "administrative burden" (for
example, to adapt to variable security requirements in different Member States).
These additional compliance
costs are, however, difficult to quantify given the variety of requirements
across Member States.

To
give an idea of overall compliance costs born by large and very large companies,
a recent study - concerning companies based both inside and outside Europe[55]
- estimates that each of these large multinational companies spends as an average
€2.5 million per year on overall compliance with various data protection
obligations (including administrative burden and other costs). A large part of
these compliance costs are due to the fragmentation of national data protection
rules - within the EU and beyond - and also cover compliance obligations
non-data protection related. The same study concludes that the cost of
non-compliance for such companies is much higher[56].

However,
fragmentation is not only a problem for large, multinational enterprises. On
the contrary, the complex situation on the ground deriving from diverging and
sometimes conflicting data protection requirements at national level also constitutes
a disincentive for all enterprises operating in the internal market from
expanding their operations cross-border or establishing in more than one Member
State. This problem thus concerns all EU businesses, including micro-enterprises
and SMEs: this complexity leads to significant costs in terms of legal fees if
they consider expanding their operations cross-border, and often acts as a
disincentive from so doing. The outcome is that they do not reap the advantages
of the internal market, with subsequent impacts on the EU economy, competition
within the EU, and competitiveness in general.

b) Public
authorities

Differences
between Member States in implementing and interpreting the Directive also create
difficulties for public authorities. It is difficult to estimate the costs,
including the administrative burden, born by public authorities. Moreover,
given the nature of their activities – generally addressed, in most cases, to
individuals residing in the Member State of origin - they are likely to be only
marginally affected by fragmentation.

However,
fragmentation is relevant to the extent that it affects cooperation between
national authorities aiming at attaining common EU objectives, for example in
the area of public health[57].

One
way of ensuring health protection is to produce information on health
indicators and trends at EU level to compare national public health between
Member States, identify health problems common to Member States and trace their
causes, inform EU policy on health and take decisions based on evidence. Health
data are considered sensitive under the Directive. Their processing for
monitoring public health is only allowed in specific situations, in particular
where consent is given by data subjects or for the purposes of preventive
medicine, medical diagnosis, the provision of care or treatment or the
management of healthcare services or where Member States deem processing
necessary due to substantial public interest. Since the Directive does not
harmonise the rules for the processing of data specifically for public health
purposes, Member States' practices vary greatly. As illustrated in the examples
below, this lack of harmonisation and divergent national implementation affects
cooperation between national authorities aiming at attaining common EU
objectives.

Example 3: Divergent practices as a barrier to EU public health cooperation  Two examples of difficulties in pursuing public health policies due to divergences in data protection requirements are cancer registries and contact tracing. In the first case, some Member States require the "prior informed consent" of individuals regarding the reporting of cancer incidence and mortality data, whereas other Member States have different requirements. The consequence of these differences is that cancer registries cannot operate in some Member States, or in some cases, the registries even collapse, and the reporting and comparison of cancer incidence across the EU is not sufficiently reliable. In the second case, the collection of data on communicable diseases for contact tracing from entities concerned by travel activities for public health purposes, is not effectively conducted within the EU because some Member States have established diverging conditions for the processing of such data. This problem was particularly acute, for instance, during the H1N1 flu pandemic.

c) Individuals

Legal
uncertainty and complexity have a chilling effect of on the preparedness of
businesses, in particular SMEs, to offer their services across borders or
online at all. This reduces the choice of offerings for consumers and the
competition in the market. The potential benefits of the online single market
are only available to a limited extent. At the same time, legal uncertainty
also affects directly the willingness of consumers to make use of online
services and in particular cross border services. Concerns about privacy and
data protection are one of the factors that act as obstacles to the full
development of the online single market.

3.3. 
Problem 2 – Difficulties for
individuals to stay in control of their personal
data
3.3.1. 
Description of
the problem

Individuals
enjoy different data protection rights, due to fragmentation and inconsistent implementation
and enforcement in different Member States. Furthermore, individuals are often
neither aware nor in control of what happens to their personal data and
therefore fail to exercise their rights effectively.

Globalisation
and technological developments, particularly the fact that personal data are
nowadays being transferred across an increasing number of virtual and
geographical borders in the online economy, including through "cloud
computing", further challenge the control individuals may keep
over their own data.

a) Insufficient awareness, loss of control and trust, particularly
in the online environment

In
the online environment, it is increasingly difficult for
individuals to be aware of the processing of the data related to them and the
risks linked to such processing, to maintain control over their own data and,
ultimately, to assert their rights vis-à-vis data controllers.

Two
thirds of European citizens feel that the disclosure of personal data is a major
concern for them and six in ten citizens consider that nowadays there is no
alternative to disclosing personal data in order to obtain products and
services[58]. Three quarters of citizens feel that they have either no or only
partial control of their personal data on social networking sites[59].

– 
Insufficient awareness and underestimation of
privacy risks

In
order to be in control, individuals need to be aware by whom, on
what grounds, from where, for what purposes, and for how long their personal
data are being processed and what their rights are in relation to the
processing. Currently, the duty to inform the data subject does not cover each
of these elements; and even when sufficient information is available, it is
often not understandable for the individual[60].

A
2008 survey[61] revealed that on average in the EU only 41% of data controllers
maintain and update privacy policy notices. This percentage is even lower for
SMEs[62].

When
they are provided, online privacy policy notices ("Privacy
Statements") are often overly complex, making use of technical and
legal terminology. This complexity is reflected in the responses to a 2011
Eurobarometer survey: close to six in ten internet users claim they read
privacy policies (58%), but only a third say that they read them and understand
them (34%); a quarter say that they read them but do not fully understand them
(24%). A quarter say they do not read them (25%), one in twenty say they do not
know where to find them (5%) and almost one in ten ignore privacy statements
(8%).[63]

The
lack of readily available and easily understandable information makes it
difficult for individuals to become aware of the risks linked to
the use of their personal data and take the necessary measures to ensure their
own protection. For instance, almost half of the respondents to a recent
Eurobarometer do not feel sufficiently informed on social networking and file
sharing sites[64].

This
is particularly relevant with respect to children, who tend to
underestimate the risks and consequences of making their personal data
available online. A recent survey funded under the Safer Internet programme[65] shows that 38% of
children aged between 9 and 12 and 77% of 13-16 year olds have a profile on a
social network site (SNS)[66] even though the privacy policies of most social networking sites
prohibit this. A quarter of 9-12 year olds have their profile as 'public',
displaying in some cases private information such as their address and/or phone
number to all other users.

– 
Loss of control and trust

As
confirmed by a recent Eurobarometer survey[67], profiling, data mining, and technological developments that ease
the exchangeability of personal data make it even more important for
individuals to be in control of their personal data. The graph below shows the
extent to which individuals feel in control of their personal data online.

||

In
a recent Eurobarometer survey, 75% of respondents that owned an account on a
social networking site and 80% of online shoppers consider that they have no or
only partial control over their personal data. 70% of them are concerned that
economic operators processing their personal data may use it for a different
purpose than the one they were collected for[68].

In
relation to profiling, the Directive grants individuals the right
not to be subject to a decision which is based solely on automated processing
of data intended to evaluate personal aspects of the data subject. This safeguard
only applies to decisions based "solely" on automated processing so
that there is a risk that it is easily circumvented by including a merely
formal human intervention in the decision process which has no influence on its
outcome. Examples for such procedures include the conditions of a telephone
service or insurance contract, where conditions and tariffs are adjusted on the
basis of a scoring of the potential customers on the basis of general and
individual data related to him or her. While the decision to make a specific
offer is formally with the sales staff, this person's decision is defined by
the outcome of an automated system so that he or she effectively has no margin
of decision to deviate from that suggestion. In the specific case of behavioural
advertising[69], 54% of Europeans feel uncomfortable with practices which involve
online profiling and a large majority of them (74%) would like to be given the
opportunity to give (or refuse) their specific consent before the collection
and processing of their personal data[70].

With
current technologies it is possible to collect and process personal data
anywhere, at any time and in many different forms. For instance, mobile devices
can nowadays easily obtain information about the geographical location
of individuals in real time by many different technological means[71]. Services based
on location information are considered one of the most dynamic areas for
innovation. Location based services can provide considerable benefits to
individuals, from improved real-time routing algorithms which consider traffic
density and congestions and provide faster and more fuel-efficient routes than
static systems, over faster dispatching of emergency services based on accurate
real-time location information, to advertising services in the immediate
vicinity of the requesting individual. The possibilities for using location
information as parameters in services such as search, social networking or
other web 2.0 services are still being explored. On the other hand, location
information may be retained to create motion profiles of individuals containing
information about their each and every move at a level of detail and for a
period far beyond what individuals would remember themselves. Divergent
application of data protection rules would not only hamper the development of
useful services, but would also reduce citizens' willingness to use existing
services when they fear becoming subject of constant monitoring of their lives.

When
using online services, individuals are associated with technical (online)
identifiers provided by their devices, applications, tools and
protocols[72] and leave traces of their activity at each server they communicate
with. This interaction log and other information received by the servers, e.g.
time and contact of interaction, location data etc, can build a very detailed trace
of an individual's online activity. Even without a name or other traditional
identifying attribute, it is often possible to effectively identify the
individual to whom the data relates. However, legal practice in Member States
differs as to the assessment of identifiability of such online data collections
(and hence whether to consider such data as personal data) and thereby leaves
individuals with uncertainty and effective impossibility to assert their rights
regarding the fastest growing and most comprehensive collections of data about
their behaviour. While some Member States recognise the sensitivity of such
data and provide for clear rules on the use and retention of usage data, others
do not provide for legal provisions addressing this issue, leaving the
application of data protection principles to decision on a case by case basis.

The
fact that important data controllers operating in the digital/online market are
established outside the EU makes it even more challenging for
individuals to keep control over their own data in such cases and to
effectively exercise their rights. The practical application of the criteria
provided by the Directive on whether and when EU laws are applicable to processing
of personal data by controllers established outside the EU/EEA is currently subject
of considerable discussion. Member States apply different interpretations
regarding the "use of equipment" on the territory of Member States[73]. Other relevant
issues of interpretations concern the identification of the actual data
controller and the distinction between controllers and processors. Moreover,
even in cases where the applicability of EU legislation is established,
enforcement of data protection laws and administrative measures and decisions remains
problematic. Even when parts of the equipment used for processing are located
within the EU, EU based authorities usually have no means to enforce decisions
or sanctions on entities whose main establishment is outside the territory of
their jurisdiction. They may also meet difficulties to enforce the basic requirement
for the establishment of an EU representative by data controllers not
established in the EU but subject to EU legislation. In particular in cases
where services are clearly customized to address citizens of a specific EU
Member State, by using the county's languages and adapting to its cultural
preferences and obtaining revenue from advertising local brands, products and
services, it is usually not even possible for the citizen to recognize that by
using such services they are entrusting their personal data to a data
controller which may not effectively be subject to the adequate data protection
legislation.

Where personal data
is collected by an entity established in the EU which is part of an
international group or acts on behalf of a main service provider outside the
EU, provision of services is often based on the transfer of most or all
personal data collected to processing facilities outside the EU. In principle,
such transfers to third countries are subject to conditions which shall ensure
that appropriate data protection safeguards are observed by the receiving
entity in a third country. From an individual's perspective, it is important to
know whether the controller – e.g. as a provider of a service on the web –
complies with the conditions and legal requirements, and how to obtain support
in case of a suspected breach of the rules.

– 
Data breaches

The
increased number of data breaches of large companies’ customer
databases is an additional factor undermining individuals' trust and
confidence. As shown by the example below, these security failures may lead to
harmful consequences for individuals, ranging from undesired spam to identity
theft[74]. In the context of the SME consultation, in relation to data breaches,
7.1% of respondents have recently experienced a breach (of which 55% actually
informed the individuals whose data were affected by breaches) and indicated a
cost of less than €500 for the notification (see Annex 8 for details).

Example 4: Recent data breach case putting data subjects' personal data at risk

One recent prominent case of data breach was that of a gaming service, in which according to media reports tens of million user accounts were compromised by hackers, including users' names, addresses and possibly credit card data. A further problem in this case was the fact that the data controller delayed the notification of the breach to data subjects by one week after the breach in the security of the network had been discovered. This attracted additional criticism by users, and prompted questions on whether there needed to be explicit deadlines within which a data controller must notify a data breach to data subjects and supervisory authorities.

Individuals react on the increase of data breaches with raising concern. The
percentage of individuals that would want to be informed when their personal
data is lost, stolen or altered in any way is constantly increasing and has
reached the level of 88% EU wide[75]. At present, EU wide harmonised
rules on the notification for data breaches exist only for the electronic
communications sector, which are still being implemented by many Member States
following the 2009 Telecom Reform. For other sectors, some Member States have
implemented rules at national level through different legal instruments (laws,
regulations, guidance by the DPA, but no harmonised rules have been established
so far. Increasing pressure to establish such rules could move national
legislators to adopting national legislation on breach notifications. This
could create the risk of increased divergence between Member States on this
aspect.

– 
Fragmentation

Individuals’
confidence and trust is already weakened by the fragmentation, legal
uncertainty and inconsistent enforcement of data protection rules
across Member States. The same individual, travelling to another Member State
or shopping cross-border on the internet, would see his/her rights, and
the way of exercising them, vary significantly depending on the
applicable national legislation. Thus, individuals, even if they are aware of
the data protection provided by their own Member States, often do not know how
to exercise their data protection rights when their personal data are processed
across several Member States. This is an additional factor reducing their
readiness to shop for goods and services from other Member States.

According
to the Digital Agenda for Europe, a lack of trust in the online environment is
hampering the development of Europe's online economy. A recent Eurostat survey
shows that privacy and trust concerns are amongst the top reasons preventing
people from buying online[76]. Among people who did not order online in 2009, the top reasons
were: payment security concerns, privacy concerns, and trust concerns.

.

Source: Eurostat
Community Survey on ICT Usage by Households and by Individuals 2009

b)
Difficulties in exercising data protection rights

The
Directive provides for a set of rights for individuals, such as the right to
access, rectify, block and delete their own data, as well as the right to
receive information for what purposes and by whom their data are processed. The
Directive also provides judicial remedies as well as the right to receive
compensation for damage suffered. These rights are, however, expressed in general
terms and the way they can actually be exercised is not clearly specified.

– 
Difficulties to access one’s own data

Access
to personal data is a significant matter[77]: as evidenced by a 2008 survey of data controllers, 46% of data
controllers surveyed indicated that their company had received requests for
access to personal data in the preceding year[78].

However,
individuals can access their own data more easily in some Member States than in
others. In some Member States, data controllers are allowed to demand a fee to
access their data, while in others it is free of charge[79]. Some Member States impose a deadline on data controllers to
respond to access requests, while others do not. The Commission has received several
complaints from individuals that asked data controllers for access to the data
stored about them and received no or unsatisfactory responses. Complaints to
their national data protection authorities did not lead to effective remedies,
as these authorities declared themselves not competent or incapable of
following up in some cases. All these observations contribute to individuals'
perception that their rights are not effectively guaranteed by the current
implementation of the framework across the Member States.

– 
Difficulties to have one's own data deleted –
the “right to be forgotten”

The
right to request the deletion of data is provided by the
Directive, but in practice it is difficult for an individual to enforce this
right vis-à-vis the data controller. Recent reported cases about people
seeking to have their data deleted from a social network are a telling example
of the practical difficulty to exercise this right especially in the online
environment[80].

While
the Directive already requires that data is not kept in a form which permits
identification of data subjects for any longer than necessary for the purposes
for which the data were originally collected or for compatible purposes for which
they are further processed, in practice this is often not implemented properly.
For an individual, it is very difficult to assess the data preservation
policies of a data controller. In any case, if the processing of personal data
is based only on the consent of the data subjects, there is generally no
justification for keeping this data after the data subjects have withdrawn
their consent and requested deletion of the data. Faced with different
interpretations and practices in different Member States, both individuals and
data controller need more clarity on the rules on the deletion of data.

– 
Difficulties to withdraw and transfer
personal data from an application or service – “data portability”

There
is also no explicit right for the individual to extract his/her own personal data
(e.g. his/her photos or a list
of friends) from an application or service in a format that may be processed
further, so that the individual may transfer data to another application or
service. With increasing use of certain online service, the amount of personal
data collected in this service becomes an obstacle for changing services, even
if better, cheaper or more privacy friendly services become available. This
could mean the loss of contact information, calendar history, interpersonal communications exchanges and
other kinds of personally or socially relevant data which is very difficult to
recreate or restore. Even where possible, re-entering the data manually into
another service can be a major effort. This situation effectively creates a
lock-in with the specific service for the user and makes it effectively very
costly or even impossible to change provider and benefit from better services
available on the market. Portability is a key factor for effective competition,
as evidenced in other market sectors, e.g. number portability in the telecom
sector.

– 
Difficulties to access effective remedies

As
regards administrative and judicial remedies and compensation,
individuals are in most cases not aware of the possibility to lodge a complaint
to a DPA: 63% of respondents to a recent Eurobarometer have never heard of any
public authority responsible for the protection of personal data[81].

Therefore,
in many Member States judicial remedies, while available, are very rarely
pursued in practice. This is also related to a general reluctance to bring an
action to court against large global companies in particular, when costs for
legal action are disproportionate compared to the potential compensation that
could be obtained.

Whereas
the Directive provides the possibility that associations representing a data
subject may lodge claims to the DPA, there is not a right to be represented by
an association in a court case, which might otherwise give an incentive and
limit the financial risk of going to court in relation to an infringement of
data protection rules.

3.3.2. 
Who is affected
and to what extent?

The
difficulties in exercising data protection rights potentially affect every
individual in the EU, given the rapid growth of digital information on
individuals as a result of evolving information and communication technologies.
Processing of personal data is part of everybody's daily life: every
transaction is likely to create a digital record, e.g. opening a bank account,
shopping on line (on average, about 40% of individuals in the EU currently use
the internet to purchase goods and services[82]), requesting a shop's loyalty card, buying a book or uploading
photos on the internet.

a)   Individuals

Individuals, including children, are potentially exposed to
different types of harm. This includes
reputational or even physical harm (caused e.g. by the publication of
health-related data on a public blog without the concerned person's consent or
harassment caused e.g. by unsolicited advertising) and also financial harm
particularly by identity theft, the total cost of which at EU level is estimated
at around €700 million per year[83]. In particular for young people, the disclosure of personal data
can cause immense social and mental harm. The media have given much attention
to several recent cases where sensitive personal information was published and
led to bullying and harassment or serious humiliation so that the victim was
driven into suicide. Personal data breaches are also becoming more common and
more severe. A 2010 study[84] in the UK indicates that, out of 622 UK-based IT and business
managers, analysts, and executives from 15 industry sectors, 71% reported at
least one incident of data breach in their respective organisations. The same
study reports that while the average organisational cost of a data breach
decreased by nearly 3% – from £1.73 million in the 2008 annual study to £1.68
million in 2009 – the average cost per compromised personal data-set rose by £4
(7%), from £60 to £64 (approximately €74[85]).

Based
on information from 20 Member States, there were 54,640 complaints concerning
(potentially) unlawful processing of personal data or breaches of data
protection rights in the EU in 2009[86]. Half of the total number of requests and complaints received by
the Commission in 2010 in relation to fundamental rights and freedoms concern
data protection[87]. Many individuals may have experienced detriment, but either
resolved the issue with the data controller or did not pursue the complaint.
Those that pursue a complaint are likely to have experienced significant harm. Over
a third (39%) of all potential EU users of the internet may not be fully
benefitting because of concerns over safety and data protection[88]. Individuals
limit their use of new technologies, particularly the internet and online
services, because of lack of trust in the digital environment and fears about
possible misuse of their personal data. Those not benefitting from ICT because
of fears over data protection lose out in terms of price benefits online and in
time taken to access goods and services.

Privacy
and the protection of personal data are fundamental rights enshrined in the
Charter of Fundamental Rights of the European Union. They play a key role for
the exercise of fundamental rights in a broader sense. Many of the fundamental
freedoms can only be fully exercised if the individual is reassured that it is
not subject of permanent surveillance and observation by authorities and other
powerful organisations. Freedom of thought, freedom of expression, freedom of
assembly and association, but also the freedom to conduct a business will not
be exercised fully by all citizens in an environment where the individual feels
that each of her or his moves, acts, expressions and transaction is subject to
scrutiny by others trying to control him or her. Exercise of these freedoms is
crucial to maintain all fundamental rights.

In
a free and democratic society, the individual must have reassurance that
fundamental rights are respected. Measures to protect individuals with regard
to the processing of personal data must be effective, credible and easily accessible
for the individual. Information about risks to privacy must be made accessible
and the conditions of the processing of personal data must be transparent and
understandable.

In
today's digitised society, communication and interaction rely on digital media
and communications channels. Web 2.0 tools, including social media, play an
increasingly important role for social interaction and exchange. Not being able
to use these media effectively restricts the exercise of fundamental rights in
the social reality. Where the individual suspects that his or her interactions
in this space are subject of surveillance, collection and analysis by
authorities, service operators or others, it looses partly the possibility of
exercising some fundamental rights. This chilling effect can already be caused
by the perception of surveillance, which may or may not exist. The lack of
transparency of processing and of accessible means to effectively enforce data
protection rules is therefore directly affecting individuals' fundamental
rights.

The
same effect is also true with regard to the economic aspects of citizens' life.
Be it consumers who are subject to profiling and classification, or employees
or job candidates subject to extensive research and analysis of their online
activities, the economic possibilities of individuals are reduced towards the
organisations having access to extensive data collections about them. The
individual's negotiation position is severely affected by the imbalance of
information and the possibility of the other side to use detailed knowledge of
the situation and needs, e.g. when offering a loan or an employment contract
with less advantageous conditions for the consumer or employee.

Lack
of transparency of data processing, lack of credible enforcement and the
absence of effective remedies and sanctions for violations of the principles
contribute to creating a climate in which the individuals do not rely on
exercising their fundamental freedoms and economic rights fully, even when some
concerns regarding data collection and surveillance may be exaggerated over the
reality. Doubts about the actual degree of protection have a chilling effect on
democracy and also on the economic activity in the market.

b) Economic operators

Many
economic activities are linked to the processing of personal data. The current
inconsistent application of EU laws impacts the take-up of online and
audiovisual media services. Individuals limit their use of new
technologies because of a lack of trust in the digital environment and fears
about possible misuse of their data. This creates costs for economic operators
and public authorities and slows down innovation. Strong growth of the internet
economy, widespread use of new mobile devices and the expansion of e-commerce
and other web-based services could bring tremendous economic benefits.

c) Public authorities

Public
authorities have undertaken considerable investments in making public services
accessible online. This dematerialisation can create considerable benefits in
terms of efficiency, quality of services and reduction of resources required
for the provision of services. When citizens can enter their requests for
certain public service directly into online systems, they enjoy a better
service then when they would have to go to the authority physically or to
communicate in writing, while the authority at the same time saves resources
for servicing physical visitors or processing paper mail and for entering data
into their systems.

The
potential benefits require citizens' willingness to make use of online
offerings. Lack of confidence and trust in the services, fear or potential
misuse of data collected will make many potential users refrain from using
these services. With growing concern about privacy in the online world, this section
of the population may grow further. This development reduces the value of the
investments in public online services and their positive effects for the public
budget, when the more traditional and more expensive ways of offering public
services have to be maintained.

3.4. 
Problem 3 – Gaps and inconsistencies
in the protection of personal data in the field of police and judicial
cooperation in criminal matters 
3.4.1. 
Description
of the problem[89]

The
scope of the Directive, based on an internal market legal basis, specifically
excluded police and judicial cooperation in criminal matters. The Framework Decision
adopted in 2008 to regulate data processing in the area of police cooperation
and judicial cooperation in criminal matters reflects the specificities of the pre-Lisbon
"pillar" structure of the EU[90] and is characterised by a limited scope and various other gaps, often
leading to legal uncertainty for individuals and law enforcement authorities,
as well as to practical difficulties of implementation. Moreover, while the
Framework Decision contains general data protection principles (e.g., on
lawfulness of data processing, right to access, rectify and delete one's own
personal data), it provides at the same time for wide possibilities of
derogating to them at national level, thereby not harmonising them. This does
not only risk emptying such principles of their very purpose – and thus
negatively affecting the fundamental right of individuals to the protection of
their personal data in this area - but also hinders the smooth exchange of
personal data between relevant national authorities. This situation is
aggravated by the uncertain relation between the Framework Decision and
existing "former third pillar" instruments with specific data
protection rules, which adds to the complexity of the legal framework at EU
level and increases the legal uncertainty for both individuals and law
enforcement authorities.

a) Limited
scope of application of the Framework Decision

The
Framework Decision is limited in scope in that it does not cover data
processing by police and judicial authorities at domestic (purely
national) level, since its scope is limited to cross-border processing
activities (i.e. personal data that "are or have been transmitted or made
available" between Member States or between a Member State and Union
authorities or bodies[91]).  This is problematic both in legal and in practical terms. Legally,
the newly established Article 16 TFEU covers all areas "which fall under
the scope of Union law" - thus including police cooperation and judicial
cooperation in criminal matters[92]. Hence, both 'purely domestic' and 'cross-border' activities are
covered. Given that the Framework Decision only covers cross-border processing
activities of police and judicial authorities in criminal matters, the
legislator has now the duty to extend its scope in order to fill this gap,
which causes several problems[93].

First
of all, as confirmed by several Member States' experts during the workshop
organised on 2 February 2011 on the implementation of the Framework Decision
and in the replies to the Commission's questionnaire related to the
implementation of the Framework Decision[94], personal data which have been gathered in a purely domestic
context can hardly be factually distinguished from data that have been subject
to cross-border transmission. Plus, a priori, any purely domestically
processed data may be subject to cross-border transmission. This somehow
"artificial" distinction thus complicates the actual implementation
and application of the Framework Decision: law enforcement authorities are
burdened by unmanageable distinctions between domestic data and data
transmitted or available for transmission. Criminal files are in quite a number
of cases composed of data originating from different authorities. The
consequence of the limited scope is that parts of such files — the parts
containing data originating from authorities in other Member States — are
protected under the Framework Decision whereas other parts are not protected,
or at least not under the same regime. In addition, the legal certainty for
individuals can be harmed since data originating from third countries, but not
exchanged between Member States are not covered by the Framework Decision. The
processing of those data entails specific risks to the data subject should
there be, for instance, no legal obligation in a Member State to examine the
accuracy of those data.

Secondly, good co-operation between Member States requires there to
be mutual trust  between  Member States, as a condition
for a successful exchange of information. If common standards are applied to
the processing of data this will facilitate cooperation and mutual exchange of
information between Member States' law enforcement authorities.

Finally,
this distinction exists neither in the Directive nor in the relevant Council of
Europe instruments[95].

b) Low level of harmonisation of the Framework Decision

The
Framework Decision provides for a very minimum level of harmonisation
and leaves a very large room for manoeuvre to Member States in terms of its
implementation into national law, for example in relation to the right of
access of individuals to personal data related to them (Article 17) or
to the exceptions to the purpose limitation principle (Articles 3
and 11). Provisions on information to be given to data subjects
are very general (Article 16) and basically refer to national laws, and
therefore implemented variably. Moreover, the Framework Decisions allows
national laws to impose higher safeguards than those established in there for
any issue covered (Article 1(2)). In certain cases, specific national
processing restrictions in place in one Member State have to be met by the
other Member States (Article 12). Therefore, exchanges of information still
remain subject to very different national ‘rules of origin’ and varying
standards that affect efficiency in law enforcement cooperation. As a
consequence, police authorities may have to apply heterogeneous legal requirements
to processing systems containing data originating from different Member States depending
on various factors, such as whether personal data have been collected
domestically or not, whether each of the transmitting bodies has given its
consent for the envisaged purpose, whether further processing restrictions
requested by each of the transmitting bodies exist etc.

Also rules on international transfers (Article 13) leave
a large room of discretion to Member States in assessing the
"adequacy" of a third country for the purposes of transferring
personal data to prevent, investigate, detect or prosecute criminal offences or
the execution of criminal penalties. This creates legal uncertainty and affects
practical implementation, as pointed our by some Member States in their reply
to the questionnaire on the Implementation of the Framework Decision, calling
for more uniform rules in this area[96]. The absence of a sufficiently harmonised system for the exchange
of personal data with third countries also harms the trust between the
authorities of the Member States, since an authority might be less willing to
share information with an authority in another Member State if this Member
State could also share this information with authorities of third countries in
the absence of clear safeguards. It also enables "forum shopping" by
authorities of third countries: those authorities could ask for information in
the Member State with is considered to have the lowest legal  requirements for
transfers.

Additionally, the Framework Decision does not contain any mechanism –
no implementing powers for the Commission, no advisory group similar to the
"Article 29" Working Party - fostering a common approach in its
implementation or supporting common interpretation of its provisions. The
Commission has currently no infringement powers in cases of non- or incorrect
transposition of the Framework Decision, and the Court of Justice has limited
powers as well for a transitional 5-year period from the entry into force of
the Lisbon Treaty[97].

c) Additional gaps and shortcomings of the Framework Decision

The
Framework Decision also fails to address issues that are particularly important
in the framework of data processing by police cooperation and other law
enforcement authorities.

First
of all, there are no specific provisions in the Framework Decision regulating
the processing of genetic data for the purposes of a criminal
investigation or a judicial procedure. As pointed out very clearly by the European
Court of Human Rights[98], this is an area were clear rules are essential to regulate the
scope and application of measures by law enforcement authorities. The Court
ruled that protection afforded by Article 8 of the European Convention on Human
Rights would otherwise be unacceptably weakened by the use of modern scientific
techniques (such as DNA testing) in the criminal justice system without a careful
balancing between the potential benefits of the extensive use of such
techniques against important private-life interests.

Other
relevant issues not covered by the Framework Decision, which are included in some
other "former third pillar" instruments as well as in Recommendation
No R (87) 15 of the Committee of Ministers to Member States regulating the use
of personal data in the police sector, are the following:

– 
The need to distinguish personal data
according to their degree of accuracy and reliability, or whether they
are based on facts or on opinions or personal assessments. The lack of such a
requirement could actually undermine the data being exchanged between police
authorities as they will not be able to ascertain whether the data can be
construed as ‘evidence’, ‘fact’, ‘hard intelligence’ or ‘soft intelligence’.
This could have the consequence of hampering security operations and of making
it more difficult for courts to secure convictions;

– 
The need to distinguish between different
categories of data subjects (criminals, suspects, victims, witnesses,
etc.), and to provide in particular for specific guarantees for data relating
to non-suspects. Again, these distinctions are on the one hand necessary for
the protection of the concerned individuals and on the other hand for the
ability of the recipient law enforcement authorities to be able to make full
use of the data they receive.

d) Unclear relation between the Framework Decision and other "former
third pillar" instruments

In
addition to the above problems linked to the limited scope and other gaps of the
Framework Decision, the relation between its provisions and specific data
protection rules contained in other "former third pillar" legal acts[99] – adopted prior
to the Framework Decision - is not entirely clear. In principle, the Framework
Decision leaves unaffected most of the acts previously adopted containing
specific data protection provisions, in particular where such provisions constitute
"a complete and coherent set of rules"[100]. In other cases, however, the Framework Decision is only partially
applicable, i.e. it does not apply where the provisions of these (former third
pillar) acts impose conditions upon the receiving Member States that are
"more restrictive" than those in the Framework Decision[101]. These rules
setting the relation between the Framework Decision and data protection
provisions contained in other acts in the area of police and judicial
cooperation in criminal matters are unclear and leave a large room for interpretation
on a case-by-case basis as to which rules shall apply to a concrete situation.

The
result is a fragmented environment creating legal uncertainty for both the
concerned individuals and law enforcement authorities. As a consequence, law
enforcement agencies may be reluctant to share information for enforcement
purposes due to concerns about the legal consequences[102]. This negatively affects the effectiveness of cross-border
cooperation in this area.

Example 5 – Difficulties for police
authorities created by a variable and complex legal environment

A police authority in one Member State (country A) is dealing with an investigation related to
cross-border trafficking of human beings. The nature of the case implies that
information, including personal data of suspects, is required from two other
Member States (country B and country C).

When processing the data
related to the above investigation, the police authorities in country A have to apply different data protection rules for
different aspects of the file related to the investigation, depending on
whether the data come from their
own Member State or have been
received from country B or C. This
means that, for example, different rules may apply to the further transmission
of data related to the investigation – which may not be easily
separated/distinguished depending on their origin - to other non-police
authorities (i.e., immigration or asylum authorities) or in relation to the
information that can be provided to the individuals concerned.

3.4.2. 
Who is affected
and to what extent?

The
complex and fragmented legal environment in the area of police cooperation and
judicial cooperation in criminal matters is highly problematic as it creates
uncertainties about the rules applicable and hence affects individuals, public
authorities and private data controllers, in the following way:

– 
Individuals are unlikely to know which rules apply to the processing of
personal data by the police and other law enforcement authorities and thus what
their rights are in this context. They also enjoy different rights depending on
which Member State or public authority is processing their data.

– 
The differences in Member States' data
protection standards in this area, as well as the uncertainties about the rules
to be applied to a specific situation, affect the smooth cooperation
between Member States' police and judicial authorities. The fact that
different, sometimes conflicting rules, may apply to personal data related to a
same investigation – depending on the origin of the data and/or on which
specific instruments apply - adds a layer of complexity to the work of police
and other competent authorities in Member States, particularly in the case of
cross-border matters.

– 
Private companies operating in different Member States are affected by the absence of
common and uniform rules at EU level on issues such as further processing by
law enforcement authorities of data held by them.

3.5. 
The drivers behind the identified problems

The main
drivers behind the three problems are the shortcomings of the existing legal
framework and of the current governance system in the area of data protection.

As
regards the Directive, the analysis of the problems showed
that, while most of its key principles remain sound, several of its provisions
are not sufficiently clear, are sometimes difficult to apply to new situations
and developments and often leave an excessively large margin of manoeuvre to
Member States in their national implementation. This leads to important
variations and divergences across the EU. Enforcement of the Directive is not
always satisfactory and, above all, is inconsistent across Member States.

This
has precluded the desired level of harmonisation within the internal market,
created legal uncertainty and unnecessary costs for business (Problem 1)
and made it difficult for individuals to exercise their rights effectively (Problem
2).

Protection
of personal data in the area of police co-operation and judicial co-operation
in criminal matters is characterised by a lower level of harmonisation (limited
scope, wide derogations, insufficient safeguards) and a fragmented landscape,
leading to legal uncertainty (Problem 3). Enforcement is even more
problematic in this area given the peculiarities of the "former third
pillar acquis" in terms of (limited) powers of the Commission and
of the ECJ.

Globalisation and technological developments have contributed to and exacerbated all
three problems, by greatly facilitating and encouraging the exchanges and flows
of personal data worldwide in all areas and sectors, including law enforcement,
with the development of new applications and services and the availability of
increasingly sophisticated tools.

3.6. 
Baseline scenario: How would the problem evolve?

Globalisation
and technological developments, which are the common drivers of the problems
are expected to pose ever-increasing challenges to the fundamental right to
data protection. The extent and the seriousness of existing problems are
therefore also expected to increase. Without further regulatory intervention,
it is anticipated that under the baseline scenario the problems in the current
situation would evolve as follows:

3.6.1. 
Fragmentation,
legal uncertainty and inconsistent enforcement

Member
States are likely to continue to implement and enforce the Directive in a
diverging way. Data protection issues with a cross-border dimension are likely
to remain without a consistent response.

The
numbers of businesses operating in more than one Member State and of public
authorities exchanging data with other Member States’ authorities are expected
to continue to rise (due in particular to further EU integration and
globalisation, involving for instance e-government applications and the
increasing ease of exchanging personal data[103]). Given that the largest part of the administrative and compliance
costs originates from cross-border processing, the costs for companies
(particularly large companies) and public authorities are likely to increase
further.

The
total administrative burden imposed by the
Directive in the baseline scenario is estimated to amount to about
€5,3 billion per annum. The costs of legal fragmentation in the
baseline scenario (expressed solely in terms of administrative burden) for
economic operators processing personal data in more than one Member State, are
estimated to amount to approximately €2.9 billion per annum (see
Annex 9 for details).

As
regards enforcement, experience has shown that the progressive increase in
cross-border transfers and of data controllers operating across several Member
States did not lead, by itself, to increased cooperation between Data
Protection Authorities. The legal uncertainty caused by inconsistent – and
sometimes contradictory – decisions taken by DPAs will therefore increase, as will
related costs. As a result, the credibility of the EU data protection framework
will gradually decline.

3.6.2. 
Difficulties
for individuals in exercising their data protection rights effectively

There
is a strong likelihood that the current difficulties in maintaining control
over one's own data and in effectively exercising data protection rights will
increase, given the large and growing volume of personal data collected and the
ease with which it can be processed and communicated thanks to new
technologies.

Individuals
are likely to encounter increasing problems with the protection of their
personal data, or refrain from fully using the internet as a medium for
communication and commercial transactions. The 75% of individuals currently not
feeling in complete control of their personal data on social networking sites
(and 80% when shopping online) is not likely to decrease without regulatory
intervention which can support the confidence of individuals. Such a
development could counteract the key performance target of the Digital Agenda
for Europe for 50 % of the population to buy online by
2015.[104]

Individuals
are also likely to face increasing difficulties in knowing what their data
protection rights are when their data are processed by companies or public
authorities involved in cross border data processing, in particular with the
development of cloud computing. They would increasingly be unable to foresee
the scope of their data protection rights in order to adapt their behaviour.

3.6.3. 
Inconsistencies
and gaps in the protection of personal data in the field of police and judicial
cooperation in criminal matters and inconsistency of the rules

The
Commission and the Court of Justice will eventually become competent as regards
the implementation and the application of the Framework Decision after the
expiry of the five-year transition period provided by the Lisbon Treaty. Thus,
the "lisbonisation" of the Framework Decision will be a matter of
fact as of 1st December 2014 even in the absence of an intervention
from the legislator.

However,
the problems and difficulties linked to the limited scope and other gaps of the
Framework Decision will become more acute in the current context of growing
intra-EU and international cooperation and data exchange as showed by the
increasing number of exchanges of personal data for these purposes, at  EU or
Member State's level. Also the current fragmentation will be maintained.

3.7. 
SUBSIDIARITY AND PROPORTIONALITY 
3.7.1. 
Subsidiarity

The need for EU
level legislation on the protection of personal data and the free flow of such
data within the Union was already recognized by the European legislator with
the adoption of the Directive. As explained in the previous sections, while the
Directive has indeed contributed to addressing the problems observed at the
time, such problems have become more important and widespread due to the recent
technical and economic developments. Therefore, the need for an EU level
instrument further harmonising the protection of personal data is even more urgent
today than when the Directive was adopted.

In
light of the problems outlined above, the analysis of subsidiarity indicates
the necessity of EU-level action on the following grounds:

– 
The right to the protection of personal data is
enshrined in Article 8 of the Charter of Fundamental Rights. Article 16 TFEU is
the legal basis for the adoption of rules relating to the protection of
individuals with regard to the processing of personal data by Union
institutions, bodies, offices and agencies, and by the Member States when
carrying out activities which fall within the scope of Union law, and the rules
relating to the free movement of such data;

– 
Personal data can be transferred across national
boundaries, both EU-internal borders and to third countries, at rapidly
increasing rates. In addition, there are practical challenges to enforcing data
protection legislation and a need for cooperation between Member States and
their authorities, which need to be organised at EU level to ensure the
necessary coherence and level of protection within the Union. The EU is also
best placed to ensure effectively and consistently the same level of protection
for individuals when their personal data are transferred to third countries;

– 
Member States cannot alone reduce the problems
in the current situation. This is particularly the case for those problems that
arise from the fragmentation in national legislations implementing the EU data
protection regulatory framework. Thus, there is a strong rationale for the
legal framework for data protection being at the EU level. There is a particular
need to establish a harmonised and coherent framework allowing for a smooth
transfer of personal data across borders within the EU while ensuring effective
protection to all individuals across the EU;

– 
Whilst it would be possible for Member States to
enact policies which ensure that this right is not breached, this would not be
achieved in a uniform way in the absence of common EU rules and would create
restrictions on cross-border flows of personal data to other Member States that
do not meet the same data protection standards;

– 
The EU legislative actions proposed are likely
to be more effective than similar actions at the level of Member States because
of the nature and scale of the problems, which are not confined to the level of
one or several Member States.

3.7.2. 
Proportionality

One of the aims of
the reform is to reduce the current legal fragmentation and all the problems
linked to that (see Section 3.2.1 above), in particular by further harmonising
Member States' substantive laws and by setting up governance mechanisms to make
enforcement more effective and more consistent across the EU.

The
envisaged actions are proportionate as they are within the scope of the Union
competences as defined by the Treaties and are necessary to ensure uniformity of
application of EU legislation, ensuring effective and equal protection of
individuals' fundamental rights. Action at EU level is essential to continue
ensuring credibility and a high level of data protection in a globalized world,
while maintaining the free flow of data. The proper functioning of the internal
market requires that the provisions ensure a level playing field for economic
operators.

The
current initiative builds on the current Directive and intends to cover the
existing gaps by making the implementation of existing principles by Member
States more effective and their application more cost efficient. To this end,
the reform intends to strengthen the coordination powers and reinforce the role
of the advisory body composed of the Data protection authorities of the EU,
currently the Article 29 Working Party. The powers of the existing data
protection authorities should also be more harmonised to ensure a better and
more consistent enforcement. The Commission also intends to facilitate certain
procedures and instruments relating to the relation between the Union and third
countries, such as Binding Corporate Rules, which are an existing co-regulation
mechanism, where no comprehensive mutual recognition system at EU level was
ensured.

Where
possible, the reform leaves space to actors to implement appropriate measures
to achieve the purpose of the instruments, e.g. by strengthening accountability
and responsibility of data controllers and processors for assessing and
mitigating data protection risks and by cutting unnecessary administrative
burden, with the objective of reinforcing the proportionality of the data
protection framework.

Compared to the
existing legislation, the Commission aim is to propose a stronger and more prescriptive
approach in the area of data protection. This approach is justified by the
observations of the practical operation of the current system and the problems
described in the present impact assessment. Where the current Directive
deliberately and explicitly leaves margin to Member States for interpretation,
this has led to widely diverging interpretation and practices. This is also
true to a large extent for those cases where the Directive fails to provide for
clear rules or where it is silent. In an environment where processing of
personal data was predominantly at national level and transfer across borders
was still limited, such differences could be tolerated, even though with some
limiting effects. As in the meantime the internal market has become more
important and effective, in particular due to the increased provision of
services online, for which cross border operation is possible without any extra
efforts or costs, the divergences have become such an important obstacle that
stronger measures at EU level are required. The Commission's proposal observes
the need to balance by providing for stronger measures only in those areas of
Union competence where the protection of fundamental rights and the Single
Market require stronger harmonisation and by leaving margin to Member States in
all areas where culture, tradition or the national constitutional system
require this, e.g. :

- the area of police
cooperation and judicial cooperation in criminal matters. While general data
protection rules will as a matter of principle be applicable to this area as
well, some flexibility will be left to Member States in defining the
limitations and exceptions;

- the relation
between data protection and freedom of expression, which is very much linked to
cultural and social traditions in Member States.

3.8. 
Relation with fundamental rights

The right to protection
of personal data is established by Article 8 of
the Charter and Article 16 TFEU, based on Directive 95/46/EC as well in Article
8 of the ECHR and in the Council of Europe 108 Convention. As clarified by the
ECJ (judgment of 9.11.2010 in cases C-92/09 and 93/09, Schecke), the right to
the protection of personal data is not an absolute right, but must be
considered in relation to its function in society[105].

Data protection is closely
linked to respect for private and family life protected by
Article 7 of the Charter. This is reflected by Article 1(1) of Directive
95/46/EC which provides that,  Member States shall protect fundamental rights
and freedoms of natural persons and in particular their right to privacy with
respect of the processing of personal data. Other potentially affected
fundamental rights are the following:

– 
Freedom of expression (Article 11 of the Charter);

– 
Freedom to conduct a business in accordance with Union law and national laws and practices (Article
16);

– 
The right to property and in particular
the protection of intellectual property(Article 17(2);

– 
The prohibition of any discrimination amongst
others on grounds such as race, ethnic origin, genetic features, religion or
belief, political opinion or any other opinion, disability or sexual
orientation (Article 21);

– 
The rights of the child (Article 24);

– 
A high level of human health protection in
the definition and implementation of all the Union's policies and activities (Article
35 of the Charter);

– 
The right to an effective remedy before
a tribunal (Article 47 of the Charter).

The impact of the measures proposed in the
framework of the data protection reform on these rights is examined in Section
6 and in Annex 7.

4. 
Policy Objectives

The current reform
aims at, first of all, completing the achievement of the original objectives,
taking account of new developments and challenges arising today, i.e.:

1. 
Enhancing the internal market dimension of data protection;

2. 
Increasing the effectiveness of the
fundamental right to data protection .

In addition, the entry
into force of the Lisbon Treaty - and in particular the introduction of a new
legal basis (Article 16 TFEU) - offers the opportunity to achieve a new
objective, i.e.:

3. 
Establishing a comprehensive EU data
protection framework and enhancing the coherence and consistency
of EU data protection rules, including in the field of police cooperation and
judicial cooperation in criminal matters .

In order to enhance
the internal market dimension of data protection (objective 1),
the Commission strives to achieve the specific objectives of:

· 
Harmonising and clarifying EU data protection
rules and procedures to create a level playing field.

Diverging national interpretations of concepts,
principles and procedures under EU data protection rules shall be prevented.
Key elements of the legal provisions shall be clearly and completely defined at
EU level, leaving margin for interpretation to Member States only where this is
necessary in order to properly respect national legal, social, cultural and
administrative traditions and systems to the extent that these differences do
not undermine the functioning of the internal market. This shall also ensure
that data controllers enjoy legal certainty on the obligations they are subject
to, on the basis of EU wide provisions. At the same time, flexibility and
adaptability of the framework to technical, economical and societal development
must be ensured at EU level. Rather than leaving a wide margin of
interpretation to Member States, additional clarification and precision of the
rules and procedures shall be added to the framework at EU level through a
faster and more lightweight procedure than a full legislative procedure. The
Union's position in the global economy shall be strengthened by simplifying and
clarifying the conditions for the transfer of personal data to third countries.

· 
Ensuring consistent enforcement of data
protection rules.

Further to increasing harmonisation of the
legal provisions as such, their practical application and enforcement should
also be more consistent. To this effect, data controllers shall have a single
authority as the unique contact point for supervision and enforcement cases
throughout the entire EU, which shall act on the basis of appropriate and
effective coordination ensuring consistency of the principles applied by all
authorities. Authorities' powers shall be equivalent and adequate throughout
the Union and they shall be equipped with adequate resources.

· 
Cutting red tape.

While harmonisation and consistent enforcement
will already contribute to drastically reducing duplication of administrative
burden needed for compliance with diverging procedures and interpretations, the
reform shall ensure that only such information and notification obligations are
maintained that have a positive effect on the protection of personal.
Procedures for data transfers to third countries shall be clear, simple and
effective in ensuring data protection.

In order to increase
the effectiveness of data protection rights (objective 2), the
Commission strives to achieve the specific objectives of

· 
Ensuring that individuals are in control of
their personal data and trust the digital environment,

Individuals must enjoy effective transparency
about the conditions of the processing so that they can make a meaningful
decision whether or not to agree to it. The individual should be aware when
they are deemed to giving their consent to data processing. They should also be
reassured that they will be informed about any breaches of the security of
their personal data. The execution of individuals' rights should be easy and
their extent should be clear, e.g. regarding access to their own data and its withdrawal
and transfer form one data controller to another or its deletion, as well as
the data controller's obligation to minimise the processing of personal data.
Another element for the creation of trust and confidence is clarity about
available remedies in cases of breaches and appropriate sanctions. In cases
concerning many persons, it should not be up to each data subject to pursue
legal redress individually, but it should be possible to handle cases through
associations, reducing effort for data controllers, individuals and the
supervisory and judicial system.

· 
Ensuring that individuals remain protected
including when their data are processed abroad

Individuals should have confidence that they
enjoy data protection rights whenever they buy goods or use services (including
information society services) that are offered to them from outside the EU  or
when their behaviour is monitored (for example, when people are tracked on the
internet with data processing techniques applying a 'profile' to them, particularly
to take decisions concerning them based on their preferences, behaviour or
attitudes).

· 
Reinforcing the accountability of those
processing personal data.

Individuals can gain more confidence in data
protection when they can rely on data controllers' interest in actually
ensuring appropriate safeguards rather than only being formally compliant with
the letter of the law. Data controllers should be incentivised to take this
approach by increasing their responsibility and accountability for the measures
they take. By this, they should be encouraged to apply the principle of privacy
by design or to perform privacy impact assessments.

In order to increase
the coherence of the data protection framework across all areas of
Union competence (objective 3), the Commission strives to achieve the specific
objectives of

· 
Ensuring that individuals' data protection
rights are fully guaranteed in this area and

· 
Enhancing trust and facilitating police
co-operation and judicial co-operation in criminal matters.

It should be clear that the principles of data
protection apply also to this area, including also to domestic processing in
the police and judicial area. This will include seamless integration into the competences
of the Court of Justice of the EU and of the Commission, as well as an increased
role for data protection authorities and their coordination body (currently the
Article 29 Working Party).

This will enhance the coherence and
consistency of the EU data protection framework, in particular by revising
the current rules on data protection in the area of police cooperation and
judicial cooperation in criminal matters. It will also contribute to the
fulfilment of the original objectives of the Framework Decision, i.e. the need
to ensure  a high level of protection to individuals, on the one hand, and to
enhance mutual trust and facilitate the exchange of information between police
and judicial authorities, on the other hand.

Table 1 below sets
out the specific and operational objectives.

General objectives || Specific objectives || Operational objectives

1. To enhance the internal market dimension of data protection || To harmonise and clarify EU data protection rules and procedures to create a level playing field || – To ensure that the data protection framework can be applied in a uniform way throughout the EU and reduce the current legal fragmentation – To allow flexibility to adjust to rapid technological development, while maintaining technological neutrality – To ensure  legal certainty for data controllers – To address globalisation and simplify and clarify the conditions for international transfers

To ensure consistent enforcement of data protection rules || – To establish a "one-stop-shop" for data controllers in the EU – To ensure stronger powers and adequate levels of resources (to DPAs) for enforcement and control – To develop binding cooperation procedures and effective mutual assistance between DPAs – To rationalise the current governance system to help ensuring a more consistent enforcement

To cut red tape || – To reduce/remove unnecessary formalities, such as notification obligations for data controllers  (except for risky processing) – To simplify formalities for international transfers

2. To increase the effectiveness of the fundamental right to data protection || To ensure that individuals are in control of their personal data and trust the digital environment || – To increase transparency of data processing vis-à-vis individuals including in case of data breaches – To strengthen and expand individuals' rights (access, rectification, deletion ("right to be forgotten"), withdrawal ("data portability"), data minimisation, meaningful consent) – To provide for more effective remedies and sanctions – To empower associations to act on behalf of data subjects

To ensure that individuals remain protected including when their data are  processed abroad || – To clarify the scope of application of EU law to foreign data controllers To provide for benchmarks for assessing the protection afforded by third countries to EU data

To reinforce the accountability of those processing personal data || – To provide accountability mechanisms for data controllers (Data protection by design, data protection impact assessment for risky processing etc.)

3. To establish a comprehensive EU data protection framework  and enhance the coherence and consistency of EU data protection rules, including in the field of police cooperation and judicial cooperation in criminal matters  || To ensure that individuals' data protection rights are guaranteed in this area To enhance trust and facilitate police co-operation and judicial co-operation in criminal matters || – To apply general data protection principles to police cooperation and judicial cooperation in criminal matters – To address the specificities of data protection in these fields – To reduce shortcomings and inconsistencies in particular by covering domestic processing activities – To ensure the competence of the Court of Justice and the Commission – To expand the advisory role of the Working Party 29

Table 1:
Policy Objectives

Compliance with horizontal EU policies

The above objectives
are in compliance with and complement the horizontal policies of the EU. In
particular:

– 
the Europe 2020 Strategy and the Single
Market Act[106], as they help deepening the internal market by streamlining rules
and further harmonising them where needed, thereby boosting EU business
competitiveness;

– 
the Digital Agenda for Europe[107], since they contribute to the development of a digital single
market and aim to increase individuals' digital confidence;

– 
the Action Plan for Implementing the
Stockholm Programme, as they "strengthen the
EU’s stance in protecting the personal data of the individual in the context of
all EU policies" and in the context of international relations;

– 
the general EU Better Regulation policy[108], as they aim at simplifying the regulatory environment,
streamlining existing obligations and procedures and reducing administrative
burden (see also § 7.4 below);

– 
the Small Business Act for Europe[109], as it provides a comprehensive SME policy framework, promotes
entrepreneurship and anchors the "Think Small First" principle in law
and policy making to strengthen SMEs' competiveness.

5. 
Policy options

A number of possible measures have been
identified to address each of the three problems and to achieve the objectives
defined in Section 4. Measures
differ in the extent of EU intervention, and in particular in the strength of the
regulatory approach, ranging from interpretative guidance and codification of
best practices, to further and detailed harmonisation of rules and centralised
enforcement. By grouping measures according to their strength, three options
have been identified, each of which represents a comprehensive approach aiming at
achieving the identified policy objectives.

· 
Option 1 would mostly
rely on clarifying the interpretation and application of the existing rules via
'soft law' and provide for a limited legislative intervention aimed
at codifying existing best practices and clarifying some specific concepts. Due
to the nature of problem 3, i.e. improving data protection rules in the area of
police and justice, this approach would not be suitable to address it;
therefore, option 1 does not contain measures related to this problem.

· 
Most of the measures composing option 2 require
legislative amendments, although the non-regulatory measures under policy option
1 could be combined with or added to the measures under this option. This
concerns in particular actions on awareness raising and promotion of PETs. This
option contains measures addressing all three problem areas.

· 
Policy option 3 would also be based on an
essentially legislative approach and include most of the measures considered
under option 2. It would, however, go farther and provide for more detailed and
prescriptive rules, also regulating and harmonising specific sectors. It would
also apply a 'centralised' approach in relation to enforcement by establishing
a European agency. As regards the former "third pillar", this option
would also be the most far-reaching as it would foresee the amendment of all
"third pillar" instruments in order to align them entirely with the
new data protection rules. This option contains measures addressing all three
problem areas.

The options are
described in more detail below. For the status quo option see the description
of the baseline scenario under Section 3.6.

5.1. 
Options to address Problem 1: Barriers for business and public authorities due to fragmentation,
legal uncertainty and inconsistent enforcement
5.1.1. 
Addressing fragmentation and legal
uncertainty

Option 1:        Interpretation, technical support tools and
encouragement of self-regulation.

Under this option,
the Commission would make extensive use of soft policy instruments and provide
technological support to Member State authorities in order to improve the
regulatory environment in the internal market, and propose only very limited
legislative amendments targeted at specific issues that cannot be addressed
effectively in any other way.

This option would
include in particular:

· 
Creating a single EU-wide IT system (central
platform) for notifying processing, based on a common format and
procedures agreed by national DPAs,  would be set up. Data controllers would
submit only one form electronically and mark the countries they need to notify
(as proposed by the WP29 in its Advice paper on the matter). Requirements,
exceptions and derogations (currently allowed for by the Directive) would
however not be harmonised, which means that further information would have to
be provided if required by national law(s).

· 
Increased use of interpretative
Communications by the Commission to provide more detailed guidance to
Member States, public authorities and businesses on the application of Union
law, and on the interpretation of certain concepts defined in the Directive to
favour a more uniform interpretation of the current rule. These would in primis cover issues and notions whose diverging
interpretation has led to quite different implementation and practices by
Member States (e.g. definition of personal data, provisions on applicable law).

· 
The lack of harmonisation would further be
addressed by the encouragement of EU-wide self-regulation initiatives
building on the existing data protection acquis ("co-regulation"),
e.g. on on-line advertising, medical research, e-health, network and
information security. The Commission would support this process by providing
support and advice, building on its own experience with these types of instruments
with the aim of ensuring that the critical success factors (e.g. participation
of all relevant stakeholder groups, transparency of the process, feedback and
measurement, monitoring and enforcement)[110] are properly taken into account. Use of the existing mechanisms for
formal recognition by national supervisory authorities and the Article 29
Working Party would be encouraged.

· 
Limited legislative amendments to clarify
the key criteria for adequacy of data protection in third countries,
and to create an explicit legal basis for Binding Corporate Rules (BCRs),
in order to facilitate secure international transfers of personal data.

Option 2:        Legislative
amendments addressing gaps in current harmonisation that cause harmful
fragmentation

Under this option,
the Commission would present legislative proposals aimed at solving specific problems
caused by divergent approaches in Member States. These legislative proposals
would concern in particular:

· 
Simplified basic registration system: this would replace the current system of notifications by
data controllers to DPAs with a simpler system of basic registration with DPAs
(i.e. this registration would include the identity of the data controller, the contact
details, an indication of the nature of the business; and an indication of the
processing, and/or personal data held).

· 
Ensure that data controllers are always
subject to one single law. Two sub-options are possible:

a) If the new instrument is a Directive, -
the provisions on applicable law would be clarified in the following way:

- for data controllers based in the EU, the sole
criterion determining the applicable law would be the main establishment
of the data controller, defined as the place of its establishment in the EU
where the main decisions as to the purposes, conditions and means of the
processing of personal data are taken and as the place where the main
processing activities take place when no decision are taken in the EU;

- 
For data controllers based outside the EU, the offering of goods and services (including information society
services) to individuals in the EU, or the monitoring of EU individuals would
become the main criteria to determine the applicable law.

b) If the new instrument is a Regulation,
the latter would be the law applicable throughout the EU. The Regulation would
also be applicable to data controllers outside the EU if they offer goods and
services (including information society services) to data subjects in the EU or
monitor their behaviour.

· 
Ensure that one single DPA – the
one of the Member State of main establishment - is responsible vis-à-vis
a given data controller, thus establishing a "one-stop shop"
for data controllers. The decisions taken by the responsible DPA would have to
be recognised and enforced in the other Member States concerned.
It would, however, always be ensured that an individual retains the possibility
of addressing himself/herself to the DPA of his/her Member State of residence,
as well as – where appropriate – to the courts in the country of residence for
proceedings against the controller or processor.

· 
Increased harmonisation of the substantive
rules at EU level - either by a directly
applicable Regulation or by a "maximum harmonisation" Directive – by
establishing more prescriptive and more precise rules, thus reducing the margin
for manoeuvre currently left by the Directive to the Member States.

· 
Giving the Commission the competence to adopt implementing
acts or delegated acts where there is a need for uniform implementation
of specific provisions, or when there is a need to supplement or amend specific
non-essential data protection provisions. This would allow the Commission to
adopt detailed and specific rules covering certain aspects/sectors where the
need may arise (e.g. application of security measures in various situations,
application of data breach notification in specific circumstances, further
specifying the conditions for data protection officers), while taking into
consideration, wherever necessary, the relative position of micro, small and
medium enterprises and the regulatory burden they incur in application of the
"think small first principle".

· 
Simplifying rules and procedures for
transfers of personal data to third countries
by giving the Commission exclusive competence for adequacy decisions, extending
the scope of BCRs to include data processors and introducing a clear definition
of "groups of companies". Moreover, prior authorisations by DPAs will
be deleted in the large majority of cases.

· 
Going a step further in co-regulation, by
providing for the possibility for the Commission to give general validity
within the Union, via implementing measures, to Codes of Conduct submitted by
associations and other bodies representing categories of controllers in several
Member States.

Option 3:        Detailed harmonisation in all policy fields

This option would include
all elements of option 2 (except the basic registration system) and
include much more detailed EU legislation. The following additional measures
would be added:

· 
Abolishing the general obligation to
notify data processing operations, currently
foreseen by Article 18 of the Directive (and there would be no basic
registration either. However, prior authorisation by the competent DPA would be
maintained in cases of data processing likely to present specific risks to the
rights and freedoms of data subjects.

· 
Developing an EU-wide certification scheme
for data protection compliance for EU and third country controllers and
processors, to be certified as complying with EU data protection rules. Such
scheme could be based on appropriate standardisation by recognized
standardisation organisations and should be supported by adequate monitoring,
complaint processing and compliance mechanisms.

Establishing detailed and further harmonised
rules for specific sectors and circumstances (health and medical
sector, employment relationships), based on relevant
Council of Europe recommendations. In particular:

– 
Employment
relationships - key measures:

a) Proportionality and legitimacy requirements mentioned in Articles 6 and 7 of Directive 95/46/EC would be
regulated in details for employment relationships.

b) the processing of data concerning health and the processing of
drug and alcohol testing data by the employer shall in principle be prohibited,
subject to limited exceptions;

– 
Health/medical sector - key measures:

c) personal data shall in principle only be obtained from the data
subject (with very limited exceptions);

d) persons subjected to genetic analysis should be informed of
unexpected findings under specific conditions.

5.1.2. 
Addressing inconsistent enforcement

Option 1:        Interpretation,
technical support tools and encouragement of co-operation

Under this option,
the Commission would use soft policy instruments to improve the cooperation and
coordination between Member State authorities and encourage more consistent
application of EU legislation. This option would include in particular:

· 
The Commission would adopt interpretative
Communications in order to clarify and specify in detail the content of
investigative and intervention powers of DPAs, so as to encourage a more
uniform practice at national level. The notion of independence of DPAs
would be further clarified in the light of Article 8 of the Charter and recent ECJ
case-law.

· 
Cooperation between DPAs would be improved by:

– 
Extending the role of WP29 to include the
competence to provide advice to DPAs and elaborate best practices
on the application of EU data protection rules;

– 
Providing them with practical tools, namely IT
tools, to better exchange information (e.g. on complaints received, on
investigations being carried out);

– 
Funding from the EU budget would be made
available in order to promote and encourage common training and the
exchange of officials between DPAs.

Option 2:        Reinforcement and harmonisation of DPA powers and strengthened co-operation between DPAs

The shortcomings identified
would be directly addressed by specific legislative changes, namely:

· 
Reinforcing DPAs and harmonising their tasks
and powers and obliging Member States through
the EU legal instrument to provide adequate resources. This would include, in
particular:

– 
Further strengthening their independence and
further harmonising DPAs’ tasks and powers to enable them to carry out
investigations, take binding decisions and impose effective and dissuasive
sanctions;

– 
Establishing a legal basis detailing the obligations
for co-operation and mutual assistance between DPAs, including
the obligation for a DPA to carry out investigations and inspections upon
request of other DPAs.

· 
Harmonising data protection offences subject to administrative sanctions as well as the level of
sanctions. Supervisory authorities should be empowered to respond to specifically
listed data protection violations by way of administrative sanctions; the offences
which are to be subject to such sanctions would be harmonised at EU level.

· 
Replacing the current WP29 by a European
Data Protection Board, with a strengthened role
and tasks, in particular in order to ensure a more consistent enforcement (see
below).

· 
Setting up a consistency mechanism
at EU level which will ensure that decisions taken by a DPA with a wider
European impact take full account of the views of other concerned DPAs. This
system would foresee a role for the Commission and for the European Data
Protection Board, in order to ensure consistency and compliance with EU
rules. More specifically:

– 
The Commission and the European Data Protection
Board would be informed about national DPA draft measures in cases where such
decisions would have a "European impact". The Board would have the
opportunity to issue an opinion on the matter, to be taken into account by the
concerned DPA. The Commission would also be able to adopt an Opinion on the
draft DPA Decision and, as a last resort, a reasoned Decision requesting the
concerned DPA to suspend the adoption of its draft measure, where required to ensure
full compliance with Union law.

– 
This suspension could last up to 12 months,
during which the Commission may decide to adopt implementing measures to ensure
the correct and consistent application of EU rules.

· 
Ensuring the independence and effectiveness of
the new European Data Protection Board by establishing the EDPS as responsible
for providing the Board secretariat (instead of the Commission).

Option 3:        Centralised
enforcement and EU-wide harmonised sanctions

Option 3 would foresee
the establishment of a centralised EU-level enforcement structure ensuring the
functioning of personal data protection in the internal market by:

· 
Establishing a central EU Data Protection
Authority (i.e. a new EU regulatory agency) responsible for the
supervision of all data processing with an internal market dimension, which
could also take binding decisions vis-à-vis data controllers.

· 
Defining harmonised EU-wide criminal
sanctions for breaches of data protection rules.

5.2. 
Options to address Problem 2: Difficulties for individuals in exercising their data protection
rights effectively
5.2.1. 
Addressing individuals' insufficient
awareness and loss of control and trust

Option 1:        Interpretation, information and encouragement of
self-regulation

The Commission would
focus on using soft policy instruments to improve the practical implementation
of existing rules by data controllers and the awareness of individuals, and
make limited legislative proposals clarifying some existing concepts of the
Directive. This would include in particular:

· 
Awareness-raising activities for
individuals, particularly children. In terms of
enhancing the effectiveness of individuals' rights, the focus
under this policy option would be on non-regulatory measures namely awareness-raising
activities on data protection matters, particularly vis-à-vis
children, namely by increasing EU funding for such activities.

· 
Promoting privacy-friendly default options, greater uptake of Privacy Enhancing Technologies (PETs)
and encouraging privacy certification scheme/privacy seals,
research activities including on behavioural economics to help design
privacy-friendly applications. This would be achieved by increasing the EU
financing for studies and research in the above areas.

· 
The only regulatory measures under
this option addressing this problem would be the introduction of explicit
references to the principles of transparency and data minimisation in
the relevant instruments, aiming at clarifying existing principles in the
current legislation.

Option 2:        Legislative
amendments to reinforce responsibility of data controllers and processors

This option focuses
on targeted legislative amendments directly addressing specific issues for
which the need for regulatory clarification and increased precision has been
established. It also includes the measures from option 1 introducing
transparency and data minimisation as explicit data protection principles:

· 
Further clarifying the concept of personal
data by better specifying what identified or identifiable natural
person means, using wording from current recital 26 of the Directive and
including an explicit reference to online identifiers.

· 
Clarifying the rules on consent, in particular by specifying that – where consent is the legal
ground for data processing – it should be given explicitly (i.e. by
either a statement or a 'clear affirmative action' by the data subject) and
that the data controller should be able to demonstrate it.  Moreover, the data
subject should be able to withdraw his/her consent at any time. Furthermore,
the context of the consent should allow a genuine and free choice and in
particular it should be excluded as a ground for lawful processing in case of
significant imbalance between data controller and data subject (e.g., in the
framework of an employment relationship).

· 
Including genetic data into the
category of "sensitive data" (i.e., data whose processing is
prohibited as a rule, with exceptions and derogations) and better framing the exceptions
to the processing of sensitive data, particularly health data.

· 
Provide for specific rules regarding the
application of data protection rules to children's data, e.g.
concerning the information given to them and the data subject's right to
request that data be erased or rectified ("right to be forgotten")
and the prohibition of automated profiling for children. Specific rules on consent
for children below 13 years in the online environment – specifying that
parental consent would always be required - would also help protecting a very
vulnerable category of children because of their young age.

· 
Clarifying the rules applying to data
processing by individuals for purely private purposes ("household
exemption"). In this case, when the processing has no gainful interest and
concerns a 'definite' number of individuals they would be totally exempted from
data protection rules. .

· 
Strengthening data controllers' and
processors' responsibility and accountability, namely
by:

– 
providing for additional obligations for
data controllers, i.e. they will have to provide more mandatory information
to individuals about the processing of their data, and in an intelligible form,
using clear and plain language, in particular for privacy statements. In
addition to what is currently provided for by the Directive, data subjects
would have to be better informed about the processing operations, e.g. clearly
indicating the period for the storage of the data plus the contact details of
the controller, of the controller's representative and of the DPO (if any), as
well as about their own rights, including their right to address themselves to
a supervisory authority, along with the authority's contact details;

– 
Given the increasingly role played by data
processors in today's environment, some of the obligations of the controller would
also be extended to the processor, which are currently only bound to respect the
instructions of the controller via contractual obligations. The same
requirements should apply to data processors based in third
countries that are processing EU data as laid down in a contract with the controller
or prescribed by a legal act.

– 
Introducing the mandatory appointment of Data
Protection Officers (DPOs) for public authorities, for companies above
250 employees and those whose core business involves risky processing. Conditions
would be set to ensure the independence of the DPO from the data controller as
regards the performance of his/her duties and tasks. It will also be clarified
that where the controller or processor is a public authority or body the DPO
can be appointed for several of its entities, taking account of the
organisational structure of the public authority or body. Even in cases where a
DPO is not required, a register on data processing activities should be kept by
the data controller;

– 
Introducing Data Protection Impact
Assessments (DPIAs) with narrowly defined applicability criteria for
processing operations likely to present specific risks to the rights and
freedoms of data subjects.

– 
Introducing a “Data protection by design”
principle (i.e. the controller would be obliged to design the organisational
structure, technology and procedures in a way that it meets the requirements of
data protection);

Introducing a general obligation, extended to
all sectors (currently this is only harmonised for the telecommunications
sector and regulated by the e-Privacy Directive), to notify data breaches
to DPAs and to individuals in cases of breaches likely to adversely affect them.
The controller will be obliged to notify the breach to
DPAs without undue delay and, where feasible,
not later than 24 hours after having become aware of it. After notifying the
DPA, the controller will also be obliged to inform individuals without undue
delay about the breach. The thresholds and criteria
for notification to both Data Protection Authorities and concerned individuals
would be defined in implementing measures to be adopted by the Commission.

Option 3:        More
detailed rules at EU level

This option includes
all the measures from option 2, as well as the following further measures:

· 
In addition to the strengthened modalities of
consent, under this option consent would become the "primary
ground" for data processing. This would thus introduce a hierarchy
of legal grounds for processing personal data, of which consent would be the
primary one and all the other existing ones would remain as residual grounds.

Adding further categories to the list of
sensitive data, namely:

– 
data relating to children;

– 
biometric
data;

– 
and financial data, e.g. financial
messaging data, credit histories and financial solvency
(bad debtors lists) data contained in credit bureaux’ “scoring” systems;

· 
Introducing harmonised EU-level criminal
sanctions for breaches of data protection rules (see also problem 1)
and would establish minimum rules with regard to the definition of criminal
offences and sanctions in the area of personal data protection.

· 
Specifying detailed thresholds and
criteria for notifying breaches to data subjects, i.e., sectoral
criteria, procedures and formats for notifying breaches to data subjects.

· 
Developing EU-wide certification schemes
on data protection (see also problem 1).

5.2.2. 
Addressing the difficulty for individuals
to exercise their data protection rights

Option 1:        Interpretation and standardisation

The Commission would
rely on soft policy measures and limited legislative amendments addressing the
insufficient awareness and loss of control referred to in the previous section
and in addition:

· 
Publish interpretative Communications
regarding the interpretation and the modalities of exercising
individuals' rights to data protection, e.g. clarifying that the right
of access to one's own data should be exercised free of charge. Particular
focus would be on data subjects' rights in the online environment.

· 
Mandate standardisation institutions
to develop standards for technical and organisational measures improving the
protection of personal data. These standards should
address general issues, such as methodologies and procedures, assessment
criteria and techniques, as well as specific technological and sectoral
elements.

Option 2:        Legislative
amendments to clarify and strengthen individuals' rights and how they can be exercised

This option focuses
on targeted legislative amendments addressing directly the need for regulatory clarification
and precision, in particular:

· 
In order to enhance control by individuals over
their own data, the existing provisions on modalities for access,
rectification and deletion would be clarified and strengthened. As
regards the exercise of these rights, it would be provided that the
controller's actions in response to the data subject's requests should be in
principle free of charge and a deadline would be set for the data controller to
respond to requests. The right of an individual to have its data deleted when
it is no longer needed and that wrong data is rectified could be spelled out
more clearly in the legal instrument, making their execution practicable.

· 
Introducing a right to data portability,
giving individuals the possibility to withdraw their personal data from a
service provider and process them themselves or transfer them to another provider,
without hindrance from the controller. Individuals should have the right and
the practical possibility to obtain a copy of the data processed by a data
controller on the basis of their consent, and where this is technically
feasible and appropriate, to have their data transferred from one service
provider to another one. The data should be provided in a format that allows
further processing either by the individual itself.

· 
Strengthening the right of individuals to have
their personal data deleted ("right to be forgotten"), particularly
in the online environment. As regards deletion of data, clarifications as to
the duties of the data controller would be included in order to
strengthen the right of the data subject to have his/her data deleted when
there are no longer lawful grounds to retain them ("right to be
forgotten"), also clarifying that the burden of proving the need
for further conservation of the data lies with the data controller.

· 
Strengthening the provisions on judicial
redress for data subjects, namely by making
more explicit and clarifying the right for data protection authorities and
associations aiming to promote the protection of personal data to bring action
before courts on behalf of data subjects. This would, however, not amount to
collective redress and the associations would not be entitled to act on their
own behalf, except in case of data breaches.

Option 3:        EU
level sectoral rules and redress mechanisms

This would include
the measures from option 2, as well as:

· 
Specific provisions regulating in detail how to
deal with  online identifiers and geo-location data.

· 
Introducing a right for collective redress
regarding breaches of the protection of personal data. A
general possibility for a collective legal action system in the area of
protection of personal data (both injunctive and compensatory) would be
introduced, allowing business and professional organisations and trade unions
to represent individuals and bring actions before courts, by setting its basic
procedural features including procedural guarantees for the parties and provide
for the enforcement of judgements issued in other Member States.

5.3. 
Options to address Problem 3: Gaps and
inconsistencies in the protection of personal data in the field of police and
judicial cooperation in criminal matters

There is
no Policy Option 1 to address this problem. For the area of the "former
third pillar", only regulatory intervention can be effective, given the
current gaps in data protection and the shortcoming of the legal instruments
regulating this area. Therefore, a soft and interpretative approach is not
considered as appropriate and only options 2 and 3 are elaborated.

Certain changes are not discretionary since they are the automatic
consequence of the entry into force of the Lisbon Treaty and the abolition of
the former "pillar" structure of the EU, namely:

· 
The "lisbonisation" of the Framework
Decision, i.e. the fact of giving the Commission and the ECJ full powers
to monitor the correct application of the acquis in this area by Member
States. Based on  Protocol (N°36) on transitional provisions annexed to the
treaties[111], this will happen either when the "former third pillar"
acts – including the Framework Decision – are amended or in any case five years
after the entry into force of the Lisbon Treaty (i.e. on 1st
December 2014)[112];

· 
The extension of the advisory powers of WP
29 to this area.

5.3.1. 
Addressing gaps in the Framework Decision

Option 2:        Extending
the scope of data protection rules in this area

Under this option,
the most important gaps of the Framework Decision would be addressed, in
particular:

· 
The extension of  the scope of the new legal instrument to cover domestic data processing:
the scope of the data protection rules in this area would no longer be limited
to cross-border data processing (transferring to or making available to
competent authorities) – as it is currently the case – but would also cover
domestic processing in line with Article 16 of the TFEU;

· 
The application of the general data
protection principles to this area, in order to ensure full compliance with Article 8 of the Charter of
Fundamental Rights and with the relevant case-law of the ECtHR and the ECJ.
This entails, namely:

· 
Stricter and more harmonised rules on
purpose limitation, i.e. on limiting processing
of personal data to the purposes compatible with those of its initial
collection, with limited derogations from this principle;

· 
More harmonised rules on international
transfers by foreseeing that transfers in this
area can take place only, as a general rule, where there is an adequacy
decision by the Commission or where appropriate safeguards
have been adduced by way of a legally binding instrument. In the
absence of the latter, transfer can also take place if the competent
authorities have assessed all the circumstances surrounding the transfer
operation and provided appropriate safeguards. Further derogations allow for
transfers in exceptional circumstances such as: a) when the transfer is necessary
to protect the vital interests of the data subject or another person or b) to
safeguard legitimate interests of the data subject; and finally, c) when the
transfer is essential for the prevention of an immediate and serious threat to
public security (of a Member State or a third country).

· 
Provide for the obligation to appoint Data
Protection Officers.

· 
Provide for stricter and more harmonised
obligations to adequately inform the data subjects about the processing of
his/her data, while providing for the necessary and proportionate
limitations/exceptions to this principle (such as restricting or
delaying the transmission of data), to take account of the specific nature of
these fields (i.e. , to avoid obstructing official or legal inquiries,
investigations or procedures; to avoid prejudicing the prevention, detection,
investigation and prosecution of criminal offences or for the execution of
criminal penalties; to protect public and national security; to protect the
data subject or the rights and freedoms of others).

· 
Provide for more harmonisation as to the
criteria and conditions on the right of access of data subject-
in line with Article 8 of the Charter – particularly in cases under national
law where currently the data subject does not have direct access to personal
data processed by police authorities and only has recourse to indirect access
via the data protection supervisory authority.  Possible limitations to this
right would be the same as for the right to provide information (see above).
However, in case of refusal of access (or restrictions), the reasons shall be
provided in writing to the data subject.

· 
Add genetic data to the list of sensitive
data, in line with the
case-law of the ECtHR[113].

· 
The codification of selected principles
based on the Council of Europe Recommendations and best practices
regarding law enforcement and data protection, in particular on the distinction
between personal data of different categories of data subjects (e.g. witnesses,
suspects, convicted persons), as well as between personal data based on facts,
on the one hand, and those based on personal assessment, on the other hand.

Option 3:        More prescriptive and stringent rules

In addition to the
measures included in option 2, this would also require Member States to:

- always ensure direct access to
data subjects in this area;

- include biometric data amongst
sensitive data;

- require the carrying out of a DPIA
prior to the processing of data, in particular sensitive data, in large information
systems.

5.3.2. 
Addressing fragmentation

Option 2:        New instrument with strengthened and more
harmonised rules

· 
The application of the general data
protection principles to this area (see above under § 5.3.1
for the specific measures) would also contribute to reduce the
fragmentation and the legal uncertainty in this area.

· 
Leave unaffected for the time being existing
"former third pillar" instruments with
specific data protection provisions, which would n remain "lex specialis". The Commission would prepare a report, after the
entry into force of the new instrument, to assess the existence of any possible
incompatibility and propose, where appropriate, specific amendments.

Option 3:        Full
integration of general principles in former third pillar instruments

This would include
all elements of option 2 plus:

· 
The immediate amendment  of all existing
former "third pillar" instruments , to the
extent that they contain data protection provisions incompatible with the new proposed
rules in order to fully align them. .

Table 2: Summary
of Policy Options

|| || Sub-Problem || Specific Objectives || POLICY OPTION 1 || POLICY OPTION 2 || POLICY OPTION 3

ROBLEM 1: -Barriers for business and public authorities due to fragmentation, legal uncertainty and inconsistent enforcement General Objective: To enhance the internal market dimension of data protection || Fragmentation and legal uncertainty || · To harmonise and clarify EU data protection rules and procedures to create a level playing field · To cut red tape || · Creating a single EU-wide IT system for notifying processing, based on a common format and procedures agreed by national DPAs; · Increased use of interpretative Communications by the Commission to provide more detailed guidance to Member States, public authorities and businesses on the application of Union law, and on the interpretation of certain concepts defined in the Directive; · Encouragement by the Commission to businesses and associations to engage more self-regulation and co-regulation for specific sectors or practices at EU-level, using the mechanisms provided for by the Directive; · Legislative amendments to clarify the key criteria for adequacy of data protection in third countries, and to create an explicit legal basis for Binding Corporate Rules (BCRs), in order to facilitate secure international transfers of personal data. || · Replacing the obligation to notify data processing operations by a simplified 'basic registration' system; · Simplifying the provisions on applicable law, to ensure that data controllers are always subject to the legislation of one Member State (or to the EU Regulation) only and supervision of only one supervisory authority; · Amending substantive rules to remove explicit margins for manoeuvre for Member States and increase clarity and precision of the rules in general (maximum harmonisation Directive or Regulation); · Strengthen mechanisms for co-Regulation · Giving the Commission the competence to adopt implementing or delegated acts where there is a need for uniform implementation of specific provisions, or when there is a need to supplement or amend specific non-essential data protection provisions. Simplifying rules and procedures for transfers of personal data to third countries by giving the Commission exclusive competence for adequacy decisions, extending the scope of BCRs to include data processors and introducing a clear definition of "groups of companies". Moreover, prior authorisations will be deleted in the large majority of cases. || Measures under Policy Option 2 (except basic registration) plus: · Abolishing notification of processing altogether (prior checks  for cases of risky processing would be maintained); · Developing an EU-wide certification scheme for data protection compliance for EU and third country controllers and processors, to be certified as complying with EU data protection rules; · Establishing detailed and harmonised rules for specific sectors and circumstances (health and medical sector, employment relationships and scientific research) ||

|| || Inconsistent enforcement of data protection rules across the EU || To ensure consistent enforcement of data protection rules || · Interpretative Communications on the independence and the required investigative and intervention powers of DPAs; · Encouraging enhanced cooperation between DPAs, including by providing programmes for exchange of staff between DPAs and mutual training and best practice workshops and technical tools; · Extending the role of the WP29, to include the competence to provide advice to national DPAs and to elaborate 'best practices' through limited legislative changes. || · Reinforcing and harmonising DPA tasks and powers (including administrative sanctions) and obliging Member States through the EU legal instrument to ensure provide adequate resources; · Harmonising offences subject to administrative sanctions; · Providing for mutual recognition of DPAs' decisions and increased co-operation via a consistency mechanism and mutual assistance operated, under the supervision of the Commission, through a European Data Protection Board  with a possibility for the Commission to intervene to ensure swift compliance with EU law (opinion and, as a last resort, decision to suspend the measure); · Ensuring the independence and effectiveness of the new European Data Protection Board by establishing the EDPS as providing its secretariat (instead of the Commission). || · Establishing a central EU Data Protection Authority (a new EU agency) responsible for the supervision of all data  processing with an internal market dimension, or with an effect on the European area of freedom, security and justice; · Defining harmonised EU-wide criminal sanctions for breaches of data protection rules.

|| PROBLEM 2: Difficulties for individuals to stay in control of their personal data General Objective: To increase the effectiveness of the fundamental right to data protection || Insufficient awareness, loss of control and trust, particularly in the online environment || To ensure that individuals are in control of their personal data and trust the digital environment || · Funding of awareness-raising activities for individuals, particularly children; · Encouraging greater uptake of Privacy Enhancing Technologies by business and voluntary privacy certification schemes/privacy seals; · Introducing explicit references to the transparency and data minimisation principles in the Directive || · Further clarifying the concept of personal data; · Clarifying the  rules on consent (explicit; burden of proof on controller); · Including genetic data into the category of "sensitive data"; · Clarifying the application of rules including for children (e.g. in the context of the right to be forgotten, clearer information, prohibition of profiling, modalities for consent online); · Clarifying provisions relating to processing by individuals for private purposes ("household exemption"); · Strengthening data controllers' responsibility and accountability, including by extending data controllers' obligations to data processors and creating stronger transparency obligations for data controllers (e.g. giving individuals clear and intelligible information); · Introducing Data Protection Officers (DPOs) for public authorities, companies above 250 employees and companies performing risky processing; · Introducing Data Protection Impact Assessments (DPIAs)  for processing operations likely to present specific risks,; · Introducing a “data protection by design” principle; · Introducing a general obligation to notify data breaches to DPA within 24 hours of becoming aware of it (wherever feasible) and, when likely to adversely affect them, individuals within without undue delay after the breach has been established. || Measures under Policy Option 2 plus: · Defining consent as a "primary ground" for data processing; · Adding further categories to the list of sensitive data (data related to children, biometric and financial data); · Introducing harmonised EU-level criminal sanctions for breaches of data protection rules (see also problem 1); · Specifying detailed thresholds and criteria for notifying breaches to data subjects; · EU-wide certification schemes on data protection (see also problem 1)

|| Difficulties in exercising data protection rights || To ensure that individuals remain protected including when their data are  processed abroad || · Publish interpretative Communications regarding individuals’ rights, e.g. the right to access their own data, particularly in the online environment; · Mandate standardisation institutions to develop standards for technical and organisational measures improving the protection of personal data || · Strengthening and harmonising provisions on how individuals can exercise their rights of access and rectification to personal data (e.g. free of charge); · Introducing a right to data portability; · Strengthening the right of individuals to have their personal data deleted ("right to be forgotten"); · Strengthening the right of associations to bring action before courts on behalf of individuals; · Clarifying the conditions for the application of the balance of interest criterion as a legitimate ground for data processing. || · Specific provisions regulating online identifiers and geo-location data; · Introducing a right to collective redress regarding breaches of the protection of personal data.

|| PROBLEM 3: Gaps and inconsistencies in the protection of personal data in the field of police and judicial cooperation in ;is would happen  to a lesser extent given the different legal nature of the two instruments and the need for transposition by Member States. criminal matters General Objective: Enhance the coherence of the EU data protection framework || · Limited scope of application of the Framework Decision · Insufficient safeguards in the Framework Decision || To ensure that individuals' data protection rights are respected in this area || || · Stricter rules on limiting data processing to the purposes compatible with those of its initial collection; · Providing minimum conditions for the right to information and the right of access for individuals; · Add genetic data to the category f sensitive data; · Obligation to appoint a DPO · Codifying selected principles based on the Council of Europe Recommendations and best practices regarding law enforcement and data protection (distinction to be made between different types of data) || All measures under Policy Option 2 plus: · Providing for the right of individuals to always have 'direct access' to their data. · Obligation to carry out a DPIA for risky processing in information systems

|| · Low level of harmonisation of the Framework Decision · Unclear relation with other former third pillar instruments leading to legal uncertainty and fragmentation || To enhance trust and facilitate police co-operation and judicial co-operation in criminal matters || || · Extended scope for the new legal instrument to cover domestic data processing; · Clearer and more uniform rules on international transfers · Leaving unaffected other existing "former third pillar" instruments || · Amending the relevant provisions of all existing third pillar instruments, to align them entirely with the new rules as laid down in the reformed general instrument.

6. 
Analysis of Impacts

Following the
standardized impact assessment methodology of the European Commission, this
section summarises the expected impacts of the three policy options addressing
objectives 1 (to enhance the internal market dimension of data protection) and
2 (to increase the effectiveness of data protection rights) and the two policy
options for addressing objective 3 (to ensure a comprehensive EU data
protection framework including in the field of policies cooperation and
judicial cooperation in criminal matters). For the first two policy objectives,
each of the three options is assessed for its effectiveness regarding each of
the two policy objectives, its economic and financial impacts, including on the
Union budget where appropriate, social impacts and effect on fundamental
rights. All measures are assessed for their effectiveness regarding both policy
objectives, where appropriate. For the third policy objective, the two options
are assessed for their effectiveness regarding the policy objective and their
economic and social impacts. Specific environmental impacts could not be
identified for any of the options. A detailed assessment of the impacts of each
measure is included in Annexes 5, 6, 7, and 9. The analysis is
the basis for the choice of the preferred option which is defined in section 7.
The impact on the simplification of the regulatory
environment of the preferred option is summarized in section 7.4, given that the data protection reform is
contributing to the Commission's Rolling Programme for simplification.

6.1. 
Policy objectives 1 and 2: Enhancing the internal market dimension of data protection and
increasing the effectiveness of data protection rights
6.1.1. 
POLICY OPTION 1: Interpretation,
technical support tools, encouragement of self-regulation and cooperation and
standardisation

a)  Effectiveness
regarding Policy objective 1: Enhancing the internal market dimension

As regards the objective of harmonisation and clarification of the
EU data protection rules, interpretative Communications of the Commission
regarding the key concepts defined in the Directive would not be
binding for the Member States and could therefore have only limited impact on
reducing legal uncertainty and resulting costs. The Commission would have to
apply this tool with caution in order to avoid the risk that data controllers
or data subjects relying on the Commission's interpretation face legal problems
in Member States that do not comply with its interpretation in its national law.

More
self-regulation at EU level could help provide some
additional legal certainty for data controllers and enable easier operation of
specific sectors of the Single Market, in particular when enhanced by elements
of co-regulation, such as formal recognition of the supervisory authorities. The
establishment of EU level self-regulation mechanisms could, however, only be achieved
meaningfully and effectively with a clear and harmonised legal framework as its
foundation.

More support for the
use of PETs by data controllers, as well as increased
standardisation of technical and organisational data protection tools
and measures, would increase businesses' certainty about how to achieve
compliance with legal obligations.

Legislative
clarifications regarding the principles of
transparency, data minimisation, adequacy and BCRs would increase
harmonisation and legal certainty and contribute to more consistent enforcement
of data protection obligations.

As regards the
objective of consistent enforcement (independence and powers of
supervisory authorities), Commission communications would not
overcome Member States' reluctance to change their national rules in order to
allow for more harmonisation and more independence and consistent powers of
DPAs.

Enhanced
coordinating tasks of the Article 29 WP, the
provision of additional IT tools to facilitate sharing of information and
cooperation between national authorities and EU programmes for common training
and staff exchanges between DPAs would have a positive, though not major,
impact on more consistent enforcement of the rules. However, this solution
would have a limited impact on the problem of inconsistent enforcement as no
binding mechanism would be in place to ensure actual cooperation and mutual
assistance.

b) Effectiveness
regarding policy objective 2: Reinforcing individuals' right to data protection

Soft policy
measures, such as interpretative Communications (e.g. on aspects of exercising
the right to access one's own data), awareness-raising activities and
encouragement of more self-regulation could help improve
individuals' awareness of their rights and better understand how to practically
exercise their data protection rights. They would however not be
sufficient for individuals to ascertain their rights effectively in the absence
of a strong underlying legal framework.

Data subjects'
ability to exercise their rights would be slightly improved by introducing
clarifications in the legal framework regarding transparency and the
data minimisation principle. This would however only bring along limited
improvement to individual's rights as it would not substantially improve rights
of access, deletion etc, which are essential to enhance trust in the digital
environment.

c)  Economic
and financial impacts

The expected financial
and economic impacts of this policy option are limited.

For economic
operators, measures under this option would provide some additional
legal clarity but would not substantially reduce the costs and burdens linked
to the current fragmentation of the regulatory environment. Moreover, continuing
divergences in national interpretations and practices would still undermine
individuals' trust in cross-border transactions and therefore limit their use
of the online environment.

This set of foreseen
measures would give rise to some additional compliance costs for data
controllers as introducing the principles of transparency and of data
minimisation might require additional capabilities in processing data and
controlling flows. These are however difficult to quantify as the current rules
already contain, albeit less explicitly, such obligations, and many
organisations have already implemented them in practice. Moreover, 'data
minimisation' is a sound data management principle. Raising awareness of its
importance could yield benefits to businesses by helping data controllers avoid
data overflow and mitigate the risks caused by security breaches.

Budgetary
impacts: the option would have an impact on the
public authorities' both at EU and national level. It would include some
additional compliance costs due to the establishment of the online platform for
data controllers' notifications, the IT tool for exchanges of information
between DPAs, and the programmes for best practice sharing and staff exchange
between national supervisory authorities. The extended tasks for the WP 29
would lead to an increase of the annual costs of its secretariat from the currently
estimated costs of €1.7 million[114] by an approximate minimum of 30%, i.e. an additional €0.5 million
per year for the EU budget.

EU funding would
also be needed for awareness-raising activities to encourage the use of PETs
and privacy certification schemes. In the period 2009-2010 the funding of
projects under the Fundamental Rights programme, covering awareness-raising and
other activities amounted to more than €800,000. A 25% increase could be
envisaged to finance additional awareness raising projects and activities in
the domain of data protection.

Simplification: a single platform for notification of processing operations
to national supervisory authorities would reduce administrative overhead for
data controllers as it would simplify the process. However, this measure would
not remove the additional administrative burden created by diverging national
rules that would still need to be complied with.

An amendment to the
legal instrument streamlining and clarifying the adequacy criteria and
procedures would accelerate the recognition process and have a positive
impact on relations with third countries. Increasing the number of adequate
countries would in turn reduce the current overheads for data controllers
transferring data to third countries in the longer term. However, the costs
linked to the current burdensome procedures related to transfers based on other
grounds would not be reduced in the short term. Although providing a legal
basis for Binding Corporate Rules would be a positive step to recognise and
encourage the use of this tool as a means to facilitate transfers within
corporate groups, this would not  be sufficient to address the shortcomings
that currently limit their use (i.e. limitation of their scope).

d)  Social
impacts and Fundamental Rights

By improving the capacity
of individuals to exercise their data protection rights more effectively, this
option would have a limited positive social impact regarding fundamental
rights.

e) Environmental
impacts

No impact.

6.1.2. 
POLICY
OPTION 2: Legislative amendments addressing gaps in current harmonisation,
clarifying and strengthening individuals' rights and reinforcing responsibility
of data controllers and processors, reinforcement and harmonisation of DPA
powers and strengthening of their cooperation

a) Effectiveness
regarding policy objective 1: Enhancing the internal market dimension

- Regulatory
intervention improving harmonisation and clarification of EU data protection
rules, including
concepts such as personal data and consent, would significantly reduce legal
uncertainty for private companies and public authorities. Consistency will be
increased due to the reduced margin of interpretation and the implementing
measures and/or delegated acts to be adopted by the Commission. These would be
used in particular in cases where new technological or economic developments
require a common approach to be adopted by authorities in all Member States. In
recent years, a large number of such issues have arisen, where diverging
approaches have been taken at national level and by the various DPAs. In
contrast to the only instruments available for providing guidance at present -
i.e. non-binding opinions of the Article 29 Working Party – delegated or
implementing acts by the Commission would be legally binding and thus provide
legal certainty to data controllers.

The increased
harmonisation will be beneficial not only for large multinational enterprises
operating in several Member States, but also for enterprises currently only
operating in their domestic markets, including SMES, which are expected to welcome
increased legal certainty and uniformity as a strong incentive to expand their
operations cross-border.

Two sub-options
are possible in this respect:

i) If the current Directive is replaced by
a Regulation:

- a Regulation, being directly applicable
upon Member States, would achieve a very high degree of harmonisation of the
rules, without the need for transposition into different national laws. It
would also eliminate the need for defining criteria for applicable law, as the
Regulation would be the applicable law across Member States. This is the option
favoured by the great majority of economic operators, which consider it
essential to ensure the desired legal certainty and simplification within the
internal market. On the other side, this option would have a major impact on
Member States, given the fact that most of them have developed an extensive and
detailed national legislation implementing the Directive, covering both the
private and the public sector.

The current cost
of legal fragmentation, only in terms of administrative burden,
is estimated to amount to almost € 3 billion (see Annex 9 for
details). These costs are incurred by economic operators processing
personal data in several Member States and to which the different national laws
and requirements are applicable. Replacing the Directive by a Regulation would
have the effect of cutting such costs and drastically simplifying the
regulatory environment.

ii) If the current Directive is amended
and made a "maximum harmonisation Directive":

A very detailed
Directive, further harmonising the applicable rules and reducing the room for
manoeuvre left to Member States, could also help substantially in cutting
the costs and administrative burden in the baseline scenario due to fragmentation.
However, this would not eliminate the need for transposition by Member States
and the differences in national transposition laws that this might entail.
Moreover, there would always be the risk for "gold-plating" from
Member States.

- Clarifying
and simplifying the rules on applicable law  - even more if the single applicable
law will be the EU Regulation - and on the responsible DPA by establishing a
"one-stop shop" for data protection supervision will
strengthen the internal market, including by removing existing
differences in administrative formalities vis-à-vis DPAs and simplifying
the requirements. This will have a major positive impact on data controllers,
which will not have to be subject to different requirements and DPAs practices
for the same data processing operations involving several Member States.

- Replacing the
general notification of data processing activities, while maintaining a simplified
basic registration system (as well as prior checks for processing
operations likely to present specific risks to rights and freedoms of data
subjects), will relieve data controllers from a burdensome obligation currently
implemented in a diverging manner. However, the basic registration would also entail
additional administrative burden for data controllers in those Member States
that already today largely exempt from the notification obligation.

- An EU-wide
harmonised obligation to notify data breaches will ensure
consistency and avoid the creation of diverging rules in the Member States. The
definition of criteria and thresholds for notification is a key factor in
determining the cost impact of data breach obligations on data controllers and
requires an in-depth assessment and will thus be left to implementing measures.
However, in order to avoid delayed notifications – particularly in cases where
the breach is likely to have adverse consequences on the data subject – it is important
that the notification both to the DPA (as a rule, wherever feasible, 24 hours
from the point the controller becomes aware of the breach) and to the data
subject is made without undue delay.

- Simplifying rules and procedures for transfers of personal data to
third countries  would have a positive impact
on business as it would entail, in the large majority of cases, the elimination
of the need for prior authorisations before transferring data to third
countries. This is an important element to boost the international
competitiveness of EU businesses (see also Annex 10).

- Strengthening data
controllers’ and data processors’ responsibility by introducing obligations to
establish Data Protection Officers in organisations of a certain
size and nature and to perform Data Protection Impact Assessments
(with appropriate thresholds – see below) and introducing the principle
of data protection by design will also offer easier ways to
ensure and demonstrate compliance for data controllers and increase their legal
certainty.

- Consistency
of enforcement will be fostered by reinforcing
and harmonising DPAs’ powers – including the power to impose dissuasive and
effective administrative sanctions - and by the establishment of a strong
co-operation and mutual assistance mechanism between DPAs for cases with an EU
dimension. The newly established "consistency mechanism"
would ensure that a decision takes account of data subjects and data controller
establishments in EU countries other than the one of its main establishment. Interventions
by the Commission, based on the expert advice of the EU Data Protection Board would
allow settling potential disputes. Increased competences of the Commission in
particular through implementing measures and/or delegated acts
would further strengthen harmonisation. Consistency of enforcement would also
benefit from harmonising the offences subject to administrative sanctions. A streamlining
of the advisory functions of the EDPS and of WP 29 (that
would become the EU Data Protection Board and whose secretariat would be provided
by the EDPS) would further increase consistency in the internal market and
simplify the EU-coordination on data protection issues without the need of
creating a new EU Agency.

b) Effectiveness
regarding policy objective 2: Reinforcing individuals’ right to data protection

Legislative
amendments improving harmonisation and clarification of EU data protection
rules – both those strengthening controllers'
responsibility and accountability and those clarifying and improving existing
rights – would contribute to significantly strengthening individuals' control
over their own data and the actual exercise of their rights. This is
particularly true for legal provisions clarifying definitions
("personal data") and key concepts such as the modalities for
valid consent, the right to have one's own data deleted ("right to
be forgotten") or to withdraw and transfer it to other controllers ("data
portability"). This will reduce grey areas where the rights of
individuals are sometimes not properly respected.

The explicit
inclusion of genetic data as a special category of personal data
requiring specific safeguards (“sensitive data”) would bring about an important
positive impact for individuals as it would address the particular concern that
genetic data is properly and securely dealt with in all Member States. Equally,
the harmonised approach would bring about positive impacts for those
controllers who process genetic data as they could enjoy legal certainty for
this processing in all Member States.

Highly beneficial in terms of individuals'
rights are also the provisions strengthening the protection of children's
data. The additional burden for data controllers would be limited if from
the very beginning, products and services are designed to include
children-friendly privacy information and settings ("data protection by
design"). The specific rules on consent in the online environment for
children below 13 years – for which parental authorisation is required – take
inspiration for the age limit from the current US Children Online Data
Protection Act of 1998 and are not expected to impose undue and unrealistic
burden upon providers of online services and other controllers. This would not
interfere with Member States' contract laws, which would remain unaffected. The
methods and modalities to obtain verifiable consent would be left to
Commission's implementing measures.

Strengthened rules on remedies and
sanctions would also significantly contribute
to enhance individuals' data protection rights.

Simplifications
regarding applicable law to choose only one law and one single data
protection authority for data controllers active in several Member
States may bring individuals in a situation where they interact with data
controllers not directly responding to their national supervisory authorities. However,
individuals will always the possibility to address themselves to the DPA (and
the courts, for actions against the controller or the processor) of their
country of residence. Moreover, individuals' legal position will be
strengthened through the possibility for associations to bring
proceedings before the courts on their behalf.

On the basis of strengthened
DPAs powers, the improved cross-border enforcement cooperation
(particularly via the consistency mechanism) and the streamlining of the
advisory functions of WP29 and EDPS will enable individuals to exercise their
rights throughout the EU in a more consistent way and will provide them with a
stronger mechanism to assert their rights in the internal market effectively.
Strengthened administrative sanctions available to DPAs against
non-compliant data controllers will contribute to ensure that individuals'
rights are actually respected and enforced.

Other administrative
simplifications, such as the reduction of processing notification
obligations and procedural conditions for transfers to third countries will not
directly affect individuals possibility to exercise their rights, where it is
ensured that data controllers and processors responsibility and
accountability is respected, and individuals have transparency
about the processing of their data and receive fast and comprehensive information
on breaches of personal data protection.

The introduction of DPIAs
can contribute to improving transparency for individuals, as data controllers
will be better informed about the risks connected to their data processing, and
to the security of the processing of personal data, as data controllers and
processors can better avoid privacy risks related to some types of processing
and take mitigating measures for residual risks. This effect is further
strengthened by application of the principles of privacy by design and
data minimisation. Where they exist, Data Protection Officers
often serve as the contact point for individuals regarding privacy concerns and
are in a position to provide clear and comprehensible information on data
protection issues, both individually and in public communication.

c)  Economic and financial impacts

– 
Business

These measures would
bring important economic benefits within the internal market and
create a more level playing field for businesses and foster their intra-EU and
international competitiveness (see Annex 10).

Data Protection
Officers (DPOs)

The obligation for
larger economic operators only (more than 250 employees) to designate DPOs is
not expected to create disproportionate costs, as DPOs are already common in
large and multinational companies whose business is linked with the processing
of personal data.  Compliance costs are expected to amount to € 320 million per
annum for large companies in total (see annex 6 for more details). Such
costs could even be reduced in the scenario whereby groups of companies would
appoint a single DPO for the group. SMEs would be excluded from
this obligation, except if their core activity consists of processing
operations which require regular and systematic monitoring. This would mean
focusing on those activities which, by their own nature entail significant data
protection risks. For example, this would concern head-hunters companies engaged
in profiling activities. In such cases, this burden would be justified by the
nature of the processing and the particular risks, as well as the added value
for data subjects' rights of having a dedicated officer in place. Moreover, SMEs
involved in such processing activities are expected to resort to ad hoc
legal consultants for DPO services – as opposed to hiring/designating full time
employees – which would limit their costs[115].

All companies would
have to keep in any case a register of data processing operations. This would
be a minimum requirement and is part of the routine internal administration and
management of the business and would not constitute, in itself, an additional
burden. This would also have an impact on data processors given the increased
role of data processors in processing activities (e.g. in cloud computing
applications). The above thresholds/criteria would apply also in this case.

The requirement to
designate a DPO in public authorities would entail a cost for
Member States’ public authorities other than DPAs. It is difficult to estimate
such costs given that many public authorities already have DPOs or
corresponding functions (this varies between Member States).

However, the fact
that where the controller or the processor is a public authority or body, the
data protection officer may be designated for several of its entities, taking
account of the organisational structure of the public authority, ensures that
the financial burden imposed is not disproportionate and can be spread out
between the administrative departments of a public authority in a cost-efficient
way.

Data Protection Impact Assessments
(DPIAs)

The cost of a DPIA
inherently involves a case-by-case calculation, depending on the nature and
scale of the exercise. However, this obligation would be foreseen only for those
data processing presenting specific risks to the rights and freedoms of data
subjects. The threshold criteria for the applicability of this provision would
be narrowly and precisely defined to ensure that its scope would not be
disproportionately wide. Therefore, like for DPOs, most SMEs will
be exempted from this measure. Actual costs, for those companies subject to
this obligation, will necessarily depend on a set of variable criteria,
including the size of the organisation and how significant the data protection impacts
of a new technology, service, product, or proposed policy are expected to be. Annex
6 includes three case studies of DPIAs, differentiated by size and magnitude. It
is estimated that a small-scale DPIA would cost €14,000, a medium-scale DPIA
would cost €34,500, and a large-scale DPIA would cost €149,000.

In terms of benefits
to businesses, undertaking a DPIA can help to identify and manage data
protection risks, improve the security of personal data, and avoid unnecessary
costs (in terms of problems being discovered at a later stage and inadequate
data processing solutions) and damage to trust and reputation.

The burden would
also not be unreasonable for public authorities, as a DPIA would not be required
where the assessment of the impact on privacy and data protection of a certain
processing activity or system has already been carried  out during the
preparatory stage of the law on which such processing is based.

Including a general
principle of Data Protection/Privacy by Design without specific
obligations is not expected to create significant economic impacts, as it only
strengthens existing obligations. The Commission would be given the power to
adopt implementing measures setting specific obligations, which will be subject
to a separate assessment.

Strengthening the
criteria for making EU law applicable to data controllers/businesses based
outside the EU – e.g. when offering goods and services to individuals within
the EU,  or when monitoring them – could have a negative impact on them to the
extent that EU rules on data protection are more stringent than in their
country of establishment and may in some cases go as far as discouraging them
from doing business in the EU. This is however essential to ensure that
protection of EU individuals' data is not circumvented by a mere
"outsourcing" of data processing activities in countries not ensuring
an adequate level protection.

Simplifying
the rules for international transfers would,
overall, have a positive impact on the international competitiveness of EU
businesses. (see Annex 10)

– 
Public authorities

Strengthening DPAs’
independence and powers, together with the obligation for Member States to
provide them with sufficient resources, would entail additional costs for
public authorities that are currently not equipped with appropriate
powers and adequate resources. It is difficult to estimate such costs in
detail, given the differences in the size, available resources and sources of
funding, tasks and powers of national DPAs. Costs will be higher for those
Member States whose DPAs are currently not equipped with the appropriate tasks,
powers and resources to ensure a common level of data protection in the EU. On
the other hand, additional resources could derive from the increase of the
powers to impose sanctions for breaches of data protection rules.

The new cooperation
and mutual assistance mechanism between DPAs to improve the effectiveness and
consistency of enforcement would entail additional costs (including
administrative burden) for national DPAs, as they would need additional
resources to adequately cooperate and exchange information with other DPAs, in
particular to:

– 
Carry out checks, inspections and investigations
as a result of requests from DPAs in other Member States;

– 
Have additional staff and mechanisms in place to
investigate enforcement requests from DPAs in other Member States;

– 
Enforce the decisions taken by DPAs in other
Member States as part of the "one-stop shop" system of supervision.

The additional tasks
of the EDPS for providing the secretariat of the EU Data
Protection Board replacing WP29 and in particular the involvement in the
consistency mechanism are likely to require an increase of its current
resources by an additional €3 million per annum on average for the first six
years, including credits for additional human resources of 10 Full Time Equivalent
(FTE).

– 
Simplification

The costs of current
legal fragmentation for economic operators only in terms of administrative
burden are estimated to amount to more than € 2.9 billion in total per
annum. The expected net savings for economic operators would
be around € 2.3 billion per annum, arising from the elimination of
legal fragmentation and the simplification of notifications (basic
registration). Clarifying the requirements for consent, as well
as explicitly stating that the data controllers should be able to prove it
(when required), will not entail significant additional costs, as the
obligation to demonstrate that consent has been given, when the processing is
based on it, exists already today. Thus, the purpose is not to introduce a
(new) obligation for 'written consent' in all cases (a statement or clear
"affirmative action" of the data subject would also be valid), but merely
to clarify existing obligations  in order to harmonise the current divergent practices
across Member States and give legal certainty to data controllers, who would
otherwise continue to face fragmentation. The streamlining of the advisory role
of WP29 and EDPS simplifies significantly the advisory process and accelerates
the provision of coordinated guidance.

d) Social
impacts and Fundamental Rights

These measures would
give rise to significant positive social impacts, including the
strengthening of several individual fundamental rights.

e) Environmental
impacts

No impacts.

6.1.3. 
POLICY OPTION 3: Detailed harmonisation and rules at EU level in all policy fields
and sectors, centralised enforcement and EU wide harmonised sanctions and
redress mechanisms.

a) Effectiveness
regarding policy objective 1: Enhancing the internal market dimension

Adding further detailed
legal provisions, including and beyond the measures envisaged in option 2 – i.e.
making consent as primary legal ground, adding additional categories of
sensitive data, envisaging specific and detailed rules for the execution of
individuals' rights and establishing detailed and harmonised rules on specific
sectors, such as health and employment - would lead to a maximum reduction
of divergences between Member States. However, this would at the same
time lead to an unbalanced situation, as there may be not enough flexibility
for Member States to apply EU rules taking account of national specificities,
which will make implementation difficult. As regards in particular issues
without cross border impact, some flexibility is necessary for Member Sates
allowing them to design solutions tailored to their specific issues.

The total
abolition of notifications – while maintaining prior checks for risky
processing - would greatly simplify the regulatory environment, reduce
administrative burden and increase the consistency of enforcement. Having more
harmonised rules would also contribute to pursuing public policies at EU level.

An EU-wide
certification system for data controllers' compliance with their data
protection obligations would provide them with full legal certainty in an ex-ante
verification process.

Concerning the
specification of detailed criteria and thresholds for notifying data
breaches, US experience shows that the definition of such thresholds
and criteria is a very complex and difficult exercise, and deserves an in-depth
and specific assessment.

As regards
consistent enforcement, the setting up of an EU
Data Protection Agency (which would be a new EU Agency) would improve
the consistency of enforcement and solve the inconsistencies for cases with a
clear EU dimension. The EU Data Protection Agency would take over from national
DPAs the responsibility for supervision of specific cross-border cases.
However, regardless the economic implications of setting up such an agency (see
below), this could lead to a situation where an EU agency would enjoy
discretionary competences which could go too far under EU law[116]. EU harmonised
criminal sanctions would further strengthen this effect but would raise
opposition a the recourse to criminal sanctions in this area is very rare.

b) Effectiveness
regarding policy objective 2: Reinforcing individuals’ right to data protection

Data subjects'
rights, including the rights of children, would be further strengthened (compared
to the impacts under policy options 2) by extending the definition of sensitive
data to include data of children, and biometric and financial data and more
precise rules for specific circumstances and sectors (e.g. location data and
online identifiers). More detailed rules on the modalities of exercising
individuals' rights would strengthen these.

Defining consent as
a primary ground for data processing would not necessarily have a positive
effect on individuals' rights as it may lead to numerous  and eventually "artificial"
expressions of consent (i.e. not really specific, freely given etc).

The definition of
thresholds and procedurals elements of data breach notifications in the basic
act instead of in implementing or delegated acts has no advantage for
individuals.

The introduction of
a right to collective redress could allow maximising rights by means of
litigation.

A central
Agency supervising the cross-border processing
activities at EU level, a single contact point for individuals in many cases,
would ease the exercise of their rights. However, national DPAs would remain
competent for purely national situations.

Additional
strengthening of individual rights would be expected from harmonising the level
of sanctions, including criminal ones, at EU level for
infringements of data protection rules. The latter element would lower the
threshold for individuals to pursue their rights also through legal action when
administrative procedures do not produce a satisfactory outcome.

An EU-wide
certification scheme with clear and strictly
applied criteria would provide individuals with a means to select data
controllers for their transactions according to their degree of compliance. A
certification for third country controllers dealing directly with individuals
would also have a positive effect.

c) Economic and financial impacts

– 
Economic operators

Making a hierarchy
between grounds for processing with consent as the primary ground would make
the processing of personal data more difficult, cumbersome and costly for
businesses. Expanding the categories of sensitive data to biometric, financial
and children’s data would also entail substantial costs as it would require
data controllers to adapt their procedures and technical systems to more stringent
rules concerning the processing of such data.

Specifying detailed criteria
and thresholds for notifying data breaches would provide more legal
certainty but is also likely to impose undue costs on data controllers.

As regards
international transfers, the voluntary certificate/seal data controllers'
compliance with EU data protection rules would benefit EU competitiveness and facilitate
data transfers between the EU and third countries.

– 
Public authorities

While the elimination
of the general notification requirement will benefit controllers and processors
(see below), it will have a negative impact on those DPAs for whom this
currently represents an important – if not exclusive – source of financing,
such as the Information Commissioner's Office (ICO) in the UK. It may also make
it more difficult for certain DPAs to maintain an overview of data processing activities.

An EU-wide
certification system would be a resource-intensive option.

The budgetary impacts
of setting up a regulatory EU Data Protection Agency would be significant. For
comparison, the overall 2011 budget for the EDPS amounts to € 7.6 million, the
EU Fundamental Rights Agency’s budget was € 20 million and that for the European Network and Information Security Agency was € 8.1
million. It is therefore expected that a regulatory agency for data
protection would require a substantial annual budget in the range of € 7-15
million.

– 
Simplification

Abolishing
notification or registration of data processing
operations altogether would reduce costs and administrative burden for data
controllers, amounting to € 130 million per annum only in terms of
administrative burden plus the fee that may additionally be imposed..

d) Social
impacts and Fundamental Rights

The social/fundamental
rights impact would be generally positive also under this option.
Impacts would be similar as under option 2, but right to an effective remedy
would be enhanced thanks to provisions on collective redress. Many of the more detailed
measures do not create additional positive impacts.

It is expected that too
detailed data protection legislation would not be easily accepted at national
level as it would not leave enough flexibility for national social norms
and cultural specificities (for instance in the employment sector,
regarding surveillance of employees).

e) Environmental impacts

No impacts.

6.2. 
Objective 3:
Enhancing the coherence of the EU data protection framework in the field of
police and judicial cooperation in criminal matters

There is no Policy
Option 1, as 'soft' action would not be appropriate to meet the objectives.

6.2.1. 
POLICY OPTION 2: Strengthened specific rules and new instrument with extended scope

a) Effectiveness
regarding the policy objective

The extension of the
scope of the general data protection instruments to cover the area of police
and judicial cooperation in criminal matters would have a positive impact on
the objective of enhancing the coherence of the EU data protection framework.
It would also contribute to eliminating gaps in particular by extending the
scope of data protection rules in this area to 'domestic' processing.

Individuals' rights
would also be strengthened by setting minimum conditions for the right of
access and providing stricter rules on purpose limitation.
The codification of some principles from the Council of Europe Recommendation
on law enforcement, including on genetic data, will contribute to the
fulfilment of the objective.

The establishment of
a mechanism supporting common interpretations by extending the competences of
the WP 29 and of the Commission in this area – as a consequence of the entry
into force of the Lisbon Treaty- would further help to address inconsistencies
and gaps.

b)  Economic
and financial impacts

Impacts would mainly
concern the public sector. There is no indication that better coordination,
harmonisation and clarity of rules would require any additional resources;
rather the use of existing resources could become more efficient. The impact of
new obligations, such as the appointment  of a Data Protection Officer (DPO),
would also be limited to the extent that the possibility is provided – as for
public authorities in general - to appoint a single DPO for different areas,
departments and offices (and not, for instance, one per each Police Office or
Department).

c) Social
impacts and Fundamental Rights

Clarification of
provisions, reinforcement of individuals' rights and increased coordination
would have a positive effect on individuals' fundamental rights, particularly
on the right to data protection.

On the other hand,
the fact that rules are tailored to the nature and needs of law enforcement
activities – by providing for exceptions and limitations to individuals rights
when, for example, this is necessary to avoid disrupting investigations, to
protect public security and the rights and freedom of others etc – will avoid
interfering with and disrupting the activities of police and judicial
authorities in the performance of their public interest's tasks.

d) Environmental
impacts

No impacts.

6.2.2. 
POLICY OPTION 3: Extended specific rules and full integration of general
principles in former third pillar instruments

a) Effectiveness
regarding the policy objective

Explicit amendments
of all instruments extending the general rules to the area of police and
judicial cooperation in criminal matters, with limited
derogations/specifications in line with the Charter, would have a very positive
impact in terms of consistency and coherence of the rules in this area and of strengthening
individuals' rights and would provide for a higher level of data
protection.

This would, however, have an important
impact on existing forms of police and judicial cooperation as regulated in the
specific instruments that would be affected and should not be attempted without
serious evaluation.

b) Economic
and financial impacts

As in option 1.

c) Social
impacts and Fundamental Rights

The positive social
impact in terms of enhancement of individuals' data protection rights would be
slightly stronger than under option 1. Measures under this option could,
however, undermine the work of law enforcement authorities and affect their
capacity to effectively prevent and combat crime.

d) Environmental
impacts

No impacts.

Table 3: Summary of
economic impacts

Policy Option || Magnitude of Economic Impacts || Benefits || Costs

Policy Option 1 || Limited || Compliance costs · Streamlining and clarifying the adequacy criteria and procedures would accelerate the recognition process and would facilitate data transfers to third countries. Increasing the number of adequate countries would in turn reduce the current overheads for data controllers transferring data to third countries in the longer term. Administrative burden · Simplification of Notifications: a single platform for data controllers' notification would accelerate the process (but no substantial reduction of administrative burden || Compliance costs · Continued divergences in national DP laws do not alleviate administrative burdens and disincentives cross-border trade (both for businesses and individuals) · Introduction of data minimisation principle · Costs flowing from online platform for data controllers' notifications, IT tool for exchanges of information between DPAs, best practice-sharing programmes, and staff exchange between national supervisory authorities · Extended tasks for WP29 would increase annual secretarial costs from €1.7 million by an approximate minimum of 30%, i.e. an additional €0.5 million per year for the EU budget. · Costs to the EU budget for awareness-raising activities (children, PETs uptake, certification, etc) Administrative burden · Introduction of transparency principle adds some administrative burden estimated at approximately €176 million per annum

Policy Option 2 || Extensive || Compliance costs · Increased harmonisation will create a more level playing field for businesses and foster their intra-EU and international competitiveness. · DPOs and DPIA increase data controllers' accountability, and will help identify and manage data protection risks, improve the security of personal data, avoid unnecessary costs and damage to trust and reputation. · Positive impacts on the international competitiveness of EU businesses through the simplification of rules for international transfers. Administrative burden · An estimated € 2.3 billion in the administrative burden of legal fragmentation will be virtually eliminated by the increased harmonisation. · Replacement of notifications by a basic registration system would reduce administrative burden linked to that of about 50% (€ 65 million, fees excluded). || Compliance costs · Obligation (where applicable) to appoint DPOs imposes some costs on business (estimated at €320 per annum for large businesses) · DPIAs (where applicable) impose costs on a case-by-case basis. It is estimated that a small-scale DPIA would cost €14,000, a medium-scale DPIA would cost €34,500, and a large-scale DPIA would cost €149,000. · Strengthening DPAs’ independence and powers and resources, would entail additional costs for public authorities. It is difficult to estimate such costs in detail, given national divergences, but costs will be higher MS whose DPAs are currently under-resourced. · New cooperation and mutual assistance mechanism between DPAs would entail additional costs (including administrative burden) for national DPAs, in terms of additional resources.. · Additional tasks of EDPS for providing the secretariat of the EU Data Protection Board are likely to require an average increase of its annual budget by about €3 million, including additional human resources. Administrative burden · Introducing a general obligation to notify data breaches to DPAs and individuals imposes additional administrative burden estimated at €20 million per annum. · Introducing a general obligation for data controllers to be able to demonstrate  compliance with data protection law is estimated to impose additional administrative burden of approximately €580 million per annum.

Policy Option 3 || Far-reaching || Administrative burden · The total abolition of notifications – while maintaining prior checks in case of risky processing - would greatly simplify the regulatory environment and reduce administrative burden by approximately €130 million per annum (fees excluded). || Compliance costs · Eliminating the general notification requirement will have a negative impact on those DPAs for whom this currently represents an important – if not exclusive – source of financing · Making a hierarchy between grounds for processing with consent as the primary ground would make the processing of personal data more difficult, cumbersome and costly for businesses. · Expanding the categories of sensitive data to biometric, financial and children’s data would entail costs as it would require data controllers to adapt their procedures and technical systems to more stringent rules concerning the processing of such data. · Specifying detailed criteria and thresholds for notifying data breaches would provide more legal certainty but is also likely to impose undue costs on data controllers. · An EU-wide certification system would be a resource-intensive option. · Budgetary impacts of setting up a regulatory EU Data Protection Agency would be significant. For comparison, the overall 2011 budget for the EDPS amounts to €7.6 million, the EU Fundamental Rights Agency’s budget was €20 million and that for the European Network and Information Security Agency was €8.1 million. It is expected that a regulatory agency for data protection would require an annual budget of approximately €7-15 million.

7. 
Comparing the Options
7.1.1. 
Analysis
7.1.1. 
Policy Option 1

Measures under Policy
Option 1 would lead to low levels of compliance and administrative costs,
especially for private data controllers, as most of the additional costs would
fall on national and EU public authorities (e.g. financing for
awareness-raising activities, encouragement of PETs and of privacy
certification schemes).

However, at the same
time it would only have a limited positive impact on the identified problems
and on achieving the policy objectives.

In terms of
political feasibility, although the policy proposals that have been included in
Policy Option 1 are generally not controversial, this policy option is likely
to be met with resistance by stakeholders as a result of its limited scope and
impact on the problems, and would be considered as not ambitious enough.

7.1.2. 
Policy Option 2

As regards the
first and second objectives, measures under Policy
Option 2 are a considerably further-reaching and more ambitious package of
proposals, particularly of regulatory nature. It will lead to a significant
reduction of fragmentation and legal uncertainty. It can be expected to
have a much greater impact in addressing the identified problems and achieving
the policy objectives.

On balance, the
compliance and administrative costs associated with the proposals included in
this policy option are expected to be reasonable in view of the benefits and
savings of about €2.3 billion in terms of administrative burden that
can be achieved (see Annex 9).

This option will ensure
a better and consistent enforcement overall. The abolition of notifications in
favour of a much simpler 'basic registration system' would also simplify the
regulatory environment and reduce the administrative burden.

As to its political feasibility
and stakeholders' acceptance, it is expected to be positively received by
economic operators, as it would reduce their overall compliance costs,
particularly those linked to the currently fragmented rules. The strengthening
of data protection rights would be welcomed by the data protection community
and DPAs in general. The EP report on this issue has likewise called for
providing a uniform and high level of protection of individuals, while Council
conclusions have called for the new legal framework to provide for a higher
level of harmonisation than the current one.

As regards the third general
objective, this option would contribute to
achieving the objectives of ensuring more coherence and consistency of data
protection rules in the area of police cooperation and judicial cooperation in
criminal matters by repealing the Framework Decision, and eliminating gaps in
particular by extending its scope to "domestic" processing.

7.1.3. 
Policy Option 3

As regards the first and second general objectives, measures under Policy Option 3 are those having the greatest
impact on the problems and on the achievement of the objectives. They include
most of the measures in Policy Option 2, while being more far-reaching under
several aspects (e.g. more detailed rules on certain sectors, abolition of
notifications and the establishment of a European Data Protection Agency).

They would therefore
have a high and positive impact in terms of both reducing costs linked to legal
fragmentation and enhancing individuals' rights. Moreover, it would maximise
the consistency and coherence of data protection rules in the former third
pillar and raise the data protection standards in that context.

However, some of the
measures included under this option either have high compliance
costs or are likely to encounter a strong opposition from stakeholders.

As to the third
general objective, Policy Option 3 may raise
difficulties: the simultaneous amendment of all former third pillar instruments
would be very complex and politically unfeasible, as Member States will not
accept endangering existing forms of cooperation between law enforcement
authorities without an in-depth assessment, involving them, of any envisaged
modification.

It would therefore
be, overall, a rather controversial option with some measures
raising strong opposition from stakeholders.

7.2. 
Summary table comparing the policy options

Comparison of Policy Options

|| Baseline Scenario (BS) || PO1: Soft action || PO2 Modernised legal framework || PO3: Detailed legal rules at EU level || Preferred Option

Effectiveness regarding objective 1: Creating a level playing field in the internal market

Harmonise and clarify EU data protection rules and procedures || -- Fragmentation and uncertainty aggravate. || + Limited but positive effect of interpretative communications from the Commission, promotion of PETs and standardisation. || +++ Very positive effect due to the large reduction of legal uncertainties,  harmonised obligation and simplification of international transfers || ++ Very positive effect due to the maximum reduction of disparities between Member States. However, no flexibility for Member States to adapt to national specificities || +++ PO2+ elements of PO1

Ensure consistent enforcement of data protection rules || -- No EU wide coordination of enforcement. || + Limited but positive effect of coordination tools for the WP 29. || +++ Positive effect due to the introduction of a country of origin principle, mechanism guaranteeing consistency of DPAs decisions and competence for the Commission to adopt implementing measures and/or delegated acts || ++ Very positive. An EU data protection agency would guarantee consistency of decisions at EU level. However difficult to reconcile with EU Law. Harmonised criminal sanctions would strengthen the effect. || +++ PO2+elements of PO1

Effectiveness regarding objective 2: Reinforcing individuals' right to data protection

Put individuals in control of their personal data || -- Fragmentation and uncertainty increase and continue to undermine trust. || + Limited legal clarifications would only slightly improve the individual rights. || +++ Positive impact of "right to be forgotten", "data portability", addition of genetic data to sensitive data || +++ Increased protection of individuals by extending definition of sensitive data further to children data, financial data and biometric data || +++ PO2

Protect individuals data wherever they data are processed || -- Increasing problem with the development of cloud computing. || - Limited amendments to adequacy would improve some specific situations. || +++ Positive impact of new applicable law rules for controllers established outside the EU || +++ Additional positive impact of mandatory EU wide certification mechanisms allowing individuals to select controllers based on their certification level || +++ PO2

Reinforce the accountability of those processing personal data || -- No incentive beyond basic compliance, fragmentation prevents effective self regulation. || -- Limited but positive effect of interpretative communication from the Commission. || ++ Individuals will benefit from the new obligations of controllers and strengthened independence and powers of DPAs e.g. Data protection impact assessment, privacy by design and data minimisation principle. || +++ Better protection of individuals through collective redress. The EU agency have a positive impact, as a single contact point for individuals || ++ PO2

Effectiveness regarding objective 3: Including police and judicial co-operation in the EU data protection framework

Reinforce the data protection framework facilitating the police co-operation and judicial co-operation in criminal matters || -- Inconsistencies and gaps aggravate and continue to affect a smooth co-operation || N/A || ++ Enhancing the coherence and contributing to eliminate gaps || ++ Further strengthening data subjects rights and higher level of protection || ++ PO2

Lisbonize data protection rules in the ex third pillar while respecting specificities || -- Fragmentation and low level of harmonisation continue || N/A || ++ || ++ || ++ PO2

Economic and financial impacts

Impact on economic operators (including SMEs) || -- No reduction of current obligations of business and public authorities Current poor level of trust in the online sector would be maintained. || -- Simplified notifications would help SMEs and business operating cross border. Self regulation, promotion of PETs and awareness raising have a positive limited impact on the trust in the digital environment. || ++ Overall net savings of 2.3 billion Euros compared to the baseline scenario for businesses operating cross border due to increased harmonisation and coordinated enforcement. Limited new obligations to improve compliance (DPOs mainly for large companies) and detect failures (data breach notifications) || + Collective redress increases risk of litigation. Legislation to the detail could slow innovation. Detailed obligations could create additional compliance costs for business Negative impact on public authorities who rely on the notifications for their funding. But positive impact for economic stakeholders || + PO2 + encouragements of PETS, certification and awareness raising

Budgetary impact (EU and national budget) || - EU: Continuing financing projects within the fundamental right program MS: No budgetary impact || - EU: Cost of a single platform for notification Cost of IT tools for the WP 29 Cost of awareness raising activities MS: no costs || + EU: Cost of reinforcing the EDPS who would manage the consistency mechanism and provide the secretariat of WP 29 (0,85M€/year). MS: Public authorities shall be reinforced to deal with their reinforced powers. || -- EU: Cost of introducing an agency MS: Agency would take over some of the current tasks of MSes, reducing their costs || + PO2

Cutting red tape || --- Total admin burden cost equals €5.3 billion per annum Continuing national divergences and multiple requirements on businesses || + Limited reduction of the administrative burden through a single system for notification and streamlined adequacy mechanism || ++ The administrative burden costs related to legal fragmentation would be drastically reduced (€2.9 billion yearly saving leading to a  € 2.3 billion overall net saving) Positive effect due to the abolition of notifications (while maintaining prior checks for risky processing) || +++ Complete abolition of notification of processing would largely eliminate administrative burden. EU agency single point of contact for cross border business || +++ PO2 PO3 for notification €2.9 billion yearly reduction in administrative burden

Simplification || -- || + Streamlined adequacy will accelerate the recognition of third countries. Otherwise, no simplification || ++ General reduction of compliance and admin burden costs, limited administrative burden in case of failure (data breach notifications) is introduced || +++ The detailed rules may lead to more cases of non compliance and misunderstandings from businesses || ++ PO2

Social impact and Fundamental Rights

|| - || + Limited positive impact, in the fundamental rights dimension || +++ Benefits on freedom of expression, non discrimination, and right to a judicial remedy. No limitation to the freedom to conduct a business || +++ The restrictive measures under this option create only a limited positive impact, while possibly limiting the freedom to conduct a business. || +++ PO2

Environmental impact

|| No impact || No impact || No impact || No impact || No impact

Feasibility

|| Low || Medium || Medium/high || Low/medium || Medium/high

7.3. 
Preferred Option

The Preferred Option
consists of most of the measures of Policy Option 2, which are those most
likely to ensure the achievement of public policy objectives without excessive
compliance costs, combined with:

– 
One key element of Policy Option 3: the abolition
of the notification obligations (except in cases of prior checks: risky
processing), which would simplify the regulatory environment further and
totally eliminate the administrative burden required by this obligation (which
would partly remain with a basic registration system). This is called for by a
large majority of stakeholders and would have a limited negative impact on some
DPAs (see under § 6 above);

– 
Some soft measures from Policy Option 1: the
encouragement of greater uptake of PETs and privacy certification schemes and
awareness-raising activities for individuals, particularly children.

Table 4 - Summary of preferred Policy
Option

Problem || Preferred Policy Option

PROBLEM 1: -Barriers for business and public authorities due to fragmentation, legal uncertainty and inconsistent enforcement General Objective: To enhance the internal market dimension of data protection || · Abolishing notifications of processing operations altogether, while maintaining prior checks for  risky processing requiring prior checking (from Policy Option 3) · Simplifying the provisions on applicable law, to ensure that data controllers are always subject to legislation of one Member State only (or EU Regulation) and supervision of only one supervisory authority; · Amending substantive rules to remove explicit margins for manoeuvre for Member States and increase clarity and precision of the rules in general; · Giving the Commission the competence to adopt implementing acts or delegated acts where there is a need for uniform implementation of specific provisions, or when there is a need to supplement or amend specific non-essential data protection provisions, ensuring that the interests of SMEs are taken into account when these measures are developed (in accordance with the "think small first" principle). Simplifying rules and procedures for transfers of personal data to third countries by giving the Commission exclusive competence for adequacy decisions, introducing more flexibility, extending the scope of BCRs to include data processors and introducing a clear definition of "groups of companies". Moreover, prior authorisations will be deleted in the large majority of cases.. · Introducing specific provisions to safeguard the competitiveness of the EU economy and take into account the relatively weaker position of SMEs in markets, in the context of:  information requirements; responsibilities of the data controller  and joint controllers; documentation to be kept by controllers; notification of data breaches to the data subject; data protection impact assessments; processing of health data; and administrative sanctions. · Reinforcing and harmonising DPA tasks and powers and obliging Member States through the EU legal instrument to ensure provide adequate resources; · Harmonising offences subject to administrative sanctions, with low minimum thresholds to prevent unrealistic sanctions on SMEs; · Providing for mutual recognition of DPAs' decisions and increased co-operation via a consistency mechanism and mutual assistance operated, under the supervision of the Commission, through a European Data Protection Board  with a possibility for the Commission to intervene to ensure swift compliance with EU law; · Ensuring the independence and effectiveness of the new European Data Protection Board by establishing the EDPS as responsible for its secretariat (instead of the Commission). · Encouragement of awareness-raising activities for SMEs to ensure adequate knowledge and understanding of the new legal framework

PROBLEM 2: Difficulties for individuals to stay in control of their personal data General Objective: To increase the effectiveness of the fundamental right to data protection || · Funding of awareness-raising activities for individuals, particularly children (from Policy Option 1) · Encouraging greater uptake of Privacy Enhancing Technologies by business and voluntary privacy certification schemes/privacy seals (from Policy Option 1) · Further clarifying the concept of personal data; · Clarifying the modalities for  consent; · Including genetic data into the category of "sensitive data" and harmonising exceptions to the processing of sensitive data; · Clarifying the application of rules including for children (e.g. in the context of the right to be forgotten, clearer information, prohibition of profiling); · Clarifying provisions relating to processing by individuals for private purposes ("household exemption"); · Strengthening data controllers' responsibility and accountability, including by extending data controllers' obligations to data processors and creating stronger transparency obligations for data controllers (e.g. giving individuals clear and intelligible information); · Introducing Data Protection Officers (DPOs) for public authorities, companies above 250 employees and companies performing risky processing (i.e. excluding micro- enterprises and SMEs not involved in risky processing); · Introducing Data Protection Impact Assessments (DPIAs)  for processing operations likely to present specific risks, e.g. when processing biometric data; · Introducing a “data protection by design” principle; · Introducing a general obligation to notify data breaches to DPAs within 24 hours after becoming aware of the breach (if feasible), and without undue delay to individuals. · Strengthening and harmonising provisions on how individuals can exercise their rights of access and rectification to personal data (e.g. free of charge); · Introducing a right to data portability, giving individuals the possibility to withdraw their personal data from a service provider and process them themselves or transfer them to another provider, as far as this is technically feasible; · Strengthening the right of individuals to have their personal data deleted ("right to be forgotten"); · Strengthening the right of associations to bring action before courts on behalf of individuals;.

PROBLEM 3: Gaps and inconsistencies in the protection of personal data in the field of police and judicial cooperation in criminal matters General Objective: Enhance the coherence of the EU data protection framework || · Extended scope of rules in this area to cover domestic data processing; · Stricter rules on limiting data processing to the purposes compatible with those of its initial collection; · Providing minimum conditions for the right of access for individuals; · Adding genetic data to the categories of sensitive data, · Codifying selected principles based on the Council of Europe Recommendations and best practices regarding law enforcement and data protection (e.g. distinction between categories of data subjects); · Establishing mechanisms fostering common interpretation at EU level (extended competence of the WP29 and the Commission).

The
Preferred Option is estimated to reduce overall administrative burden by about €2.3
billion per annum. Most
of this reduction will come from the important reduction of fragmentation in
national data protection rules, which currently imposes significant compliance
costs on economic operators and affects the free flow of personal data in the
EU. It will hence have significant positive impacts on the EU internal market.

The Preferred Option
is also expected to substantially strengthen data subjects' rights and
the control over their data – including in the area of police cooperation and judicial
cooperation in criminal matters thus enhancing the fundamental right to data
protection and at the same time effective police and justice cooperation.

Some additional
compliance costs are expected to accrue from the strengthened data protection
rules, but a strong data protection regime in Europe can offer a competitive
advantage for the European economy. The Eurobarometer survey[117]
and other sources[118] suggest that consumers
are more likely to patronise businesses with strong privacy and data protection
records. Studies also indicate that loss of customers accounts for 60% of the
total costs of a data breach[119]. Privacy and data
protection can increase consumer confidence. The Eurobarometer survey
finds that fewer than four in ten Europeans trust shops, department stores,
phone companies, mobile phone companies, internet service providers, and
internet companies to protect their data.[120] Enhanced
data protection could enable European companies to capture the market
share of Europeans who do not shop online because of a lack of trust
that their information is secure, win customers who leave organisations with
poor data protection records and retain their existing customers.

Requiring companies
to adopt high standards of data protection can also lead to long-term
improvements for European businesses. Non-EU companies which do not have
appropriate standards will be limited in their ability to operate within the
EU, and European companies will be at the forefront if similarly high standards
are adopted in third countries. Thus, regulation could act as a stimulus to innovation
and to data protection-friendly business models. Furthermore, strong data
protection regimes could offer an opportunity to innovate in other ways. For
example, privacy enhancing technologies or privacy by design and data
protection consulting are sectors which could benefit from an environment where
enhanced data protection is the norm. European industry could become
world leaders in privacy enhancing technology or privacy by design solutions,
drawing business, jobs and capital to the European Union (see also
Annex 10 on the impact of the preferred option on competiveness).

The Preferred Option
includes a balanced solution also in relation to problem 3, as it strengthens
individuals' rights, eliminates gaps and reduces inconsistencies as regards
data protection in the area of police and judicial cooperation in criminal
matters, while limiting the potentially high impacts – vis-à-vis Member
States' law enforcement authorities – that would derive from an immediate
amendment of all ex-third pillar instruments.

7.4. 
Impacts on simplification of the Preferred
Option

The data protection
reform package forms part of the Commission’s rolling simplification programme.
The simplification will benefit individuals, private sector operators, public
authorities, including police and judicial authorities in particular by
bringing the following improvements:

– 
enhanced legal certainty as regards applicable
rights and obligations, reduction of the current legal fragmentation, and
reduction of costs and administrative burden caused by them;

– 
simplification of the regulatory environment by
streamlining obligations and procedures involved in protecting personal data
with more focus on risky processing activities;

– 
clearer rights for individuals and clearer
obligations for those processing personal data;

– 
more coherence and consistency in the field of
the former third pillar and as regards functions of the WP29 and the EDPS.

As regards administrative
burden, significant reductions will be the consequence, in particular,
of the abolition of the notification system and of simplified procedures for
international transfers. The "one-stop-shop" for data controllers will
also greatly reduce compliance costs. Compliance costs and administrative
burden related to the introduction of a principle of transparency, the
notification of data breaches and the establishment of a new co-operation and
co-ordination mechanisms are justified by enhanced quality and efficiency of
individuals rights.

Table 5 below provides an overview of
envisaged changes to the current regulatory framework which contribute to its
reduction both in terms of enhanced quality and efficiency.

Current provisions in the regulatory framework || Changes envisaged in the future framework || Expected impacts on simplification

Information of Individuals Art 10 and 11 of Directive 95/46/EC establish the obligations of data controllers with regards to information to be given to the data subject (i.e. identity of data controller and his representative; purposes of the processing for which the data are intended; recipients of the data; information on rights of access) ►Significant administrative burden is incurred by data controllers as a result of this obligation || Introduction of an explicit principle of transparency - Benefit for data subjects This would ensure that data processing is "transparent" to data subjects. Information requirements would be clarified. Intelligible information, using clear and plain language will have to be provided to individuals and I particular to children. Additional information like the contact details of the DPAs and specific rights will have to be provided. As regards controller, model for privacy notices will be introduced (via implementing measures or delegated acts). || - Better information for data subjects - Greater legal clarity for data controllers. ►Data controllers' are expected to incur one-off compliance costs for taking the necessary measures in order to provide the updated information.  This cost is justified by the enhanced quality of information (and hence protection) to data subjects. Estimated to approximately €180 million per annum in Annex 9.

Notification Art 18 requires data controllers (under certain conditions) to notify to national DPA the automatic processing of personal data. ► Significant administrative burden is incurred by data controllers as a result of this obligation, particularly by data controllers processing personal data in more than one Member State, as they have to notify DPAs in all the MS they operate in. || Abolition of the existing system of obligations of notification || - Significant simplification effects for data controllers processing personal data in more than one MS that will no longer be obliged to notify to data protection authorities in any MS ►Significant reductions in administrative burden incurred by data controllers, estimated to €80 million per annum in Annex 9

Applicable law Applicable law provisions are contained in Art 4 of Directive 95/46/EC ►These provisions do not impose administrative burden, but they do create significant compliance costs || Clarification of the provisions on applicable law, including the current determining criteria (if Directive – or EU Regulation) One law applicable to one controller || - Improved legal certainty for data controllers ►No impact on administrative burden ►Compliance costs will be reduced

Notification of data breaches There is no obligation in Directive 95/46/EC to notify data breaches to data subjects. Currently this obligation is only found in the ePrivacy Directive (2009/138/EC). || Extension of the data breach notification to all sectors || - Enhanced legal clarity as to which areas this obligation covers ►Increases in the administrative burden for data controllers, estimated at approximately €20 million in Annex 5.

Transborder data flows Articles 25 and 26 of Directive  95/46/EC foresee an adequacy procedure for international transfers, which according to stakeholders should be streamlined ||  Simplifying rules and procedures for transfers of personal data to third countries by giving the Commission exclusive competence for adequacy decisions, extending the scope of BCRs to include data processors and introducing a clear definition of "groups of companies". Moreover, prior authorisations will be deleted in the large majority of cases. || - Simplified procedures for international transfers facilitate the flow of data to third countries. ►Administrative burden linked with authorization for trans-border data flows will be reduced.

Data protection rules for police and judicial cooperation Framework Decision 2008/977/JHA: ►No administrative burden imposed by these provisions || Eliminating the protection loopholes including as regards internal processing activies and improving the consistency of data protection rules in the area of police cooperation and judicial cooperation in criminal matters: While general rules and principles would be the same as those covering other areas already covered under the scope of Directive 95/46/EC, some specific rules would be foreseen to take account of the specificities of this area – in addition to the changes already foreseen under Policy Option 1 || - Enhanced legal clarity for Member States and data controllers - Clarifications of data subjects  in the area of police cooperation and judicial cooperation in criminal matters - More consistency would exist also as regards transfers to third countries, given the enhanced Commission's role in declaring adequacy. ►No impact on administrative burden

Enforcement/Governance  Art. 28 of the Directive establishes national DPAs responsible for monitoring data protection in the Member States.  Art 29 establishes an advisory body on data protection to the Commission ►Significant compliance costs for public authorities || Establishment of a new mechanism of co-operation and co-ordination between national DPAs An enhanced role and more resources to Art 29 WP || - Increased efficiency and effectiveness in the system of governance and on enforcement ►May entail some additional  administrative burden and compliance costs for public authorities

8. 
Monitoring and
evaluation

This section
describes the monitoring and evaluation that could be applied to assess the
impact of the preferred option. The approach to monitoring and evaluation is
outlined with respect to the three main problems that the preferred policy
option will address.

The first evaluation
will take place 3 years after the entry into force of the legal instruments. An
explicit review clause, by which the Commission will evaluate implementation,
will be included in the legal instruments. The Commission will subsequently
report to the European Parliament and the Council on its evaluation. Further
evaluations will have to take place every four years. The Commission
methodology on evaluation will be applied. These evaluations will be conducted
with the help of targeted studies on the implementation of the legal
instruments, questionnaires to national data protection authorities, expert
discussions, workshops, Eurobarometers, and so forth.

The legal instrument
will also explicitly provide that the evaluations will support the possibility
for the Commission, to submit additional legislative or non-legislative
proposals and/or implementing measures, if deemed necessary.

Table 6: Monitoring and evaluation

Problem || Monitoring indicators || Tools

1. Fragmentation, legal uncertainty and inconsistent enforcement || · Time and costs spent by data controllers complying with legislation in ‘other Member States’ · The level of harmonisation of national data protection rules · Human resources available to DPAs · Powers available to DPAs (including independence) · Levels of sanctions imposed · Use made of DPOs · Use made of DPIA || · Periodic surveys of data controllers · Analyses of complaints · Comparative implementation reports at EU-level. · Surveys of DPAs and/or descriptive analyses of information in annual reports · Surveys of data controllers of different types and in key sectors · Case studies of particular issues to identify successful enforcement mechanisms.

2. Difficulties for individuals to stay in control of their personal data || · The numbers of complaints received from data subjects and compensation received by data subjects · Indications of harm suffered by data subjects as a result of violations of data protection rights · The numbers of prosecutions of data controllers · The value of fines imposed on data controllers responsible for breaches of data protection. · The confidence of data subjects in putting personal data on line and benefitting from online services · Internet usage or to be monitored through surveys. || · Trend analysis, bearing in mind that new data should be collected · Assessments of harm suffered by data subjects. · Monitoring figures on complaints to DPAs through DPA's Annual Activity Reports.

3. Inconsistencies and gaps in the protection of personal data in the field of police and judicial cooperation in criminal matters and inconsistency of the rules || · Complaints received · Incidences of data subjects having their rights breached as a result of unlawful data processing (press reports etc) · Confidence of data subjects in law enforcement agencies · Descriptions of data protection practices in different MS || · Surveys of law enforcement agencies to assess the effectiveness of measures in the preferred option. · Surveys of data subjects · Case studies and peer reviews of aspects of law enforcement affected by measures in the preferred option

Annexes
to the Impact assessment

Annex 1: Current EU Legal instruments on
data protection

Annex 2: Evaluation of the implementation of the Data Protection Directive

Annex 3: Data protection in the areas of police and judicial co-operation in
criminal matters

Annex 4: Summary of replies to the public consultation on the Commission's
Communication on a Comprehensive Approach on Personal Data Protection in the
European Union

Annex 5: Detailed Analysis of Impacts

Annex 6: Detailed Assessment of Impacts of the Introduction of Data
Protection Officers (DPOs) and Data Protection Impact Assessments (DPIAs)

Annex 7: Analysis of the Impacts of Policy Options on Fundamental Rights

Annex 8: Consultation of SMEs

Annex 9: Calculation of Administrative Costs in the Baseline Scenario and
Preferred Option

Annex 10: Impacts of the preferred option on competitiveness

ANNEX 1

Current EU Legal
Instruments for the Protection 
of Personal Data

1.   EU Charter of Fundamental Rights

Article 8 of the Charter of
Fundamental Rights of the European Union
enshrines the fundamental right to the protection of personal data of every
individual in a legally binding nature, and defines the basic principles for
the protection of personal data.

2.   Data
Protection Directive 95/46/EC

Directive 95/46/EC[121]
is the central legislative instrument in the protection of personal data in
Europe. Directive 95/46/EC is the legislative
basis for two long-standing aims of European integration: the Internal
Market (in this case the free movement of personal data) and the protection
of fundamental rights and freedoms of individuals. In the Directive,
both objectives are equally important.

Directive 95/46 was a milestone in the
history of the protection of personal data as a fundamental right, along the
path paved by Council of Europe Convention 108 of 28 January 1981. Legislation
at EU level was essential because differences in the way Member States
approached this issue impeded the free flow of personal data among the Member
States. Its legal base was thus Article 100a/Article 95 of the EC Treaty.

The Directive applies to and has been
implemented by all 27 EU Member States, as well as the
three EEA/ EFTA States: Iceland, Liechtenstein and Norway. Switzerland
has also implemented the Directive for the Schengen relevant areas. In line
with the Copenhagen criteria, all candidate countries are
committed to transposing Directive 95/46/EC by the time of accession.

The Directive develops and specifies data
protection principles in order to achieve harmonisation throughout the
EU. The principles of the protection of the rights and freedoms of individuals
vis-à-vis processing activities, notably the right to privacy, which are
contained in Directive 95/46, give substance to and amplify those contained in
the Convention (and its additional protocol on cross border data flows and
independent supervisory authorities, added only in 2001 after the
implementation of the Directive). The Directive stipulates general rules on the
lawfulness of the processing of personal data and the rights of the people
whose data are processed (‘data subjects’). The Directive also provides that at
least one independent supervisory authority in each Member State shall be
responsible for monitoring its implementation. The Directive also regulates
transfers of personal data to third countries: in general, personal data cannot
be exchanged with a third country unless the latter guarantees an adequate
level of protection. The Directive is technologically neutral,
and its principles and provisions are sufficiently general, therefore its rules
can continue to apply appropriately to new technologies and new situations.

The Directive applies to both the
public and the private sectors. Directive
95/46/EC does not apply to the processing of
personal data in the course of police and judicial cooperation in criminal
matters.

3.   "e-Privacy"
Directive 2002/58/EC

Directive 2002/58/EC[122]
particularises and complements Directive 95/46/EC with respect to the
processing of personal data in the electronic communication sector,
ensuring the free movement of such data and of electronic communication
equipment and services in the Union. It has been partially amended by the Data
Retention Directive 2006/24/EC.

This Directive has also been recently
amended by Directive 2009/136/EC[123] as part of
the overall review of the regulatory framework for electronic communications,
introducing in particular a mandatory personal data breach notification.

This Directive, also, applies to and has
been implemented by all 27 EU Member States as well as the three EEA
EFTA States Island, Liechtenstein and Norway.

4.   Data
Protection Regulation (EC) No 45/2001

Combining the relevant features of
Directives 95/46/EC and 2002/58/EC, Regulation No 45/2001[124]
regroups the rights of the data subjects and the obligations of those
responsible for the processing into one legal instrument for the Institutions
and bodies of the EU. It also establishes the European Data Protection
Supervisor (EDPS) as an independent supervisory authority for
the EU institutions (see also Decision 1247/2002). The legal basis was Article
286 EC.

With the entry into force of Article
16 TFEU (replacing the former Article 286 EC), the scope of
application of Regulation (EC) No 45/2001 extends automatically to all
data processing activities of Union institutions within the scope of Union law.
The latter now contains both former third pillar and second pillar activities.
Consequently, there is no legal need to formally update Regulation 45/2001 at
present, but this cannot be excluded in the future, for legal certainty.

5.   protection of Personal
Data in the Area of the Common Foreign and Security Policy

Currently there is no
specific EU legislation for the protection of personal data for Member States
in the area covered by the common foreign and security policy. Specific rules
for the protection of personal data may be laid down according to the newly
introduced Article 39 TEU for Common Foreign and Security Policy (CFSP)
issues, but for Member States only. The Commission applies, for all
of its activities, the provisions of Regulation (EC) 45/2001. For all measures
that fall within the sphere of the Union, such as Union action implementing
restrictive measures/sanctions, Member States apply the national provisions
resulting from implementing the Directive 95/46/EC.

6.   Protection of Personal Data in Police and Judicial Cooperation
in Criminal Matters

For the area of police and judicial
cooperation in criminal matters alone, the current data protection framework in
the EU can only be described as a patchwork that is, consisting of different
rights and obligations for Member States and individuals, and creating several
data protection supervisory authorities[125]. Several
instruments exist with specific data protection regimes or with data protection
clauses.

Since 2008 Council Framework
Decision 2008/977/JHA[126]
aims at creating an EU general legislative framework for the protection of
personal data in police and judicial cooperation in criminal matters.
Implementation of the Framework Decision was due in November 2010. It applies
fully to the UK and Ireland, as well as Iceland, Norway and Switzerland,
because it is a development of the Schengen acquis. It does not, however,
replace the rules applicable to Europol, Eurojust, Schengen and the Customs
Information System, and it does not create a single independent supervisory
authority. This Framework Decision does not affect the Council of Europe
Convention for the Protection of Individuals with regard to Automatic
Processing of Personal Data, and the Additional Protocol to that Convention of
8 November 2001[127], which therefore
remains relevant for some EU instruments relating to police and judicial
cooperation which contain specific data protection regimes or data protection
clauses.

Protocol 36 on Transitional provisions
annexed to the Treaty of Lisbon provides that in the case of the existing
former third pillar acquis, the principle is the preservation of all legal acts
so long as they are not repealed, annulled or amended (Article 9).

The Commission has no infringement powers
in the case of former framework decisions (Article 10). Also, the powers of the
Court of Justice are to remain the same with respect to those acts in the field
of police cooperation and judicial cooperation in criminal matters which were
adopted before the entry into force of the Treaty of Lisbon. These transitional
measures are to cease to have effect five years after the date of entry into
force of the Treaty of Lisbon.

Declaration 50 concerning
Article 10 of the Protocol 36 attached to the treaties invites the
institutions, within their respective powers, to seek to adopt, in appropriate
cases and as far as possible within the five-year transitional period, legal
acts amending or replacing existing third pillar acts.

ANNEX 2

Evaluation of the
Implementation of

the Data
Protection Directive

9. 
Context of the evaluation

The Commission's reports on the
implementation of the Data Protection Directive 95/46/EC[128] found in 2003[129] and in
2007[130] that the Directive
did not manage to fully achieve its internal market policy objective,
or to remove differences in the level of data protection
actually afforded in the Member
States. Enforcement was also identified as an area where improvement was needed.

This evaluation focuses on the
implementation of key provisions of the Data Protection Directive
since then. It is carried out in the context of the reform of the current acquis
on the protection of personal data in the European Union. To address the
question whether existing EU data protection legislation can still fully and
effectively cope with the challenges, posed particularly by globalisation and
new technologies, the Commission launched a review of the current legal
framework on data protection, starting with a high-level conference in May 2009.

The conclusions in the present document are
based on findings in this review as regards the implementation of Directive
95/46, including the analysis of Member States' legislation transposing the
Directive into national law, on the basis of studies[131],
of opinions of the Article 29 Working Party,[132] and of a
survey launched by the Commission in relation to certain aspects of the
Directive, to which 22 Member States responded.

10. 
Key Provisions of Directive 95/46/EC
10.1. 
Definitions and concepts
10.1.1. 
 The concept of "personal data" - Article
2(a)

The concept
of “personal data” is one of the key concepts in the protection of
individuals by the current EU data protection instruments and triggers the
application of the obligations incumbent upon data controllers and data
processors. The definition of "personal data" covers all information
relating to an identified or identifiable natural person, either directly or
indirectly. This deliberate technique to define "personal data" used
by the legislator in 1995 has the advantage of providing a high degree of
flexibility and the possibility to adapt to various situations and future developments
affecting fundamental rights. However, although the definition of "personal
data" and "data subjects" are almost literally transposed by the
majority of the Member States into their national laws[133],
this broad and flexible definition leads to some diversity in the practical
application of these provisions. In particular, the issue of objects and items
("things") linked to individuals, such as IP addresses, unique
RFID-numbers, digital pictures, geo-location data and telephone numbers, has
been dealt with differently among Member States.

For instance IP addresses,
which identify computers on networks, are considered as personal data by some
Member States, while by others they may be qualified as such only under certain
circumstances.[134] Only a few Member States
have taken a clear regulatory approach assessing the status of IP addresses.
Austria considers IP addresses as being personal data in the Austrian Security
Policy Act. Laws in Cyprus, Italy and Luxembourg suggest the same, but within
the context of electronic communications. According to the Bulgarian and
Estonian Electronic Communications Acts, only a combined set of data which
includes IP addresses constitutes, as a whole, personal data. Hence, public
authorities in charge of Network and Information Security and Critical
Information Infrastructure Protection as well as Computer Security Incident
Response Teams (CSIRTs), Internet Service Providers and the security industry
have expressed concerns about legal uncertainty regarding the handling and
exchange of IP addresses and e-mail addresses across organisations and borders
to ensure the overall security of networks and information systems (e.g. to
mitigate spam, botnets or Distributed Denial of Service attacks).

In the absence of clear regulatory
provisions, many national Data Protection Authorities (DPAs) provided guidelines
and opinions on the matter. Some of them took the view that the processing of
IP addresses does not fall within the scope of legislation implementing the
Directive, as long as the addresses themselves are not linked to individuals or
to PCs of individuals (e.g. Belgium, UK). The majority of DPAs point to the
fact that sophisticated means allow, in most cases, the re-identification of
users, and consider, in their opinions on this issue, that IP addresses
themselves are personal data (e.g. Denmark, France, Germany, Hungary, Latvia,
Lithuania, Netherlands, Poland, Spain). Estonian, Slovenian and Swedish DPAs
state that IP addresses are considered as personal data in combination with
other data, which could allow linking a dynamic or static IP address to an
individual subscriber. The Austrian DPA recognised dynamic IP addresses (which
are assigned automatically, as opposed to static IP addresses) as personal data.

National courts tend to consider IP data as
personal data (e.g. in Austria, France, Germany, Italy, Poland, Spain, Sweden,
UK); only few courts found that IP addresses were not personal data since they
allowed identification of a computer but not its user (e.g. some courts in
France[135], Ireland[136]).
ECJ case law on the confidentiality of electronic communications[137]
does not refer to the status of IP addresses.

Another major area of divergent
interpretation relates to the circumstances in which data subjects can be said
to be "identifiable", if they have been made "anonymous",
so that data can no longer be related to the individual, or
"pseudonymised", where data can only be linked to the individual if
one is in possession of a decoding "key". In this regard, recital 26
of the Directive states that "the principles of protection shall not apply
to data rendered anonymous in such a way that the data subject is no longer
identifiable". However, the assessment whether the data allow
re-identification depends on the circumstances, available means and
technological development. In several Member States, DPAs consider encoded or
pseudonymised data as identifiable – and thus as personal data – in relation to
the actors who have means (the "key") for re-identifying the data,
but not in relation to other persons or entities (e.g. Austria, Germany, Greece,
Ireland, Luxembourg, Netherlands, Portugal, UK). In other Member States all
data which can be linked to an individual are regarded as "personal",
even if the data are processed by someone who has no means for such
re-identification (e.g. Denmark, Finland, France, Italy, Spain, Sweden).
However, DPAs in those Member States are generally less demanding with regard
to the processing of data that are not immediately identifiable, taking into
account the likelihood of the data subject being identified as well as the nature
of the data.

Digital pictures of properties held in a database are considered, in the Netherlands
for example, as personal data, if used for valuation or taxation purposes. In
Sweden, telephone numbers were considered as personal data, but in one case,
under the previous law, subject to the condition that not more than one
specific person used the phone.[138] There are also cases
where the notion of "personal information" referring to professional
activities as personal data was challenged.

Responding to these divergent approaches,
the Article 29 Working Party issued an opinion on the concept of "personal
data"[139], clarifying,
particularly, the elements of "any information", "relating
to", and "natural person", and pointing to recital 26 of the
Directive as an essential means for interpretation. On the specific issue
whether IP addresses are to be considered as "personal data", the
Working Party concluded that IP addresses should be considered as personal data
particularly in those cases where they were processed for the purpose of
identifying the users of the computer. This position is referred to by DPAs in
several Member States (e.g. Latvia, Lithuania, Luxembourg, Malta, Poland, and
Romania).

Although the present definition of "personal data"
encounters divergent applications in Members States in some situations,
especially as regards things linked to individuals, it would seem
counterproductive to change the definition of personal data.  Specific issues
such as IP addresses and geo-location data should be tackled on the basis of
this proven concept, taking into account – as said in recital 26 of the
Directive - of "all the means likely reasonably to be used either by the
controller or by any other person to identify the said person". Detailed
references to specific technologies would jeopardise the proven technological
neutrality of the Directive and risk gaps when technology advances.

10.1.2. 
The concepts of data "controller" and
"processor" - Article 2(d) and (e)

The concepts of data controller and data
processor play a crucial role in the application of the Directive, particularly
for determining the responsibility for compliance with data protection rules,
the exercise of the rights of data subjects, the applicable national law and
effective enforcement by the Data Protection Authorities. The definition of
data "controller" in the Directive refers to the natural or legal person
or body which - alone or jointly with others - determines the purposes and
means of processing. "Processor" is defined as the natural or legal
person or body which processes personal data on behalf of
the controller. However, apart from rules relating to
confidentiality or security of processing and for the controller's
responsibilities as regards the data subject's rights, the Directive contains
no comprehensive or detailed set of obligations and responsibilities for
controllers and processors.

A number of national laws (e.g. Belgium,
Denmark, France, Luxembourg, Netherlands and Sweden) closely follow the
definition of the "controller". Other laws provide for
some variations: for instance, focusing on the determination of the
"purposes" of the processing, either without any reference to the
"means" (e.g. Austria) or with reference to the "contents and
use" of processing instead of the "means" (e.g. Spain). Irish
law defines the controller as the person who determines the "scope and
manner" of the processing, without referring to the purposes, while
Italian law provides a detailed definition of the controller as "either
the entity as a whole or the department or peripheral unit having fully
autonomous decision-making powers in respect of purposes and mechanisms",
and also expressly "related to security matters". German law defines
the controller as "any person or body which collects, processes or uses
personal data for itself, or which commissions others to do the same".

The definition of "processor"
has been implemented by most national laws. Austrian law provides that if a
processor carries out processing "other than as instructed", he/she
has to be regarded as the controller in respect of that processing. Some Member
States do not provide a definition of "processor", but cover this
processing in definitions of "third party" or "recipient".
German law covers in more detail processing "on behalf of the
controller" and "on instructions".

These divergences run counter the objective
of the Directive to ensure the free flow of personal data within the
internal market. This is true for a large number of sectors and
contexts, e.g. when processing personal data in the employment context or for
public health purposes. Different interpretations and a lack of clarity of
certain aspects of these concepts has led to uncertainties with regard to
responsibility and liability of controllers, co-controllers and processors, the
actual or legal capacity to control processing, and the scope of applicable
national laws, causing negative effects on the effectiveness of data
protection.

The lack of harmonisation is one of the main
recurring problems raised by private stakeholders, especially economic
operators, since it is an additional cost and administrative burden for them.
This is particularly the case for data controllers established in several
Member States, who are obliged to comply with the requirements and practices in
each of the countries where they are established. Moreover, the divergence in
the implementation of the Directive by Member States creates legal uncertainty
not only for data controllers but also for data subjects, creating the risk of distorting
the equivalent level of protection that the Directive is supposed to achieve
and ensure. Also the provision on liability in the Directive (Article 23)
focuses on the controller, without addressing the liability of the processor.

The lack of harmonisation is especially
pertinent where more than one controller and/or processor are
involved in processing operations located in different Member States that apply
different rules for controllers and/or processors. In practice, due to the
complexity of the environment in which data controllers and processors operate,
and particularly due to a growing tendency towards organisational
differentiation in both the private and the public sectors as well as the
impact of globalisation and new technologies, these concepts became
increasingly complex. Sometimes numerous controllers and/or processors are
involved in the same processing operations. An example for this is behavioural
advertising, where publishers rent website-advertising space and network
providers collect and exchange information on users. Such "joint
controllership" is covered by the definition of the "controller"
("jointly with others"). However, in such cases there is a need to
clarify the sphere of responsibilities, including the duty of informing the
data subject that his/her data are accessible by others and conditions of
access to personal data. In case the controller is located outside the EU,
additional problems arise in view of the determination and enforcement of the
applicable law (see section 2.3) and the transfer of data to third
countries (see section 2.11).

These problems are amplified in the context
of "cloud computing", whereby software, shared
resources and information are on remote servers ("in the cloud"). In
the context of cloud computing, a cloud user can delegate to a cloud operator
the supply of storage, infrastructure, software and security. The internet
makes it much easier for data controllers and processors established outside
the EU to provide such services from a distance and to process personal data in
the online environment. It is often difficult to determine the location of
personal data, which is frequently replicated on all continents in order to
improve its accessibility, and to enforce data protection rules particularly in
situations where the controller targets services to EU residents but has no
establishment or representative in the EU. This may involve the loss of individuals' control over their potentially sensitive
information when they store their data with programs hosted on someone else's
hardware. Cloud providers usually consider themselves as data
processors; however, whether the cloud provider is to be regarded as a
controller or processor depends on the circumstances. Due to the current
limitations of encryption technologies, it is expected that the cloud provider
will very often have full access to most personal data controlled by its
customers. Also, the concrete implementation of the rights of the individuals,
such as modification and deletion of the personal data, is frequently operated
by the cloud provider's subcontractors. It is, therefore, important to clarify
which controller in such situations is responsible for ensuring that the data
subjects using online services can exercise their rights, independently from
the place where the processing occurs, whether in a European or an
international cloud.

On 16 February 2010 the Working Party
adopted an opinion on the concepts of "controller" and
"processor"[140], in which it assessed
these concepts in detail, concluding that clarification of these concepts was
called for in order to ensure effective application and compliance in practice,
but also found that the current distinction between controllers and processors
was relevant and workable.

Although the definitions and concepts of "controller" and
"processor" remain themselves relevant, they need to be clarified and
detailed in specific provisions as regards the obligations, responsibilities
and liability of both controllers and processors. Harmonised rules on the
responsibilities of data controllers and processors, including the obligation
to demonstrate compliance with their obligations, would foster legal certainty.
Including in the case of more than one controller and/or processors being
involved, it must be clear for the data subject whom to address to in order to
exercise his or her rights.

10.1.3. 
The concept of "consent" - Article
2(h)

The definition of "the data subject's
consent" in the Directive builds on the elements of "any freely given
specific and informed indication" of the data subject's wishes signifying
the agreement to the processing of personal data relating to him/her. Whereas
national law in most Member States reflects these elements, several Member
States require the consent to be "unambiguous" (e.g. Portugal, Spain,
Sweden), given "expressly" (e.g. Cyprus) or "explicit"
(e.g. Greece, Luxembourg). In some Member States, the consent for data
processing must be, in principle, in writing (Germany, Italy). Poland requires
a "declaration of will", which "cannot be alleged or presumed on
the basis of the declaration of will of other content", but does not
particularise the elements "free, specific and informed". On the
contrary, some other Member States (e.g. France, Ireland, Romania and UK) do not
provide a definition of "consent" in their national data protection
laws. In practice, this leaves room for considering, in certain circumstances,
that "consent" to the processing of (non-sensitive) data is implied,
as it is the case in the UK. In some cases it is not even clear what would
constitute freely given, specific and informed consent to data processing.

These different approaches among the
national systems – ranging from written consent to implied consent
– create considerable discrepancies, which are relevant for ensuring
"informed consent" of the data subject (see section 2.7). This
situation is particularly problematic in cross-border situations, including the
internet. "Consent" obtained under the law of one country and valid
under that law, could be regarded as insufficient for subsequent processing in
another Member State because it might not meet (additional) requirements of
that law for considering "consent" as a valid legal basis. The scope
of application of "consent" also needs clarification, particularly in
relation to the requirement of "free consent" in specific situations
where there is an imbalance between the position of the data subject and the
controller, in particular in the employment context, due to the relationship of
the subordination of the employee to the employer, or in the public sector. The
opinions issued by the Article 29 Working Party cover specific situations such
as cross-border data flows,[141] employment[142],
schools,[143] and the medical sector[144],
but do not solve the problem of divergent national approaches.

These discrepancies are brought into
sharper focus in the online environment, where individuals are
generally less aware of or certain about their rights, and are hence less
capable of giving informed and meaningful consent to data processing. A
critical question in this respect is whether the settings (default or
otherwise) of most commercially available web browsers can actually be
considered to deliver the informed consent within the meaning of the Directive.
In the light of this debate and the discrepancies between Member States'
national rules, the Article 29 Working Party issued, in June 2010, an opinion
on behavioural advertising[145], in which it states
that "the settings of currently available browsers and opt-out mechanisms
only deliver consent in very limited circumstances" and calls on
"advertising network providers to create prior opt-in mechanisms requiring
an affirmative action by the data subjects indicating their willingness to
receive cookies or similar devices and the subsequent monitoring of their
surfing behaviour for the purposes of serving tailored advertising."

In view of the divergent approaches among national laws and the
consequences deriving from these, there is a need to clarify and determine in more
detail the conditions and rules on consent, in order to guarantee informed
consent and to ensure that individuals are fully aware that they are consenting
to a specific data processing.

10.2. 
"Household exemption" - Article 3(2),
second indent - and Freedom of information - Article 9
10.2.1. 
The 'household exemption'

Member States, businesses and individuals
see online services as creating one of the main challenges to personal data
protection. The internet makes processing easier and consequently vastly
increases the audience and the volume of data processed; this also results in
the increased risks for data subjects when using such applications. Surveys
show that most European users feel uneasy when transmitting their personal data
over the internet, but only a minority of users said they used tools and
technologies that increased data security.[146]

In this context, one issue of major concern
is the application of the Directive to online social network services
(SNS). While the social network providers are controllers (since they
determine the purposes and the means of processing personal information on
their online communication platforms) the situation is less clear as regards
the users of such platforms. The Directive does not apply to the processing of
personal data by a natural person in the context of a purely personal or
household activity. However, the role of the users may go beyond such context.
Personal data are often retained and disclosed without the person concerning
being informed and/or having given his/her consent on this.

ECJ case law[147] - referring to
the "correspondence and the holding of records of addresses"[148]
– has clarified the scope of this exemption. The court ruled that the exemption
does not apply "with the processing of personal data consisting in
publication on the internet so that those data are made accessible to an
indefinite number of people". This means that users of social networks,
disclosing personal data of other individuals, act as controllers and therefore
cannot rely on the complete exemption from the scope of the Directive, even if
the processing relates to purely non-economic, charitable and religious
purposes. On the other hand, the Court clarified that the information appearing
on a computer in a third country does not constitute a transfer of data by the
users themselves, and also, that Member States are not prevented from extending
the scope of their national law to areas not included in the scope of the
Directive.[149]

In practice, in most Member States the Data
Protection Authorities focus on the responsibility of the service
providers, without dealing with the question of whether users of such
sites, who make personal data available to others, become subject to the law as
controllers. In France, the Data Protection Authority excludes bloggers from
the notification requirement and advises internet users who create a personal
website for a circle of family or friends to impose access restrictions, to
inform the individuals concerned, to disseminate the data to third parties only
within the context of private activities, to give the data subject the
opportunity to object to it and to ensure a proportional retention period. By
contrast, in the UK, the Data Protection Authority has not even addressed the
responsibilities of the SNS providers and has restricted itself entirely to
issuing guidance to individual users, without addressing the issues that arise
on the processing of information about other individuals.

In view of these serious discrepancies
between the Member States, the Article 29 Working Party issued, in June 2009,
an opinion on social networking[150]. It clarified that the
"household exemption" applies to users who operate within a purely
personal sphere, contacting people as part of the management of their personal,
family or household affairs. The opinion advocates robust security and
privacy-friendly default settings and focuses on the obligations of providers in
its recommendations, including the obligation to inform data subjects on the
different purposes for which they process personal data, and to take particular
care with regard to the processing of the personal data of minors. It
recommends that information on other individuals should only be uploaded by a
SNS user with that individual's consent.

10.2.2. 
Freedom of expression

According to the Directive, should it be necessary to reconcile the right to privacy with the rules governing
freedom of expression, Member States shall provide for exemptions or derogations in the national laws for the processing
of personal data for solely journalistic purposes, artistic or literary
expression (Article 9). However, the Directive does not
provide guidance on what is "necessary" in order to reconcile the
right to privacy with the rules governing freedom of expression. As regards this
exemption, also, the ECJ held that processing of personal data must be
considered as "solely for journalistic purposes" if the sole object
of those activities is the disclosure of information, opinions or ideas
to the public, and that also personal data files which contain solely,
and in unaltered form, material that has already been published in the media,
fall within the scope of application of the Directive.[151]
In its case law, the ECJ stressed the margin for manoeuvre of Member States to
determine how, in any particular case, a fair balance between freedom of
expression and privacy should be achieved, provided that the right to freedom
of expression and freedom to receive and impart information is taken into
account, and that any such national decision would have to be proportionate in
relation to those rights.[152]

In practice, this provision is applied
quite differently in the Member States. The need to extend the exception
to everyone and not just to journalists, artists or writers is
recognised particularly clearly by Denmark and Sweden, where the data
protection law does not apply to the extent of violating the freedom of
expression. On the other hand, Luxembourg's law contains the caveat that "without
prejudice to the rules in the legislation on mass communication media", thus
focussing on the mass media rather than on non-journalists. It provides
specific rules on informing the data subject, on the right of access, on
transfers to third countries and – to the extent that they relate to matters
"manifestly made public by the data subject" – on the processing of
sensitive data. Italian law provides that data on private matters may only be
reported if there is a "substantial public interest", unless the data
subject has made the data public, or if their publication is justified in view
of the public conduct of the data subject.

Austrian law focuses on whether it is
"necessary to fulfil the information-providing task of media companies,
media service providers and their employees". Spanish law does not refer
to freedom of expression, but contains certain provisions relaxing its rules
with regard to the processing of data derived from "publicly accessible
sources". In France, there are a number of exemptions for the media and
for literary or artistic expression, explicitly stressing that these exemptions
are without prejudice to the rules in civil and criminal law of defamation. In
Germany, the "media privilege" does not exempt the media from the
data protection requirements, but recognises that the interests of data
subjects and controllers must be balanced differently in this context. In other
Member States (e.g. Belgium, Netherlands, Portugal), the exemptions relate to a
more limited range of provisions. Belgian law spells out that issues such as
the protection of sources, or whether the normal rules would hamper the
collection of information, should be taken into account. The UK and the Irish
law impose the requirement that the controller "reasonably believes"
that the processing is "in the public interest", thus leaving, in
practice, the emphasis on self-regulatory control of the press. In Greece, the
law only grants an exemption from the obligation to inform data subjects, and
then only if the data subjects are "public figures". Apart from these
widely different approaches in national legislation, in several Member States
"non-professionals" such as SNS users and "bloggers" are
not covered by exemptions in relation to freedom of expression, despite the
fact that their "user-generated" information will, to a significant
extent, provide information to the public.

As regards the disclosure of information to
the public or to third parties, the ECJ[153] has made it
clear that no automatic priority can be conferred to the objective of
transparency over the right of personal data, and that the disclosure of
documents involving personal data would require demonstrating the necessity for
their disclosure on compelling legitimate grounds.

Both the "household exemptions" and exemptions in relation
to freedom of expression create increasing uncertainty in particular as regards
the processing of data by users of social networks. The limitations of
"purely personal or household activities" and the application of data
protection rules for disclosing to the public information, opinions or ideas,
in relation to the freedom of expression should be clarified.

10.3. 
The applicable law - Article 4

The Commission’s first report on the
implementation of the Data Protection Directive[154]
in 2003 already highlighted the fact that the provisions on applicable law were
“deficient in several cases, with the result that the kind of conflicts of law
Article 4 seeks to avoid could arise”. The situation has not improved since
then, as a result of which it is not always clear to data controllers and data protection
supervisory authorities which law is applicable where data processing in several
Member States is involved.

The linking of the applicable law to any
establishment of the controller leads to the consequence that the same
controller has to comply with different national laws which apply for each of
its establishments. This is particularly the case for data controllers
established in several Member States and obliged to comply with the – sometimes
divergent – requirements and practices in each of these Member States.
Moreover, the divergence in the implementation of the Directive by Member
States creates legal uncertainty as to which legal obligations apply. This is not
only relevant for data controllers, but also for data subjects, creating the risk
of distorting the equivalent level of protection that the Directive is supposed
to achieve and ensure. This may lead to situations of different levels of
protection, e.g. when Member States follow different interpretations of the
"household exemption", or of the concept of freedom of expression.
Data Protection Authorities frequently provide guidance to controllers on how
to comply with their law on the internet, but rarely on the question of when
their law applies to these activities. Generally, they do not seek to apply
their national laws to processing operations of controllers established in
other Member States (see point 2.12.6).

Uncertainties exist also on the issue as to
which national law applies to the processing activities of controllers
located outside the EU, in particular when the data controller is not
established in the EU but provides its services to EU residents in several
Member States. The application of the Directives for such controllers is linked
to the "use of equipment, automated or otherwise, situated on the
territory" of the Member State, unless used for purposes of transit.
However, already the notion of "equipment" itself is not clear
and widely interpreted in the sense of "means". This is in particular
relevant given the growing complexity due to globalisation and technological
developments: data controllers increasingly operate in several Member States
and jurisdictions, providing services and assistance around the clock. The
internet makes it much easier for data controllers established outside the EU
to provide services from a distance and to process personal data in the online
environment, and it is often difficult to determine the location of personal
data and of equipment used at any given time (e.g., in “cloud computing” applications
and services). Whereas, for example, in most Member States, the Data Protection
Authorities regard the use of "cookies" – in line with the opinion of
the Article 29 Working Party[155] - as sufficient to
bring the processing of data by a non-EU controller within the scope of their
laws, investigating violations on the internet and enforcement of the data
protection rules becomes difficult where servers are located outside the EU. In
some Member States (e.g. in France), the views of national courts and Data
Protection Authorities differ from each other. The "transit"
criterion is applied by several Member States (including Belgium, Finland,
Ireland, UK) only to the Member State in question, or without clarifying
whether this means transit through their territory or transit through the EU
(e.g. Greece, Netherlands and Spain).

Divergent approaches exist also in relation
to the obligation to appoint a representative for a non-EU based
controller. In many Member States it is not known how many controllers not
established on EU territory and making use of equipment situated on their
territory have designated a representative, as required by Article 4(2) of the
Directive. Thus this obligation to designate a representative is hardly
enforced in practice. This situation creates the serious risk of depriving
individuals of the protection to which they are entitled under the EU Charter
of Fundamental Rights and EU data protection legislation.

In December 2010, the Article 29 Working
Party issued an opinion[156] aimed at clarifying the
concept of applicable law. It notes, inter alia, that several Member
States' laws could become applicable when establishments of the same controller
are located in several Member States. The "use of equipment"
provision should apply in those cases where there is no establishment on EU
territory, or where the processing is not carried out in the context of such
establishment. The opinion recommends simplifying the rules for determining
applicable law, and applying the 'country of origin principle' on the basis of
comprehensive harmonisation of national legislation, so that the same law
applies to all establishments of the controller, regardless of the location of
the establishments. Where the controller is established outside the EU, it recommends,
inter alia, to developing 'targeting criteria' when processing is targeted at
individuals in the EU, and to apply the equipment criterion in a limited form.

Uncertainties and different approaches as regards applicable law demonstrate
the need for a revision of the provisions on applicable law, in order to
improve legal certainty and ultimately provide for the same degree of
protection of EU data subjects, regardless of the geographic location of the
data controller.

10.4. 
Data Protection Principles - Article 6
The data protection principles are in general considered, both by
Member States and stakeholders, as being sound and valid. However, the wording
of the purpose-limitation principle leaves it open to divergent application,
ranging from "reasonable expectations" of the data subject, to
"fairness" or the application of various "balance tests".
In some countries, the principle is subject to exemptions, particularly for the
public sector. In others, purposes are sometimes defined in excessively broad
terms. The rules concerning the change of purpose for the processing of non-sensitive
personal data without the consent of the data subject, including for research
and statistical purposes, vary considerably, as they do as regards the
requirement of safeguards. Some Member States do not provide any safeguards,
and others only minimal, insufficient safeguards.

Also, the vague terminology that personal
data must be "not excessive" in relation to the purposes for which
they are collected and/or further processed, leaves room for divergent interpretations
and does not guarantee data minimisation, i.e. limiting the extent
of processing to the minimum necessary in relation to its purposes. This is
relevant e.g. in view of the collection and storage period for personal data or
of privacy-friendly default settings which could enhance data protection.
Currently, default settings are often overly complex and not user friendly;
also, the method of changing them can be unclear or imprecise.

While the Directive requires that personal
data be processed "fairly" and provides for certain information
requirements, it does not explicitly express the "principle of
transparency" in the sense that the data must be processed in a
manner that is transparent to the data subject. The specific inclusion of such
a principle would emphasise that transparency is a fundamental condition for
enabling individuals to exercise control over their own data and to ensure
effective protection of their personal data, which could serve as a basis for
improved information requirements (see section 2.7.).

Another issue is the need to clarify the
role of data controllers in ensuring compliance with these principles, as
required by Article 6(2) of the Directive. The Working Party concluded, in its
opinion of 13 July 2010 on the principle of accountability[157],
that there is a need to strengthen this concept by requiring data controllers
to implement appropriate and effective measures to ensure that the principles
and obligations of the Directive are complied with, and demonstrate this to the
Data Protection Authorities upon request. Such a principle on the comprehensive
responsibility of data controllers would need to be clarified and accompanied
by the elaboration of detailed provisions, specifying the concepts of
controllers and processors.

While the key data protection principles have proven to still be
valid and sound, the principles of data minimisation, transparency should be
added, as well as the principle of comprehensive responsibility of the data
controller to ensure and demonstrate compliance with data protection rules.
Clarification is also needed particularly on the conditions for the change of
purpose of the processing of personal data, which are collected for another
purpose, and on the processing of personal data for statistical and research
purposes.

10.5. 
Lawfulness of processing - Article 7
In several Member States the criteria set out in Article 7(a) to (f) of
the Directive are transposed as alternative grounds for lawful processing on
equal footing (e.g. in Belgium, Denmark, Finland, Ireland, Luxembourg, the
Netherlands and Sweden). In Austria, Germany and Spain, consent and processing
based on a law or to fulfil a legal obligation are given primary status, the
other criteria being seen as exceptions. In other countries (including the
Czech Republic, France, Greece and Portugal) processing on the basis of consent
is the sole primary criterion. In Italy this is the case only for the private
sector. 
As regards processing on the basis of consent, the legitimacy of processing depends on
the concept of "consent", which is understood and applied differently
from Member State to Member State (see point 2.1.3). Apart from that, uncertainties arise as
to how far data processing in the public sector and other specific sectors,
such as employment, may rely on the consent of the data subject.

In relation to processing on the basis of a
legal obligation, the ECJ[158] and the
European Court of Human Rights[159] clarified the issue of
whether such legal obligation might be justified by reasons of substantial
public interest such as those laid down in Article 8 of the European Convention
on Human Rights and the requirement of necessity and proportionality for this
purpose. However, different standards in the quality of laws cause problems
particularly in the cross-border context, both in the private and public
sector. This may lead to the situation that the Member State in which the data
are further processed does not meet the requirements of the law of the Member
State in which the data are collected. Another uncertainty is whether the legal
obligation or the public interest as a legal basis for processing is to be
determined by the national law to which the controller is subject, or by the
national law of any EU Member State, which might then require the data
collection and disclosure by a controller residing in another Member State. As
regards a third country requesting the transfer of data collected in a Member
State, the Article 29 Working Party indicated that an obligation imposed by a
third country's legal statute or regulation requiring a controller in a Member
State to undergo processing activities cannot qualify as a legal obligation by
virtue of which data processing in the EU would be made legitimate[160].

The implementation of the "balance
of interest" criterion (Article 7(f)) differs substantially
between Member States. In the UK it is largely left to controllers to conduct
the assessment and to determine whether they can process personal data on this
basis. In the Netherlands, the explanatory memorandum to the data protection
law sets out guidance on what issues should be taken into account when applying
this criterion. Given its vagueness, several Member States (including Belgium,
Ireland and UK) have envisaged issuing further rules for the application of
this criterion, but have not yet adopted such rules. DPAs have provided
guidance in their opinions interpreting the law. In some countries, it is
explicitly indicated that the balance test applies only to the private sector
(e.g. Germany) or in cases specified by the Data Protection Authority (Italy)
or on the basis of the permission of the national data protection supervisory
authority in a specific case (Finland). Other countries (including Greece and
Spain) impose stricter requirements on processing on the basis of this
criterion. Thus, by its nature, this criterion gives the Member States latitude
to adapt its application to specific situations.

In view of divergent approaches in the Member States, the criteria
on lawfulness of processing on the basis of consent, of a legal obligation and
of the 'balance of interest' criterion need clarification and specification.

10.6. 
Sensitive data - Article 8

The Directive is based on the premise that certain categories of
personal data, as distinct from all other personal data, require extra
protection and may be processed by private and public bodies only for specific
purposes and under special conditions. Therefore, the Directive prohibits, as a
general rule, the processing of exhaustively listed special categories of data,
the so-called 'sensitive data', i.e. data revealing racial or ethnic origin,
political opinions, religious or philosophical beliefs, trade-union membership,
and the processing of data concerning health or sex life, unless under certain
conditions and safeguards. Without qualifying them as such special categories
of data, the Directive sets out that for data relating to offences, criminal
convictions or security measures, Member States may provide specific
safeguards.

When
implementing this provision, some Member States go beyond the categories
of "sensitive data" set out in the Directive and have added
genetic data (e.g. Bulgaria, the Czech Republic, Estonia, Luxembourg, Portugal)
and biometric data (e.g. the Czech Republic, Slovenia and Estonia). Portugal
regards "private life" as sensitive data, Poland "party
membership" (in addition to trade-union membership) and "addictions".
Some Member States have also included data from the judiciary in their catalogue
of special categories of personal data, for example information about previous
convictions or criminal behaviour (e.g. Cyprus, the Czech Republic, Estonia,
Slovenia, Spain, the Netherlands, Poland). On the other hand, some national
laws do not include information on ethnic origin, political opinions or
philosophical beliefs. Belgium provides a specific provision for health data in
line with the Directive.

Genetic
data are not expressly mentioned by the
Directive in the list of 'sensitive data'. However scientific progress made
over recent years in the field of genetic research has given rise to new data
protection issues in relation to genetic tests and more generally to the
processing of genetic data. Genetic data show characteristics which make them
unique. The judgement of the European Court of Human Rights, in S and Marper v
United Kingdom[161], stated that there
could be little, if anything, more private to the individual than the knowledge
of his genetic make-up[162]. The fact that some
Member States have listed genetic data as ‘sensitive data’ in their data
protection law with associated restrictions and safeguards, whereas in most
Member States the issue of the processing of genetic data is not regulated as
such, leads to the consequence that an individual’s fingerprints, cellular
samples and DNA profiles may be processed for different purposes from one
Member State to another, with different data protection rules and standards
applying.

Beyond
sensitive data, France considers specific categories of treatments as “risky”.
Such “risky treatments” include for instance genetic data,
biometric data and information about criminal records. Processing such data is
not prohibited as such but is subject to prior authorisation from the data
protection supervisory authority.

Differences
in the interpretation of the categories in the Directive may also be observed:
e.g. "health data" may range from information about a
simple cold to information about illnesses or disabilities. Furthermore, the
term "racial origin" (in addition to "ethnic
origin") is often differently understood. Photos and images of persons,
such as those published on the Internet or taken by traffic monitoring or other
surveillance cameras, are especially problematic, since they can reveal
information about an individual's ethnic origin or health status. Finally,
there are differences in applying certain categories of sensitive data in
Member States, because the degree of sensitivity may be seen in one Member
State differently than in another Member State, e.g. with regard to the
category “trade-union membership”.

As regards the exceptions from the
general prohibition of processing 'sensitive data', even less
harmonisation than for the categories of 'sensitive data' has been achieved.
Member States have used their discretion in a different fashion with the result
of significant differences in the implementation of Article 8 (2) – (5). Some
Member States impose additional requirements for the processing of sensitive
data. The Netherlands provides specific exemptions for each category of
sensitive data. The UK provides specific exemptions and conditions for
processing genetic data. France allows processing under additional conditions,
if justified by the purpose of the processing. For the exception based on
explicit consent, about half of the Member States (including Belgium, Cyprus,
France, Germany, Greece, Hungary, Italy, Latvia, Poland, Slovakia, Slovenia,
Spain) require, as an additional condition, that the consent is given in
writing. Some Member States stress, in addition to their general rules on
consent, that the consent for processing sensitive data must not be obtained
illegally or contrary to accepted moral values (Cyprus, Greece). Other Member
States, such as Italy and Sweden, do not accept consent as a legitimate basis
for processing sensitive data.

The
provision on the processing of sensitive data for specified health-related
purposes has been implemented by most Member States; in some with
corresponding provisions, in others with either more stringent or less
stringent conditions. For example, in Cyprus and Denmark this exception is
restricted to health professionals only, whereas in the Czech Republic and in
Slovakia the exception is extended also to health insurance. In the other
Member States, which do not recognise such extension to insurance, processing
for the purpose of health insurance contracts is normally based on the
exception of explicit consent; this leads, for example, to the use of blanket
declarations by insurance companies, which might be doubtful both as regards
"informed" and "free" consent. DPAs noted the problems in
national data protection with regard to the term "health
professionals". In practice health data are processed for various purposes
and it is often not clear who belongs to the category of health professionals
or the group of persons obliged to comparable secrecy obligations. Nor are
there currently explicit grounds under Article 8 of the Directive
justifying the processing of sensitive personal data in case of injuries, when
health data are transmitted by non-medical personnel, e.g. at schools.

The possibility for Member States to add
further exemptions for reasons of substantial public interest has
led to a broad range of exceptions allowing for the processing of sensitive
data for different purposes. These purposes are mostly related to public
security (e.g. in Germany, Spain, UK), social security and welfare (e.g.
Austria, Czech Republic, Ireland, Latvia, Spain), research and statistics (e.g.
Austria, Belgium, Denmark, France, Germany, Malta, Netherlands, Poland, Spain,
Sweden), journalistic and artistic purposes (e.g. Belgium, Spain, UK), the
administration of justice (e.g. Ireland, UK), the functioning of government
(Ireland), protection of public health and fiscal control (Spain) and
obligations under international law (Netherlands). Some national laws refer to
regulations made for reasons of "substantial public interest"
(Ireland) or, for certain categories of data, to the "general interest"
(Spain). However, in the national laws of several Member States provisions on
suitable safeguards are missing. Consequently, the Article 29 Working Party noted
a need to formulate more precisely the exception for the processing of
sensitive data “for reasons of substantial public interest”.

The provision on data relating to offences,
criminal convictions or security measures is also transposed in various
ways, partly by including it in the categories of "sensitive data"
(e.g. Czech Republic, Hungary, Greece, Netherlands, Slovenia, Spain) or by a
special legal framework (e.g. Belgium, Bulgaria, Germany, Italy, Luxembourg),
but in many Member States suitable safeguards are not provided. As far as these
categories are included in the definition of sensitive data, this has consequences
such as that explicit consent may serve as a legitimate basis for data
processing.

In many cases the provision on the notification
of derogations from Article 8(1) of the Directive to the Commission has
not been transposed. This is demonstrated by the fact that, for example, in
2009 the Commission received notifications of derogations only from four Member
States (Denmark, Finland, Netherlands, UK). As in practice the obligation to
notify is not always met by Member States it
is difficult for the Commission to provide an EU-wide overview of those
derogations.

Only some Member States (including
Bulgaria, Denmark, Finland, Hungary, Latvia, Malta, Netherlands, Romania, and
Sweden) have determined the conditions under which the national identity
number can be transposed, with different basic approaches to the use of
this identifier, ranging from a widespread exchange between public authorities
to more restricted use. Some countries allow the use of such a number in the
private sector, whereas others are restrictive in this regard.

Divergent approaches about what categories of data are considered as
being "sensitive data" and under what conditions such data may be
processed call for an examination of the concept of sensitive data, including
the categories and their possible extension e.g. on genetic data and for
further harmonising the conditions under which such data may, exceptionally, be
processed.

10.7. 
Information to data subjects - Articles 10 and
11

Articles 10 and 11 of the Directive oblige the controller or his representative to inform the data subject as to the identity of the controller, the purposes of
the processing and to provide any further information
"in so far as such further information is necessary". Despite the examples of such information listed in those
provisions, this open wording leads to uncertainties whether such information
might or might not be necessary in a specific situation. Moreover, the application
of the information requirement itself is not always ensured on in
practice. For example, a survey conducted by the Commission among Data
Protection Authorities and Member States in the case of hotel registrations
revealed that not in all Member States national law obliges hotels to inform travellers
about the purposes of the processing of their personal data when completing
hotel registration forms. Whereas such an obligation exists e.g. in Belgium,
the Czech Republic, Denmark, Estonia, Finland, Luxembourg, Latvia, Netherlands,
Poland, Portugal, Romania, Slovenia, Slovakia, in other Member States the
hotels are not required to provide such information (e.g. in Austria, Bulgaria,
France, Germany, Greece, Hungary, Spain). Some Member States argued that the
information requirement is fulfilled by expressly laying down in the law the purposes
of the registration as well as other information.[163]

Despite being particularly relevant for
individuals for exercising their rights, Articles 10 and 11 currently do not
require informing the data subject of the competent Data Protection Authority and
its contact details nor do these provisions specify how long the data will be
retained. Moreover, the information provided by the controller is often not
easily accessible and difficult to understand. Especially in the online
environment, quite often privacy notices are unclear, difficult to access, non-transparent[164]
and not always in full compliance with existing rules. A case where this might
be so is online behavioural advertising, where both the proliferation of actors
involved in the provision of behavioural advertising and the technological
complexity of the practice make it difficult for an individual to know and
understand if personal data are being collected, by whom, and for what purpose.

Despite children deserving
specific protection, as they may be less aware of risks, consequences,
safeguards and rights in relation to the processing of personal data[165],
there are no specific requirements in the Directive. The lack of clear and
understandable information of the data subjects also affects the validity of
consent, which requires, as a fundamental condition, "informed
consent" (see point 2.1.3 on the concept of consent).

Data breaches, in particular of large companies’ customer databases, are
increasing. Security failures may lead to harmful consequences for individuals,
ranging from undesired spam to identity theft[166].
The recent revision of the e-Privacy Directive[167]
introduced a mandatory personal data breach notification, which covers,
however, only the electronic communications sector. Given that risks of data
breaches also exist in other sectors (e.g. the financial sector), the
consultation carried out by the Commission in 2010-2011 confirmed the need to
extend the information of data subjects to a general obligation of the
controller to inform Data Protection Authorities and, in defined circumstances,
also of data subjects when their data are accidentally or unlawfully destroyed,
lost, altered, accessed by or disclosed to unauthorised persons.

To ensure that individuals are well informed in a transparent way,
data controllers should be obliged to inform data subjects about how and by
whom their data are collected and processed, for what reasons, for how long and
what their rights are if they want to access, rectify or delete their data.
This information should be provided in an easily accessible and understandable
way, using clear and plain language. Data controllers should be obliged to
notify data breaches to Data Protection Authorities and, under defined
circumstances, also to data subjects.

10.8. 
Rights of the data subjects - Article 12

The
Directive provides for a set of rights for individuals. These include
individuals' rights vis-à-vis those processing their personal data such
as the right to access, rectify, block and delete their own data. These rights
are, however, expressed in general terms and the way they can actually be exercised
is not clearly specified. Nor does the Directive impose any deadlines for
responding to data subjects’ requests or any indication of the level of fees
for exercising the rights to rectification, erasure and blocking; the condition
"without excessive delay or expense" applies only to the right of
access.

All Member States guarantee the right of
the data subject to access his/her own data, although also in
that respect there are differences in the implementation in national law. In
some countries (e.g. Greece, Spain and Sweden) the controllers are required to
inform the data subject, on request, about the source of the data, the
processor or of any developments in processing since the last access request.
In the Netherlands the law stipulates that the controller must contact other
individuals if their data are involved and decide, in the light of the
response, whether to disclose this data. UK follows a similar approach, but
with an exemption concerning information given in confidence to the controller
for certain purposes, including employment. In Germany the right of access is
extended to data held in unstructured files, if the data controller, e.g. a
credit reference agency, processes the data professionally for the purpose of
providing the data to others. Other countries provide specific rules relating
to such purposes. Austrian law provides that, on the data subject's request,
the data may not be deleted for a period of four months. ECJ case law clarified
that the Directive requires Member States to ensure the right of access, not
only in respect of the present, but also in respect of the past, and to provide
for access to that information on the basis of a fair balance between the
interests of the data subject and the burden for the controller.[168]

All Member States guarantee in their laws
the right of data subjects to obtain rectification of personal
data relating to them, but also with some differences. In Greece, this right
extends to all contested processing, whereas in other Member States this is
linked to incomplete or incorrect data. The laws in Austria and Germany provide
that documents retained for historical purposes need not be rectified, but the
data subject has the right to have comments added. Austrian law stipulates also
that regularly issued compilations, such as address lists, should be corrected
in the subsequent regular issue.

The right to request the deletion of
data is provided by the Directive, but in practice it is difficult for
an individual to enforce this right vis-à-vis the data controller.
Recent reported cases about people seeking to have their data deleted from a
social network are a telling example of the practical difficulty to exercise
this right especially in the online environment[169].

It is also not always clear who owns the
personal data supplied by a user to a service provider. The Directive provides
no explicit right for the individual to withdraw his/her own personal
data (e.g. his/her photos or a list of friends) from an online-service,
so that the individual may transfer data to another application or service.

The way in which these rights can be
exercised differs from country to country, so
that exercising them is actually easier in some Member States than in others. All
Member States except Spain give data subjects the right to obtain an actual
copy of the data. In some Member States (e.g. Austria, Finland, UK) the law
expressly provides that, if the data subject agrees, the controller may, as an
alternative, offer access on its premises or online rather than by hard copy.
In other Member States this alternative is at the discretion of the
controllers, at least when a copy in permanent form is not feasible or would
involve a disproportionate effort (e.g. Ireland). In France, access to data on
criminal convictions, "penalty points" on a driving licence and
certain medical data is restricted to the inspection of the data, without
providing the right to obtain a hard copy. In some Member States individuals
have to pay a fee to access their data, while in others it is free of charge[170].
Some Member States impose a deadline on data controllers to respond to access
requests, while others do not.

Clarification and enhancement of the individual's control over his
or her "own data" is needed, including the right to have the data
deleted or to retrieve data from online service providers. Also, the conditions
and modalities for the actual exercise of the rights of access, rectification
and deletion of data need to be improved and harmonised, taking into account
electronic means which facilitate access to their data and the exercise of
these rights.

10.9. 
Notification of processing and Data Protection
Officers - Article 18 
10.9.1. 
Notification

Article 18 of the Directive imposes a general
notification requirement, but leaves considerable room for
manoeuvre to Member States to determine exemptions from and
simplifications of notification requirements and the procedures to be followed.
Accordingly, Member States adopt very different approaches. Some national laws
(e.g. Bulgaria, Czech Republic, Denmark, Estonia, Greece, Hungary, Latvia,
Spain, Romania, and UK) require all controllers to notify. In several Member
States the controllers are required to notify when the processing is carried
out by automated means (e.g. France, Malta, Netherlands, and Sweden). Other
national laws require hardly any controllers to notify, except in limited
circumstances on the basis of a positive list (e.g. Austria, Finland).

Moreover, the details and the use of
the information provided by the notifications vary from Member State to
Member State. The most frequent use of notifications is for inspections and
audits, and for contacting the controllers. Most DPAs consider the purposes of
the processing and data categories to be the most useful information, whereas
the description of security procedures is considered as less useful for their
purposes. Some DPAs use the notifications for prior checking; some only use it
to contact organisations in cases of a complaint, for enforcement purposes.

In several Member States, Data Protection
Authorities collect notification fees, whereas others do not. The
fees collected for a single notification range from about 23 EUR to about 599
EUR. In some Member States the fee varies depending on: whether the data
controller is a natural or legal person; if processing is in the public or
private sector; the numbers of staff and turnover; or by the method of
notification, i.e. paper or online (e.g. Belgium). Some Member States charge a
fee for amendments to the notification. In other Member States the fees are a
one-off charge or an annual charge. Among those DPAs who collect fees, most
receive income to their budget; this ranges from just over 1.2 % of their
budget up to 100%, i.e. providing their complete budget (UK DPA). In few Member
States the fees are paid into general revenue and do not benefit the DPA's
budget.

There is general consensus amongst data
controllers that the current general obligation to notify all data processing
operations to the Data Protection Authorities is a rather cumbersome obligation
which does not provide, in itself, any real added value for the protection of
individuals' personal data, but rather creates an additional administrative and
financial burden. This is particularly the case, as a consequence of the rules
on the applicable law, where a controller is established in several Member
States and has to comply with divergent notification systems.

According to the Article 29 Working Party's
Advice paper on notification, a public register held by a DPA is
no longer the best and most appropriate way for individuals to understand what
an organisation is doing with their personal data, and who to contact when
things go wrong.

10.9.2. 
Data Protection Officers

Most Member States made use of the
possibility to exempt from the notification requirement in case that the
controller ensures internal control of data processing operations by appointing
a Data Protection Officer (DPO). However, only the national laws of about one
third of the Member States (including France, Czech Republic, Germany, Hungary,
Latvia, Luxembourg, Malta, Netherlands, Poland and Slovakia) contain specific
provisions on the expertise or the independence of the DPO regarding
the exercise of his/her functions.

While the appointment of a DPO is optional
for the controller in other Member States, in Germany the appointment of a DPO
is mandatory: for the public sector and – with a specified
threshold of, in principle, ten employees permanently employed in the automatic
processing – for the private sector. This does not necessarily lead to the
recruitment of additional staff; often the assignment is given as an additional
task to an existing staff member where the DPO function does not require a
full-time, dedicated staff member. Other controllers outsource this task to
external DPOs which provide services to various clients.

Existing studies point to the fact that
larger corporations, especially multinationals, usually already have appointed data
protection officers. The same is true for many public data controllers in a
number of Member States. The Article 29 Working Party noted that the successful
experience of the mandatory introduction of Data Protection Officers in
Germany abolished not only the centralised system of notification and public
register, but contributed also to the development of sector-specific best
practices in data processing and protection.[171] This has
been confirmed by stakeholders who expressed strong support for such concept,
seen as a key element to demonstrate "accountability".

Given the different approaches of Member States to the notification
requirements and on the exemptions there from, and the administrative burden
for operators in the internal market to comply with different rules and
concepts, a revision of the current notification system is needed.  Harmonised
conditions and standards are also needed for Data Protection Officers.

10.10.Remedies
and Sanctions - Articles 22 and 24
10.10.1. 
Remedies

All Member States guarantee, as a
fundamental principle of the rule of law, the right to seek redress and
corrective action through the courts. Data subjects are therefore
entitled by ordinary administrative or civil law to go to court. In some Member
States, data protection law either creates a special tort, or adds such a
special right to the general law. The forum and the procedures are also
determined by the ordinary court procedural law, However, under the applicable
rules in the Directive, the courts may have to apply the substantial law of the
country in which the controller is located.

The substantial law differs to a certain
extent from Member State to Member State, but in principle, the applicable
administrative or civil law provides, in line with the Directive, that the
controller is liable for compensation, unless he/she can prove
that he/she is not responsible for the event causing the damage. In Ireland,
under certain conditions, there is some lessening of the controller's burden of
proof in view of alleged inaccuracy. UK law is more restrictive concerning
non-material damage, for which compensation can only be awarded if material
damage has also been proved. Belgium, Italy and Greece give data subjects the
option of settling disputes either through the courts or by lodging a complaint
to the Data Protection Authority in a quasi-judicial procedure.

Despite the fact that many cases where an
individual is affected by an infringement of data protection rules also affect
a considerable number of other individuals in a similar situation, in
many Member States judicial remedies, while available, are very rarely
pursued in practice. This seems to be related to a general reluctance
to bring an action to court, often related to the lack of information and the
financial risk for the individual, when he/she is obliged to bear the costs of
an unsuccessful claim for a judicial remedy, or when the damage is limited,
e.g. in the case of unsolicited mails. Whereas the Directive spells out that
each supervisory authority shall hear claims also when lodged by an association
representing the individual, such possibility that associations
represent data subjects in court cases is not provided by the Directive. On the
other hand, stakeholders expressed reluctance as regards a 'class action' style
procedure, fearing that this would increase the cost of services.

10.10.2. 
Sanctions

The Directive obliges Member States to
"lay down the sanctions to be imposed in case of infringement of the
provisions adopted pursuant to this Directive", but does not detail the
categories of sanctions or whether and, if so, what sanctions could be imposed
by Data Protection Authorities or by other authorities or by the courts.
Accordingly, the implementation of this general provision by the individual Member
States has given rise to significant variations. In most Member States, both
the DPAs and the judicial authorities have the power to impose sanctions,
in others the sanctioning power is only for judicial authorities.
Administrative fines are imposed by the DPAs in most Member States, but not in
all (e.g. not in Austria, Belgium, Denmark, Lithuania, Hungary and UK).
Criminal sanctions have been imposed by judicial authorities in most Member
States, but not in e.g. Bulgaria, the Czech Republic, Spain and Latvia. Hungary
does not provide for administrative or criminal sanctions for the violation of
data protection rules at all, but merely establishes liability under civil law.
Slovakia in addition to administrative fines introduced disciplinary fines which
may be imposed by the DPA.

The degree of precision of the infringements which
are subject to administrative sanctions diverges considerably
between the countries. Some countries define the infringements in general
terms, for instance 'processing of personal data in violation of the Data
Protection Law' (e.g. Lithuania). Others enumerate long and very detailed lists
of infringements, such as: failure to specify the purpose, means or manner of
processing; processing of inaccurate personal data; collecting or processing of
personal data in a scope or manner which does not correspond to the specified
purpose; preservation of personal data for a period longer than necessary for
the purpose of processing; processing of personal data without the necessary consent
of data subject; failure to provide the data subject with information in the
scope or in the manner provided by law; refusal to provide the data subject
with the requested information; failure to adopt or implement measures for
ensuring security of personal data processing; failure to fulfil the
notification obligation (e.g. Czech Republic).

Administrative fines in most Member States are established by specifying the minimum and
maximum amount of money, while some others also make a reference to the percentage
of gross turnover for the latest financial year in case the data controller is
a legal entity (e.g. France). The upper limits for violating data protection
laws range from €290 in Lithuania up to €120,000 in Italy, €300,000 in Germany
and €601,000 in Spain. Some Member States differentiate the fines according to
the type of the data controller, distinguishing natural and legal persons (e.g.
Estonia, Czech Republic, France, Portugal), whether there is a repetitiveness
of the offence or not (e.g. France, Lithuania), or have specific provisions to
take into account negligence or intent (e.g. Poland, Portugal). In a few Member
States the attempt to commit an offence is subject to penalty (e.g. Austria).

Criminal sanctions are not imposed in all Member States (e.g. not in Bulgaria, Czech
Republic, Latvia). In almost two thirds of the Member States detention has been
imposed for serious violations of the data protection rules. The maximum period
for imprisonment ranges from 4 months (e.g. Denmark and Portugal), one year
(e.g. Austria) and two years (e.g. Germany, Sweden) up to three years (Spain
and Poland). Several Member States do not impose criminal sanctions at all. The
amount of criminal fines also differs significantly between Member States.

In a number of Member States the level of fines is seen as too low. Fines are
imposed too infrequently to have a dissuasive effect, or because supervisory
bodies have not developed a practice of imposing them. In some countries
prosecutions and sanctions for violation of data protection law are extremely
limited.

In order to facilitate the application of remedies, the right to
bring an action in court might be extended to civil society associations representing
data subjects. There is also the need for strengthening the existing provisions
on sanctions, including by explicitly obliging the Member States to impose
criminal sanctions in cases of serious data protection violations.

10.11.Data
transfers to third countries – Articles 25 and 26
10.11.1. 
Adequacy

Article 25
provides the principles for the transfer of personal data on the basis of an
adequacy decision, either on the basis of national law or by the Commission.[172]
However, the condition that the third country must provide an adequate
level of protection to the data being transferred is implemented by
Member States in different ways. Some allow the data controller itself to
conduct the adequacy check, while others reserve it for national authorities,
in particular the DPAs. This leads to divergent approaches and uncertainties on
the interpretation of "adequate level of "protection", and
varying interpretations of this concept between Member States, the DPAs and
data controllers for declaring that the level of protection of a third country
is adequate for the purposes of transfers to that country.

As regards the Commission's adequacy decisions, the
effect of such unilateral recognition by the Commission that a given third
country ensures an adequate level of data protection is to allow the free flow
of personal data from EU Members States to that third country. The Commission
may unilaterally launch the procedure with a view of assessing a third
country's data protection legislation. In some cases, the Commission has
adopted partial adequacy findings covering not all but only specific transfers
of personal data to a particular third country.[173]

In the course of its adequacy findings the
Commission has encountered various failings in the data protection system of
third countries, for example, failure on the part of public authorities to respect
data subject's rights to privacy and the lack of independent data protection
institutions.

At the same time, adequacy findings constitute a real opportunity for
the Commission to engage in dialogue with third countries, promoting an EU compatible
data protection model. Indeed, in today's world, characterised by constant and rapid
development of new technologies where international data flows take place easily
and quickly, traditional measures might not ensure sufficient protection of EU individuals.

Furthermore, the Commission's adequacy decisions are perceived by
some third countries as a means to promote their strategy for a digital economy
and a modern information society. These countries consider that adequacy
decisions will allow them to become actively involved in international flows of
personal data and they will thus become internationally recognised as offering an
adequate infrastructure and adequate means for processing personal data
received from the rest of the world.

Nevertheless, current
practice has shown its limits. Apart from the fact that adequacy findings
involve a complex, lengthy and detailed exercise, Commission adequacy decisions
are accorded a "direct effect" in only a minority of Member
States. In most cases there are preliminary legislative and
administrative formalities before such decisions can take effect. Depending on
the Member State concerned, Commission decisions must be ratified
legislatively, notified by the ministry to the national data protection
supervisory authority, adopted by the supervisory authority, or notified in
advance to, and authorised by, the supervisory authority.

10.11.2. 
Standard contractual clauses

International transfers may also take place
to a third country which does not offer an adequate level of protection where
the controller adduces adequate safeguards, particularly by means of standard
contractual clauses, which are included in contracts that allow data
transfers from a data controller established in the EU to data controllers and
processors in third countries. The Commission standard contractual clauses were
updated in February 2010[174], to cover subsequent sub-processing activities and provide a single
contractual framework for all processing activities related to a given
transfer.

Contractual clauses are seen as a useful
instrument for international transfers involving a limited number of
organisations or companies. However, these are also implemented differently. In
some Member States, the DPA still needs to authorise the transfer, whereas in
other Member States such authorisation is not required.

10.11.3. 
Binding Corporate Rules (BCRs)

The use of "Binding Corporate Rules"
(BCRs), i.e. internal rules followed by a multinational corporation for
transfers of personal data between the groups of companies belonging to the
same multinational corporation, has been developed without being explicitly
mentioned by the Directive.[175] Data Protection Authorities
in 16 Member States (Austria, Belgium, Bulgaria, Cyprus, Czech Republic,
France, Germany, Ireland, Italy, Latvia, Luxembourg, Malta, Netherlands,
Slovenia, Spain, UK) and three EEA countries (Iceland, Liechtenstein, Norway) have
agreed on a mutual recognition procedure aimed at speeding up the
procedure of analysis and approval of BCR so as to ensure that they provide the
necessary data protection safeguards. This procedure, which has been in place
since 2008 and in which one of those DPAs acts as lead authority in each case,
has accelerated the adoption of BCRs, on average, from 18 months previously to
less than six months.

However, the use of BCRs also differs. Apart
from the fact that not all DPAs participate in this mutual recognition scheme,
several Member States still require an authorisation for the use of BCRs even
though they have been approved by DPAs of other Member States. The adoption and
authorisation of BCRs therefore remains complex and time-consuming.
Considerable time is often necessary for the dialogue between the
multinationals concerned and the lead DPAs, as well as to allow the companies
to present modified proposals, since this requires the regular involvement of
the company's board.

While welcoming the approach of the BCRs and
pointing to its increased significance, stakeholders in the private sector
consider that the implementation of BCRs remains too lengthy, particularly due
to the fact that they are a complex instrument which must address several
issues, and that Data Protection Authorities have often no sufficient resources
to approve BCRs promptly. This has limited the number of companies using this
tool[176]
and discouraged several other companies, potentially keen on using them[177].
Economic stakeholders also expressed uncertainties about the notion of 'group
of companies' and the lack of the inclusion of processors in the application of
BCRs, and stressed the need to lay down legal rules on BCRs and to improve and
simplify the "mutual recognition procedure".

Given divergent approaches and complex and lengthy procedures, there
is a need to improve and streamline the current procedures for international
data transfers, including providing a clear legal basis for "Binding
Corporate Rules. The adequacy procedure should also be clarified, particularly
as regards the criteria and requirements for assessing the level of data
protection in a third country.

10.12.National
Data Protection Authorities and enforcement - Article 28
10.12.1. 
'Complete independence' of the National Data
Protection Authorities - Article 28(1)

The requirement of "complete
independence" has been clarified in a recent ECJ ruling[178],
which stresses particularly that independence implies a decision-making power
independent of any direct or indirect external influence on the supervisory
authority, precluding not only any influence exercised by the supervised
bodies, but also any directions or any other external influence, whether direct
or indirect, which could call into question the performance by those
authorities of their task. The Court ruled therefore that making a DPA subject to
state scrutiny is not in compliance with the requirement of "complete
independence".

In Greece and Portugal an independent
supervisory authority is explicitly established even by the Constitution. In
other Member States DPAs are provided with a distinct legal personality (e.g.
Malta, Spain) and by the power to bring an action in the Constitutional Court
(e.g. Slovenia). In a number of Member States concerns arise as to the effective
capability of the DPAs to perform their tasks with complete
independence. These concerns are partly due to the fact that staff are
appointed exclusively by the government (e.g. Ireland, Luxembourg, UK) or by
the Minister of Justice (Denmark, Netherlands), whereas, in contrast, in other
Member States Data Protection Commissioners are elected by legislative
assemblies (e.g. Germany,  Slovenia), sometimes pursuant to procedures which
require consensus between the majority and the opposition (e.g. Greece), or in
combined procedures involving executive, legislature, judiciary and organised
societal groups (e.g. France, Spain, Portugal). 
In some countries the DPA is attached to the Ministry of Justice. In some
Member States 
(e.g. Slovenia, Poland) the dismissal of Data Protection Commissioners has to
follow the same procedures as their appointment, and only in specified cases.
In other countries, government can directly remove them from office (e.g. Ireland).

Understaffing and lack of financial
resources also pose problems in several Member
States, restricting DPAs in the proper exercise of their tasks. Despite
increases in the staff of most DPAs in recent years, the level of resources
available to DPAs continues to remain limited in the majority of Member States
with regard to their needs. In most Member States the DPAs receive their
financial resources from the State's budget, and often from the budget
allocated to the Ministry of Justice. In some Member States, these resources
are increased through the revenues obtained from notifications and/or the
financial sanctions imposed as a penalty for the infringement of data
protection rules (e.g. Luxembourg, Malta). However, in the UK the DPA
notification fees are the only financial source of the DPA (see section 2.9
on notifications). In a large number of Member States the lack of resources
represents a significant challenge to the effectiveness of the national
supervisory systems. In several Member States, DPAs do not have enough staff to
handle all complaints. Furthermore, due to this lack of resources, some DPAs
cannot regularly attend the meetings of the WP29.

The concept of "complete independence" of Data Protection
Authorities needs to be clarified on the basis of the recent Court of Justice
ruling, including the requirement to provide sufficient resources for the
effective performance of the tasks of the Data Protection Authorities.

10.12.2. 
Investigative powers - Article 28(3), first
indent

In all Member States the Data Protection
Authorities hear and review claims or complaints and are charged
with investigating possible infringements of the data protection law within
their jurisdiction. This includes that they are vested with powers to request
and access all necessary information in relation to processing operations and
filing systems and therefore usually demand full access to relevant sites and
materials. A range of DPAs practice a selective approach, i.e. selecting
particular issues or sectors for particular attention, because of the
importance of the processing in the sector concerned, the sensitivity of data,
or because of the level of complaints received about the sector. In such cases
especially, investigations tend to be detailed and in-depth, including
discussions with the data controllers, but less so with the data subjects or
their representatives.

In most Member States the DPAs are
empowered to search premises without judicial warrant. In
Belgium, DPA staff has the status of Officers of Judicial Police when carrying
out on-site investigations, empowering them to demand, inter alia, the
disclosure of documents and access locations. But in other Member States (e.g.
France, Malta, Romania and UK), the DPA cannot enter premises without first
obtaining a judicial warrant.

In some Member States the investigative
powers are not clearly spelt out in the legal text, being expressed as duties
rather than as an express reference to powers, or without clarification of the
relationship to other legislation.

10.12.3. 
Powers of intervention - Article 28(3), second
indent

The DPAs' powers of intervention differ
from Member State to Member State. In most Member States the DPAs have the
power to authorise processing operations likely to present
specific risks, but not in others (e.g. Cyprus, Latvia, Spain and the UK).
Experience shows that a major problem with these "prior checks" is
that they are very time-consuming and demanding on human resources, and that
too often they are carried out too late to be of any benefit in restructuring
processing systems fundamentally, focussing instead on the minor details of
such systems.

In all Member States, the DPAs may issue a
warning to or reprimand the controller, and, except in Belgium, issue decisions
binding upon the controller to suspend data processing
operations. In most Member States the DPAs are also empowered to order
the erasure or destruction of data (but not e.g. in Belgium, Germany or
the UK). In Germany, the DPA is empowered to demand the dismissal of a Data
Protection Officer, if he/she does not possess the required specialised
knowledge and demonstrate the necessary responsibility. In several Member
States the law provides that such binding measures should be preceded by
recommendations, opinions or warnings (e.g. Austria, Bulgaria, Denmark, France,
Greece, Ireland, Latvia, Lithuania, Slovakia).

In most Member States, the DPA has the power
to impose sanctions, which mostly consist of imposition of
administrative measures and/or financial sanctions/fines, however with
considerable variation as to what constitutes an infringement and severity of
sanctions (see section 2.10). Most DPAs report infringements to
competent police and judicial authorities; in several Member States, such
obligation is expressly laid down in data protection law (e.g. Cyprus, France,
Lithuania, Netherlands and Slovenia). French law provides that the DPA may
publish its warnings and, in certain situations, the penalties imposed. In
several Member States the DPAs may refer the matter to national Parliament
(including Belgium, Estonia, Finland, France, Germany, Greece, Italy,
Lithuania, Malta, Netherlands and Sweden).

In all Member States formal actions and
sanctions are, in practice, used as a last resort. In general,
the DPAs see themselves more as advisors, facilitators and conciliators. In more
than half of Member States, DPAs have issued guidelines to assist in the proper
application of the data protection rules, including sector specific guidance.
In cases of violations of data protection rules, DPAs in general first issue
warnings, reminders or recommendations. In complex cases, DPAs often try to
reach a compromise acceptable to the DPA and the controller. Such "soft
measures" seem to be more effective where they are backed-up by effective
enforcement powers available to the DPA in the event of non-compliance with the
agreed measures.

10.12.4. 
Power to engage in legal proceedings - Article
28(3), third indent

In many Member States, national laws
provide the immediate right to DPAs to bring an action to court.
But in some Member States this is limited to the private sector or to specific
situations. In Sweden, for instance, the right to bring an action in court is
limited to the administrative courts for applications of the DPA to erase
personal data which have been processed in an unlawful manner. In other Member
States, DPAs have only the power to bring violations of the data protection
rules to the attention of judicial authorities (e.g. Austria, Latvia and
Ireland). In Slovenia, the DPA has the right to bring an action before the
Constitutional Court to assess the constitutionality of legislation. In some
Member States, DPAs have the right to join in court proceedings which are
initiated by other parties. In practice, also in many Member States, even where
the DPAs have the power to engage in legal proceedings, the DPAs rarely
commenced legal proceedings or intervened in legal proceedings on behalf of a
data subject. In other Member States, the number of interventions ranged from 2
to a maximum of 143 cases per year.

In several Member States, Data Protection Authorities are not
endowed with the full range of powers to conduct investigations, intervene in
data processing operations and engage in legal proceedings. The divergence in
powers and approaches to enforcement taken by the individual DPAs causes
problems not only for the data subjects who do not enjoy the same level of
enforcement in each Member States, but also uncertainties for controllers,
particularly when operating in several Member States.

10.12.5. 
Appeals against decisions of supervisory
authorities - Article 28(3)

As regards the right to appeal against
decisions of the Data Protection Authorities,  Danish law stipulates
that no appeals may be brought before any other administrative authority
against the decisions of the DPA, but does not clarify whether there is a right
to go to court against those decisions. In Slovenia the law provides that there
shall be no appeal against a decision or ruling of the DPA, but that an
"administrative dispute" shall be permitted. Some Member States have
no specific provision in their data protection law, but provide a general right
to judicial review against any act of a public authority, on the basis of
general court procedural law or, e.g. in Germany, on the basis of the
Constitution.

Competent courts are either the ordinary courts or administrative courts. In some
Member States the competent court is the Supreme Administrative Court (e.g.
Austria, Portugal) or the general Court of Appeals (e.g. Greece, Sweden), in
France the Conseil d'Etat and in Malta a specific Data Protection
Appeals Tribunal. In several countries judicial review is limited to certain
acts of the DPA (e.g. Ireland, Luxembourg, UK), or to the grounds of
"illegal conduct" of the DPA (Hungary). The competence and procedure
of the courts and the conditions for a right to appeal follow the general
national rules of their judicial systems. Cases in which data subjects or data
controllers have appealed in courts against decisions taken by the national
data protection supervisory authority are rather limited.

Nearly all Member States guarantee in their national legislation the
right to bring an action to court against decisions of the Data Protection
Authority, either in data protection law or in general laws on judicial review.

10.12.6. 
Cooperation of Data Protection Authorities - Article
28(6)

Article 28(6) provides the competence of
Data Protection Authorities to exercise their powers on the territory of their
Member State, whatever national law is applicable, and the duty to exercise
their powers on request of another DPA and to cooperate with each other
"to the extent necessary for the performance of their duties".

Some Member States have provisions which
specifically allow them to act on the request of the DPA in another
Member State (e.g. Denmark, France, Portugal, UK) or to also exercise,
on its own territory, its powers in cases where the law of another Member State
applies (e.g. Denmark, Netherlands, Portugal). Whereas several national laws do
not contain any related provision, other Member States have transposed in their
national law only the mandate to cooperate with DPAs in other Member States or
generally with "foreign" DPAs (e.g. Cyprus, Czech Republic, Estonia,
Greece, Italy, Luxembourg, Malta, Romania, and Spain).

In practice, DPAs liaise and/or cooperate
with authorities of other Member States mainly in the context of the Article
29 Working Party or in the mutual recognition procedure for BCRs (see point
2.11.3). There has also been separate cooperation as between Nordic
countries, as well as on the part of Central and
Eastern Europe Data Protection Commissioners. Other forms of cooperation concern
the participation in the Article 31 committee, the Working Party on Police and
Justice, fora such as the Spring Conference of Data
Protection Authorities and joint supervision for SIS, Europol, Eurojust,
Eurodac and the Customs Information System. Some DPAs have designated, within
their organisation, a contact point for such cooperation. DPAs have also some
experience in joint investigations, where each applies its own law in its own
jurisdiction.

However, the situation is more complex when
jurisdiction and applicable law do not coincide. This concerns
not only the legal aspect in terms of the applicable law to be followed, but
also procedural aspects as regards the respective roles, responsibilities,
powers and practices of each DPA involved. Thus, when a controller is
established in more than one Member State or in other similar situations, the
approaches taken by DPAs could considerably differ from one Member State to
another.

Despite the fact that the Directive creates
the duty of mutual cooperation and information exchange, there is no
cooperation mechanism established by the Directive to provide an
effective cooperation in such situations. This is amplified by the lack of
harmonisation with regard to investigation powers and the absence of a legal
obligation to reply and to inform of the outcome of proceedings, while current
cooperation seems to be based on "good will", and deadlines are
difficult to respect. There is hardly any experience on the application of the
national law of another Member State; difficulties could arise in enforcing the
data protection law of another Member State especially for small DPAs which
have limited resources for cooperation on such a scale. Due to the lack of
detailed rules in the Directive, some DPAs apply the provisions on mutual
assistance in the Council of Europe Convention for the Protection of Individuals
with regard to the Automatic Processing of Personal Data[179].
However such an approach, as well as existing non-binding mechanisms and
structures in the framework of the WP 29, are insufficient to ensure the
consistent application of data protection rules across the EU (see point
2.13). This situation often leads to divergent decisions of DPAs vis-à-vis
the same data controller for the same data processing. No one single DPA has a
complete overview of the processing activities of companies that are established
(or, if based outside the EU, have appointed a representative) in several
Member States.

Cooperation between DPAs is insufficient and does not ensure
consistent enforcement of the common rules within the EU, in spite of
the fact that the Directive creates the duty of mutual cooperation and
information exchange. To improve the cooperation and coordination between Data
Protection Authorities a cooperation mechanism should be introduced which
ensures the consistent application and enforcement of the data protection rules
in all Member States where this concerns issues with cross-border dimension.

10.13.Article
29 Working Party

The Working Party on the Protection of
Individuals with regard to the Processing of Personal Data established by
Article 29 of the Directive with advisory status[180] - the so-called "Article 29 Working Party" (WP29) - is
mandated to contribute to the uniform application of the Directive, to give the
Commission an opinion on the level of protection in the EU and in third
countries, on codes of conduct drawn up at EU level and advise the Commission
on any amendment of the Directive and on any measures related to the protection
of the rights and freedoms of natural persons with regard to the processing of
personal data.

Since its creation, the Working Party has adopted 187 opinions
(as at July 2011) and a variety of other documents. The opinions of the Working
Party have dealt with topics including certain key concepts of the Directive,
such as the opinions on the concept of personal data, the concepts of
'controller' and 'processor' and applicable law and on consent, as well as to the transfer of data to third countries and the level of
protection in third countries or to specific issues.

Although
in some cases the opinions of the Working Party have a certain impact national
legislation and practice – some Member States amended their data protection
legislation, once or twice, as a result of the work of the Working Party[181]
– the continuing divergent application and interpretation of EU rules by Data
Protection Authorities has not been resolved sufficiently. This is largely due
to the fact that often DPAs are not in a position to enforce in their own
national jurisdiction the very same principles they advocate at
European level. Apart from the fact that the Working Party's opinions are not
legally binding, this may be often caused by legal restraints particularly as
regards the DPAs' competences and powers, which vary widely among Member States
and the lack of a mechanism at EU level to ensure a coordinated application and
enforcement of data protection rules (see section 2.12).

Moreover, the fact that the Commission also
ensures the secretariat of the WP29 leads to uncertainties as to
the demarcation between the role of the Commission as an Institution, on the
one hand, and its role as secretariat, on the other hand, particularly when the
WP29 adopts opinions which are critical of the Commission's position. As member
of the Working Party (albeit without voting rights) the Commission promotes its
priorities, its views and requests for advice. In its role as secretariat, it
is its role to assist the Working Party according to the Working Party's own
priorities and approaches.

The non-binding opinions of the Article 29 Working Party are
insufficient to ensure the consistent application and interpretation of EU
rules by Data Protection Authorities. The two-fold role of the Commission,
being member in the Working Party and providing at the same time its
secretariat, bears the risk of "conflicts of interest".

11. 
    The main results: the need for a new legal
framework

The findings of this evaluation on key provisions of the Directive
show that the problems encountered in the Commission's 2003 and 2007
implementation reports have not been solved since then. On the contrary, the
problems in fully achieving its internal market policy objective,
removing differences in the level of data protection
actually afforded in the Member
States and in ensuring effective enforcement across the EU have become more acute in particular due to fast and
far-reaching development of digital technologies and online services.

While the two-fold objective of ensuring an
equivalent level of data protection amongst Member States and removing
obstacles to the free movement of data as well as the key
data protection principles remain valid, divergent approaches and gaps in the Directive and its application in
Member States have led to legal fragmentation and
uncertainty with negative consequences for businesses, individuals and the public
sector and increasing difficulties for individuals in keeping control of their
personal data. Since the Directive does not provide for sufficient protection in a fast-developing
information society and globalised world, the increasing problems call for a new legal framework for the protection of personal
data in the EU.

As confirmed by the findings of this evaluation of key provision, the
fragmentation and uncertainties in the implementation of the Directive 95/46/EC
and new challenges require the EU to adapt the legal framework for the
protection of personal data in the European Union.

ANNEX 3

Data Protection in the Areas of Police and Judicial 
Co-operation in Criminal Matters

12. Fragmentation
of the EU legal framework for the protection of personal data in the areas of
police cooperation and judicial cooperation in criminal matters
12.1. Directive 95/46/EC does not apply in these areas

The general Data Protection Directive
95/46/EC[182] applies to public and
private data controllers and all sectors but does not apply to the processing
of personal data in the areas of judicial cooperation in criminal matters and
police cooperation.[183] Furthermore, Article
13(1) of the Directive allows for exemptions and restrictions of some important
provisions of the Directive (relating to data quality, information, access, and
publicising), inter alia for safeguarding national security, defence,
public security and the  prevention, investigation, detection and prosecution
of criminal offences.[184] The exclusion of the
area of judicial cooperation in criminal matters and police cooperation led to
the adoption of specific rules at EU level for police and judicial co-operation
in criminal matters[185].Given the lack of a single
EU instrument on data protection in this area until the adoption of Framework
Decision 2008/977/JHA in 2008, these specific rules generally refer either to
national legislation of the Member States, or to the Convention of the Council
of Europe (ETS 108)[186] and – for those Member
States which have ratified it – to the Additional Protocol to that Convention
(ETS 181)[187], as well as to the
principles of the non-legally binding Recommendation No. R
(87) 15 of the Council of Europe regulating the use of personal data
in the police sector (Police Recommendation)[188], which sets
out the principles of Convention 108 for the police sector.

12.2. Gaps and shortcomings in Framework Decision 2008/977/JHA
12.2.1. Limited scope of application of Framework Decision 2008/977/JHA

Framework Decision 2008/977/JHA[189] had to be implemented by Member States by 27 November 2010 (Article
29(1)).[190] It applies to personal
data which for the purpose of the prevention, investigation, detection or
prosecution of criminal offences or the execution of criminal penalties are
transferred between different Member States (Article 1 (2)(a)), or which, after
having been transferred between different Member States are subsequently
transferred to a third country or international organisation (Article 13). It
furthermore applies to personal data which are or have been transmitted or made
available by Member States to authorities or to information systems established
on the basis of the former Title VI of the Treaty on European Union (‘Police
and judicial cooperation in criminal matters’) (Article 1(2)(b)), or are or
have been transmitted or made available to the competent authorities of the
Member States by authorities or information systems established on the basis of
the former Treaty on European Union or the former Treaty establishing the
European Community (Article 1(2)(c)).

· 
No application to domestic data processing:

As a first consequence of the scope as
described in Article 1 (2)(a), the Framework Decision does not apply to
domestic processing operations by competent judicial or police
authorities in the Member States, or to direct transfers from a
Member State to a third country or an international organisation.

Example
1: Exchange of personal data with Interpol

The Council
Common Position 2005/69/JHA[191] on exchanging certain
data with the International Criminal Police Organisation (Interpol) obliges
Member States to take the necessary measures to allow for the exchange of data
between their competent law enforcement authorities and Interpol.

The
Framework Decision does not apply to direct exchanges of personal
data by Member States with Interpol.

However it
would apply once personal data had been exchanged between Member States and
then transferred to Interpol (Article 13 of the Framework Decision).

This distinction between personal data to
be transferred or exchanged, and personal data being processed at domestic
level only, exists neither in the relevant Council of Europe instruments, nor
in the Directive. Both instruments apply without distinction to the processing
of data carried out within Member States and when transferred from a Member
State to a third country.[192] As held by the ECJ in a
number of cases[193], the rules on the
protection of individuals with regard to the processing of personal data and
the free movement of such data apply regardless of whether or not there is a
cross-border dimension.

Moreover, this distinction is difficult to
make in practice: personal data which have been gathered in a purely domestic
context can hardly be factually distinguished from data that have been subject
to cross-border transmission. A priori, any purely domestically
processed data may be subject to cross-border transmission. It can complicate
the actual implementation and application of the Framework Decision and other
legal instruments at EU level: good co-operation between Member States requires
there to be mutual trust regarding the data protection of information received
from other Member States. Such a high degree of trust can only be achieved if
the protection (and the ensuing reliability) of all data which – at a later stage
– may be transferred to other Member States, is fully ensured.

This distinction also may lead, in these
areas, to different levels of data protection in different Member States
between personal data to be transferred or exchanged or personal data being processed
at domestic level only. Neither Article 8 of the Charter of Fundamental Rights
of the European Union nor Article 8 of the Convention for the Protection of
Human Rights and Fundamental Freedoms excludes any situation or sector from the
scope of protection.[194]

This distinction also creates legal
uncertainty – both for data subjects and for competent authorities – as to
which rules should apply when personal data are processed by police and
judicial authorities.

This limited scope of the Framework Decision
already leads to legal and practical deficiencies for the protection of
personal data at EU level: more and more EU legislation creates harmonised
legal obligations upon private or public sector data controllers requiring the
processing and exchange of personal data for purposes of prevention,
investigation, detection or prosecution of criminal offences, without providing
for correspondingly harmonised and/or comprehensive provisions for the
protection of personal data, as the Framework Decision does not apply to the
domestic processing of personal data in these situations.

This shortcoming of the Framework Decision
has been pointed out also by several Member States during an expert meeting in
February 2011 on the implementation of the Framework Decision. It has also been
criticised by the European Data Protection Supervisor.[195]
The European Parliament[196], the Conference of Data
Protection Authorities[197], and the Council of
Europe's T-PD Consultative Committee – consisting of data protection
representatives of European governments – have all made clear in various
occasions that the non-applicability of the Framework Decision to domestic
processing of personal data is a key weakness.

· 
Application only to ‘competent
authorities:’

The Framework Decision applies to the
processing of personal data by ‘competent authorities’ (or ‘information
systems’) which transfer or make available personal data to other competent
police or judicial authorities. In that context, ‘competent authorities’ means
“agencies or bodies established by legal acts adopted by the Council pursuant
to Title VI of the Treaty on European Union, as well as police, customs,
judicial and other competent authorities of the Member States that are
authorised by national law to process personal data” within the scope of the
Framework Decision (Article 2 h));

However, as a second consequence of
the limited scope as described above, the Framework Decision does not apply
to activities by data controllers, which are not competent police or judicial
authorities, but which are transferring personal data within "a
framework established by the public authorities that relates to public security",
as described by the case law of the ECJ and are therefore in some way connected
with the prevention, investigation, detection or prosecution of criminal
offences or the execution of criminal penalties or enforcement of criminal law.

This is the case e.g. for air carriers
providing travellers information to police authorities of third countries, or
internet service providers which have retained communication data for the
purpose of fighting serious crimes, as required by Directive 2006/24/EC on data
retention[198]. The Framework Decision
therefore fails to address this legal uncertainty.[199]

12.2.2. 
Low level of harmonisation of the Framework Decision

The Framework Decision provides for a
low level of harmonisation. It allows national laws providing for
the protection of personal data at national level to impose higher
safeguards than those established in the Framework Decision (Article 1(5)).
As a consequence, national processing restrictions in place in one Member State
have to be met by the other Member States (Article 12). The higher safeguards
may also result from legal instruments adopted at EU level its Article 28 also
states: “where in acts adopted prior to the date of entry into force of this
Framework Decision and regulating the exchange of personal data between Member
States [...] specific conditions have been introduced as to the use of
such data by the receiving Member State these conditions shall take precedence
over the provisions of this Framework Decision” (see below § 1.3).

Furthermore, the Framework Decision also
‘does not affect’ Convention 108 and its Additional Protocol (recital 41),
thereby leaving it open for interpretation if its level of protection is ‘at
least equal’ to the one of the Convention 108.

By contrast, other former third pillar
instruments require Member States explicitly to adopt national data protection
provisions in order to achieve a level of protection of personal data ‘at least
equal’ to that resulting from the Convention 108 (Schengen Implementing
Convention Aricle 126) or additionally to the Additional Protocol with the
Police Recommendation (Prüm Decision Article 25).

12.2.3. No powers of EU institutions vis-à-vis the Framework Decision

As to the powers of the EU institutions,
Protocol 36 on Transitional provisions annexed to the Treaty of Lisbon provides
that the Commission has no infringement powers in the case of the Framework
Decision (Article 10). Also, the powers of the Court of Justice are to remain
the same with respect to those acts in the field of police cooperation and
judicial cooperation in criminal matters which were adopted before the entry
into force of the Treaty of Lisbon. Till these transitional measures cease to
have effect five years after the date of entry into force of the Treaty of
Lisbon, this legal status of the Framework Decision has implications to the
extent that current rules for data controllers are not uniform and coherent across
the EU. Furthermore, the Commission does not have implementing powers and there
is no competence for the Article 29 Working Party composed by DPAs aiming at
fostering common interpretation.

12.3. The Framework Decision’s relationship with other legal instruments
12.3.1. Unclear rules of precedence

The Framework Decision did not replace or
specifically amend the various existing sector-specific legislative instruments
for police and judicial co-operation in criminal matters with data protection
provisions. The articulation between the Framework Decision and these other
data protection provisions contained in ex third pillar legal acts is not
always clear.

Article 28 of the Framework Decision
spells out a rule of precedence of acts adopted prior to the date
of entry into force of the Framework Decision (19.1.2009).

However,
some former third pillar acts have been adopted after the entry into force
of the Framework Decision. This includes:

- 
Framework Decision 2009/315/JHA on criminal records exchange[200],
which states that its specific data protection rules complement the general
data protection rules in force, but with no specific reference to Framework
Decision (recital 13 in the preamble);

- 
Decision 2009/316/JHA on the
establishment of the criminal records system ECRIS[201],
which implements Framework Decision 2009/315/JHA on this issue, states that the
Framework Decision ‘should’ apply in the context of computerised exchange of
data between Member States, while allowing Member States to set higher levels
of protection (recital 18 in the preamble);

- 
Decision 2009/371/JHA establishing Europol[202],
which replaced the prior Europol Convention and Protocols as from 1 January
2010, equally provides that the Framework Decision on data protection applies
to the processing by Member States of the data to Europol, but that as regards
Europol as such, the data protection rules in the Europol Decision replaced the
general rules of the Framework Decision because of the ‘particular nature,
functions and competences of Europol’ (recital 12 in the preamble); the same
applies to two implementing decisions on Europol analysis work files[203],
and on Europol’s relations with partners, including the exchange of personal
data and classified information[204];

- 
Amending Decision 2009/426/JHA to the Decision
establishing Eurojust[205] specifies that the
Framework Decision on data protection applies to the processing by Member
States of the data transmitted between the Member States and Eurojust, but that
the data protection rules applying to Eurojust as such (as amended by this
later Decision) are not affected by the Framework Decision, because of the
‘particular nature, functions and competences of Eurojust’ (recital 13 in the
preamble);

- 
Framework Decision 2009/829/JHA on the
recognition of pre-trial supervision orders[206]
also states that the Framework Decision applies to personal data exchange
within its scope (recital 19 in the preamble);

- 
Decision 2009/917/JHA establishing the
Customs Information System (CIS)[207], which
replaces the CIS-Convention and its Protocols as from 27 May 2011 (Art 34),
contains a number of specific references to the Framework Decision, which
applies to the CIS unless otherwise provided for in the Decision (Art 20);

- 
Framework Decision 2009/948/JHA on conflicts
of jurisdiction[208] states that the Framework
Decision applies to personal data exchange within its scope (recital 18).

As regards the acts adopted prior to the
entry into force of the Framework Decision, Article 28 does not clarify
whether "specific conditions as to the use of such data by the
receiving Member State" should also relate to general principles for the
protection of personal data, such as guaranteeing lawful processing or
supervision by independent data protection authorities or if they are only to
be understood as being limited to conditions of use, e.g. a prohibition to
process personal data supplied for the prevention of criminal offences for a
major event with a cross border dimension for other purposes.

Recital
39 lists some existing measures which are deemed to set out a “complete and
coherent set of rules” regarding data protection and remain unaffected by
the Framework Decision. This creates legal uncertainty, in particular, because
there is no exhaustive list of legal instruments that are to remain unaffected.
As a consequence, it is left to the interpretation on a case-by-case basis
which rules apply to a concrete situation. Furthermore, despite explicit
references in the recital (but not in the legal text itself), it is not
entirely clear whether the specific rules in these measures mentioned apply
entirely instead of the rules in the Framework Decision or if the Framework
Decision could apply e.g. in case of possible gaps in the legal instruments
cited.

As regards measures targeted by recital 40
of the Framework Decision which have “more limited data protection rules”, they
apply instead of the Framework Decision if the conditions imposed – as to the
use or further transfer of personal data - on receiving Member States are ‘more
restrictive’ than the Framework Decision, but otherwise the Framework
Decision applies. Again, this leaves a large room for interpretation and
therefore does not provide legal certainty neither for individuals nor for
police and other competent authorities.

12.3.2. Differences in content between the Framework Decision and the other legal
instruments with specific data protection
provisions

A comparison of the substantive rules
contained in the Framework Decision with the abovementioned other legal
instruments with data protection relevance, in particular Directive 95/46/EC,
shows differences in content, some of which are presented below.

· 
Definition of ‘personal data’:

The definition of ‘personal data’ (Article
2 (a) Directive) can equally be found e.g. in the Framework Decision (Article 2
(a)), while the definitions used for the SIS II Decision (Article 3 (d), or the
CIS Decision (Article 2 No. 2) are only identical as to the main part of the
definition, and do not describe further what is to be understood under an
‘identifiable person’. The Prüm Decision adds that “processing within the
meaning of this Decision shall also include notification of whether or not a
hit exists” (Article 24 (1) a)).

· 
Limitations to the purpose limitation
principle:

The Directive requires personal data to be
collected for specified, explicit and legitimate purposes and prohibits further
processing in a way incompatible with those purposes (Article 6(1)(b)).

While the Framework Decision does lay down
similar principles in its Article 3, it leaves it explicitly to the Member
States to determine more precisely at national level which other purposes are
to be considered as incompatible with the purpose for which the personal data
were originally collected (recital 6). It also provides for further exceptions
from the purpose limitation rule, as regards data received from other Member
States (Article 11), including further processing for “any other purpose”, with
the prior consent of the transmitting Member State or with the consent of the
data subject, given in accordance with national law (Article 11 (d)). Equally,
the Prüm Decision provides that although processing of personal data by the
receiving Member State is ‘permitted solely’ for the purposes for which the
data have been originally transferred, processing ‘for other purposes’ is
admissible with prior authorisation of the Member State administering the file
and subject to the national laws of both receiving and administering Member
State (Article 26). A similar provision exists in the CIS Decision (Article 8).

In consequence, a provision permitting
processing ‘for other purposes’ means that in practice any personal data,
including sensitive data, processed by a competent police authority in one
Member State and transmitted to another Member State may be processed for
different purposes other than those for which they were originally collected
and then transmitted and thereby emptying the purpose limitation principle of
its value. In this context, the “consent” or “authorisation” of the
transmitting authority cannot be considered under any circumstances as
providing a valid legal ground to derogate from the purpose limitation
principle.

· 
Periodic review of personal data processed:

The periodic review provided for by Article
5 of the Framework Decision refers to review of the need for the storage of the
data but does not ensure the periodic verification of data quality and does not
ensure that police files are purged in practice of superfluous data and kept up
to date.[209] The importance of such review
is important both to ensure individuals' rights and for the efficient operation
of police services.

· 
Information to the data subject:

Under the Framework Decision (Article 16),
Member States have to ensure that their competent authorities inform data
subjects of processing, unless national law provides otherwise or in cases of
transfer to another Member State where that Member State has requested that the
data subject is not to be informed. The Framework Decision does not specify
form, content and modalities of that information and leaves this to national
law.

Under the Europol and Prüm Decisions it is
established that when a data subject is informed it must be in an
‘intelligible’ or ‘comprehensible’ form. Under the Prüm Decision it must be
free of charge.

· 
Right of access:

Under the Framework Decision (Article 17),
a data subject has the right to obtain, without constraint or excessive delay
or expense, either:

(a)        at least a confirmation from the controller or from the
national supervisory authority as to whether or not data relating to him have
been transmitted or made available and information on the recipients or
categories of recipients to whom the data have been disclosed and communication
of the data undergoing processing, or

(b)        at least a confirmation from the national supervisory authority
that all necessary verifications have taken place.

This information or confirmation can either
be provided directly by the competent authority (“direct access”) or by the
supervisory authority (“indirect access”)[210]. Member
States may legislate restrictions to this right of access, in order to avoid
obstructing official or legal inquiries, investigations or procedures;
prejudicing the prevention, detection, investigation and prosecution of
criminal offences or for the execution of criminal penalties; protecting public
security; protecting national security; and protecting the data subject or the
rights and freedoms of others (Article 17 (2)). Any refusals on behalf of the
controller to provide this information must be made in writing (Article17 (3)).

Both the 2002 Eurojust Decision (Article
19) and the Europol Decision (Article 30) provide for a specific right of
access in a detailed provision. Other than these instruments, out of 26 other
instruments, only six provide for a specific right of access in a specific
provision: the Schengen Implementing Convention (Article 109), the SIS II
Decision (Article 58), the Naples II Convention (Article 25), the Prüm Decision
(Article 31), the VIS access Decision[211] (Article 14)
and the CIS Decision (Article 22). All these instruments require the right of
access to be exercised in accordance with national law (in the case of the CIS
Decision, implementing the Framework Decision) and some allow the national
supervisory authority to decide whether and how that right can be exercised
(SIC, SIS II, VIS Access Decision). The involvement of other MS before granting
access is expressly foreseen (SIC, SIS II, Naples II, VIS access). Only the
Prüm Decision lays down further details as to which information is to be given
(e.g. which data are being processed, legal basis for the processing, etc.).
All lay down grounds for refusal for access, but while similar use different
grounds and differently wording.

· 
Rights to correction, deletion and blocking
of data:

Under the Framework Decision a data subject
has the right to obtain, without constraint or excessive delay or expense,
confirmation of data processing (Article 17(1)). Any refusals on behalf of the
controller to provide this information must be made in writing (Article17 (3)).
The data subject also has the right to request rectification, erasure or
blocking of personal data (Article 18(1)). Each Member State will decide
whether the request must be made to the data controller or to the national supervisory
authority. Any refusals on behalf of the controller to rectify, erase or block
data must be made in writing to the data subject (Article 18(1)).

Under other legislative acts with access
rights provisions, concrete time limits have been established by which requests
made by data subjects must be dealt with. Under the Europol Decision, a subject
requesting the deletion or correction of data will be informed of the outcome
of their request within a maximum of three months (Article 31(5)). Under the
Eurojust Decision, requests of access must also be dealt with within a maximum
of three months and access to data are free of charge (Article 19(2)). Under
Schengen legislation and the VIS Decision, requests for deletion must be dealt
with within 60 days.

· 
Transfers to third countries or international
organisations:

The Framework Decision establishes that
personal data may be transferred to competent authorities in third States or to
international bodies. This is generally allowed if ‘adequate protection’ is
provided, and it is necessary for the prevention, investigation, detection or
prosecution of criminal offences or execution of criminal penalties, and with
the prior authorisation of the original Member State (Article 13). The
assessment of adequacy is left to the Member States on the basis of indicative
criteria (see the text of Article 13 (4) DPFD).

There are also several exceptions to this
rule, in particular when the national law of the transferring Member States so
provides because of ‘legitimate prevailing interests’ (Article 13(3)). These
specific rules on the transfer of data to third states or international bodies
differ significantly from those applicable under the Directive (Articles 25,
26).

Example
2: Third country data transfers

Member
State A considers that a third country X with which it has a bilateral data
transfer agreement ensures an ‘adequate’ level of protection.

Member
State B did not conclude a similar bilateral agreement with the same third
country X and does not consider that country X ensures an ‘adequate’ level of
protection.

Under the
rules of the Framework Decision, Member State A is able to transfer personal
data of individuals from Member State B, if transmitted to it by Member State B
previously, to third country X – in emergencies without Member State B’s
authorisation.

Had third
country X requested this personal data directly from Member State B, third
country X would not have received the data directly from Member State B as
Member State B considers X as not ensuring an 'adequate' level of protection
and would prohibit the transfer.

Other instruments also allow for the
transfer of data to third countries or international organisations: by way of
example, under the SIS II Decision, data cannot be transferred to third
countries or to international organisations except for stolen, misappropriated,
lost or invalidated passports, which may be exchanged with members of Interpol
by establishing a connection between SIS II and the Interpol database on stolen
or missing travel documents. The VIS Decision Article 8(4) says that VIS data
shall not be transferred or made available to a third country or to an
international organisation. However, in an exceptional case of urgency such
data may be transferred or made available to a third country/international
organisation exclusively for the purposes of the prevention and detection of
terrorist offences and of other serious criminal offences subject to the
consent of the originating MS.

The
Framework Decision is furthermore ‘without prejudice’ to existing obligations
and commitments incumbent upon Member States or upon the Union by virtue of
bilateral and/or multilateral agreements with third States existing at the time
of its adoption (Article 26), e.g. to the Agreement between the European Union
and the Republic of Iceland and the Kingdom of Norway on the surrender
procedure between the Member States of the European Union and Iceland and
Norway[212] or the Agreement between the
European Union and Iceland and Norway on the application of certain provisions
of the Prüm Decision[213]. However, future agreements have
to comply with the rules on exchanges with third States: Article 26 provides
for the application of conditions of Article 13 (1)(c) or (2) when falling
within the scope of the Framework Decision.

· 
Supervisory authorities

As in the
Directive, the Framework Decision recognises that the establishment in Member
States of supervisory authorities, exercising their functions with complete
independence, is an essential component of the protection of personal data
processed within the framework of police and judicial cooperation between the
Member States. It also allows that the supervisory authorities already
established in Member States under the Directive to assume such responsibility
(recitals 33, 34). The Prüm Decision also refers specifically to a supervisory
authority within the meaning of the Directive (Article 31).

The Framework Decision does not establish
rules related to the existing joint supervisory authorities. The instruments
concerning Europol, Eurojust and CIS make specific provisions for the
establishment up of a joint supervisory authority. The Europol Decision obliges
an Independent Joint Supervisory Body to be set up to review the activities of
Europol in order to ensure that the rights of individuals are not violated
through the storage, processing and use of the data held in Europol.[214].

The Framework Decision does not establish
any provisions concerning the European Data Protection Supervisor (EDPS). In
this respect, the CIS Decision stipulates that the EDPS is to supervise the
activities of the Commission regarding the CIS. The SIS II Decision (when it
will be applicable) envisages that the EDPS will supervise processing
activities of the Management Authority of SIS II; the same is the case also for
the VIS decision. The VIS Regulation further stipulates that the EDPS is
responsible for checking that personal data processing activities of the
Management Authority are carried out in accordance with the VIS Regulation. The
EDPS is also to ensure that data processing activities carried out by the
Management Authority are audited. Under the SIS II Decision the EDPS is to act
as a mediator between Member States in disputes regarding the correction or
deletion of data.

13. Fundamental
Rights and other Standards

The protection of personal data is recognised
as a fundamental right and has been interpreted by the jurisprudence of the
European Court of Justice (ECJ) and the European Court of Human Rights (ECtHR).

13.1. 
Fundamental Rights Standards
13.1.1. 
Case law interpreting Article 8 of the EU
Charter of Fundamental Rights

Important case law provided guidance
for the interpretation of this fundamental right by the European Court of
Justice (ECJ) in particular in the following cases: Commission v Federal
Republic of Germany[215], concerning the lack of
independence of the national supervisory authorities, and Schecke et al.[216]
As underlined by the ECJ in the latter decision, the fundamental right to
the protection of personal data is not an absolute right, but must be
considered in relation to its function in society. Article 8(2) of the Charter
thus authorises the processing of personal data if certain conditions are
satisfied. It provides that personal data ‘must be processed fairly for
specified purposes and on the basis of the consent of the person concerned or
some other legitimate basis laid down by law’.

13.1.2. 
Article 8 of the European Convention of Human
Rights of the Council of Europe (ECHR)

Under Article 8 of the ECHR European
Convention of Human Rights of the Council of Europe (ECHR), “everyone has the
right to respect for his private and family life, his home and his
correspondence.” Data protection emerges from the jurisprudence of the European
Court of Human Rights in Strasbourg as an aspect of privacy protection. The
case law is particularly relevant for the police and judicial cooperation in
criminal matters.

The ECtHR has found in Article 8 ECHR not
only negative obligations for the Member States to abstain from interfering
with the right to privacy, but also positive obligations, that entail ‘the
adoption of measures designed to secure respect for private life even in the
sphere of the relations of individuals themselves’.[217]
 In M.S. v. Sweden[218],
for instance, the ECtHR made clear that ‘the protection of personal data [...]
is of fundamental importance to a person’s enjoyment of his or her right to
respect for private and family life as guaranteed by Article 8 of the
Convention’.

The collection of information by officials
of the State about an individual will always concern his or her private life
and will thus fall within the scope of Article 8 (1) ECHR. This includes for
example: an official census which includes compulsory questions relating to the
sex, marital status, place of birth and other personal details[219];
the recording of fingerprinting, photography and other personal information by
the police[220]even if the police
register is secret[221]; the collection of
medical data and the maintenance of medical records[222];
the compulsion by state authorities to reveal details of personal expenditure
(and thus intimate details of private life)[223]; records
relating to past criminal cases[224]; information relating
to terrorist activity[225], collecting personal
information in order to protect national security[226].

13.1.3. 
Possible limitations to the fundamental right to
personal data protection and to private life

Limitations on the right to privacy and
data protection may be applied only when certain conditions are met.
Article 8(2) of the European Convention on Human Rights accepts
interference only where it is "in accordance with the law and is
necessary in a democratic society in the interests of national security, public
safety or the economic well-being of the country, for the prevention of
disorder or crime, for the protection of health or morals, or for the protection
of the rights and freedoms of others".

Article 52(1) of the Charter accepts
limitations only where they are "provided for by law and respect the
essence of those rights and freedoms. Subject to the principle of
proportionality, limitations may be made only if they are necessary and
genuinely meet objectives of general interest recognised by the Union or the
need to protect the rights and freedoms of others".

These are the provisions that serve as a
frame of reference for the Court of Justice, which follows the lead of the
European Court of Human Rights (Court of Human Rights) on this matter, when
examining the compatibility of a data-processing measure with the rights
in question[227].

Once an interference or infringement of the
rights has been established, then, in application of the Court of Human Rights
criterion that "[t]he mere storing of data relating to the private life
of an individual amounts to an interference",[228]
the grounds for that interference must be examined, which involves three
cumulative conditions[229] that the interference
or infringement must:

(1) be in accordance with the law, which requires in
particular:

- 
that the measure "should have some basis in
domestic law, but also refers to the quality of the law in question, [which]
should be accessible to the person concerned and foreseeable as to its
effects"[230];

- 
rules involving negative consequences for
individuals should be clear and precise and their application predictable for
those subject to them[231];

- 
that the measure must be foreseeable, i.e. drawn
up with sufficient precision to enable the individual to regulate his
conduct"[232]. It is "essential
[...] to have clear, detailed rules governing the scope and application of
measures, as well as minimum safeguards concerning, inter alia, duration, storage,
usage, access of third parties, procedures for preserving the integrity and
confidentiality of data and procedures for its destruction, thus providing
sufficient guarantees against the risk of abuse and arbitrariness"[233].

- 
States "do not enjoy an unlimited
discretion to subject persons within their jurisdiction to secret
surveillance" and must provide adequate and effective guarantees against
abuse". [234]

(2) meet a general-interest
objective recognised by the Union (legitimate aim):

Article 52(1) of the Charter requires that
the restrictions imposed on the exercise of the rights in question
"genuinely meet objectives of general interest recognised by the Union"[235].
Article 8(2) of the ECHR lists the various legitimate goals, including national security, public safety and the prevention of crime".

(3) be necessary and respond
effectively to a general-interest objective:

This condition presupposes a review of
proportionality according to settled case-law of the Court of Justice "the
principle of proportionality, which is one of the general principles of
European Union law, requires that measures implemented by acts of the
European Union are appropriate for attaining the objective pursued and do not
go beyond what is necessary to achieve it".[236]

The objective pursued must in effect be
reconciled with the fundamental rights set forth in Articles 7 and 8 of the
Charter.[237] It is thus necessary to
balance on the one hand "the European Union's interest" in
improving security through the prevention and combating of crime and, on the
other hand, "the interference with the right of [individual data
subjects] to respect for their private life in general and to the protection
of their personal data in particular".[238]

As they constitute exceptions to the
fundamental rights, grounds for interference are "to be interpreted
narrowly"[239] and "must apply
only in so far as is strictly necessary"[240].

A limitation
imposed on the rights in question, is justified only if it is "proportionate
to the legitimate aim pursued"[241] and "necessary
in a democratic society" to attain a legitimate aim, and,
in particular, that it is "proportionate to the legitimate aim
pursued and [that] the reasons adduced by the (...) authorities to justify
it are relevant and sufficient".[242] The
authorities "enjoy a margin of appreciation, the scope of which will
depend not only on the nature of the legitimate aim pursued but also on the
particular nature of the interference involved".[243]

It is therefore necessary to examine
whether any proposed measure does not "go beyond what [is] necessary
for achieving the legitimate aims pursued, having regard in particular to the
interference with the rights guaranteed by Articles 7 and 8 of the Charter".[244]

It is apparent from the case‑law of
the Court of Human Rights that a measure authorising "so‑called
exploratory or general surveillance" would contravene Article 8
of the ECHR[245]. Similarly,
"the blanket and indiscriminate nature of the power of retention"
of data (fingerprints, biological samples and DNA profiles) "of persons
suspected but not convicted of offences", which are "retained
irrespective of the nature or gravity of the offence with which the
individual was originally suspected or of the age of the suspected offender"
and without restriction of time, "overstep[s] any acceptable margin of
appreciation in this regard [and] constitutes a disproportionate interference
with the [...] right to respect for private life"[246].

ECHR case law:

In Leander v Sweden[247], the Court held that
the storing of information relating to an individual’s private life in a secret
register and the release of such information amounted to an interference with
his right to respect for private life as guaranteed by Article 8(1).

In Rotaru v Romania[248], the ECtHR reiterated
that the storing by a public authority of information relating to an
individual’s private life and the use of it amount to interference with the
right to respect for private life and added that such an interference occurred
also from the refusal to allow an opportunity for the personal data to be
refuted.

In Amann v Switzerland[249], the Court found that the
storing of a card containing data relating to an individual’s private life and
stored by an authority storage itself amounted to an interference with the
right to respect for his private life.

In S. and Marper v. United Kingdom[250]
the ECtHR ruled on the lawfulness of the retention of fingerprints, cellular
samples and DNA profiles after criminal proceedings against the applicants were
terminated by an acquittal or discharge and despite the applicants had
requested their destruction. The retention of both cellular samples and DNA
profiles amounted to an interference with the applicants’ right to respect for
their private lives. The Court reiterated that as for the storing and use of
this personal information, it was essential to have clear, detailed rules
governing the scope and application of measures, as well as minimum safeguards.
The protection afforded by Article 8 would be unacceptably weakened if the use
of modern scientific techniques in the criminal justice system were allowed at
any cost and without carefully balancing the potential benefits of the
extensive use of such techniques against important private-life interests.

The Court found that it amounts to a violation of Article 8 that fingerprints,
cellular samples and DNA profiles could be retained by police authorities
irrespective of the nature or gravity of the offence with which the individual
was originally suspected or of the age of the suspected offender; if the
retention was not time-limited; and if there existed only limited possibilities
for an acquitted individual to have the data removed from the nationwide
database or to have the materials destroyed. It expressly found that that the
retention of unconvicted persons’ data could be especially harmful in the case
of minors such, given their special situation and the importance of their
development and integration in society

13.2. 
Other standards (Council of Europe)

Additionally,
certain standards included in Recommendation No R (87) 15 of the Committee of
Ministers of the Council of Europe are also useful benchmarks in this area, in
particular:

– 
The need to distinguish personal data
according to their degree of accuracy and reliability, or whether they
are based on facts or on opinions or personal assessments. The lack of such a
requirement could actually undermine the data being exchanged between police
authorities as they will not be able to ascertain whether the data can be
construed as ‘evidence’, ‘fact’, ‘hard intelligence’ or ‘soft intelligence’.
This could have the consequence of hampering security operations and of making
it more difficult for courts to secure convictions;

– 
The need to distinguish between different
categories of data subjects (criminals, suspects, victims, witnesses,
etc.), and to provide in particular for specific guarantees for data relating
to non-suspects. Again, these distinctions are on the one hand necessary for
the protection of the concerned individuals and on the other hand for the
ability of the recipient law enforcement authorities to be able to make full
use of the data they receive[251].

_________________________

LIST OF EU INSTRUMENTS IN THE FIELD OF
POLICE AND JUDICIAL COOPERATION IN CRIMINAL MATTERS CONTAINING 
SPECIFIC DATA PROTECTION PROVISIONS

(1) 
Convention implementing the Schengen Agreement
of 14 June 1985 between the Governments of the States of the Benelux Economic
Union, the Federal Republic of Germany and the French Republic on the gradual
abolition of checks at their common borders (OJ L 239, 22.9.2000, p. 19);

(2) 
Council Decision of 17 October 2000 establishing
a secretariat for the joint supervisory data-protection bodies set up by the
Convention on the Establishment of a European Police Office (Europol
Convention), the Convention on the Use of Information Technology for Customs
Purposes and the Convention implementing the Schengen Agreement on the gradual
abolition of checks at the common borders (Schengen Convention) (OJ L 271,
24.10.2000, p. 1);

(3) 
Council Decision 2005/211/JHA of 24 February 2005
concerning the introduction of some new functions for the Schengen Information
System, including in the fight against terrorism (OJ L 68, 15.3.2005, p.44);

(4) 
Commission Decision 2006/758/EC of 22 September
2006 on amending the Sirene Manual (OJ L 317, 16.11.2006, p. 41).

(5) 
Council Decision 2007/533/JHA of 12 June 2007 on
the establishment, operation and use of the second generation Schengen
Information System (SIS II) (OJ L 205, 7.8.2007, p. 63);

(6) 
Commission Decision 2008/334/JHA of 4 March 2008
adopting the SIRENE Manual and other implementing measures for the second
generation Schengen Information System (SIS II) (OJ L 123, 8.5.2008, p. 39).

(7) 
Council Act of 18 December 1997 drawing up, on
the basis of Article K.3 of the Treaty on European Union, the Convention on
mutual assistance and cooperation between customs administrations (OJ C 24,
23.1.1998, p.2).

(8) 
Council Act of 29 May 2000 establishing in
accordance with Article 34 of the Treaty on European Union the Convention on
Mutual Assistance in Criminal Matters between the Member States of the European
Union (OJ
C 197, 12.7.2000, p 1).

(9) 
Council Decision 2000/642/JHA of 17 October 2000
concerning arrangements for cooperation between financial intelligence units of
the Member States in respect of exchanging information (OJ L 271, 24.10.2000,
p. 4).

(10) 
Council Framework Decision 2002/584/JHA of 13
June 2002 on the European arrest warrant and the surrender procedures between
Member States (OJ
L 190, 18.7.2002, p. 1).

(11) 
Council Common Position 2005/69/JHA of 24
January 2005 on exchanging certain data with Interpol (OJ
L 27,29.1.2005, p. 61)

(12) 
Council Framework Decision 2006/960/JHA of 18
December 2006 on simplifying the exchange of information and intelligence
between law enforcement authorities of the Member States of the European Union 
(OJ
L 386, 29.12.2006, p. 89).

(13) 
Council Decision 2007/845/JHA of 6 December 2007
concerning cooperation between Asset Recovery Offices of the Member States in
the field of tracing and identification of proceeds from, or other property
related to, crime (OJ L 332, 18.12.2007, p. 103).

(14) 
Council Decision 2008/615/JHA of 23 June 2008 on
the stepping up of cross-border cooperation, particularly in combating
terrorism and cross-border crime (OJ L 210, 6.8.2008, p. 1);

(15) 
Council Decision 2008/616/JHA of 23 June 2008 on
the implementation of Decision 2008/615/JHA on the stepping up of cross-border
cooperation, particularly in combating terrorism and cross-border crime (OJ L
210, 6.8.2008, p. 12).

(16) 
Council Decision 2008/633/JHA of 23 June 2008
concerning access for consultation of the Visa Information System (VIS) by
designated authorities of Member States and by Europol for the purposes of the
prevention, detection and investigation of terrorist offences and of other
serious criminal offences  (OJ
L 218, 13.8.2008, p. 129).

(17) 
Council Framework Decision 2008/947/JHA of 27
November 2008 on the application of the principle of mutual recognition to
judgments and probation decisions with a view to the supervision of probation
measures and alternative sanctions (OJ L 337, 16.12.2008, p. 102).

(18) 
Council Framework Decision 2008/978/JHA of 18
December 2008 on the European evidence warrant for the purpose of obtaining
objects, documents and data for use in proceedings in criminal matters (OJ
L 350, 30.12.2008, p.72).

(19) 
Council Framework Decision 2009/315/JHA of 26
February 2009 on the organisation and content of the exchange of information
extracted from the criminal record between Member States (OJ
L 93 7.4.2009, p. 23).

(20) 
Council Decision 2009/316/JHA of 6 April
2009 on the establishment of the European Criminal Records Information System
(ECRIS) in application of Article 11 of Framework Decision 2009/315/JHA (OJ
L 93, 7.4.2009, p. 33).

(21) 
Council Framework Decision 2009/829/JHA of 23
October 2009 on the application, between Member States of the European Union,
of the principle of mutual recognition to decisions on supervision measures as
an alternative to provisional detention (OJ
L 294, 11.11.2009, p.20).

(22) 
Council Decision 2009/917/JHA of 30 November
2009 on the use of information technology for customs purposes (OJ
L 323, 10.12.2009, p 20).

(23) 
Council Framework Decision 2009/948/JHA of 30
November 2009 on prevention and settlement of conflicts of exercise of
jurisdiction in criminal proceedings (OJ
L 328, 15.12.2009, p. 42).

As regards the processing of personal data
by Eurojust:

(1) 
Decision 2002/187/JHA setting up Eurojust with a
view to reinforcing the fight against serious crime (OJ L 63, 6.3.2002, p. 1);

(2) 
Council Decision 2009/426/JHA of 16 December
2008 on the strengthening of Eurojust and amending Decision 2002/187/JHA
setting up Eurojust with a view to reinforcing the fight against serious crime
(‘Eurojust Decision 2009’) (OJ
L 138, 4.6.2009, p. 14).

As
regards the processing of personal data by the European Police Office
(Europol):

(3) 
Council Decision 2009/371/JHA of 6 April 2009
establishing the European Police Office (Europol) (OJ L 121, 15.5.2009, p. 37).

(4) 
Council Decision 2009/934/JHA of 30 November
2009 adopting the implementing rules governing Europol’s relations with
partners, including the exchange of personal data and classified information
(OJ
L 2009, L 325, 11.12.2009, p. 6).

(5) 
Council Decision 2009/936/JHA of 30 November
2009 adopting the implementing rules for Europol analysis work files (OJ
L 325, 11.12.2009, p. 14).

ANNEX 4

Summary of Replies to the Public consultation on the
Commission's Communication on a Comprehensive Approach on Personal Data
Protection in the European Union

Following the
adoption of the Commission's Communication of 4 November 2010 on "A
comprehensive approach on personal data protection in the European Union"
a public consultation was launched on the ideas therein. The deadline for replies to the consultation was 15 January
2011. The Commission received 305 responses, of which 54 from citizens,
31 from public authorities and 220 from private organisations, in particular
business associations and non-governmental organisations. The full text of these responses is available at http://ec.europa.eu/justice/news/consulting_public/news_consulting_0006_en.htm, except where respondents asked to remain anonymous or to
have their entire contribution treated as confidential.[252]

This document
provides a factual and objective summary of the contributions received during
the public consultation. While the summary is structured along the issues
identified in the Commission's abovementioned Communication, the views and
opinions expressed are not necessarily those of the Commission.

1.           Strengthening Individuals' Rights

1.1. Ensuring appropriate protection
for individuals in all circumstances

The Commission will consider how to ensure a coherent application
of data protection rules, taking into account the impact of new technologies on
individuals' rights and freedoms and the objective of ensuring the free
circulation of personal data within the internal market.

­ 
Coherence

The coherent
application of data protection rules was considered particularly important by
large private companies, who insisted on having a coherent and uniform
framework. Across industry, stakeholders felt that the current lack of
harmonisation is detrimental to economic activity within the EU. Many
stakeholders also pointed out that data protection rules should be coherent
with existing sectoral regulation, such as the rules in the media sector
(freedom to inform, journalistic rights and exemptions), the police and justice
sector (specificities regarding access to data rights), the history and
archiving sector (access to historical documents), the communications sector
(security of networks, services and information), the health sector (collection
of data for pharmacovigilance), and the research sector (recognition of
scientific purposes as a substantial public interest, exemptions and safeguards
for further processing of personal data).

Many
contributors referred to the challenges to data protection posed by
technological developments, such as cloud computing or social networks, and
urged the legislator to respond to these in a concrete and coherent manner. Some propose to introduce sectoral legislation to specifically
address these issues (following the model of e-Privacy directive). Similarly, a
number of citizens complained about the apparent lack of regulation of
the internet as far as personal data is concerned. A consistent privacy
experience online is seen as vital in order to have trust in the internet.

Some
stakeholders, including citizens, mentioned that a coherent application of the
rules is only possible if definitions are clear, especially the definitions of
"personal data", "data controller" and "processor".
Some contributors suggested to change the current core definitions. For
instance, some proposed to foresee that identification is not the only element
in defining personal data and suggested to keep the personal data definition
broad in order to anticipate possible evolution of new technologies and
behavioural profiling. A group of researchers suggested to exclude from the
definition of personal data any information whose processing does not interfere
with the values of privacy, fairness and non-discrimination. Some DPAs wished
to reconsider the categories of sensitive data by possibly moving towards a
definition of the content which might be considered sensitive instead of
prescribing an exhaustive list of sensitive data. A more radical proposal consisted
of eliminating the general prohibition to process sensitive data and foreseeing
instead a special obligation to ensure appropriate safeguards for such
processing. Some public research institutions touched upon the need for further
clarification and harmonisation of the existing definitions, especially the
concepts of personal data, anonymous data and encoded data.

DPAs insisted
on the need for coherent enforcement mechanisms in order to ensure the coherent
application of data protection rules. Some pointed out the need to make use of
existing rules and strenghen self-regulation or self-enforcement. Indeed, a
number of public authorities argued that the issue at hand is less the
strenghening of rights but rather the proper application of the existing Directive.
Other stakeholders, including business assocations, consider that in order to
reach greater coherence of the data protection legal framework, an obligation
of mutual recognition of the national data protection regimes between Member
States should be introduced.

According to some public authorities and
citizens more competition between internet providers, and hence less dependency
on providers with a dominant market share, could strengthen internet users’
self-determination and exercise of their rights. Currently, some services
depend on a specific platform or there is no data portability (possibility for
individuals to take their data with them when they move from one (social)
network to another).

Some DPAs felt the need to shift the focus
of regulation from all data processing operations to risky data processing in
order to take into account today's technological reality. Accordingly, rules
for daily, harmless data processing (such as processing of an unstructured
documents like ordinary email or publication of personal data in running text
on the internet) should be simplified, by permitting such processing without
any additional requirements, unless it leads to an inappropriate encroachment
of the individual's privacy. The focus on the areas which involve specific
risks would increase respect and compliance with the regulation.

In this
context, some stakeholders expect the new legal framework to explicitly state
that the right to data protection will sometimes need to be balanced with other
equally important fundamental rights.

1.2.        Increasing transparency
for data subjects

The Commission will consider:

- introducing a general principle of transparent processing
of personal data in the legal framework;

- introducing specific obligations for data controllers on
the type of information to be provided and on the modalities for
providing it, including in relation to children;

- drawing up one or more EU standard forms (‘privacy
information notices’) to be used by data controllers.

Transparency

Stakeholders
generally agree on the importance of the principle of transparent processing.
Many respondents, in particular businesses, noted that the notion of
transparency is already an integral part of the present legal framework through
Articles 10, 11, 12, 15 and 6.1(a) of the Directive. While some respondents
argue that an inclusion of an explicit transparency principle would increase
legal certainty, others consider it more important to reinforce the existing
provisions.

One citizen
proposed a standard obligation whereby (online) companies should once a year
send an e-mail summary of all personal information held linked to a given e-mail
address. Another citizen proposed creating a special icon on internet browser
screens to inform individuals about the data processing (e.g. profiling,
behavioral advertising), indicate the type of information collected and the
identity of the processor. A similar suggestion is submitted by a group of
privacy experts. This system would enable consumers to know about the processing
of their data and give a meaningful consent prior to the collection of tracked
data.

Children

Citizens are
generally very concerned about privacy risks entailed by childrens' online
activities and support age verification and other controls or additional
protection mechanisms. Several stakeholders insisted on clearly defining what a
child is (age) and establishing specific requirements for the processing of
children's personal data. One NGO argued that children should be able to
exercise their own privacy rights (distinct from their parents) and that
privacy notices and consent forms should to be adapted to the level of
awareness of the child.

DPAs and civil
society organisations strongly agree that more consideration should be given to
privacy-related children's issues. Some support additional legal provisions
related to requirements for information provided to children, protection from
behavioral advertising, categories of data which can never be collected, age
treshhold, parental consent to be included in the revised legal instrument. By
contrast, some others – pointing to the diverse rules for defining a child
across the EU, different levels of maturity and understanding of children of
the same age, as well as practical difficulties related to age verification and
mechanisms for obtaining consent – do not support detailed provisions on
children. Several respondents indicated that a gradual approach regarding the
responsibility of the child should be taken based on different national age
limits for criminal, administrative and civil responsibility.

Though some
restrictions may be needed for children especially regarding sharing of
information online and exposure to behavioural advertising, some contributors
argued that teenagers sometimes have a better understanding of online privacy challenges
than their parents.

Privacy information notices

Some
organisations, in particular large companies, support a standard EU form as a
practical means to inform stakeholders, while others would prefer general guidance
based on best practices. Organisations that support the introduction of EU
standard forms argue that the varying requirements across the EU regarding
privacy notices create administrative burden for data controllers and little
added value for consumers.

Public
authorities endorse the Commission’s view that transparent processing requires
the availability to data subjects of clear, easy to understand privacy
information notices. However, some authorities are not convinced that EU
standard forms are the best way to meet this need due to the specificity of the
context and possible particular needs of the data subjects at whom they are
aimed. Therefore, some institutions propose to develop forms of general nature
or forms which serve as recommendations or guidelines.

The Commission will:

- examine the modalities for the introduction in the general legal
framework of a general personal data breach notification, including the
addressees of such notifications and the criteria for triggering the obligation
to notify.

Data breach
notifications

There is
general support that data breach notifications need to be extended beyond the
Telecom sector and the e-Privacy Directive, especially from public authorities.
Data breach notifications are seen as a key element of transparency and
accountability. Information is crucial for the
individual to exercise his or her rights, for instance to claim financial
compensation.

As far as the
thresholds are concerned, respondents argue that a pragmatic approach should be
foreseen, lessons from the experiences of the telecom sector should be drawn
and overnotification should be avoided, in the interest of both businesses and
data protection authorities. Some contributions highlight that data breaches in
the public sector should be covered, as well as data breaches occuring in
foreign countries, when they impact EU citizens.

Industry argues
that no administrative burden should be created for riskless / insignificant
breaches. For instance, the banking sector argued that data breaches are
already reported on a voluntary basis, where appropriate, and that an
obligatory requirement should be limited to serious cases.

Archives
institutions argue that their special circumstances should be acknowledged;
they consider it impracticable to attempt to ascertain the current contact
details of the very large number (millions) of data subjects featuring in
archives in the event of a data breach.

1.3.        Enhancing control over
one's own data

The Commission will therefore examine ways
of:

- strengthening the principle of data
minimisation;

- improving the modalities for the
actual exercise of the rights of access, rectification, erasure or blocking
of data (e.g., by introducing deadlines for responding to individuals'
requests, by allowing the exercise of rights by electronic means or by
providing that right of access should be ensured free of charge as a
principle);

- clarifying the so-called ‘right to be forgotten’, i.e. the
right of individuals to have their data no longer processed and deleted when they
are no longer needed for legitimate purposes. This is the case, for example,
when processing is based on the person's consent and when he or she withdraws
consent or when the storage period has expired;

- complementing the rights of data subjects by ensuring ’data
portability’, i.e., providing the explicit right for an individual to
withdraw his/her own data (e.g., his/her photos or a list of friends) from an
application or service so that the withdrawn data can be transferred into
another application or service, as far as technically feasible, without
hindrance from the data controllers.

Data minimisation

Many citizens report a widespread practice of
collection of excessive (beyond the specific purpose) personal information on
the internet. They also expect more options to remain anonymous in the virtual
environment.

Public institutions, in
particular DPAs and advisory bodies, agree with the importance of data
minimisation, which can provide effective data protection, guarantee the rights
of data subjects and promote best practise by data controllers. However, some
respondents underlined that the principle should be clearly defined in order to
ensure adequate implementation.

Service
providers and industry noted that data processing can be beneficial to consumers
and in particular business sectors (e.g. finance, insurance) and business models
and therefore, not all the personal data need to be minimised. Some industry
representatives, including trade organisations, considered that the data
minimisation principle is already expressed in the Directive. Some expressed
concerns that the principle of data minimisation might conflict with other
industry legal requirements to retain data for official legally sanctioned
purposes.

Some stakeholders in
the service area (healthcare/advertising) fear that reinforcing data
minimisation rules would lead to further restrictions on secondary use of data,
which could restrict their professional activities. Also some business
stakeholders fear that this would lead to additional costly anonymisation
efforts.

Civil society
organisations argue that the data minimisation principle should become a
cornerstone of any modern approach to data protection. Data controllers should
think in terms of data minimisation at the very beginning of the design of
products and services. Privacy organisations suggested that anonymisation could
help to meet a principle of data minimisation.

Improving the actual exercise of the
rights of access, rectification, erasure or blocking of data

Many citizens consider
that they do not have enough control over their personal data put online. A
number of respondents underlined specific dangers related to the publication of
personal data (in particular pictures) by data subjects themselves - or the
uploading by others of, inter alia, slanderous images and sensitive data
– on social networking sites. They emphasised the necessity to harmonise and
strenghen the right of access to personal data by decreasing the legal
barriers, simplifying compulsory procedures and formalities, facilitating the
determination of applicable law in cross-border cases and strenghening the role
of DPAs.

A number of
other contributors, in particular businesses and public authorities, argued
that rights of access, rectification and erasure or blocking are already part
of the existing legal framework and advocated that further detailing of those
rights in sectoral codes could be more appropriate, so that they can be better
enforced in practice

A group of
academics noted the need to reconcile data subjects' right of access and the
freedom of private communications, citing as an example the personal data
restrictions of university email use. They also encouraged considering a
limitation to the right of access to one's personal data based on the ground of
disproportionate resource burden.

"Right to be
forgotten"

Several
contributors stressed that the "right to be forgotten" and the
existing right to delete one's own personal data are similar. Many
stakeholders, especially technology companies, industry and trade alliances,
service and content providers argued that the right to
be forgotten is already explicitly guaranteed by the principles of purpose and
use limitation and the right to erasure. These stakeholders therefore think
that existing rules in this regard should be implemented better and their
stronger harmonisation across the EU should be reached. Therefore, a
clear distinction between the two rights would have to be made by defining
clear requirements for the rights and specifying against whom the rights may be
enforced. Most businesses also argued that the most
fundamental challenge will be to define a "right to be forgotten"
clearly, since it is not established or widely understood.

Nevertheless,
the right to be forgotten and the possibility to recuperate or delete personal
data uploaded on internet websites was stressed as an absolute necessity by
many citizens. They wished the legal framework to provide for such a
possibility especially as regards under-age internet users.

Industry
alliances, service and content providers and legal and related companies argued
that there should be exceptions to the right in some contexts and situations,
such as preventing fraud or crime or for journalistic purposes. They were
concerned that a right to be forgotten does not add value for businesses or
customers and may cause industry to incur significant cost or administrative
burdens. Service and content providers also noted that a right to be forgotten
could negatively impact the services or products offered to customers. Some
technology companies suggested that anonymisation can replace deletion as a
means of protecting and enhancing this right.

Service and content
providers as well as international justice and trade organisations were also
concerned that a right to be forgotten might conflict with other industry legal
requirements to retain data for official legally sanctioned purposes. Stakeholders
in the healthcare sector mentioned that they are sometimes obliged to keep
patient data for a very long time, for example for the monitoring of
undesirable effects of medicine.

Some stakeholders
highlighted that the right to be forgotten may also mean that consent should
only be given for a reasonable and limited period, and that data should be
deleted after the expiry of such period. Some stakeholders specifically
suggested introducing a mechanism of automatic data deletion after the storage
period ends. Some public authorities and DPAs fear that the right to be
forgotten could have a very limited application in practice and ask for
clarifications on the extent to which this right can be effective and on its
costs. The EDPS suggested that the right to be forgotten might only be a
solution in a digital environment.

Civil society
organisations supported the right to be forgotten. However, they also asked for
clarification as to the meaning and principles associated with a right to be
forgotten and that the right should be of substance rather than a slogan with
no meaningful benefit to customers or industry. Privacy related organisations
noted that alongside the right to be forgotten there is a need to educate and
raise awareness among data subjects that they have such a right which can be
exercised. Consumer organisations noted that there is a need for such a right
to be harmonised across the EU.

Data portability

A number of citizens
have argued that they should be able to retain control over their personal
data, including by moving it from one online application to another. Some
stakeholders consider that data portability is redundant with the existing
right of access. Others doubt its feasibility both in technical terms and as
regards copyright and protection of intellectual property. Online service
providers argued that user data should be clearly distinguished from data
created by the service; in their view only user data could be portable. An
alternative proposal was to introduce in the privacy notice mandatory
information on what data can be retrieved from the online service and make this
a voluntary practice.

1.4.        Raising awareness

The Commission will explore:

- the possibility for co-financing awareness-raising activities
on data protection via the Union budget;

- the need for and the opportunity of including in the legal
framework an obligation to carry out awareness-raising activities in
this area.

Awareness-raising

Some contributors
indicated that the national DPA is the appropriate body to be tasked with
awareness raising activities. Citizens in particular expect national DPAs to
play a greater role in raising awareness of data protection norms amongst
citizens and newly emerging data controllers who often have little knowledge of
data protection compliance.

There are diverging views
on whether an obligation to carry out awareness-raising activities needs to be
included in the legal framework. Some public authorities believe that Member
States should take their own measures and DPAs should be allowed to choose
their own approach. Some others note that awareness-raising is expensive and if
this task is to be given to DPAs, it requires an explicit legal basis.
Moreover, some DPAs suffer from insufficient funding in their Member State and
welcomed any initiatives that would improve their financial situation.

Some contributors
argued that Data Protection should be a mandatory field of study in
universities, for instance in fields of studies where the manipulation of
sensitive data such as health data is inevitable.

1.5.        Ensuring informed and free
consent

The Commission will examine ways of clarifying and strengthening
the rules on consent.

There is a general
consensus among public authorities, DPAs and EDPS on the need to clarify the
notion of consent to avoid the risk of misinterpretation and to apply the rules
uniformly and consistently across the EU. The specific dimension of consent and
the link to the purpose should be maintained. In their view, an opt-in approach
is the most supportive of the right to privacy of data subjects vis-à-vis data
controllers. Some DPAs expressed concern that always requiring explicit consent
may be unworkable and present an undue burden on DPAs in ensuring sector-wide
and industry compliance.

A number of technology companies and
industry alliances expressed support for a clarification of the definition and
the rules around consent, but noted that the changes to consent should not
negativelly impact business and industry. Several business stakeholders
consider that consent may be implied from individuals' behaviour and note that
requiring explicit consent in all circumstances could be detrimental to many
business models and industry procedures. Some argue that a certain degree of
flexibility as regards rules on consent is important in order to take into
account certain business contexts (new business models, new technologies),
social and cultural differences in understanding consent. Some contributors
also highlight that privacy notices are not the best way to secure user's
consent. A shared view among industry is that too much emphasis on consent will
undermine privacy as individuals will become used to always agreeing to a
stated purpose without necessairly understanding what is being asked of them

Civil society
organisations also supported an explicit, informed and opt-in approach to
consent. However, some consumer organisations recognised that consent might be
difficult to achieve and the need to explore the best possible way to ensure
that consumers are aware of the consent they give. A need to raise awareness
amongst consumers, and particularly children, about the consent and its
implications in terms of their personal data was mentioned by many
organisations.

In addition,
some citizens pointed out situations when the data subject is not in a position
to give 'informed' and 'free' consent, such as a situation when the consent
becomes part of a larger transaction or contract, "bundled" with a
service sought by the customer, or the user is refused a service or charged a
higher price unless he consents the processing of personal data or disclosure
of such data to third parties. Some contributors proposed to oblige personal
data controllers, whenever they intend to store or process personal data beyond
the fulfilment of ordinary transactions, to explicitly specify those terms and
conditions pertaining to consumer personal data and its compensation according
to contract law, calling the result a "personal data contract".

Citizens also
mentioned the limited freedom to consent to personal data processing in the
context of employment or unequal professional-consumer relations.

Moreover, many
citizens think that data subjects should be entitled to revoke their consent at
any time and using online channels. The revocation should take effect
immediately and not be circumvented by contract terms, refusal of services or
higher price. Citizens also favoured opt-out by default from direct marketing
services and placing the burden of proof on data controllers in opt-out cases.

1.6.        Protecting sensitive data

The Commission will consider:

- whether other categories of data should be considered as ’sensitive
data’, for example genetic data;

- further clarifying and harmonising the conditions allowing
for the processing of categories of sensitive data.

There is a general consensus on
harmonising the conditions related to the processing of sensitive data across
the EU. Also many stakeholders support including genetic data in the list of
sensitive data to be considered, especially pointing to the possible
discriminatory use of genetic data. However, a big extension of the list is not
favoured, several contributors preferring to stick with a short harmonised list
of prohibited processing, allowing for some contextual exceptions.

Some DPAs instead
suggested putting more emphasis on the risk (e.g. significant damage or stress
for individuals) that particular processing poses in particular circumstances
while assessing sensitivity of personal data. Some public authorities
highlighted that there is sometimes a need to process sensitive data, such as
ethnic data in order to evaluate the benefits of some positive discrimination
policies. Therefore exceptions need to be provided.

The increase in
biometric data is a common worry among citizens and respondents want it to be
addressed in the new legal framework. One citizen underlined the lack of
effective protection of health data in relation to new technologies in the
health sector (e.g. ICT implants).

A group of researchers noted that due to
the broad definition of sensitive data many academic institutions are
restricted in activities thay may carry out as the majority of social
investigations involve the processing of such data. This practise may diminish
academic freedom and result in loss of important forms of knowledge production.

1.7.        Making remedies and
sanctions more effective

The Commission will therefore:

- consider the possibility of extending the
power to bring an action before the national courts to data protection
authorities and to civil society associations, as well as to other
associations representing data subjects' interests;

- assess the need for strengthening the
existing provisions on sanctions, for example by explicitly
including criminal sanctions in case of serious data protection violations, in
order to make them more effective.

Right to bring an action

Some public authorities
and citizens noted that present Directive offers limited help to individuals
whose privacy has been violated and who need to obtain redress.

A fairly large number
of citizens asked to introduce the right of action for consumer and privacy
associations extending injunctions for the protection of consumers' interest to
data protection violations. Collective redress mechanisms empowering groups of
data subjects to combine their claims and bring a single action against data
controllers are supported by the DPAs and the EDPS. As far as civil society
associations are concerned, some contributors fear that 'class action' style of
actions would increase the cost of services.

Some businesses argued
that out of court settlements and mediation by DPAs can be more efficient than
judicial redress.

Citizens emphasised the
need to prohibit disadvantageous treatment of data subjects who exercise their
rights under data protection legislation.

– Powers of DPAs

DPAs are in favor of
strenghtening and harmonising their powers, an idea that is generally welcomed
by citizens and privacy associations, whereas a number of business stakeholders
argued that existing legislation gives sufficient powers to DPAs

Sanctions

Several public
authorities considered that while administrative sanctions such as fines could
be harmonised, they do not support the harmonisation of criminal sanctions as
far as data protection is concerned. Others, however, argued that if the
Commission considers the introduction of criminal sanctions, these should be a
real deterrent to the unlawful trade in personal data and should be applied
also against individuals who act maliciously.

Some DPAs argued that
the cost of reputational damage, is frequently higher than fines for companies.

Citizens
strongly supported a personal data security breach regime with strict
accountability principles and corresponding remedies. Some underlined the
accountability of manufacturers and proposed to introduce the liability for
data safety in defective products as well as liability of data controllers for
data protection breaches independently of their fault or negligence. Others
supported the introduction of heavy criminal sanctions for systematic or
reckless failure to meet the data protection requirements.

According to
some contributors the fines for data protection violations should be determined
according to the scale and nature of the business of the data controller. Many
citizens desired to see a fixed minimum compensation for victims of privacy
violations established in the revised directive.

2.           Enhancing the Internal Market Dimension
of Data Protection

2.1.        Increasing legal certainty
and providing a level playing field for data controllers

The Commission will examine the means to
achieve further harmonisation of data protection rules at EU level.

Most citizens and many private
stakeholders support further EU-level harmonisation of the data protection
rules. Especially businesses operating in a number of Member States called for
harmonised rules, which would simply their operations. Some business
associations called for the mutual recognition of decisions by national DPAs.
Some business argued that harmonisation can only be accepted if it does not
lead to more stringent and burdensome rules. On the other hand, privacy
associations argued that harmonisation and EU level should not lead to an
overall reduction of data protection standards in the EU.

According to one
contributor the revised legislative act should be easier to understand and
avoid excessively complex structure and terminology, as this may affect the
implementation and help in gaining a wider public acceptance.

2.2. Reducing the administrative burden

The Commission will explore different possibilities for the simplification
and harmonisation of the current notification system, including the
possible drawing up of a uniform EU-wide registration form.

Reducing the
administrative burden is welcomed by most organisations and stakeholders,
particularly businesses.

Many DPAs see the
existing notification system as administratively burdensome, requiring
allocation of great resources for its administration and not accompanied by an
equivalent improvement in data protection as notification are not necessarily
useful for the DPAs' supervisory activities. Therefore, the majority of public
authorities support either the elimination or simplification of the current
notification procedure. One of the possible simplification options, proposed by
some contributors, is to change the existing all-encompassing general
notification requirement to a more targeted system.

One DPA noted that
changes in the notification system could adversely impact the current fee-based
funding model (i.e. not funded by their government but through notification
fees paid by data controllers). The elimination of notification requirements is
also strongly supported by a group of academics who perceive the existing
system as entirely disproportionate and serving no useful purpose.

However several
companies indicated to the Commission that third party control and possibly
certification (by the DPA or another independent organisation) is needed
throughout the 'data processing lifecycle' (from the conception to the
deployment, operations and later on dismantling) in order to guarantee a good
level of privacy. They argued that self certification is ineffective, as many
flaws in the data protection design may remain unnoticed.

A comprehensive
approach reviewing the notification of processing and the data breach
notification would be welcomed by most stakeholders. Several stakeholders
insist on the need to fully harmonise and simplify notifications, and introduce
the proposed EU-wide registration system.

2.3.        Clarifying the rules on
applicable law and Member States' responsibility

The Commission will examine how to revise and clarify the
existing provisions on applicable law, including the current determining
criteria, in order to improve legal certainty, clarify Member States'
responsibility for applying data protection rules and ultimately provide for
the same degree of protection of EU data subjects, regardless of the geographic
location of the data controller.

Some contributors proposed to improve the
area of territorial application of the Directive, especially as regards
multinational companies carrying out personal data processing in different
Member States and companies established outside the EU but collecting personal
data from EU citizens on a large scale.

2.4.        Enhancing data
controllers' responsibility

The Commission will examine the following elements to enhance data
controllers' responsibility:

–    making the appointment of an independent Data Protection
Officer mandatory and harmonising the rules related to their tasks and
competences, while reflecting on the appropriate threshold to avoid undue
administrative burdens, particularly on small and micro-enterprises;

–    including in the legal framework an obligation for data
controllers to carry out a data protection impact assessment in specific
cases, for instance, when sensitive data are being processed, or when the type
of processing otherwise involves specific risks, in particular when using
specific technologies, mechanisms or procedures, including profiling or video
surveillance;

–    further promoting the use of PETs and the possibilities for the
concrete implementation of the concept of ‘Privacy by Design’.

– 
Data Protection Officers (DPOs)

There is overall support for
introducing DPOs under certain threshold conditions
among DPAs, public institutions and the EDPS. However, some DPAs noted the
financial and administrative burden associated with mandatory DPOs and called
for research to be conducted into this area seeking to minimise any negative
impacts, especially on SMEs. Other DPAs noted that mandatory DPOs may not
address the problems currently experienced in Europe due to a lack of expertise
and skills as well as the specific nature of the problems.

Industry
organisations and companies in general preferred a voluntary and flexible DPO
system as mandatory DPOs would impose a significant and unwarranted costs on
some companies, particularly SMEs. While some service and content providers
supported the use of DPOs perceiving them as key elements in order to
demonstrate accountability, industry alliances were concerned whether mandatory
DPOs will be more effective than raising awareness and standards for data
protection within organisational structures, procedures and operations. Several
industry representatives, including service and content providers, doubt that
internal DPOs can realistically be independent, given that, as employees of the
company, they have to help it achieve its business goals. Some industry
alliances also worried that requiring mandatory DPOs could be an unwarranted
intrusion into internal company's operations and procedures.

The majority of
civil society organisations expressed the need for the role, duties,
responsibilities and powers of DPOs to be harmonised across the EU as well as
the mandatory requirement being consistently enforced within all Member States.
Both consumer and privacy related organisations called for DPOs powers to be
outlined, specifically to prevent DPOs from being limited to awareness raising
and other education activities within organisations.

– 
Data Protection Impact Assessment (DPIA)

Data protection impact assessments (DPIA) are seen as very useful tools
to reinforce privacy and are supported by many contributors. DPAs supported the
use of DPIAs as these might lead to greater self-regulation in terms of
protecting privacy and data. Furthermore, DPAs suggested that the use of DPIAs
might be incentivised for companies by foregoing other notification
requirements where DPIAs have been conducted and their results made public. A
few contributors however are not yet persuaded of the need to introduce a legal
obligation for all data controllers to conduct data protection impact
assessments, in the absence of a proper assessment of the subsequent benefits
and additional burdens for data controllers and DPAs.

Civil society organisations overwhelmingly supported the use of DPIAs.
They introduced some specific recommendations, for example, DPIAs should be
used where sensitive data is involved and when new databases are created. Many
organisations also noted that mandatory DPIAs might represent undue burdens for
some companies of smaller sizes, and that these difficulties should be taken
into account. Consumer organisations argued that there is a need for DPIAs to
be harmonised across the EU and standardised across business sectors.

A number of responses across the industry, expressed concern about the
costs associated with mandatory DPIA’s for business and industry, in particular
SMEs. Many respondents preferred a voluntary or flexible DPIA system, which
provides incentives and is encouraged by national DPAs. However, some
respondents agreed that a mandatory DPIA might be appropriate in the case of
sensitive data. Some industry respondents suggested that DPIAs should be
considered in tandem with requirements for DPOs.

– 
Privacy by design

Many citizens support
the introduction of the privacy by design principle.

DPAs also explicitly
welcome the promotion of Privacy-enhancing technologies (PETS) and
implementation of the concept of 'privacy by design', which could offer
excellent prospects for strengthening accountability, security and individual
rights. DPAs consider that the principle can be introduced without incurring
any additional burden on the controller as such measures would focus on
pre-establishing safeguards and mechanisms. Germany noted that
privacy-by-design rules are already included in its legislation and argued that
European privacy-by-design rules should not be too detailed to leave sufficient
scope for different situations.

Data protection
institutions from the third countries also strongly support the Commission
communication's approach on 'privacy by design' and consider 'privacy by
design' a significant standard for data protection internationally which will
foster simultaneous protection and innovation.

By contrast, many
stakeholders from the private sector consider privacy by design too vague a
concept and difficult to measure if it has to remain technology neutral,
whereas public administrations generally support it and see it as an
approximation to OECD and APEC principles.

Some stakeholders
underline that they would agree to privacy by design, as long as it is not
understood as 'privacy by default'. Some stakeholders suggested the creation of
some check lists, in order to assess the level of accountability and privacy by
design. These check lists could be made publicly available in a register.

2.5.        Encouraging
self-regulatory initiatives and exploring EU certification schemes

The Commission will:

- examine means of further encouraging self-regulatory
initiatives, including the active promotion of Codes of Conduct;

- explore the feasibility of establishing EU certification
schemes in the field of privacy and data protection.

– 
Self-regulatory initiatives

Many
sectoral private organisations supported the development of self regulatory
initiatives.

The majority of DPAs
referred to the need of encouraging self regulatory initiatives. Some mention
that a self-regulation
system should guarantee the representation of the sector, be credible and ensure that self-regulatory provisions are
up to date and relevant. Internal control of compliance
systems should be introduced, but it should not replace a
possible inspection by a DPA or its sanctioning regime.

– Certification schemes

Certification schemes
are widely supported by the industry, several industrial companies arguing that
products that are awarded a seal should have a faster access to the market, and
that some of the administrative burden should be lifted for those products. The
'Europrise' seal is quoted as a good reference by several stakeholders. More
than one citizen encourage to establish a European sign which could assure data
subjects that data protection was carried out in accordance with the data
protection standards.

A few stakeholders
argued that certification schemes should not be made mandatory, as this would
create additional administrative burden.

3.           Revising
the Data Protection Rules in the Area of Police and Judicial Cooperation in Criminal
Matters

The Commission will, in particular:

- consider the extension of the application of the general data
protection rules to the areas of police and judicial cooperation in criminal
matters, including for processing at domestic level while providing, where
necessary, for harmonised limitations to certain data protection rights
of individuals, e.g., concerning the right of access or to the principle of
transparency;

- examine the need to introduce specific and harmonised
provisions in the new general data protection framework, for example on
data protection regarding the processing of genetic data for criminal
law purposes or distinguishing the various categories of data subjects
(witnesses; suspects etc) in the area of police cooperation and judicial
cooperation in criminal matters;

- launch, in 2011, a consultation of all concerned
stakeholders about the best way to revise the current supervision systems in
the area of police cooperation and judicial cooperation in criminal matters,
in order to ensure effective and consistent data protection supervision on all
Union institutions, bodies, offices and agencies;

- assess the need to align, in the long term, the existing
various sector specific rules adopted at EU level for police and judicial
co-operation in criminal matters in specific instruments, with the new
general legal data protection framework.

There is general support among the DPAs and
pubic institutions for extending data protection rules to the areas of police
and judicial cooperation in criminal matters and for the harmonisation of any
specific provisions considered necessary in this area.

Law enforcement authorities should be
subject to clear rules on the protection of personal data and they should be
broadly comparable to the standards that apply in other sectors. However, as
noted by several DPAs and national public authorities, special rules and
derogations which duly take into account the specificity of the police and
justice sector should be foreseen. Thus, specific needs of law enforcement
authorities should be catered for within the legal framework (e.g. consent is
unlikely to be readily forthcoming from those engaged in criminal activities).

As regards harmonised limitations on
data protection rights of individuals, they have to be necessary, proportionate
and not change the essential elements of the right itself. The EDPS emphasised
that the Directive currently applies to "law enforcement" in various
areas (such as taxation, customs, antifraud) that are not fundamentally
different from many activities in the area of police and criminal justice.

In Eurojust's view, the new instrument
should defined the general principles applying to all sectors while specific
provisions will still be applied to the area of police and judicial cooperation
in criminal matters. Given the specificity and sensitivity of the processing
operations in this area, detailed tailor-made provisions would provide a higher
level of protection than general ones. The exclusion of Eurojust and Europol
from the scope of application of the Framework Decision 2008/977/JHA on Data
Protection should be maintained.

Voices from industry seek clarifications on
how organisations can disclose data without breaching data protection
obligations where data are requested from international or national law
enforcement authorities. Moreover, clarity is needed both on the applicable law
and jurisdiction question as well as on the process of responding to requests
received from law enforcement authorities.

Some contributions argue that the EU should
not introduce data protection safeguards that are so restrictive that they
might stop law enforcement authorities from protecting the public. On the other
hand, specific safeguards should be put in place in order to give data subjects
additional protection in an area where the processing of personal data may be
more intrusive. This is well ilustrated by citizens' replies who are worried
about the amount of data collected by the police and law enforcement
authorities and transfers of such data to third countries.

4.           The Global Dimension of Data Protection

4.1.        Clarifying and
simplifying the rules for international data transfers

The Commission intends to examine how:

- to improve and streamline the current procedures for
international data transfers, including legally binding instruments and
‘Binding Corporate Rules’ in order to ensure a more uniform and coherent EU
approach vis-à-vis third countries and international organisations;

- to clarify the Commission’s adequacy procedure and better
specify the criteria and requirements for assessing the level of data
protection in a third country or an international organisation;

- to define core EU data protection elements, which could be
used for all types of international agreements.

Respondents
from all of the different types of industry organisations recommended increased
harmonisation, consistent enforcement and uniform application of data
protection rules. BCRs, notification requirements and other administrative
burdens should be reduced in order to increase competitiveness of European
companies, however these reductions in compliance burdens could be offset by
the creation of new regulations. Despite the concerns about compliance costs,
service and content providers and technology companies all recognised that
strong data protection rules can increase consumer trust and provide a
competitive advantage. Responses
from international trade organisations also argued that a lack of harmonisation
across Member States and globally disrupts business significantly and a
harmonised approach would support competitiveness and benefit all businesses.

Several companies,
industry organisations and service and content providers all note that any
changes to the directive should promote prosperity alongside privacy protection
and recognise that restrictions and administrative burdens could give business
operators based outside the EU serving customers in the EU an unfair advantage
in not complying with the regulations applicable to EU companies. This is
particularly true in relation to developing new technologies or services.

Like industry,
privacy related civil society organisations stated that the EU data protection
framework should be considered in a global context and that the EU should take
a lead in dialogue surrounding cross border data transfers. Privacy
organisations also argued that sanctions should be imposed on organisations
that move data processing across borders in order to avoid the burden or costs
associated with compliance of EU legislation.

– 
Adequacy

Adequacy provisions are considered not
satisfactory currently, as there is a need for clarification and streamlining.
The current mechanisms are deemed to be bureaucratic, impractical, complex and
not related to commercial realities. Cloud computing and the exponential growth
in the use of the internet have moreover changed the nature and dynamics of
international data transfers.

The adequacy procedure
as it is applied nowadays has been more a test of similarity or equivalence
with the EU regime and has caused tensions with other countries whose
enforcement mechanisms will naturally differ.

According to the
responses, the Commission should consider the possibility of granting
sector-specific adequacy determinations, so that data of a certain type
transferred to another country and subject to sector-specific laws or
regulations may be found to be adequately protected.

Adequacy assessments
must focus on the outcomes of the regime being analysed and not on the list of
prescriptive provisions in the legal regime. The procedure should move from
prescriptive rules to a risk-based model of accountability with adequacy of
specific transfers rather than of a country in focus. More attention should be
paid to the competence and adequacy of the body handling data rather than to
the territory where data is held.

A recurring industry
view was that adequacy should be replaced by the extension of the
accountability principle to international data transfers. This would place the
emphasis on both data controllers and processors to ensure that data is
adequately safeguarded regardless of location.

The adequacy procedure
should be more transparent so that businesses can anticipate favourable
determinations and put in place appropriate arrangements in advance. One should
also study the possibility of carrying out sectoral adequacies, for instance to
cover certain part of a third country data protection regime (for instance,
only the banking sector, or only the IT subcontracting sector, for countries
that have sectoral legislation)

According to industry,
controllers (in the context of accountability) should have the flexibility to
make their own adequacy determinations. The revised framework should include
clear criteria for controllers to guide them through this process.

In industry's view data
processors should be reflected in the proposal – a processor that acts on
behalf of a controller should not be treated as a third party (of course if a
processor applies EU rules for data protection). As well, contractual options
should allow transfers from data processors to sub-processors, provided that
their obligations under the Directive are passed on in contract.

Representatives
of the academic community also supported a much more flexible approach and
proposed to implement a risk-based model which would be built on data
controller's obligation to evaluate all relevant factors (e.g. the nature of
the data, how long the data will be in the third country, whether the data will
remain under the control of the data controller etc.). In this case they accept
that data transfer can take place even in situations where the general legal
regime governing data protection is not similar to that as within the EU, but
reasonably effective in protecting individuals’ core rights and interests.

A citizen
working in the IT field, proposed to introduce a certification scheme as a
measure to comply with adequacy requirements in the context of international
data transfers.

Respondents argued that
any international agreement between EU and a third country should reflect a
high level of data protection.

– 
Binding Corporate Rules (BCRs)

Respondents argued that the authorisation
process for establishing BCRs is currently inefficient: too slow, bureaucratic
and complex. Thus, a clearer, more harmonised approach to BCRs is needed and
direct reference to BCRs should be made in EU legislation. Recognizing BCRs as
a suitable way of providing appropriate protection measures will give BCRs a
status equivalent to standard contractual clauses. However, BCRs should be
better adapted to modern practices (e.g. cloud computing).

BCRs could easily serve as a more flexible
and less formalistic approach to data transfers by means of robust internal
policies and procedures and internal oversight and auditing.  They can
constitute an alternative to adequacy.

In respect of BCRs, the notions of both
"accountability" and "group of companies" were referred to
very often. BCRs provide a good framework for a variety of inter-group
transfers for multinational companies. The prevailing opinion of the industry
is that transfers within the same "group of companies" need to be
radically simplified. They should also apply to data processors when
transferring personal data (such expansion of scope would be beneficial to EU
businesses).

To make BCRs more attractive and effective,
the mutual recognition scheme needs to be expanded to include all MS (for one
single regulatory approval to have effect in EU-27). One stakeholder proposed a
new approach to BCRs – creation of Binding Global Codes (BGCs) for
multinational organisations built on foundation of accountability. They would
take form of a set of binding rules demonstrating compliance with data
protection principles on a worldwide basis. The Code would cover policies,
procedures, technology and human/organisational issues, not just legal
compliance, with clear governance arrangements and identifiable internal
responsibility.

4.2.        Promoting universal
principles

The Commission will:

- continue to promote the development of high legal and technical
standards of data protection in third countries and at international level;

- strive for the principle of reciprocity of protection in
the international actions of the Union and in particular regarding the data
subjects whose data are exported from the EU to third countries;

- enhance its cooperation, to this end, with third countries and
international organisations, such as the OECD, the Council of Europe, the
United Nations, and other regional organisations;

- closely follow up the development of international technical
standards by standardisation organisations such as CEN and ISO, to ensure
that they usefully complement the legal rules and to ensure operational and
effective implementation of the key data protection requirements.

In the majority of
contributions, the Commission was encouraged to continue its work on promoting
development of international data protection standards. However this should not
take form of simply imposing EU standards on third countries. Constructive and
open dialogue is required.

Current revisions of
the EU, Council of Europe, and OECD frameworks should lead to ensure greater
convergence and enhanced protection for individuals.

Modernisation of
cross-border transfer of data between law enforcement authorities constitutes
one of the areas where international standardisation could be beneficial.

A global harmonised
approach towards data protection is deemed indispensable especially bearing in
mind the growing popularity of cloud computing services. Some stakeholders
called for a multilateral binding agreement within the G8 or G20.

There were several
references, especially in contributions from the industry, to the Madrid
resolution as a good step in establishing common standards.

Some contributions
called for capacity building support for third countries to promote the
development of data protection standards.

5.           A Stronger Institutional Arrangement for
Better Enforcement of Data Protection Rules

The Commission will examine:

- how to strengthen, clarify and harmonise the status and the
powers of the national Data Protection Authorities in the new legal
framework, including the full implementation of the concept of ‘complete
independence’;

- ways to improve the cooperation and coordination between Data
Protection Authorities;

- how to ensure a more consistent
application of EU data protection rules across the internal market. This may
include strengthening the role of national data protection supervisors,
better coordinating their work via the Article 29 Working Party (which should
become a more transparent body), and/or creating a mechanism for ensuring
consistency in the internal market under the authority of the European
Commission.

The majority of views are that the
coordination between DPAs should be enhanced in order to achieve a harmonised
approach within the EU. Some emphasise that the role and competences of DPAs
should be clarified and harmonised across the EU. Strengthening DPAs' powers
should imply being able to bring actions before court and have the power to
impose sanctions on controllers.

Only few contributions suggested that there
is no need for strengthening the DPAs as they have already sufficient powers.
Instead the enforcement of provisions by them should be improved.

In addition, a wish for the enhanced
cooperation not only between DPAs but also between DPAs and market regulatory
authorities at Member States and EU level, for instance between the Art.29 WP
and ENISA was expressed. The role of ENISA as far as data protection is
concerned should also be clarified.

As regards the full implementation of the
concept of ‘complete independence’, the German Federal Government noted that
Member States should be provided a way to reconcile the concept of ‘complete
independence’ for data protection supervision with their constitutional
traditions. On the other hand, the EDPS referred to the decision in Case
C-518/07 and insisted on the need to clarify the notion of independence
of DPAs and suggested to codify explicitly the elements of the 'absence of any
external influence' and 'instructions from anybody' in the new legal
instrument.

The role of Art.29 WP in this respect in
clarifying DP norms and standards is generally perceived as vital. Many
respondents (especially from industry) argue that Art.29WP should be more
engaged with stakeholders from public, private and NGO sector through
consultations before it reaches the decision or publish an opinion. There are
many calls for greater transparency of Art.29 WP activities. Some private
stakeholders and organisations support a single point of contact at EU level.

In order to make opinions of the Art.29 WP
more authoritative the EDPS recommended to include an obligation for the DPAs
and the Commission to take "utmost account" of opinions and common
positions adopted by the Art.29 WP, based on the model adopted for the
positions of the Body of European Regulators for Electronic Communications in
the Regulation No. 1211/2009. Furthermore, according to the EDPS proposal the
new legal instrument could give the Art.29 WP the explicit task to adopt
“interpretative recommendations”.

The EDPS underlined a need to preserve and
maybe improve coordination between the Art.29 WP and the EDPS, to make sure
that they work together on the main data protection issues, for instance by
coordinating agendas on a regular basis and by ensuring transparency on issues
which have a more national or specific EU aspect.

ANNEX 5

Detailed Analysis of Impacts

1........... Policy
Option 1: Soft action. 2

1.1.1..... 1.1.
Problem 1: Barriers for business and public authorities due to fragmentation,
legal uncertainty and inconsistent enforcement 2

1.1.2..... 1.2.
Problem 2: Difficulties for individuals to stay in control of their personal
data. 6

1.1.3..... 2. POLICY OPTION 2 - Modernised legal framework.. 7

1.1.4..... 2.1
PROBLEM 1 - Barriers for business and public authorities due to fragmentation,
legal uncertainty and inconsistent enforcement 7

1.1.5..... 2.2.
Problem 2: Difficulties for individuals to stay in control of their personal
data. 15

1.1.6..... 2.3.
Problem 3: Inconsistencies and gaps in the protection of personal data in the
field of police and judicial cooperation in criminal matters. 21

1.1.7..... 3. Policy option 3: Detailed Legal Rules at EU level.. 22

1.1.8..... 3.1.
Problem 1: Barriers for business and public authorities due to fragmentation,
legal uncertainty and inconsistent enforcement 22

1.1.9..... 3.2.
Problem 2: Difficulties for individuals to stay in control of their personal
data. 24

1.1.10... 3.3. Problem 3: Inconsistencies and gaps in the protection of
personal data in the field of police and judicial cooperation in criminal
matters. 26

14. 
Policy Option 1: Soft action 
14.1.1. 
1.1. Problem
1: Barriers for business and public authorities due to fragmentation, legal
uncertainty and inconsistent enforcement

(see section 6.1.1, a) and c) of the Impact
Assessment)

1) 
Adoption of interpretative
Communications by the Commission in order to clarify the existing rules

The Commission would issue Communications
to add more clarity on the interpretation of the provisions of the data
protection instruments. While these Communications would not have a legally
binding value, they would provide an authoritative and consistent interpretation
of EU law, providing more clarity for both Member States and other stakeholders
(data controllers, individuals) on key provisions of the Directive. However,
the current practice with (non-binding) Article 29 opinions on various aspects
of the Directive has shown that the impact of such soft law on Member States' -
and DPAs' – practice is quite limited. Furthermore, it needs to be taken into
account that a Commission interpretation is not binding for the courts and that
national courts and the ECJ in particular may come to different conclusions than
the Commission. Therefore, interpretative Communications cannot sufficiently
address the problem linked to the lack of legal certainty.

2) Further encouraging self/co-regulation

The
Inter-Institutional Agreement on Better Law Making of 2003 (IIA) between the
Commission and the legislator provides for the use of self- and co-regulation
as alternatives to EU legislation and lays down criteria and principles to
apply regarding these instruments. The Data Protection Directive provides for
self-regulation by explicitly encouraging the creation of codes of conduct and
the assessment of their legal compliance and their endorsement by supervisory
authorities at national level or by the Article 29 Working Party at EU level.
This procedure incorporates elements of co-regulation within the meaning of the
IIA.

Since the entry
into force of the Directive, the possibility to have codes endorsed by the
Article 29 Working Party has been used in a very limited number of cases[253].
In a fast moving economic and technological environment, there could be an
opportunity for self regulation to become a more meaningful and useful
instrument, so that the encouragement for EU level self regulation should be
assessed. In 2008, the Commission published a study on self regulation, which
provided recommendations and a check list for self regulation initiatives based
on a screening of 61 self- and co-regulation initiatives in SANCO policy areas[254].

A successful
self-regulation or co-regulation process is not necessarily of shorter duration
than a legislative procedure. This is due to the fact that a meaningful
agreement must achieve a balance of all relevant interests as must the ordinary
legislative procedure, however, the actors in self-regulation are not subject
to a similar mandate as the EU legislator and are not subject to similar time
constraints and procedural deadlines.

A self- or
co-regulation procedure draws less on the resources of the institutions than a
legislative initiative; it can be launched much faster than a legislative
initiative, focus much more narrowly and provide much more precise rules than
legislation, so that in the end it can make a considerable contribution to
improving legal certainty for economic operators and more effectively
protecting individuals' rights with respect to those activities and actors
within its scope. It also may engage stakeholders more than the legislative
procedure and may create a higher level of awareness due to their active
participation in the process

Effectiveness
requires that such codes are monitored systematically and equipped with an
enforcement mechanism which includes statutory enforcement of the underlying
legislation as the last resort.

Self regulation at EU level can only work
properly when all participating actors have a common legal basis. Divergences
in implementation and application of legal provisions between Member States
make EU level codes of conduct unworkable or reduce their scope considerably.
National level self regulation can only have limited effect for the EU Single
Market as they cannot address cross-border issues; and in some cases it could
contribute to making cross-border activities more difficult when national codes
differ in substance. Stronger harmonisation of legal implementation and
application of data protection rules may therefore be the key factor to
increase the effect of self-regulation and lead to a broader use of this
instrument in the data protection domain, but self regulation cannot address
the lack of harmonisation itself.

All in all, self-regulation at EU level, if
it is accepted by all stakeholders and recognized by the competent authorities,
may increase legal certainty and practical harmonisation for all stakeholders,
but it can achieve this effect only when a clear and harmonised legal framework
serves as a basis. It cannot, by itself, overcome fragmentation of national
transposition, as evidenced by the current situation.

3) Standardisation

Standards developed by recognized
standardisation bodies and addressing technological and organisational aspects of
data protection could provide practical guidance for data controllers on
setting up data protection compliant practices in their organisations. The well
developed system of security standards and existing sectoral standards for
privacy demonstrate the feasibility and the benefits of this approach. The
standardisation process allows for the involvement of all relevant stakeholders
and participation of DPAs, so that a broad reflection of all relevant views can
be expected.

Nevertheless, successful EU level
standardisation requires that legal requirements are clear and consistent.
Standardisation cannot solve by itself obstacles created by divergent
requirements in Member States.

4) Interpretative Clarification regarding DPA powers, resources and
independence

Considerable divergences exist with respect
to the powers actually entrusted to DPAs for investigation and intervention, as
well as their available resources. The Commission could spell out in more
detail the requirements resulting from the current framework. Independence of
DPAs is already enshrined in the current Directive and the recent ECJ case-law
on the matter (case C-518/07) has clarified the requirements to ensure full
independence. The strengthening of DPAs independence would allow them to better
play their role in supervising data protection legislation at national level,
and decide autonomously their enforcement priorities. A Communication could
outline the Commission's plans on how to ensure that all Member States comply
with the Court's findings on independence and a time schedule.

As regards independence, the legal
conditions have been clarified by the Court and provide the Commission with a
basis to assess DPA independence in all Member States and use its instruments
to ensure full compliance of all Member States. More concrete information would
help the Member States to prepare any adjustments of their national laws where
necessary.

As regards DPA powers and resources, an
interpretative Communication by the Commission is not likely to have strong
effect on national transposition legislation. Member States generally consider
it necessary to adapt enforcement and monitoring systems to the overall
structure of their legal, administrative and enforcement environment where no
precise binding rules are provided by the Union acquis. Commission advice
regarding resources allocated to DPAs may not have strong effect, given
budgetary constraints in many Member States.

5) Strengthened coordination tasks for WP29 vis-à-vis national DPAs and
tools

Under this option, the catalogue of tasks
of the WP29 would be extended to include the provision of advice to national
DPAs and the exchange and preparation of best practices.

DPAs would have additional practical IT
tools, to improve the exchange of information, cooperation and mutual
assistance between them. This, together with the strengthened role of WP29 in
providing advice to DPAs and the encouragement of staff exchanges between DPAs,
shoulc help the development of more consistent enforcement practices across the
EU. This would be beneficial to businesses, in particular, but also to
individuals.

The cost of three concrete elements
supporting this enhanced co-operation are assessed below:

· 
The cost of setting an IT system for
collaboration have been estimated to be up to € 2 million one off
costs[255], plus annual running
costs of € 300 000 and additional costs in terms of human resources. The
system would allow the secure exchange of documents between DPAs, and include a
workflow to follow up that documents are reviewed and validated in due time if
required for the cooperation procedures. Before setting up such a system, an in­‑depth
analysis of the reusability of existing systems would need to be made, in order
to minimize both initial and running costs;

· 
A budget for a programme supporting exchange of
experts between DPAs, in order for them to work better in a network and to
reinforce cooperation should also be provided. Depending on the number of
participants, it can be estimated empirically that between € 500,000 and € 1
million per year could be devoted to an exchange program between DPAs (covering
training, travel expenses and daily allowances of staff working in another DPA
than his own).

· 
The Secretariat of the Art. 29 WP would need to
be reinforced to cover the additional work. A 30% increase of the Secretariat
budget to cover the additional workload could be estimated; based on current
costs for the workload of Art 29 WP, this would amount to about € 0.5million.

6) Harmonised notifications forms – Single (online) platform

The setting up of a central platform with
an online form, whereby data controllers submit only one form and mark the
countries they need to notify – as one of the options proposed by the WP29 in
its Advice paper on the matter[256] – would help reducing
and simplifying the administrative formalities and burden linked to
notifications. This would be welcome by Member States, as they could keep their
current – differentiated – regime for notifications and exceptions/derogations.
On the other hand, this option presents several shortcomings.

The setting up of such a platform – be it
by the Commission or by one or several DPAs - would be technically complex and
costly, given the need to take account of the different requirements of the
various Member States. For reference, the Commission has the experience of
setting up information systems which provide for exchange of information
between public authorities; such systems include IMI (internal market
information system), Eurodac, the SIS system (information about wanted
persons), the CPCS system, and the e-justice portal (information about the
judicial system). Costs and implementation times of the systems vary greatly
(time to set up from 18 months to several years, and costs from € 1 million to
multiples of € 10s of millions, depending on the number of authorities
involved, and the volume and complexity of the data). Experience shows that the
complexity and cost of setting up such a system grows especially when the
national laws defining how to collect and process the data in the Member states
are not sufficiently harmonised, which would be the case in policy option 1.

The added value of such considerable
investment would be limited as it would only reduce part of the burden – i.e.,
it would reduce the paper formalities by providing a unique and centralised electronic
interface – while leaving the current differences in substantial requirements
and the related costs unaffected. This solution is unlikely to be perceived by
stakeholders as reducing sufficiently the costs and the administrative burden
linked to notification requirements.

7) Legal amendments clarifying provisions on international transfers

Clarifying and detailing the criteria for
adequacy and providing a clear legal basis for Binding Corporate Rules (BCRs) –
which have developed as a matter of practice, thanks to the input of WP29 - would
bring more legal certainty as regards international transfers and would benefit
data controllers and individuals as well as the third countries concerned.
However, this would not address all issues raised by business stakeholders
about the limits of the current BCRs model, i.e. on the length and complexity
of the procedure, which often requires several authorisations at national level
even when the BCR has been validated by the "lead" DPA.

14.1.2. 
1.2. Problem 2: Difficulties for
individuals to stay in control of their personal data

(see section 6.1.1, b) and c) of the Impact
Assessment)

8) Awareness-raising activities (information to individuals,
particularly children)

The Fundamental Rights and Citizenship
programme will continue to fund awareness-raising activities related to data
protection, targeting children in particular. Current funding (about
€ 800 000 for the period of 2009-2010 under the Fundamental Rights
Programme) could be increased by 25% in order to expand such activities
further.

9) Promotion of PETs, privacy-friendly default settings, uptake of
privacy seals

The EU already promotes and supports the
research and development of privacy enhancing technologies, privacy by design
and privacy by default settings through research priorities in FP 7. More than
13 EU projects related to privacy enabling technologies are currently funded by
the EU budget. An additional call for projects related to security and privacy has
been published in July 2011 with a budget of € 80M[257]. Some additional funding for studies under the Fundamental Rights
Programme could be envisaged to promote specific objectives, such as an
"EU privacy seals for international transfers".

These measures would provide support to
increased application of the principle of "Privacy by Design" in the
industry. As a recent survey carried out by the Commission has shown[258], privacy by
design is favoured by a large majority of the security industry who believes
that it should be a mandatory obligation, 77% of the respondents from the
industry would even favour introducing the privacy by design principle in the
legislation. As regards sector specific trust marks and seals, they are
generally viewed favourably by industry, but would not welcome a horizontal
certification program.

Continuing and strengthening current
support through EU programmes will maintain the current level of engagement of
stakeholders, mainly in research and technological development. However, as the
experience from several years of this support shows, it does not create an
incentive for broad endorsement in business practices when rolling out new
commercial or public services.

10) Introduction of explicit transparency and data minimisation
principles

The introduction of an explicitly stated
transparency principle for the controller - while not adding specific
additional obligations - would build on the existing provisions to provide the
necessary information to the individuals concerned before the processing of
their personal data not only in specific cases, but extend this to processing
in general. This would strengthen the data subjects position as this would
enable him/her to have more and earlier insights into the processing of his or her
personal data provided by the controller in the specific case and lay the
foundation for his or her consent (if and where necessary).

It would equally strengthen the data
controller in relation to the data subject as he would demonstrate upfront to
the data subject his way of processing the personal data in question and
thereby generate the necessary trust. While the implementation by controllers
may generate some initial additional costs, these would be offset by the
potential benefits for the controller controlling data flows and for the
development of e-commerce.

Data minimisation, i.e. processing and
storing only those personal data that are necessary for a legitimate purpose,
is becoming more and more important when technical limitations to storage, processing
and transfer capacity are quickly disappearing, and when at the same time
security risks and data breaches are becoming more prevalent. Security and data
protection experts have underlined that data that is not stored or processed
cannot be misused as a consequence of a breach. The principle is already
provided for by the current provisions; however, it is not always fully
understood how to interpret in practice. An explicit explanation of the
principle in the legal instrument will provide data controllers with more
clarity and improve the protection of individuals; and it will have no effect
on legitimate data processing.

It would strengthen the existing provisions
on data quality, explicitly stressing that data processed should be limited to
the minimum necessary in relation to the purposes for which they are collected
and/or further processed.

Explicit recognition of the principle would
be beneficial to data subjects as they will not be exposed to excessive data
collection, which will better ensure their protection. Also this will limit the
negative impact of data collected while not necessary (e.g., function creep,
reputational risk, aggressive marketing and surveillance). As regards the
impact on data controllers, data minimization requires full understanding of
the data one possesses in order to be able to delete with confidence. Data
minimisation is a sound principle of data management. It helps avoiding data
overflow and mitigates the risks in case of security breaches. Moreover, data
loses its value over time, and it would reduce costs associated with the use of
outdated data and increase compliance with data quality requirements. Finally,
if data subjects do not feel that their data protection right is violated by
excessive collection of data, e.g. for online services, consumer trust will
increase, thereby potentially having a positive effect on the development of
e-commerce.

14.1.3. 
2. POLICY OPTION 2 - Modernised
legal framework
14.1.4. 
2.1 PROBLEM 1 - Barriers for business and
public authorities due to fragmentation, legal uncertainty and inconsistent
enforcement

(see section 6.1.2 of the Impact Assessment)

1) 
Further harmonising the substantive data
protection rules

This would be achieved by a combination of
measures, namely:

a) Clearer and more detailed substantive
provisions

More precise and detailed rules would harmonise
the implementation and application in Member States, thus greatly reducing the
current cost of legal fragmentation (estimated to amount – only in terms of
administrative burden – to almost € 3 billion per annum). These costs
are incurred by economic operators processing personal data several Member
States to which different national rules are applicable.

Replacing the current Directive by a
Regulation or by a maximum harmonisation Directive – together with a clarification of rules on applicable law and
other simplification measures (see below) - would have the effect of
eliminating most, if not all, of these costs and drastically simplifying the
regulatory environment. The resulting economic benefits for the internal market
would be considerable as:

· 
In the short run, economic operators would no
longer be faced with the disincentive of high legal costs when considering
whether to expand their business cross-border. The enhanced legal certainty
could therefore encourage greater cross-border investment within the internal
market and also boost the competitiveness of EU economic operators
internationally.

· 
In the medium-run, more cross-border offers in
the internal market would boost competition within the Member States, increase
consumer choice, and hence put a downward pressure on prices.

· 
In the long-run, savings in legal costs may
result in more funds being devoted by economic operators to research and
development, hence boosting innovation in the internal market

· 
Also in the long-run, the streamlined regulatory
environment with one set of clear and consistent rules applying across the
internal market would make the EU a more attractive place for business, for
multinational companies considering expansion into the EU.

This approach – and particularly the
Regulation option, being directly applicable upon Member States without the
need for transposition into different national laws - is strongly supported by
the great majority of economic operators, which consider it essential to ensure
the desired legal certainty and simplification within the internal market. On
the other side, a Regulation would have an important impact on Member States,
given the fact that most of them have developed an extensive and detailed
national legislation implementing the Directive, covering both the private and
the public sector.

Additionally, entrusting the Commission
with powers to adopt implementing measures or delegated acts in specific
cases would increase consistency of the EU data protection framework. In
particular, detailed harmonised rules could be adopted for specifying technical
aspects that require uniform conditions of implementation (e.g. detailed
security measures in various situations).

The implementing powers to be given by the
legislator to the Commission would follow the rules and general principles
concerning mechanisms for control by the European Parliament and the Member
States of the Commission’s exercise of implementing and powers[259],
thereby guaranteeing for a procedural involvement, whilst leaving the possibility
for the European Parliament or the Council to be able at any time to indicate
to the Commission that, in its view, a draft implementing act exceeds the
implementing powers provided for in the basic act, taking into account their
rights relating to the review of the legality of Union acts.

2) 
Revising the rules on applicable law and
on DPA competence (one single law and "one-stop-shop")

In case of a Directive, the
applicable law would be the law of the Member State of main establishment of
the controller. In case of a Regulation, the EU legal instrument would
be the single and directly applicable law across EU Member States.

In both cases, the clarification and
simplification of rules and criteria on applicable law, would be highly
beneficial to data controllers with several establishments in the EU, as it
would remove conflicts of application, provide more legal certainty and reduce
existing unnecessary costs since the controller would shift from a distributive
application of different national laws to a centralised application of a single
legislation in all Member States[260].

In addition to the single applicable law,
the fact of entrusting one single DPA with the competence to deal with a controller
operating across the EU would respond to the strong demands for simplification
and consistency of the current enforcement system, leading to a "one-stop-shop"
for data controllers and processors. Together with the increased
substantive harmonisation of the rules and the simplification of rules on
applicable law, this would contribute to reducing the costs linked to
fragmentation. Due to the much higher degree of harmonisation of the data
protection rules the effective application of the “main establishment”
principle – both for the applicable law (if it is a Directive) and for DPA
competence - would not result in ‘forum shopping’ in favour of Member States
whose legislation would be considered as less strict in terms of data
protection requirements.

From the point of view of the data subject,
the impact would bring about equally legal certainty as to what rules apply to
the processing of his or her personal data. And in any case, the data subject
would retain the right to complain to a data protection supervisory authority
of his/her choice (e.g. his/her residence). Strengthened administrative
sanctions available to DPAs against non-compliant data controllers will
contribute to ensure that individuals' rights are actually respected and
enforced.

3) 
Replacing notifications with a
generalised basic registration system

A basic registration for all data
controllers would simplify formalities and allow certain DPAs to continue
financing themselves with a fee-based system[261]. However, if
the registration system would be a general requirement and not allow for
derogations of the same level as the current notification rules, it would
impose additional – albeit - reduced administrative burden to data controllers
in those Member States that have made extensive use of the current possibilities
for exemptions and derogations (e.g. Sweden, Germany). On the other hand,
maintaining this kind of margin would again open the possibility of divergence
in Member States, contrary to the main policy objective pursued (i.e.
simplification and reduction of undue administrative burden).

However, it would fall short of the
expectations of the large majority of economic stakeholders for which this
represents an (unnecessary) administrative burden, without providing any actual
added value for the data subject. Indeed, DPAs themselves acknowledged that the
current register – available at DPAs premises on the basis of notifications
received - "is no longer the best and more appropriate way for individuals
to understand what an organisation is doing with their personal data, and who
to contact when things go wrong"[262].

If this system is estimated to cost 50% of
the current costs of notifications to DPAs (including the additional burden in
those Member States that largely exempt from notifications today), then it can
be assumed that its overall cost would amount to approximately €65 million per
annum across the EU.

4) 
Notification of data breaches to DPAs and
individuals

Technical and organisational measures to
ensure the security of the processing of personal data, appropriate to the risk
connected to the processing and taking account of the state of the art and the
cost of the measure, are already a legal obligation for data controllers under
existing legislation, Directive 95/46/EC and Directive 2002/58/EC. Systematic
monitoring and enforcement of these obligations is, however, difficult, as it
would require a thorough assessment of internal conditions and procedures of
the data controller by the enforcement authority. In practice, inadequate security
measures are only discovered in cases where breaches of security occur and come
to the knowledge of the authorities of the public.

In some jurisdictions, obligations to
notify security breaches which compromise personal data have been introduced.
Experience has shown that these obligations have indeed a positive effect on
data security measures taken by data controllers. This is due to a number of
reasons: breach notifications provide a systematic feedback about the actual
risk and the actual weaknesses of existing security measures; they enable
authorities and consumers to assess the relative capabilities of data
controllers with respect to data security; they force data controllers to
assess and understand their own situation regarding security measures. Data
security issues become relevant for the management level of an organisation,
which may be even further encouraged to apply systematic procedures by the
objective to avoid reputational damage in the case of an avoidable breach.

Member State legislators and
administrations have started to implement notification obligations for data
breaches. In order to avoid diverging Member State rules, the Union has to
provide for a harmonised system of breach notifications across the EU. As a
first step, a breach notification obligation was introduced with the review of
the electronic communications framework in the e-Privacy Directive. As
requested by the European Parliament, the current review of the general data
protection framework is now the opportunity to create an all encompassing
obligation to notify personal data breaches.

Under the e-Privacy Directive, all personal
data breaches occurring at providers of electronic communications services have
to be notified to the competent national authority. In addition, breaches that
are likely to adversely affect the privacy or personal data of individuals are
to be notified to these individuals concerned. A recital of the amending
Directive lists cases that are considered examples for creating adverse
effects, i.e. if the breach may lead to identity theft or fraud, physical harm,
significant humiliation or damage to reputation. The Directive empowers the
Commission to adopt implementing measures on the circumstances, format and
procedures of breach notifications in a comitology procedure, including
stakeholder involvement and consultation of ENISA, the EDPS and the Article 29
Working Party.

US experience – as well as the responses
from stakeholders – suggests that the definition of the threshold for
notification to the data subjects is a key factor to determine the immediate
cost impact of breach notification obligations on data controllers, including
the administrative burden. The proper setting of this threshold is also
necessary to achieve the intended effect on improving the protection of
individuals with regard to possible misuse of their personal data. If the
criteria are set too strict and the threshold too high, data subjects may not
be informed about breaches concerning their data and may lose the opportunity to
protect themselves against damaging consequences. If the threshold is set too
low and criteria are too lose, data subjects might receive many notifications
that do not actually require any action from their side. This could lead to a
so-called notification fatigue, with the result that data subjects do not pay
attention to notifications and miss cases that would require action on their
part.

This is why following the same approach as
in the e-Privacy Directive - i.e. defining the core elements of the notification
system and leaving the definition of details on circumstances (including
criteria to assess the likelihood of adverse effects), procedures and formats
to Commission implementing measures, appears as the best solution to ensure
consistency across sectors. When the amendments of the ePrivacy Directive were
discussed, the EU legislator chose this approach as it found that the use of
implementing measures allowed more detailed, precise and flexible rules than
could be integrated in the basic legal act itself. These considerations were
conducted with a broader application than the electronic communications sector
in mind, as the legislator also noticed that data breaches in some other areas,
in particular online business, could result in similar or even more serious
damage than in that sector. An additional advantage of technical implementing
measures would be that they would allow for differentiation of sectors where
appropriate, what would not be possible within the sector agnostic general data
protection instrument. Implementing measures would allow for a comparably fast
and easy way to adjust rules based on experience with first practical
application of breach notification rules in the EU and to ensure that its
practical application can remain in line with technological development.

Notably, the experiences with breach
notifications in the electronic communications sector could be fully exploited
for a more general solution. It results that the approach of leaving the
definition of details regarding circumstances, formats and procedures of
notifications to implementing measures is more effective regarding the
achievement of the political objectives of simplification and improving
individuals' exercise of their rights that the attempt to provide for full details
in the basic act. The approach also allows for better involvement of
stakeholders and better balancing of the different interests at stake.

While the legal instrument should provide
for the possibility of defining details of breach notifications through
implementing measures, it must set certain basic characteristics of the
procedures by itself. It has been suggested in particular that setting a more
precise time frame for a notification could provide more legal clarity to data
controllers and reassure data subjects. While the ePrivacy Directive provides
that notifications should be made without undue delay, a 24-hour deadline to
notify the supervisory authority, where feasible, , from the establishment of
the breach and the identification of who is affected s could be expected to
provide more precision.

The impact of such a concrete deadline
needs to be assessed. Firstly, it needs to be clarified which event should
trigger the start of the time interval. Such an event would be the detection of
the breach by the data controller. To be more precise, it would be the moment
when the data controller records in its files that an event that triggered a
first investigation has been identified as a personal data breach. This event
could be a security breach discovered in-house, or an alert received from an
outside entity. It should be noted that the actual breach itself may have taken
place much earlier, or may have been ongoing for a while before it was
detected. Secondly, it should be considered that a notification is the more
useful the more precise and comprehensive information about the nature of the
breach and the data concerned can be provided. A 'quick and dirty' notification
rushed out to meet a deadline, which then requires updates and corrections will
cause more insecurity concern and loss of confidence of data subjects than it
provides benefits to users. Thirdly, the notification can only be provided if
the individuals concerned and a workable channel for the communication of the
notification have been identified. Fourthly, as already recognized by the
amended ePrivacy Directive, the breach may require additional criminal and
forensic investigations which could be compromised if the general public,
including the perpetrators, receives early information about the detection of
the breach. Any deadline for notifying a breach must in practice consider these
elements and should not create an incentive for the data controller to delay
the recognition and recording of a breach in order to avoid consequences of a
formally delayed notification.

Nevertheless, the legal instrument could
provide the clarification that a first notification of the detection of a
personal data breach should be delivered to the competent authority, where
feasible, within 24 hours after the establishment of the breach, followed where
appropriate by more detailed information as it becomes available. The data
controller shall provide the competent authority on its request with the
precise reasons if the delay exceeds 24 hours. Individuals would only be
notified, without undue delay, where the data breach is likely to adversely
affect the protection of the personal data or privacy of the data subject. This
would ensure that "over-notification" – even when there is no harm to
the individual - is avoided. As regards criteria for determining the
seriousness of a breach, it should be taken into account that quantification is
generally not possible due to the vast differences of breach cases that can
occur. The number of individuals concerned by a breach cannot be used as a
severity criterion, as the possible risk for any individual is not dependent
from the number of others that are concerned by the same incident. In some
circumstances damage may even be ore likely when less individuals are concerned,
e.g. if a hacker obtains only a few credit card records, each one may have a
much higher probability to be used for fraud than when several million records
are stolen.

Annex 9 estimates the cost of this measure
in terms of administrative burden to amount to € 20 million per annum, based on
UK figures and extrapolating from those for the rest of the EU, factoring in a
cost of € 400 per notification.

5) 
Strengthened and simplified rules on
international transfers

Simplifying the rules on international
transfers would generally have a positive impact both on relations with third
countries and on non-EU businesses and will boost the competitiveness of EU
economic operators internationally, as they will find it easier to transfer
personal data outside of the EU. In particular (in addition to measures
foreseen in Policy Option 1, see above):

· 
Giving the Commission a monopoly on adequacy
findings would reduce uncertainty and inconsistency that would arise from
potentially contradictory decisions from Member States, which are both
prejudicial to data controllers;

· 
Abolishing the system of prior authorisations in
Member States when standard tools (e.g. contractual clauses or BCRs) are used,
would also be beneficial to data controllers as it would shorten and simplify
the procedure for authorising a transfer, thus reducing costs;

· 
Extending the use of BCRs to "data
processors and "groups of undertakings", together with the
simplification of the procedure of "mutual recognition" between DPAs,
would extend and facilitate their use, while at the same time ensuring a high
level of data protection. This would considerably reduce the time (currently 6
months to 2 years) and the money spent on – nowadays - long and burdensome procedures
(up to € 1 million for large companies as reported in the course of the public
consultation by some of these companies with BCR experience).

· 
Allowing data controllers, under certain
circumstances, to conduct their own assessment under their responsibility - and
adducing appropriate safeguards - as regards specific transfers will increase
flexibility.

6) 
New governance system – Better monitoring
and enforcement

a) Strengthening national DPAs

The strengthening of DPAs independence
would be highly beneficial to data subjects, as it would help them exercise their
data protection rights: DPAs would have more powers and resources to
investigate complaints, assist individuals in having access to their data etc. Data
controllers are also likely to benefit since DPAs will have more resources to
provide advice and assistance to them.

The harmonisation of tasks and powers of
DPAs is essential to ensure that they can effectively perform their monitoring
and investigation tasks, as well as for the proper working of the cooperation
and consistency mechanism described below.

As regards costs, the requirement of
providing DPAs with sufficient resources to be able to fulfil their tasks would
require additional financial means for some Member States. This additional cost
is difficult to estimate in general, given the current differences in the size,
available resources, means of funding, tasks and powers of national DPAs. It is
likely that the costs will be higher for smaller Member States and/or those
Member States where DPAs have limited resources at the moment, taking into account
that the abolition of notification requirements will freed resources.

Ensuring proper resources for DPAs is also
key to ensure good cooperation between them. Some DPAs face recurrent financial
difficulties, limiting their ability to cooperate with others.

b) Strengthening cooperation and mutual
assistance between DPAs –Mutual recognition of decision and "consistency
mechanism"

Together with the revision of provisions on
applicable law (see above), these measures would further enhance the
internal market dimension of data protection, increase harmonisation and
legal certainty and reduce the current costs linked to fragmentation and
inconsistent enforcement.

As regards the impact on Member States’
data protection authorities, they will no longer have a direct role in cases
where the data controller's main establishment would be in another Member
States and thus outside their direct supervision. However, they would remain
competent to supervise the implementation of the data protection legislation on
the territory of their Member State e.g. to verify and intervene on a
processing operation that is taking place on its territory by a controller with
a main establishment in another Member State. This would have to be done in
close coordination with the supervisory authority in that Member State, which
would take a final decision against the controller. This decision would have to
be enforced by all concerned DPAs on their own territory.

The new cooperation and consistency
mechanism between DPAs will ensure that their concerns are taken into
account as they would be able to intervene in cases concerning their citizens
and or affecting their country. The strengthened role of the Commission would
ensure the overall consistency and compliance with EU rules on data protection.

This mechanism would also entail additional
costs (including administrative burden) for:

· 
National DPAs, as they would need to foresee additional resources to adequately
cooperate and exchange information with other DPAs, in particular to:

· 
Carry out checks, inspections and investigations
as a result of requests from DPAs in other Member States, as part of the mutual
assistance mechanism established;

· 
Have additional staff and mechanisms in place to
investigate enforcement requests from DPAs in other Member States;

· 
enforcement of the decisions taken by DPAs in
other Member States as part of the "one-stop shop" system of
supervision

It is expected that
DPAs will need at minimum 2 or 3 staff members working for the EU cooperation
to ensure a proper functioning of the proposed consistency mechanism. This may
pose problems for the DPAs of small Member States, whose financial and human
resources are already more scarce. On the other hand there is a trade-off, as
parallel procedures by several DPAs will be eliminated by the clear assignment
of a single DPA for the controller. It is difficult to establish the balance
between these effects as this will depend very much on the current size and
resources of DPAs, the cases they will have to be involved in etc.

· 
The EU budget, since additional human, financial and technical resources should
be foreseen to:

a) Handle notifications of cases handled by DPA that have a European
impact.  In other policy areas similar mechanisms (e.g. telecom, technical
standards), require between 15 and 20 staff to handle the notification system
managed by the Commission, together with adequate technical means (databases,
communication system, translations etc). The data protection consistency
mechanism requires resources particularly from the EDPS, which will provide the
secretariat of the European Data Protection Board and operate the IT system
required for quick and standardised communication between national DPAs and the
Board. Together with the general tasks of the board secretariat, these tasks
will require 10 FTE posts (in addition to the EDPB Chair).  Overall, the EDPS
budget will have to be increased by approximately € 3 million on average for
the first six years of operation.

b) Establish an information exchange system to facilitate communication
between DPAs, the Commission and the European Data Protection Board which
will be replacing the WP29.

(see
section 6.1.2, b) of the Impact Assessment)

14.1.5. 
2.2. Problem 2: Difficulties for
individuals to stay in control of their personal data

7) 
Clarifying substantive rules  and key
concepts

a) Definition of personal data (online
identifiers):

A recent study[263]
analysing case law relating specifically to IP addresses found that in the vast
majority of cases analysed the courts had identified these identifiers as
personal data in the cases under decision, by applying the interpretation
provided in recital 26 of the data protection directive on whether or not a
person is identifiable. In 84% of the relevant 48 cases courts considered IP
addresses personal data on the basis that they relate to an identifiable
individual, in particular when the data controller has the intention to
identify the individual, when other data elements were present that made
identification easier or when the court applied a principle of caution
regarding identifiability. The interpretation of identifiability depends to
some extend on how the national legislator has used the explanation provided in
recital 26 in its national legislation. Several Member States have integrated
the explanation of identifiability in the national legislation as part or the
definition of personal data, thus providing a more stringent basis to national
courts than the Directive itself. Differences in national interpretation
regarding online identifiers can accordingly be explained to some degree by
differences in national transposition laws, which also include other
modifications of the definition[264]. By moving the
explanation of the term 'identifiable person' from the recital to a substantive
provision and by further clarifying the related recital, diverging
interpretation will be avoided and more harmonised interpretation ensured.

This will have a beneficial impact on
individuals, which will have enjoyed increased and effective protection of
their personal data across all Member States.

In order to assess the impact of these
clarifications on data controllers, it must be taken into account that no
substantial change of the legal situation is envisaged, but a clarification of
existing rules. Data controllers are not faced with new obligations, but with a
clarification of existing already applicable law. Considering the Article 29 WP
has already for a long time recommended to treat online identifiers as personal
data as concerns the rules applied to their processing[265],
those data controllers who followed this advice would not have to take any
additional measures and would thus not experience any changes of their
processing and not suffer any additional costs of administrative requirements.
This interpretation has recently been confirmed by the ECJ in its ruling of 24
November 2011[266].

b) Definition and modalities of consent

As also pointed out in the opinion adopted
by WP29 on consent, it seems essential to clarify that valid consent requires
the use of mechanisms that leave no doubt of the data subject’s intention to
consent, while making clear that – in the context of the on-line environment -
the use of default options which the data subject is required to modify in
order to reject the processing ('consent based on silence') does not in itself
constitute unambiguous consent. This would give individuals more control over
their own data, whenever processing is based on his/her consent. As regards
impact on data controllers, this would not have a major impact as it solely
clarifies and better spells out the implications of the current Directive in
relation to the conditions for a valid and meaningful consent from the data
subject.

In particular, to the extent that
'explicit' consent would clarify – by replacing "unambiguous" – the
modalities and quality of consent and that it is not intended to extend the
cases and situations where (explicit) consent should be used as a ground for
processing, the impact of this measure on data controllers is not expected to
be major.

The current requirement for unambiguous'
consent has been translated in the various languages quite differently (in some
cases even with the word 'explicit'[267]) and subject to a
variety of interpretations. 'Explicit' consent ensures, on the other hand, that
consent is clearly expressed by the individual concerned – not necessarily and
not solely in writing, it is not the purpose of imposing one specific modality
- where consent is required as a legal ground for processing personal data.
Additional legal certainty would be provided by specifying in a recital that
consent must result at least from a "clear affirmative action" of the
data subject and that data controllers must be "in a position to
demonstrate that consent has been obtained". This is, on substance, in
line with WP29 opinion on consent[268].

Individuals would greatly benefit from the
clarification of consent and from a strengthening of the modalities for
consent, as this would allow them to be more aware that they indeed indicate
their wishes in relation to the processing of their personal data and better
informed about what they are consenting to ‘ex ante’, if consent is required.
They would also be enabled to ask the controller ex-post for a proof of their
consent in cases where they contest having given their consent or the extent of
their consent. Thus the control of the data subject over their own data would
be strengthened.

As regards controllers, this can bring
significant benefits in terms of responsibility and the effective protection of
personal data, as it is made sure that only consent that is construed in a
solid way is taken as such and can be relied upon by controllers. 'Explicit'
consent helps the controller to demonstrate that the individual has given
his/her consent and to comply with their burden of proof. This would enhance
legal certainty also for the controller that he could rely on the individual's
consent has a legal ground for processing his/her personal data.

What is also important to clarify is that
consent cannot be a valid ground for processing when there is a clear imbalance
between the data controller and the data subjects (e.g. in the employment
context).

The administrative burden linked to this
obligation is included in the estimate for measuring the general obligation for
the controller to demonstrate compliance with data protection law (see Annex 9).

c) Data portability

The possibility to move data from one
service provider to another would increase competition in some sectors, e.g.
between social networks, and could also make data protection an element in this
competition, when users decide to move away from a service they do not consider
appropriate in terms of data protection.

Given that the transfer of data about users
is usually already possible through other interfaces, e.g. for third party
application developers or for exchanges with affiliated companies, the costs
for implementation are minimal. In fact, use of existing interfaces for these
purposes may allow the development of portability functions very quickly.

d) "Right to be forgotten"

The clarification of the right to be
forgotten would strengthen users' control on their own data by enabling individuals
to decide whether or not to share personal information as well as to impede the
continued use of their data by data controllers, data processors or third
parties. The adverse effect of data retained and retrieved after a long time has
lapsed (e.g. in employment area, where a prospective employer may be prevented
from hiring someone on the basis of information on political opinions which may
have changed in the meantime) would be avoided.

Therefore, the reinforcement of the right
to be forgotten would greatly benefit the data subjects, especially (but not
exclusively) in online environments, such as social networks or cloud computing
platforms: the data subject's right to remove his/her personal data from such a
service would be more clearly stated in data protection rules.

As far as the data controllers are
concerned, as with data minimisation, the right to be forgotten will avoid the
retention of data that are outdated and often useless for the data controller.
Another advantage is that this will stimulate innovation in this area.

On the other hand, this right, if it is carried
out in an automatic way will imply some technological changes, necessary to
affix an "expiry date" on data or sets of data. This will involve
costs for data controllers.

The "right to be forgotten" will,
however, not apply to activities subject to exemptions and derogations provided
for under the provisions for processing for private purposes ("household
exemption") and under processing for journalistic and literary purposes; it
would therefore be ensured that the right to be forgotten does not affect
freedom of expression and is used by individuals to attempt to alter or
disappear from the public record. The media's role in keeping such public
record will therefore not be affected.

e) Adding genetic data to the category
of sensitive data

The explicit inclusion of genetic data as a
special category of personal data requiring specific safeguards (“sensitive
data”) would bring about an important positive impact for individuals as it
would address the particular concern that genetic data is properly and securely
dealt with in all Member States. Equally, the harmonised approach would bring
about positive impacts for those controllers who process genetic data as they
could enjoy legal certainty for this processing in all Member States.

f) Children data

When services are specifically addressed to
children, the information provided and the tools to control the protection of
personal data must be adapted to the target group's expected capabilities.
Privacy notices that are written for lawyers and complex privacy setting
mechanisms that require deep understanding of the functioning of IT and online
services cannot be considered appropriate. Appropriate information and
mechanisms would greatly improve the possibility for children to exercise their
data protection rights more effectively. The additional burden for data
controllers would be limited if from the very beginning, products and services
are designed to include children-friendly privacy information and settings
("data protection by design"). In relation to rules on consent in the
online environment for children below 13 years – for which parental
authorisation is required – it should be noted that they build on existing US
regulations and practices (see in particular the Children Online Data
Protection Act of 1998) and are not expected to impose undue and unrealistic
burden upon providers of online services and other controllers. This would also
not interfere with Member States' contract laws, which would remain unaffected.
The methods and modalities to obtain verifiable consent would be left to
Commission's implementing measures.

e) Clarification of the rules applying
to data processing by individuals for private purposes:

Under this option, the current
"household exemption" contained in Article 3 (2) first indent of the
Directive would be clarified to exclude purely domestic processing addressed to
a 'definite' number of individuals. This would reduce to zero the burden of
data protection compliance costs when relating to activities which are solely
carried out in the course of private or family life of individuals (which is
not the case with the processing of personal data consisting in publication
publicly available on the internet so that those data are made accessible to an
indefinite number of people).

Article 9 of Directive 95/46/EC, however,
would be reformulated in a way that it would cover all activities which
aim at the disclosure to the public of information, opinions or ideas and
protected by the right to freedom of expression, irrespective of the medium
which is used to transmit them and of the person transmitting them, i.e. not
linking the exceptions and derogations to "journalism" only. Doing so
would bring private individuals engaged or claiming to be engaged in informing
the public online via blogs, YouTube, Twitter, etc. under the scope of Article
9 of Directive 95/46/EC.

Under this solution, the situation of data
subjects would change compared to the current situation. Private individuals
who disclose information, opinions or ideas to the public –  e.g. through
blogs, YouTube or Twitter, protected by the freedom of expression – would be
treated the same way like media professionals which process personal data
“solely for journalistic purposes or the purpose of artistic or literary
expression” and thus have to be exempted by Member States from certain
provisions of data protection requirements if necessary to reconcile the right
to data protection with the rules governing freedom of expression. In contrast
to the current situation following the “Lindqvist” case[269],
data subjects would not be able to rely anymore on the full set of data
protection rights and remedies against private individuals that process their
personal data on the internet accessible by an indefinite number of people. However,
these possible exemptions from data protection laws would not deprive data
subjects from their right to protection of private life. Data subjects will
continue to be able to rely on civil and criminal law remedies developed under
national law to enforce their right to private life against private bloggers,
twitterers, etc.

8) 
Benefits for individuals from
strengthened DPAs and more consistent enforcement

(See above under 2.1)

9) 
Strengthened remedies:

a) role of associations

In those cases where an individual is
affected by an infringement of data protection rules, a considerable number of
other individuals in a similar situation might be equally affected. Actions on
behalf of individuals which might be brought by a representative entity (e.g. ombudsman,
consumer or civil society association), should encourage beneficial remedies
against infringement of the data protection rules, in particular by allowing
savings for the parties involved and increasing the efficiency of both judicial
and out-of-court redress with the supervisory authorities.[270]

b) strengthened sanctions:

Experience in Member States shows that
administrative sanctions, such as fines, serve as an important incentive for
controllers and processors for compliance. Individuals could be ensured that a
data protection violation would not be sanctioned differently from one Member
State to the other. At the same time, further harmonised rules on
administrative sanctions would bring about major benefits for controllers and
processors as these sanctions for breaches of applicable data protection law
within any European jurisdiction would cease to vary depending on the approach
taken by the applicable regulator, and thus, provide for more business
predictability.

10) Introduce a general obligation for data controllers to demonstrate 
compliance with data protection law (including through evidence that data
subjects' consent was sought and obtained wherever necessary, as well as DP
Impact Assessments and Data Protection Officers, where applicable)

Under this option data controllers will be
obliged to demonstrate their compliance with data protection rules in cases of
audit by date protection authorities. Annex 9 estimates the net administrative
burden of this obligation to amount to € 600 million per annum, assuming 100%
compliance by data controllers. The need not to impose an undue burden on SMEs
is taken duly into account when formulating these obligations, in particular in
relation to DPOs and DPIAs, and including in the empowerment of the Commission
to adopt delegated acts where the principle of "think small first" is
integrated.

a) Additional information obligations

The introduction of mandatory information
requirements relating to the quality of information provided to data subjects,
as part of the enhanced transparency, will positively strengthen the
information of data subjects about the processing of personal data relating to
them. This is a pre-condition to give the data subject a say in the processing
of personal data, ‘ex ante’, i.e. prior to processing and for exercising their data
protection rights in general.

For controllers, further information
requirements can bring significant benefits in terms of accountability and the
effective protection of personal data. Though the introduction of further
mandatory information requirements for controllers entails a an additional
administrative burden for data controllers (estimated to be approximately € 180
million per annum in Annex 9, assuming 100% compliance by data controllers),
the cost can be justified in terms of enhanced accountability and compliance
and should be seen in the context of the drastic reduction of other ex-ante
controls from DPAs (e.g. simplification of notifications). This additional
compliance cost must therefore be balanced with the eliminated costs of
notification obligations.

b) More responsibility for processors

New and harmonised provisions which clarify
the legal obligations for the processor, irrespective of the obligations laid down
in the contract or the legal act with the controller, as well as the
application of the “data protection by design” principle, the need for data
protection impact assessments in some cases, and an obligation to cooperate
with supervisory authorities will bring about benefits for the individual, as
this will ensure that outsourcing and delegation by controllers to processors
do not result in lowering the standard of data protection.

While these measures might entail some
initial additional compliance cost for the processors, the cost can be
justified in terms of enhanced accountability and compliance, making it easier
in the long run for controllers to choose a processor providing sufficient
guarantees for processing.

c) DPOs – see detailed assessment in
Annex 6

d)DPIAs –  see detailed assessment in
Annex 6

e) Data protection by design

Data protection by design is a measure
aimed at reducing the risks of infringements of the data protection
legislation. This would not be a requirement targeting designers and developers
but data controllers, which should implement it when defining their data
protection and privacy policies, especially but not solely in the field of
security. It can be estimated to a few percentage points of the total
development cost of the product or service.

It shall also be considered that – as
confirmed by a recent study conducted by the Ponemon Institute[271]
- the cost of compliance is much lower than the cost of non compliance. Recent
incidents, such as a data breaches that occurred in major companies and where
personal data about millions of individuals have been stolen, have shown that
the cost of non compliance, or poor compliance are huge. Data protection by design
can help reducing such risks and thus be beneficial both to the data controller
and the individuals concerned.

No administrative burden would be incurred
by either public authorities or data controllers as a result of the
introduction of the data protection by design principle.

14.1.6. 
2.3. Problem 3: Inconsistencies and gaps
in the protection of personal data in the field of police and judicial
cooperation in criminal matters

Policy Option 2

11) Extending the scope of data protection rules in the area of police cooperation
and judicial cooperation in criminal matters

Measures under
this option would have positive impacts on data protection in the area
of police cooperation and judicial cooperation in criminal matters, both for
individuals and law enforcement authorities, as they would entail:

· 
The elimination of gaps, in particular by the
fact of extending the scope of rules also to 'domestic' data processing, thus ending the artificial and
unpractical distinction between cross-border and non-cross border data processing.
This would be fully in line with Article 16 TFEU;

· 
The extension of general data protection
principles to this area would have a positive impact on the standards of protection, and thus on individuals' data
protection rights, in particular by strengthening the rules on right of access,
transparency  and on purpose limitation;

· 
Benefits for police and judicial authorities due to more legal certainty and
consistency of the rules in this area, which would facilitate exchanges of
personal data between authorities of different Member State.

The additional
specific safeguards to be put in place will be beneficial to data subjects by
giving them additional protection in an area where the processing of personal
data may be more intrusive. The increased harmonisation of the conditions for
access to one's own personal data, or  i or the distinction to be made  between
various categories of data subjects (criminal suspects, victims, witnesses,
etc.) would strenghten data subjects' legal position
vis-à-vis police authorities.

This would have some, but limited impact on
police and criminal authorities in the Member States: today’s data protection
principles, in particular the principle of data quality but also the principle
of necessity and the principle of proportionality, already require a controller
to distinguish between different categories of data subjects, as this is
relevant inter alia for the use and storage of that data. In the police sector,
the distinction between a suspect of a criminal activity and a non-suspect
comes particular to mind as well as a data classification between verified and unverified information.

Moreover,
the exemptions and limitations foreseen to the rights of the data subject (of
information, access etc) allow taking into account the specific needs of law
enforcement authorities, in line with Declaration N° 21.

As
regards international transfers, the increased harmonised approach would
provide additional legal certainty for both individuals and competent
authorities, which is currently lacking[272].

Additional
obligations upon competent authorities – such as the appointment of a DPO –
have been tailored to the nature of the activities of such authorities and are
proportionate to the objective pursued, i.e. to ensure a high level of data protection,
without hindering police activities. As regards the DPO, this function can
easily be performed at central level (central police authority) and is not
meant to impose an undue burden on each police office/department.  .

12) Addressing fragmentation

The increased harmonisation of the rules
and the extension of the scope of the Framework Decision, as described above,
would also reduce fragmentation and increase legal certainty in this area for
both individuals and competent authorities. A certain degree of fragmentation
would nevertheless remain as the other "former third pillar
instruments" are not specifically amended. This would, however, be
counterbalanced by the evaluation to be carried by the Commission that would
help identifying any possible incompatibility and propose amendments where
necessary.

14.1.7. 
3. Policy option 3: Detailed Legal
Rules at EU level
14.1.8. 
3.1. Problem 1: Barriers for business and
public authorities due to fragmentation, legal uncertainty and inconsistent
enforcement

1) 
Increasing harmonisation - Detailed rules
for specific sectors (e.g., employment, health, scientific and historical
research)

By providing for further harmonisation of
rules for specific sectors (health/medical and employment) the internal market
dimension would be further improved and the free flow of data would be
favoured, with more legal certainty and reduced costs for data controllers,
currently exposed to different requirements.

However, a high level of detail and
sectoral specificity would increase the risk of the rules becoming outdated and
ineffective very quickly in view of rapid technological and economic
development, so that frequent revisions of the instrument would be required to
maintain the effectiveness of the provisions. An approach allowing for more
flexible adaptations, e.g. by implementing acts, could be much more beneficial.

2) 
Abolition of the notification
requirements

The abolition of the general notification
obligations for data controllers would entail a significant reduction of the
current administrative burden for data controllers - particularly those
operating cross-border and hence incurring the cost of notifications in more
than one Member State - and would simplify the regulatory environment, without
having a negative impact in terms of the protection of data subjects, given its
limited added value in that respect. Annex 9 estimates the cost to data
controllers to be EUR 200 per notification. It is estimated that there
are approximately 650,000 notifications in the EU per year, therefore resulting
in an approximate cost of € 130 million per annum, incurred by data
controllers. The abolition of notifications would therefore eliminate these
costs, as well as the costs linked to notification fees (not included in the
calculation of the administrative burden).

There is an almost unanimous support from
stakeholders – particularly economic operators - for radically simplifying the
current system and, in some cases, for abolishing notifications altogether.

This change would have, however, a negative
impact on those DPAs that are funded by the fees to be paid when notifying a
data processing[273].

3) 
Development of an EU-wide
certification/standardisation scheme (privacy seal)

Such a measure could be beneficial for both
controllers, in the EU and in 3rd countries, as it could make their
compliance more 'visible', and for individuals, who would be reassured that
their data are effectively protected.

However, the cost of certifying products by
third parties is high. For instance, in the existing voluntary certification
program Europrise, the cost of certifying a single product or service varies
from 10 man days of work of a data protection expert, for a very simple product
to up to 100 man days of work for complex products or services. Therefore,
making a standardisation scheme mandatory of all processing would have a
significant cost, superior to the existing compliance costs.

4) 
Setting up of a central EU Data
Protection Authority (via a new EU agency) responsible for the supervision of
all data processing with an internal market dimension or with an effect on the
European area of freedom, security and justice

Enforcement would be considerably improved
thanks to the setting up of a pan-European Authority /regulatory Agency
competent to issue binding decisions on Member States. This option would, however,
entail significant costs for the EU budget.

Examining other institutional bodies with a
similar mandate and objective in order to identify comparison benchmarks,
reveals that an EU regulatory Agency would require a substantial budget
allocation, within the range of EUR 7-15 million. In the current economic
climate, such an economic burden is not likely to be welcome by Member States
or the European Parliament.

Indicatively:

· 
The overall 2011 budget for the European Data
Protection Supervisor (EDPS) amounts to EUR 7,6 million

· 
For the EU Fundamental Rights Agency (FRA) the
2008 budget amounted to EUR 15 million (and is expected to reach up to EUR 22
million by 2013) and

· 
For the European Network and Information
Security Agency, EUR 8,1 million for 2011.

In
addition, this could be against EU law as an Agency cannot exercise genuine
discretionary powers.

5) 
Establishing minimum rules with regard to
the definition of criminal offences and sanctions in the area of personal data
protection

EU minimum rules with regard to the
definition of criminal offences and sanctions in the area of personal data
protection, to be implemented by Member States, would foster the confidence of
individuals as regards the processing of their personal data through a more
efficient fight against crimes involving personal data. Such rules would also
lessen the incentive and possibility for criminal controllers or processors to
choose the Member State with the most lenient legal system as a certain
approximation of the national laws prevents the existence of such "safer
havens". Additionally, common rules strengthen mutual trust between the
supervisory authorities, and judiciaries of the Member States. This facilitates
cooperation and mutual recognition of judicial measures. On the other side,
criminal investigations and sanctions may have a significant impact on
individuals' rights and have a 'stigmatising' effect.

However, this would be a very far-reaching
measure – to be based on a specific legal basis (Article 83 TFEU) – that would
encounter strong resistance from Member States.

14.1.9. 
3.2. Problem 2: Difficulties for
individuals to stay in control of their personal data

6) 
Extension of categories of sensitive data
to: children, biometric and financial data

The extension of special categories of “sensitive
data” to those relating to biometric identifiers and of financial data, coupled
with detailed rules on when processing would be lawful, would vigorously
improve the level of protection for those data and this option would have a
very high positive impact. In relation to the rights of the child, this option
would increase the protection of children.

Inclusion of financial data would be more
controversial given its impact on the financial sector, whose processing would
have to be generally adapted to the new data protection requirements.

7) 
Introduction of specific provisions on
online identifiers and geo-location data

Under this PO specific Articles would
regulate a specific regime for online identifiers and geo-location data. While
this could have the advantage of allowing for more flexibility, it would affect
the technological neutrality of the Directive, which would risk of becoming
rapidly obsolete.

8) 
Making (explicit) consent as the primary
legal ground for processing

This measure would sensibly change the
current model in the Directive, based on six different grounds for processing
and where consent does not have a primary role but is just one of them. This
could be justified given that Article 8 of the Charter explicitly mentions only
"consent" (and not other legal grounds).

However, this would create a very rigid
system which would be both very costly for data controllers to use – as they
would be obliged to base their processing more often on consent, and be able to
prove it - and not necessarily in the interest of individuals. An 'abuse' of
consent as a legal ground for processing can, on the contrary, rather lead to a
much poorer quality of it.

9) 
Specific thresholds and criteria for
notifying data breaches to data subjects

This measure would provide more legal
certainty for data controllers. However, it would risk being rejected by
stakeholders if not based on sound evidence and analysis of the implementation
of existing legislation. Reports and studies are being prepared on the implementation
of the e-Privacy Directive, which could be used to define specific obligations
consistently across al sectors.

10) 
Collective redress

Where
breaches of EU law (and in particular, data protection law) harm a large group
of individuals and businesses, individual legal actions are often not an
effective means to stop unlawful practices or to obtain compensation for the
harm caused by these practices: individuals and businesses are often reluctant
to initiate private lawsuits against unlawful practices, in particular if the
individual loss is small in comparison to the costs of litigation. As a result,
continued illegal practices cause significant aggregate loss to individuals and
businesses. In addition, as acknowledged by the Digital Agenda for Europe, enforcement
of EU Law in the Digital Environment appears sometimes to be difficult because
of the lack of clarity on the applicable rights especially for consumers.
Uncertainty and perceived difficulty to access redress is one important factor
undermining confidence and thus constitutes
an obstacle to the development of cross-border electronic commerce. Moreover, where
breaches of EU law do trigger multiple individual lawsuits, the procedural laws
of many Member States often leave the courts ill-equipped to deal with the case
load efficiently and within reasonable delay. This can be true for injunctive
collective redress, but in particular for claims to obtain compensation. For
these reasons, mechanisms of collective redress are being considered in order
to remedy the current shortcomings in the enforcement of EU law[274].

Not only are collective actions important for ensuring full
compensation or other remedial action; they also perform indirectly a
deterrence enhancing function. The risk of incurring expensive collective
damages in such actions would multiply the controllers’ incentives to
effectively ensure compliance. In this regard, an enhanced private enforcement
by means of collective redress mechanisms would complement public enforcement.[275]

Nonetheless, given that the Commission has
conducted a wide public consultation on the issue of collective redress[276]
in order to explore policy options for a coherent European approach and
consider possible further action, it would not be prudent to pre-emptively
introduce provisions relating to collective redress in the data protection
reform package.

14.1.10. 
3.3. Problem 3: Inconsistencies and gaps
in the protection of personal data in the field of police and judicial
cooperation in criminal matters

11) 
More prescriptive and stringent rules

The fact of providing for very prescriptive
rules (i.e. imposing direct access) would not take into account the need to
leave some flexibility to Member States in an area which remains sensitive.
Including biometrics amongst the sensitive data would also be disproportionate
given the needs of law enforcement authorities to use fingerprints etc in their
routine work. Equally, carrying out a DPIA – even if only for processing of
data into large scale systems, when the processing is likely to be risky - would
impose a disproportionate obligation upon police and other law enforcement
authorities – who already act under the legality principle – and  could hinder
the performance of their tasks.

12) 
Maximum coherence and consistency of the
rules in the former third pillar

In addition to measures foreseen in Policy
Option 2 - which are highly beneficial to individuals and enhance data
protection in this area – under this policy option consistency and coherence of
the rules would be maximised by amending other ex-third pillar instruments, to
the extent that they would be incompatible with the new rules.

This would, however, have an important
impact on existing forms of (police and judicial cooperation) as regulated in
the specific instruments that would be affected and should not be attempted
without serious evaluation.

ANNEX 6

Detailed Assessment
of Impacts of the Introduction of

Data Protection
Officers (DPOs) 
and Data Protection Impact Assessments (DPIAs)

15.

Introduction

A central objective of the data protection
reform package is to increase the effectiveness of data protection rights, by
enhancing the responsibility and accountability of data controllers. Two
particular measures included in the preferred policy option which aim to
achieve this objective are the introduction of Data Protection Officers (DPOs)
and Data Protection Impact Assessments (DPIAs).

This Annex provides a detailed analysis of
the expected impacts of new provisions on DPOs and DPIAs. In general terms, the
two proposed changes are expected to have some economic impacts on data
controllers, particularly in terms of compliance costs. For this reason, in the
course of the public consultation some stakeholders were opposed to the
introduction of such obligations. However, while it may be easy to overestimate
the potentially negative cost-related impacts of these measures, the benefits
they can portend if a targeted, threshold-based approach is adopted, should not
be overlooked.

Data Protection Officers

o 
Background

The designation of data protection officers
is an issue on which several stakeholders have provided input in the context of
the public consultation, some highlighting potentially negative impacts in
terms of compliance costs.

Some of the stakeholder responses raised
questions as to which type or size of organisation would have to designate a
data protection officer. Germany already mandates a DPO for organisations with
more than 10 employees. Existing studies point to the fact that larger
corporations, especially multinationals, usually already have data protection
officers. The same is true for many public data controllers in a number of
Member States. The evidence from the German example is that introduction of
DPOs has been successful, due to the development of best practices in specific
sectors and the streamlining of administrative costs due to exemptions from
centralised notification requirements.

Some stakeholders argued that the
requirement to designate DPOs should not be extended to SMEs because of the
costs that would be incurred. Others argued that if DPOs were mandated, then
concessions should be made, specifically to exempt data controllers from some
reporting obligations.

Furthermore, it can be expected that some
organisations, perhaps a majority, will use existing staff to perform the
function of a DPO; they will not recruit additional staff, rather they will
assign an additional responsibility to an existing staff member, especially
where they believe that the DPO function will not require a full-time,
dedicated staff member. Yet other organisations may not seek to designate a DPO
to their respective organisations; instead, they will seek to draw on
independent DPOs who provide services various clients. External contracting of
work related to the responsibilities of a DPO, while still incurring some
costs, might reduce labour and compliance burdens overall.

o 
Envisaged measures in Policy Option 2

Policy Option 2 envisages the introduction
of the mandatory appointment of Data Protection Officers (DPOs) for public
authorities, for companies above 250 employees and those whose core business
involves risky processing. Conditions would be set to ensure the independence
of the DPO from the data controller as regards the performance of his/her
duties and tasks.

It will also be clarified that where the
controller or processor is a public authority or body the DPO can be appointed
for several of its entities, taking account of the organisational structure of
the public authority or body. Even in cases where a DPO is not required, a
register on data processing activities should be kept by the data controller.

It is a reasonable assumption that, as with
other professionally provided services, such as accounting, general legal
advice etc., a rate of € 250 per hour will be an EU average in terms of
employing external contractors to perform DPO-related compliance activities.

As such it is envisaged that most data
controllers – other than larger organisations better equipped or already having
a substantive expenditure on DPOs or employees performing such duties as part
of the normal terms of their employment – will make use of a mixture of means
to ensure compliance with compulsory aspects of the proposed changes to the
data protection regulatory framework in the EU.

These elements could be:

1. Use of existing staff, with training, to perform duties and
responsibilities envisaged for DPOs.

2. Use of external contractors to perform these duties and
responsibilities.

3. Hiring new staff to perform these duties and responsibilities.

The same considerations would apply for the
public sector, especially considering that Policy Option 2 allows the
flexibility of appointing one DPO for several entities within the same
organisational structure.

The benefits of having either a DPO or some
element which will perform the duties and responsibilities for the DPO in a
data controller can be assumed to be the following:

1. Protecting the rights of data subjects and being a conduit between
the data controller and data subjects

2. Reducing compliance and administrative costs

3. Reducing losses associated with data breaches

According to Commission
Recommendation 2003/361/EC, enterprises are distinguished by size according to the
following specific criteria:

Category || Employees || Turnover- or || Balance Sheet Total

Medium sized || <250 || < €50 million || < €43 million

Small || <50 || < €10 million || < €10 million

Micro || <10 || < €2 million || < €2 million

Eurostat figures indicate that the majority
of EU enterprises are small and micro sized enterprises.[277]

|| Total || SMEs || Micros || Small || Medium || Large

Number, millions || 19.65 || 19.60 || 18.04 || 1.35 || .21 || .04

% of total || 100.0 || 99.8 || 91.8 || 6.9 || 1.1 || 0.2

o 
Sub-options as regards the designation of
Data Protection Officers

·

· For public data controllers: a general obligation to
designate a DPO, without exceptions, but with flexibility allowing the
appointment of the same DPO for several entities under the same organisational
structure.

· For private sector data controllers, three sub-options are
considered:

a. Sub-Option
1: DPOs should be designated when processing is carried out by large
enterprises (more than 250 employees) and when processing is likely to present
specific risks to the rights and freedoms of data subjects; OR

b. Sub-Option
2: DPOs should be designated when the processing is likely to present specific
risks to the rights and freedoms of data subjects); OR

c. Sub-Option
3: DPOs should be optional, while providing incentives to data controllers that
do designate a DPO in terms of the supervision they undergo by national
authorities.

·

o 
Expected impacts

The compulsory requirement to designate a
DPO for public authorities would entail a cost for Member States’ public
authorities. It is difficult to estimate such costs given that many public
authorities already have DPOs (this varies between Member States) and that
organisational structure and data processing varies between public authorities.
Moreover, it would be reasonable to expect that the role of DPO would be assume
by existing civil servants in public authorities, who will be suitably trained
to perform the function, and that no additional staff would need to be
recruited. Additionally, the fact that it is possible to appoint a DPO for
several entities of a public administration will limit the burden even further.
Therefore it can be expected that the financial cost of introducing this
obligation would not be disproportionate to the risks involved in the
processing of personal data by public authorities.

As regards the private sector, the impacts
of each sub-option are expected to be the following:

For Sub-Option 1:

· 
The exclusion of economic operators with less
than 250 employees (i.e. excluding all SMEs and micro enterprises) is intended
to facilitate the business environment for comparatively smaller operators by
reducing the burden of data protection compliance costs.

· 
Exempting micro, small and medium sized
enterprises from the provisions would exclude 99.8% of EU enterprises.

· 
In some specific instances enterprises of this
size might however be reasonably assumed to fall under the provisions of this
requirement, where the processing might present specific risks to the rights
and freedoms of data subjects. These might include, for instance:

1. 
High-tech start-up enterprises working in
particular fields, e.g. health.

2. 
Enterprises whose processing of personal data
involves an evaluation of personal aspects relating to the data subject,
including his or her ability, efficiency and conduct;

3. 
Enterprises processing children's, genetic,
biometric, financial or location data

4. 
Enterprises processing data obtained from video
surveillance

In Sub-Options 2 and 3 it can be assumed
that in most cases the larger enterprises’ DPO would have a role in ensuring
compliance with sub-contractors. Assuming that 100% of large enterprises will
be data controllers, this would entail 40,000 large size enterprises having to designate
a DPO. It is reasonable to assume that the vast majority of large organisations
processing personal data already have employees with the responsibilities to
perform the duties of DPOs. From stakeholder feedback during the impact assessment
study the total labour cost associated with recruiting an additional employee
as a full-time DPO was estimated at €80,000 per annum.

Number of large enterprises involved || 40,000

% Rate of DPO designation || 100%

DPO required || 40,000

Total Labour Cost || €3.2 billion (per annum)

This table assumes that all large enterprises
will have to designate a DPO. This would entail a total annual cost of €3.2
billion. However, this probably significantly overstates the outcome since many
enterprises of this size already comply with current data protection
regulations. That being the case, it would be reasonable to assume that a
majority already have DPOs or related staff performing similar duties.

Number of large enterprises involved || 40,000

% Rate of DPO designation || 10%

DPO required || 4,000

Total labour cost || €320 million (per annum)

This table assumes that 90 per cent of
large enterprises already have staff performing comparable duties. For 10 per
cent of enterprises requiring DPOs, the total labour cost would be €320 million
(per annum). However, it would be reasonable to assume that, given the size of
these enterprises, some of this cost would be reduced by re-training and re-skilling
existing employees. It is impossible, however, to determine this with any
degree of certainty.

Similar considerations apply in the case of
enterprises processing personal data falling under categories 1-6 above, as it
would be impossible to determine the number of enterprises that process those
types of data reliable certainty. Some estimates based on simplifying
assumptions are however made below.

In the following tables, it is assumed that

· 
SMEs and micro-sized enterprises will either
train and certify existing staff in performing routine data protection tasks,
or recruit external contractors for that purpose;

· 
Only 50% of SMEs and micro enterprises will be
data controllers;

· 
External contractors charge similar rates to
legal validation rates, which have been determined from stakeholder feedback to
be €250 per hour;

· 
Checking compliance in processing operations
which are likely to present specific risks will take four hours on average for all
enterprises.

Number of enterprises by size || Micro:  9,020,000 || Small: 675,000 || Medium: 105,000 || Totals

% of data controllers || 0.001 || 0.001 || 0.001 ||

Number of data controllers || 9,020 || 675 || 105 || 9800

Risky processing operations, annual number of times || 1 || 1 || 1 || 3

External contractor hours required || 4 || 4 || 4 || 12

Total charges || €1,000 || €1000 || €1000 || €3,000

Total costs for data controllers || €9,020,000 || €675,000 || €105,000 || €9,800,000

This table illustrates that if 0.001% of
small and medium-sized enterprises who are data controllers require validation
in terms of processing risky data, the total cost for each data controller would
be €1,000 with a total cost across the EU of €9,800,000 (per annum).

In examining these figures, it is arguable that
the costs are broadly in line with other external costs facing small and
micro-sized enterprises such as accountancy or IT related fees.

Data Protection Impact Assessments

o 
Background

The obligation for data controllers to
carry out a DPIA when processing operations are likely to present specific
risks  to the rights and freedoms of data subjects will entail some additional
compliance costs (in terms of conducting the DPIA) and administrative burden
(in terms of providing the information to public authorities about the DPIA).

DPIAs, however, have the potential to
simplify data protection processes for data controllers in the medium- to
long-term by ensuring effective compliance with data protection rules. Recent
experience in DPIAs in several Member States and internationally has shown that
this procedure has beneficial effects in terms of rationalising and
streamlining processing operations, and closes potential gaps in compliance and
security.

A DPIA can help in identifying and managing
data protection risks, avoiding unnecessary costs (in terms of problems being
discovered at a later stage), avoiding inadequate data-processing solutions,
improving the security of personal data and most importantly for an economic
operator, avoiding the loss of trust and reputation.

While labour costs for some categories of
data controllers might not increase due to employees with relevant skills and responsibilities
already being in place, with regard to DPIAs, it can be assumed that a broader
range of stakeholders will incur resource costs. While in some Member States,
such as the UK, the use of Privacy Impact Assessments (PIAs) in government
departments and agencies is growing, most Member States and the vast majority
of data controllers have yet to use PIAs or DPIAs. Estimating potential costs
for DPIAs is dependent on a number of contextual factors.

In theory, if a new project, technology,
service, product or any scheme involves the collection and/or processing of
personal data, a DPIA (or, better still, a PIA) would ideally be carried out.
The scale and rigour of the DPIA will depend on how an organisation perceives
the risks and the seriousness with which it tackles those risks. If the risks
are regarded as minimal or negligible, then a small-scale DPIA may be
conducted. If the organisation perceives significant risks, then it would be
advisable to opt for a full-scale DPIA, one that engages stakeholders, with the
aim of identifying all possible risks, assessing those risks and devising
strategies to avoid or mitigate those risks.

The reporting costs of a DPIA would be the
least costly part of a DPIA – the real costs will be in determining whether a
DPIA should be conducted, gathering information about the project, deciding
whether to engage stakeholders (internal and/or external to the organisation),
identifying the risks, assessing the risks, identifying options for avoiding or
mitigating the risks and only then preparing a DPIA report, making
recommendations, following up on those recommendations to ensure they are
actually implemented. There may be additional costs if an external assessor is
brought in to conduct the DPIA. Engaging stakeholders could take several forms
– e.g. an online consultation, briefing meetings, working groups, face-to-face
interviews, etc. Even if a DPIA is conducted without resorting to external
stakeholders, usually there will be several internal stakeholders involved, e.g.
legal staff, project staff, operational staff, procurement staff, perhaps HR
staff, the public relations department, risk managers, internal audit staff,
etc. The amount of time consumed by a DPIA (or PIA) would depend on how serious
the privacy (or data protection) risks are estimated to be, but it could
escalate considerably.

o 
Benefits of conducting a DPIA

Several benefits can be identified for
conducting a DPIA[278]:

· 
A company (or government department) that
undertakes a PIA with good intent, with a genuine interest in engaging
stakeholders, including the public, has an opportunity to earn trust and good
will from individuals-consumers. Businesses able to sustain a high level of
trust and confidence can differentiate themselves from their rivals and thereby
gain a competitive advantage.

· 
If the project does raise difficult issues with
regard to data protection, ideas from stakeholders may be particularly welcome.
Even if stakeholders do not manage to generate some new considerations, the
organisation at least has an opportunity of gaining stakeholders’ understanding
and respect.

· 
Transparency in the process may also be a way of
avoiding liabilities downstream. If the organisation is able to demonstrate
that it did engage and consult with a wide range of stakeholders, was
forthcoming with information, considered different points of view, it will be
more difficult for some stakeholders to claim subsequently that the
organisation was negligent in its undertaking. By being open and transparent
from the outset, the organisation can minimise the risk of negative media
attention.

· 
The New Zealand PIA Handbook describes a privacy
impact assessment as an “early warning system”.  The PIA 'radar screen' can
enable an organisation to spot a privacy problem and take effective
counter-measures before that problem strikes the business as a privacy crisis.
It goes on to say that the PIA process can help the organisation by providing
credible information upon which business decisions can be based and by enabling
organisations to identify and deal with their own problems internally and
proactively rather than awaiting customer complaints, external intervention or
a bad press.

· 
PIA is a form of risk assessment, an integral
part of risk management. It encourages cost-effective solutions, since it is
more cost-effective and efficient to build “privacy by design” into projects,
policies, technologies and other such initiatives at the design phase than
attempt a more costly retrofit after a technology is deployed or a policy
promulgated. A PIA creates an opportunity for organisations to anticipate and
address the likely impacts of new initiatives, to foresee problems and identify
what needs to be done to design in features that minimise any impact on privacy
and/or to find less privacy-intrusive alternatives.

· 
A PIA should also be regarded as a learning
experience, for both the organisation that undertakes the PIA as well as the
stakeholders who are engaged in the process. An open PIA process helps the
public understand what information the organisation is collecting, why the
information is being collected, how the information will be used and shared,
how the information may be accessed, and how it will be securely stored. The
PIA’s educational role is a way of demonstrating that the organisation has
critically analysed how the project will deal with personal data. It might be
the case that certain identified risks on privacy cannot be mitigated and/or
have to be accepted (residual risks); even so, the PIA report, as the result of
a clear and systematic process, is something to which interested parties can
refer and be informed of the reasons why some assumptions were made and
decisions taken. Thus, a PIA promotes a more fully informed decision-making
process.

o 
Expected economic impacts and case studies

As a one-off cost which might be
significant, some organisations, especially smaller ones, might view the
obligation to conduct a DPIA with concern. However, privacy impact assessments
are a growing component of some organisations’ strategic thinking and risk
planning in relation to the development of new products and services. Even
without a provision about DPIA in the new data protection framework, this trend
will continue. The recently approved RFID PIA Framework provides evidence of
this.

The first example below illustrates the
indicative estimated costs of a small-scale DPIA:

DPIA components || Costs in euros || Totals in euros

Labour || €450 x 20 days || €9,000

IT || €1,000 || €1,000

Stakeholder engagement || €1,500 || €1,500

Auditing || €2,500 || €2,500

Total || || €14,000

The example above focuses on a small number
of impacted data subjects utilising a new product offering in one Member State,
involving the automatic processing of personal data. The assumptions made in
this example are as follows:

1. The DPIA takes 20 days to complete at a rate of €450 per day.[279]

2. The data controller conducts a limited exercise with stakeholders –
in this example, one focus group (€1,000) and an online consultation exercise
(€500).

3. There are IT-related costs of €1,000 to analyse the feedback and
data generated during the course of the DPIA. This also includes any costs
associated with disseminating the results of the DPIA.

4. 10 hours of legal validation are needed to audit the results of the
DPIA prior to any reporting obligations or notifications.

The second example below focuses on a
medium-scale DPIA:

DPIA components || Costs in euros || Totals in euros

Labour || €450 x 40 days || 18,000

IT || €1,500 || 1,500

Stakeholder engagement || €10,000 || 10,000

Auditing || €2,500 || 5,000

Total || || €34,500

The assumptions made in this example are as
follows:

1. The DPIA takes 40 days to complete at a rate of €450 per day.[280]

2. The data controller engages stakeholders via a series of eight focus
groups (€8,000) and an extended online consultation exercise (€2,000).

3. There are IT-related costs of €1,500 to analyse feedback and data
generated during the course of the DPIA. This also includes any costs
associated with disseminating the results of the DPIA.

4. 10 hours of legal validation are needed to audit the results of the
DPIA prior to any reporting obligations or notification.

The third example below illustrates a
large-scale DPIA.

DPIA components || Costs in euros || Totals in euros

Labour || €450 x 60 days x 5 Experts || €135,000

IT || €1,500 || €1,500

Stakeholder engagement || €10,000 || €10,000

Auditing || €2,500 || €2,500

Total || || €149,000[281]

The assumptions made in this example are as
follows:

1. The DPIA takes 60 days to complete and involves five experts at a
rate of €450.[282]

2. The data controller engages stakeholders via eight focus groups (at
a cost of €8,000) and an extended online consultation (€2,000).

3. There are IT-related costs of €1,500 to analyse feedback and data
generated during the course of the DPIA. This also includes any costs
associated with disseminating the results of the DPIA.

4. 10 hours of legal validation are needed to audit the results of the
DPIA prior to any reporting obligations or notifications.

Estimating the administrative costs
associated with DPIAs is a difficult task as the nature of DPIAs in and of
themselves will be very context-specific to the size of enterprise needing to
undertake one and the specific nature of the project or technology or service
or other scheme for which the DPIA is to be conducted. Likewise, the main bulk
of costs associated with a DPIA will arguably not be linked with the reporting
obligations of proposed changes; rather the main body of costs will be in the
consultation and identifying, assessing and mitigating risks as well as the
actual work of conducting the DPIA itself.

ANNEX 7

Analysis of the Impacts of Policy Options on
Fundamental Rights

1. 
Policy Option 1:  Soft action

This option would have positive impacts for
the protection of personal data and privacy by clarifying and
promoting the conditions for exercising the existing data subject's rights:

- 
interpretative communications and explicit
references to the transparency and data minimisation principles would increase
legal certainty also in relation to data subjects' rights ;

- 
non-legislative measures would enhance the
effectiveness of individuals' rights, in particular by awareness-raising and
promoting Privacy Enhancing Technologies and voluntary privacy certification
schemes, which would support the application of data protection principles.

However this positive impact will remain
limited, as it aims to make the application of the existing data subjects'
rights more effective, but without adding substantial changes as regards these
rights and their enforcement.

This option will also have a positive
impact in relation to the rights of the child as clearer
information policy and promotion of awareness-raising will contribute to the
protection of children.

2. 
Policy Option 2: Modernised legal
framework

This option has a very positive impact on
the protection of personal data in all its dimensions. In
particular the clarification of the role and conditions of consent will enhance
the data subjects' control over their data. Data subjects' rights would be
significantly strengthened by a detailed set of rules on the data subject
rights, which comprises in particular additional information obligations for
controllers towards the data subject, as a general precondition for exercising
the rights in relation to data protection. Specific rights such as the right
for deletion will be strengthened and clarified ("right to be
forgotten"). Rules on the modalities will facilitate the data subject's
exercising their rights. The specific safeguards on the protection of 'sensitive'
personal data will be extended to genetic data.

A range of further new and clarified
elements would reinforce the effectiveness of the right to protection of
personal data: reducing the fragmentation and increasing legal certainty by
more detailed rules in the legal instrument and implementing acts and strengthened
cooperation between Data Protection Authorities would considerably help to
ensure the same level of data protection and the consistent implementation of
the right to data protection in all MS and towards non EU-controllers and the
effectiveness of enforcement.

The right to respect for private life
would be equally strengthened by the measures to enhance the protection of
individuals' personal data, but also, in addition, as regards the clarification
of the exemption of purely private activities from the application of the data
protection rules.

The clarification of the
rules on 'sensitive' data and its extension to genetic data would also enhance non-discrimination.

The clarification of the application of
rules for children will have a further positive impact on the rights of
the child.

The relation of data protection rules to
the freedom of expression and information will be clarified for
the media, but also for private persons, who (e.g. as bloggers) make personal
data of other accessible for an indefinite number of individuals.

As regards the freedom to conduct a
business there would be, on the one hand, positive impacts by reducing
fragmentation, enhancing legal certainty and simplification (such as by
reducing the notification requirement). - On the other hand; this option
contains also elements which could impact the freedom to conduct a
business negatively. New specific requirements and uniform rules (e.g.
introduction of Data Protection Impact Assessments, reinforced data subject
rights, particularly when using Internet) could limit to a certain extent freedom
to conduct business. However, such limitation does not seem disproportionate,
taking account the positive impacts. This is in particular the case for the
appointment of Data Protection Officers, which will be entrusted with tasks
which would otherwise be carried out by other means, in order to comply with
the data protection rules.

The protection of intellectual
property rights is not impacted by reinforced protection
of data subject rights.

This option would have also a positive
impact on health care, as more uniform rules will be established
for the exceptions to the processing of sensitive data, in particular those
concerning health data.

The right to an effective remedy will
be reinforced by providing access to the courts not only to the individual or
controller or processor concerned, but also by providing the right for
associations to bring an action before the court on behalf of individuals. Also
the right of DPAs to engage in legal proceedings would be clarified.

3. 
Policy Option 3: Detailed legal rules at EU level

As regards the protection of personal
data and privacy this option would have a very high
positive impact. On top of the very positive impact of the measures provided by
Policy Option 2, the data subjects' rights and legal certainty would be further
strengthened by detailed harmonisation in all policy fields.

On freedom to conduct a business,
this option would have a similar impact as Policy Option 2.

In relation to health care, there
would be an increased positive impact as there would be more detailed harmonised
rules on data protection in the health and medical sector.

As regards freedom of expression
and the protection of Intellectual property rights there would be
no additional measures, meaning that the impact would be the same impact as in
Policy Option 2. There would be a higher positive impact on the right to
an effective remedy and to a fair trial thanks to the introduction of
collective actions in this area.

ANNEX 8

Consultation of
SMEs

Introduction

SME panel consultations are regularly
conducted through the Enterprise Europe Network, which is managed by DG
Enterprise and Industry. SMEs in EU Member States are contacted by the regional
associations that constitute the Enterprise Europe Network. Participation in
the consultations is voluntary.

In the context of this impact assessment,
the SME panel was utilised in order to consult SMEs on the data protection
obligations in the baseline scenario. 383 responses were submitted to the
consultation.

Summary
of main findings

The main findings of the SME consultation
are the following:

2.1. Notifications
to DPAs

Nearly one third of the participants (29.2%)
stated that they notify processing of personal data to DPAs. Another third of respondents
(33.2%) stated that their data processing does not need to be notified. The
remainder either stated that they do not process any personal data (21.7%) or
responded "I don’t know / not applicable" (14.4%).

Generally, SMEs responded that they do not
find these notifications particularly difficult, but many find them
bureaucratic (30%), even if they do not notify themselves.

Regarding the financial impact of these
declarations, about 30% of those providing an estimate of costs considered them
to be higher than €500, while about 40% estimated them at less than €100 and
22% between €100 and €300. However, given that 21.5% of consulted stakeholders did
not provided any estimate and most respondents either did not answer this
question or chose "I don’t know / not applicable", these financial
estimates concern only a very limited subset of the panel.

2.2. Privacy Policies on SME Websites

A high percentage of respondents (42.8%)
indicated that their privacy policy does not appear on their website. Slightly
fewer respondents (36.8%) stated that their website does include a privacy
policy.

2.3. Data Protection Officers

Almost half of respondents have some type
of Data Protection Officer, although only few (6%) stated that they employ a
person to deal with data protection issues full-time, whereas most of these
respondents (40%) stated that someone does it alongside other activities.

A smaller share of respondents (38.1%)
stated that there is no person formally assigned in their SME to deal with data
protection issues and the remainder responded "I don’t know / not
applicable".

2.4. Information to data subjects and
its financial impacts

Nearly half (48.6%) of the SMEs have been
providing information to data subjects, as required by data protection laws, but
only 27.4% of responding SMEs always provide this information. More than
21% of respondents stated that they never provide such information and 25%
responded "I don’t know / not applicable".

The financial impact of information to data
subjects appears to be relatively low, since 16.2% of respondents indicated
costs of less than €100 and only about 12% of the respondents indicated costs exceeding
€100 (3.7% indicated costs exceeding €300 and another 3.7% indicated costs
exceeding €500). The majority of respondents (70%) answered "I don’t know
/ not applicable".

2.5. Access of data subjects to their
personal data

The majority of SMEs consulted stated that
they have never received requests from data subjects to access their data
(53.8%). Only a minority declare having received such requests (about 19.3%
rarely and 6.5% frequently).

Regarding the time needed for the SMEs to
respond, only 19.1% are able to roughly quantify it, most of those (11.5% of
total respondents) indicated that it requires less than 1 day of work.

Only very few stakeholders (2.6%) charge a
fee for this access. These fees are generally between €10 and €50 with only one
respondent (0.3%) charging more than €100.

54% of SMEs do not charge a fee for such
requests and 32% answered "I don’t know / not applicable".

2.6. SMEs and legal advice on data
protection

Most of the consulted SMEs (54.3%) have
never sought paid legal advice on data protection issues, whereas 20.4% responded
that they have.

Only 16.5% of respondents were able to
indicate the costs of obtaining these services. These appear to vary somewhat,
with 3.7% of respondents indicating expenses of less than €200, 4.2% indicating
expenses between €201 and €500, 3.9% indicating expenses between €501 and €700
and 4.7% indicating expenses of more than €701.

2.7. Data breaches

Most respondents (71.5%) have never
experienced a data breach. Among the 7.1% of SMEs that state having experienced
breaches, 1.6% related to data being lost, 2.1% stolen and 3.4% misused.

Among those SMEs that experienced breaches,
roughly half (i.e. 3.9% of SMEs consulted) informed the individuals whose data
were affected by breaches, whereas the other half did not. Regarding the cost
of the notification to affected individuals, respondents indicated that the
notification cost: less than €500 (for 1.6% of SMEs consulted), in the range €501-1000
(for 0.5%), in the range €1001-2000 (for 0.8%) and in the range €2001-5000 for
only one single respondent (0.3%).

3.           Detailed Results Per Question

1. In most cases, the processing of personal data needs to be
declared to the National Data Protection Authority. Have you ever declared the
processing of personal data to your national Data Protection Authority (DPA)?

-single
choice reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| No, I don't process any personal data || 83 || (21.7%)

|| No, my processing does not need to be declared || 127 || (33.2%)

|| Yes, I declared processing to my DPA || 112 || (29.2%)

|| Don't know / Not applicable || 55 || (14.4%)

|| N/A || 6 || (1.6%)

|| || ||

2. If you answered yes in question 1, can
you estimate the cost to your company of providing this information to your
national Data Protection Authority?

-single choice reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| Less than €100 || 32 || (8.4%)

|| €101 - €300 || 18 || (4.7%)

|| €301 - €500 ||    8 || (2.1%)

|| More than €500 || 24 || (6.3%)

|| Don't know / not applicable || 145 || (37.9%)

|| N/A || 156 || (40.7%)

|| || ||

|| || ||

|| || ||

3. Which description best reflects the
declaration of data processing to national data protection authorities? [You may select more than one answer]

-single choice reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| Easy || 43 || (11.2%)

|| Difficult || 37 || (9.7%)

|| Bureaucratic || 115 || (30%)

|| Don't know / not applicable || 141 || (36.8%)

|| N/A || 47 || (12.3%)

|| || ||

4. Do you process personal data of individuals residing in
Member States of the European Union (EU) other than your own, or of countries
outside of the EU / European Economic Area (EEA)? [You may select more than
one answer]

-multiple choices reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| Yes, I do process personal data of individuals from Member States other than my own || 92 || (24%)

|| Yes, I do process personal data of individuals from countries outside the EU/EEA (such as the US or countries in Asia, Africa) || 53 || (13.8%)

|| No, I do not process personal data of individuals from outside my own Member State. || 181 || (47.3%)

|| Don't know / not applicable || 94 || (24.5%)

|| || ||

|| || ||

5. Have you experienced difficulties when needing to transfer
personal data to other Member States in the European Union?

-single choice reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| Yes || 19 || (5%)

|| No || 117 || (30.5%)

|| Don't know / not applicable || 202 || (52.7%)

|| N/A || 45 || (11.7%)

|| || ||

6. Have you experienced difficulties when needing to transfer
personal data to countries outside of the European Union?

-single choice reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| Yes || 20 || (5.2%)

|| No || 93 || (24.3%)

|| Don't know / not applicable || 223 || (58.2%)

|| N/A || 47 || (12.3%)

|| || ||

7. If your company has a website, does it include a page
explaining your privacy policy?

-single
choice reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| Yes || 139 || (36.3%)

|| No || 164 || (42.8%)

|| Don't know / not applicable || 64 || (16.7%)

|| N/A || 16 || (4.2%)

|| || ||

8. Is someone in your company formally assigned to deal with
data protection issues?

-single
choice reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| Yes, there is a full time position || 23 || (6%)

|| Yes, someone does it alongside his/her other activities || 155 || (40.5%)

|| No || 146 || (38.1%)

|| Don't know / not applicable || 35 || (9.1%)

|| N/A || 24 || (6.3%)

|| || ||

|| || ||

9. Data protection laws oblige data controllers to provide
information to individuals on whom you hold personal data, known as 'data
subjects',
about the identity of the data controller, the purpose of the processing,
whether it will be passed on to third parties and so forth. Have you ever
provided this information to data subjects?

-single choice reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| Always || 105 || (27.4%)

|| Often || 37 || (9.7%)

|| Sometimes || 44 || (11.5%)

|| Never || 80 || (20.9%)

|| Don't know / not applicable || 96 || (25.1%)

|| N/A || 21 || (5.5%)

|| || ||

10.
If yes in question 9, can you estimate how much it costs your company to provide
this information to individuals every time you need to provide it? (Examples of
such costs may include costs of legal advice, design and printing costs,
clerical costs, administrative overheads etc).

-single choice reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| Less than €100 || 62 || (16.2%)

|| €101 - €300 || 19 || (5%)

|| €301 - €500 || 14 || (3.7%)

|| More than €500 || 14 || (3.7%)

|| Don't know / not applicable || 144 || (37.6%)

|| N/A || 130 || (33.9%)

|| || ||

11.
Individuals are generally entitled to ask for access to their personal data you
hold, for example in order to correct it, to delete it, or simply to obtain a
copy. Have you already had such requests?

-single choice reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| Yes, frequently || 25 || (6.5%)

|| Yes, rarely || 74 || (19.3%)

|| No || 206 || (53.8%)

|| Don't know / not applicable || 54 || (14.1%)

|| N/A || 24 || (6.3%)

|| || ||

12.
If yes in question 11, how long does responding to such requests usually take?  
[Average duration (in
work days)]

-single choice reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| More than 0,5 working day || 44 || (11.5%)

|| 1 working day || 13 || (3.4%)

|| 2 working days || 10 || (2.6%)

|| 3 working days || 6 || (1.6%)

|| Don't know / not applicable || 133 || (34.7%)

|| N/A || 177 || (46.2%)

|| || ||

13.
Do you charge a fee for processing such requests?    -single choice reply- (optional)

|| || Number of Respondents || % of Total Respondents)

|| Yes || 10 || (2.6%)

|| No || 207 || (54%)

|| Don't know / not applicable || 122 || (31.9%)

|| N/A || 44 || (11.5%)

|| || ||

|| || ||

14.
If yes in question 13, how much is the fee?    -single choice reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| Less than €10 || 2 || (0.5%)

|| €10 - €50 || 5 || (1.3%)

|| €51 - €100 || 2 || (0.5%)

|| More than €100 || 1 || (0.3%)

|| Don't know / not applicable || 138 || (36%)

|| N/A || 235 || (61.4%)

|| || ||

|| || ||

15. Have you ever paid for legal advice on data protection
issues, for example on preparing a privacy page on your website or data
protection clauses for a contract?

-single choice reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| Yes || 78 || (20.4%)

|| No || 208 || (54.3%)

|| Don't know / not applicable || 61 || (15.9%)

|| N/A || 36 || (9.4%)

16.
If yes in question 15, how much did this legal advice cost your company?

-single choice reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| Less than €200 || 14 || (3.7%)

|| €201- €500 || 16 || (4.2%)

|| €501 - €700 || 15 || (3.9%)

|| More than €700 || 18 || (4.7%)

|| Don't know / not applicable || 123 || (32.1%)

|| N/A || 197 || (51.4%)

|| || ||

|| || ||

17. Have you had an incident involving personal data (e.g.
personal data held by your company was lost, misplaced or misused during the
incident)                             -single choice reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| Yes, personal data was lost || 6 || (1.6%)

|| Yes, personal data was stolen || 8 || (2.1%)

|| Yes, personal data was misused || 13 || (3.4%)

|| No || 274 || (71.5%)

|| Don't know / not applicable || 48 || (12.5%)

|| N/A || 34 || (8.9%)

|| || ||

18. If yes in question 17, were you able to inform the
individuals whose information was affected when the breach occurred?                                                              -single choice reply-
(optional)

|| || Number of Respondents || % of Total Respondents)

|| Yes || 15 || (3.9%)

|| No || 16 || (4.2%)

|| Don't know / not applicable || 126 || (32.9%)

|| N/A || 226 || (59%)

|| || ||

19. If yes in question 18, can you estimate the total cost to
your company of informing affected individuals about that incident?

-single choice reply- (optional)

|| || Number of Respondents || % of Total Respondents

|| Less than €500 || 6 || (1.6%)

|| €501 - €1000 || 2 || (0.5%)

|| €1001- €2000 || 3 || (0.8%)

|| €2001- €5000 || 1 || (0.3%)

|| €5001- €10000 || 0 || (0%)

|| More than €10000 || 0 || (0%)

|| Don't know / not applicable || 129 || (33.7%)

|| N/A || 242 || (63.2%)

ANNEX 9

Calculation of
Administrative Costs in the Baseline Scenario and Preferred Option

o Introduction

In accordance with the European Commission
Impact Assessment Guidelines (in particular Annex 10 on administrative burden),
this impact assessment closely examined the administrative costs imposed by
existing regulation and by the preferred policy option.

Data sources in this exercise included
EUROSTAT figures, Eurobarometers, qualitative and quantitative data gathered
through a series of public consultations with stakeholders, and desk research. The
analysis of this annex is confined to the costs incurred by the private sector
in order to comply with information obligations contained in the data
protection rules[283]. Other compliance costs
imposed by existing legislation and the preferred option are beyond the scope
of this analysis.

o Methodology

All calculations are carried out using the
Standard Cost Model (SCM). A number of methodological challenges were
encountered in using the SCM in the context of data protection and adapting it
to the particularities of the area. The most significant challenges and caveats
are set out below, along with an explanation of the methodological steps
undertaken:

· 
All costs
included in this calculation are considered to be administrative burdens and not costs that would be
incurred as a result of practices undertaken by an entity even in the absence
of the legislation. For this reason the values in the column "Business as
Usual Costs" are always zero.

· 
Directive
95/46/EC and the
preferred option were thoroughly screened for information obligations on either
enterprises or public authorities.

· 
The
quantitative calculations cover only the private sector; the public sector
is not included in the calculations as no reliable statistics are available
regarding the number of data controllers in the public sector who must comply
with the Directive in the baseline scenario, and subsequently with the
obligations in the preferred option. Framework Decision 2008/977/EC has
also been screened for information obligations that involve administrative
burden on public authorities, but the involved costs were judged to be negligible,
given the wide exemptions in this area as regards, for example, the duty of
informing data subjects  that their personal data is sent cross-border for
processing by other public authorities.

· 
Whenever legal
fees are considered in the calculation an estimate of €250/hour was used,
which represents a conservative average of the varying rates across Member
States. This was confirmed by stakeholder feedback.

· 
Whenever clerical
work is considered in the calculation, an estimate of the cost of a
full-time employee as €50/hour was used.

· 
Regulatory
origin: in the
baseline scenario calculation, all information obligations have an EU
regulatory origin, with the exception of the last row, "National
Transpositions of Directive 95/46/EC". In the preferred option
calculation, all information obligations have an EU regulatory origin.

· 
Recurrence:
all cost
calculations are made on an annual basis. Wherever the value in the
"Frequency per year" column is less than 1, the figure refers to a
multiannual recurrence. For instance, if the figure in the
"Frequency" column is 0.2 the recurrence is on a 5-yearly basis.

· 
Concerning the
total number of data controllers used in the calculation of
administrative burden, in the absence of official statistics on the number of
data controllers in the EU, the eventual estimate used in the SCM is based on
EUROSTAT 2008 figures on the total number of enterprises in the EU. The table
below sets out the reasoning and steps involved in obtaining the total number
of data controllers used in the calculation:

Table 1: Number of enterprises and
data controllers in the EU

Indicator || Ref. year || Source || Value

Number of enterprises in the EU (non-financial business economy): all can potentially be considered data controllers (processing personal data such as employee data, customer databases, etc) || 2008 || EUROSTAT 2008[284] || 21,003,900

Based on the data protection SME Panel (see Annex 9), particularly figures relating to the compliance of SMEs with the current data protection rules[285], it can be assumed that approximately 42% of the total number of companies can be practically considered as data controllers within the meaning of the Directive. This is the approximate total number of enterprises/data controllers on which the  administrative burden of the Directive is actually imposed. || 2010 || Data Protection SME Panel || 8,821,638

· 
Not all data
controllers in the EU are affected by the problem of legal fragmentation.
The data controllers affected would be those that process personal data of
individuals from another Member State, and also have an
establishment in that Member State, within the meaning of Article 4.1 (a) of
the Directive, which allows for a "cumulative" and simultaneous
application of different national laws to a same data controller established in
several Member States. This means that such a controller will have to comply
with the different national laws, obligations and varied requirements that
apply for each of its establishments. It is important to note that the notion
of "establishment", as confirmed by the opinion of the Article 29
Working Party on the issue, has generally been interpreted broadly by DPAs. In
practice even a legal representative, a one-man office or a simple agent in a
Member State are often considered as an "establishment", and thus
lead to the application of the national laws of the Member States concerned.

· 
In order to
obtain the number of entities affected by legal fragmentation, in the
absence of official statistics, the proxy of number of enterprises involved
in cross-border trade was used. These figures were obtained from the 2008[286]
and 2010[287] Eurobarometers on consumer
protection, where 21% and 22% were observed respectively (hence the more
conservative figure of 21% was used). The reason for choosing this proxy is
that an enterprise conducting business cross-border in another Member State,
provided that it is also established in that Member State (within the
meaning of Article 4.1 of the Directive), will be subject to the data
protection law of that Member State. This would in turn entail significant
additional costs in terms of legal adaptation and ensuring compliance with the
data protection laws of that Member State.

Table 2: Methodology for data
controllers affected by legal fragmentation

Indicator || Ref. year || Source || Value

Number of data controllers in the EU || 2010 || Data Protection SME Panel || 8,821,638

No. of B2C service/retail companies selling to final consumers in a country different to their own (21%). || 2008, 2010 || Flash Eurobarometers 224 and 300 || 21%

Total number of data controllers engaged in cross-border  trade || 2008, 2011 || 2008 EUROSTAT figures on enterprises in the EU, Flash EB 300. || 1,852,544

Assuming that only 50% of service /retail companies selling to final consumers in a Member State different to their own are also established in those Member States according to Article 4.1(a) of the Directive (e.g. by having a branch, a legal representative, a commercial agent etc in those Member States) || 926,272

· 
The figure of 926,272
in the table above is obtained by multiplying the total number of data
controllers in the EU (8,821,638), by the percentage of B2C
companies engaged in cross-border trade (21%). It is assumed that the
cross-border indicator of 21% applies also in the case of B2B cross-border
trade. The resulting figure of 1,852,544 is further subtracted by 50% in the
last row of the table to account for those data controllers which may not
actually be established in other Member States, according to Article 4.1(a)
of the Directive.

· 
In the 2010
Eurobarometer 21% of retailers said they also sold to consumers in other EU
countries. More precisely, 2% of retailers reported selling products and
services in just one additional EU country, 6% mentioned two or three other EU
countries and the largest proportion – 13% – was engaged in cross-border sales
in at least four other EU countries.

Table 3: Number of
companies/data controllers active cross border

Total number of data controllers established and processing data cross border || 926,272

% data controllers processing data in one additional MS (2010 EB) || 2% || 88,217

% data controllers processing data in two or three additional MS (2010 EB) || 6% || 264,649

% data controllers processing data in at least four additional MS (2010 EB) || 13% || 573,407

· 
The figures
from Table 3 are used in rows 5, 6, 7 of the administrative burden calculation
spreadsheet.

3.   Detailed explanation of administrative burden calculation

(a)
Baseline Scenario

(i) 
Cost of
information obligations: Line
1 refers to the obligation on data controllers to provide information to data
subjects according to Articles 10 and 11 of Directive 95/46/EC. It is estimated
that 4 hours of legal validation work are required. It is further estimated
that a clerical full-time employee will need to work for two hours to prepare
this material. The costs of reproducing the information material is assumed to
be zero. It is assumed that this is a cost which recurs on a 5-yearly basis, in
order to account for technological lifecycles, which would require adaptations
in the information provided.

(ii) 
Cost of
providing information to data subjects about access rights: Line 2 refers to the obligation on
data controllers to inform data subjects on whether their personal data are
being processed, which data and which categories of data are being processed,
the purposes of the processing, how they are being processed (manually or
automatically), the right to request the rectification, erasure or blocking of
data being processed, and to notify any third parties of any changes to the
personal data requested by the data subject. It is assumed that this task
requires two hours of legal validation (€500) and three hours of clerical work
(€150), and that it is a cost which recurs on a 5-yearly basis, in order to
account for technological lifecycles, which would require adaptations in the
information provided.

(iii) 
Cost of
Notifications of
processing activities by data controllers to national data
protection authorities: based on figures provided by national DPAs in their
2009 Annual Reports, the total number of new notifications in the EU in 2009
were 552,840. This figure was rounded up to 650.000 to account for 5 Member
States that did not submit their statistics (DE, ES, PT, HU and LV). From
stakeholder feedback submitted in public consultations, the cost of each new notification
is estimated at approximately €200 per notification[288],
comprising 4 hours work by a full-time clerical employee. This figure would
include updates of existing notifications as the means of processing may change
over time. As the figure of 650.000 refers to new notifications per year,
the number in the Frequency column is 1.

(iv) 
Prior Checking: This refers to the cost of notifying public authorities about
processing which might present specific risks to the rights and freedoms of
individuals (Article 20 of the Directive). This is estimated to involve 2 hours
of legal validation (€ 500) and 4 hours of clerical work (€200). There were
approximately 15.000 prior checks reported to the Commission for 2009. This
figure was rounded up to 16.000 to account for those Member States that did not
report statistics on this.

(v) 
Baseline
costs of legal fragmentation in the internal market / national transpositions
of Directive 95/46/EC:
the calculation of the costs of legal fragmentation in terms of administrative
burden is based on the following elements:

· 
10 hours of legal validation work to adapt the
business model of the data controller to the data protection requirements of
the additional Member States he is established in (€2,500)

· 
€2,000 for translation costs (e.g. on
information materials for data subjects, privacy policies, etc)

· 
10 hours of clerical work (€500)

· 
It is assumed
that this is a cost which recurs on a 5-yearly basis in order to account for
technological lifecycles, which would require legal adaptations to ensure legal
compliance.

(b)
Preferred Option

(i) 
Introduction
of an explicit principle of transparency: Line 1 refers to the introduction of a
general principle of transparency on data controllers, which will practically
translate into providing clear and intelligible information to data subjects.
The obligation is estimated to involve two hours of clerical work for a full
time employee. This will be a one-off cost of adapting to the new requirements
of the data protection rules on transparency.

(ii) 
Extending
some obligations applicable to data controllers to data processors: it is assumed that a big majority
of information obligations relating to data processors will be dealt with by
data controllers upstream. Some obligations may be incurred by data processors
(particularly as regards Line 3 – obligation to demonstrate compliance), but
the number of processors affected is very difficult to estimate with any degree
of certainty.

(iii) 
Abolish
the existing generalised system of notifications to DPAs: see Line 3 under the Baseline
Scenario calculation.

(iv) 
Introduction
of a general obligation for data controllers to demonstrate compliance with
data protection law:
Line 4 estimates the cost of providing information about compliance,
involving 4 hours of clerical work by a full time employee to gather and
prepare all the relevant information. Such information may include disclosures
about the appointment of DPOs and the conducting of DPIAs. As this change
includes among other the appointment of specially trained personnel and the
conduct of risk assessments through the DPIA, is assumed that this action would
need to be performed every 3 years, in order to account for technological
lifecycles, which would require adaptations in the information provided.

(v) 
Data
breach notifications: Line
5 estimates the cost of data breach notifications; it is estimated that
currently 3,000 data breach notifications take place in the EU for the telecoms
sector, at a cost of 20,000 each (based on 319 data protection breaches
reported to the UK DPA in 2008/2009 and extrapolated for the EU[289];
figure of costs based on stakeholder feedback and desk research). If
notification is extended to all sectors, it is estimated that an extra 1,000
breach notifications would occur. The additional cost of notifying about them
would therefore be in the order of 20 million per annum.

(vi) 
Eliminating
the costs of legal fragmentation: Line 6 mirrors line 4 of the baseline scenario, but with a
negative prefix as the estimated annual costs will be eliminated.

4.   Conclusion

The
calculations in this annex estimate administrative burdens to amount to:

· 
€5.257.752.500 per annum in the baseline
scenario, of which approximately €2.911.143.000 is attributable to legal
fragmentation.

· 
€1.556.749.132 in savings per annum in the preferred option,
vis-à-vis the baseline scenario (net change).

ANNEX 10

IMPACTS OF THE PREFERRED OPTION ON 
COMPETITIVENESS

16. Expected
impacts of the preferred policy option on the competitiveness of the EU economy

This annex provides additional analysis of the
expected impacts of the preferred policy option on the competitiveness of the
European economy.

The likely impacts are evaluated in terms
of three dimensions of competitiveness:

Cost competitiveness: the cost of doing business, which includes the costs of
  factors of production (labour, capital and energy);
 Capacity to innovate: the capacity of the business to produce more and/or better quality
  products and services that meet better customers' preferences

· 
International competitiveness: the above two aspects could also be assessed in an international
comparative perspective, so that the likely impact of the policy proposal on
comparative advantages on the world markets is taken into account.

As a horizontal initiative, the data
protection reform has impacts on most industries. The personal data of natural
persons is potentially processed in all sectors of the economy. The reform of
European data protection rules will therefore introduce changes that cut across
industrial sectors, and have a global impact on the economy of the EU.

The envisaged approach of increasing harmonisation at EU level will
have a significant impact on business and enhance the attractiveness of Europe
as location to do business, at the same time as strengthening the EU in its
global promotion of high data protection standards. In fact, while the reform puts
individuals in a better position to exercise their data protection rights, it
will also allow for significant cost reductions for businesses through more
harmonisation.

The current
fragmentation of the legal framework gives rise to administrative burden
costing EU businesses close to €3 billion per year. This cost could be removed
and the resources made available could potentially be used by businesses to
enhance their investment strategies, both within the EU and beyond. Thus, thanks
to the reduced fragmentation of the regulatory environment, the EU will have a
more predictable business environment in data protection, with a set of rules encouraging
more consumer confidence and a better-functioning internal market. A
multinational company operating in several Member States will no longer be
subject to different requirements and the resulting costs and legal uncertainty.

17. Cost
and price competitiveness
17.1. 
Cost of inputs

The costs of
doing cross-border business in the internal market will be reduced considerably
by the clarification of the rules on applicable law, so that a data controller
established or using equipment in more than one Member State will be subject to
one single law only. As a result of the reform, businesses will have to comply
with one set of common, harmonised rules for the processing of personal data
and ensure that personal data flows without obstacles throughout the EU.

The data
protection reform will create a level playing field for data controllers and
reduce the administrative burden linked to notifications to Data Protection
Authorities. Multinational companies with activities in more than one EU Member
State will reap significant benefits from having to contact only one, single
Data Protection Authority who will be responsible for their supervision, thus
improving coherence and compliance and reducing costs. It will also reduce
barriers to entry for potential new entrants, making the internal market more
attractive and allowing them to fully exploit its potential.

The objective
of enhancing the internal market dimension of data protection is likely to have
positive impacts on business cost efficiency, given that it proposes to:

· 
establish a "one-stop-shop" for data
controllers in the EU ensuring consistent enforcement of data protection rules,

· 
rationalise the current governance system to
help ensure a more consistent enforcement,

· 
drastically cut red tape: remove unnecessary notification
obligations for data controllers,

· 
simplify requirements for international data
transfers.

Given these
changes, the reform is expected to be positively received by economic
operators, as it will reduce their overall compliance costs, particularly those
linked to the currently fragmented rules and the data protection-related
administrative burden.

Taking account
of the concerns of industry regarding the administrative and financial costs of
implementing some of the proposed changes, and in particular to avoid the
possibility of imposing disproportionate burdens on small companies, measures
with a potential cost impact such as the appointment of Data Protection
Officers and the conduct of data protection impact assessments, have  limitations
and thresholds included in the relevant legal obligations, thus considerably
limiting the cost impacts on SMEs.

The reform is also
likely to have a positive impact on consumer confidence in online environments,
so that increased volume of transactions of goods and services through online
channels can be expected. In addition to the providers of online services who
benefit directly, this has the potential to benefit also the large supplier
base which provides goods for online transactions, as well as sectors involved
in the completion of online transactions, e.g. courier and postal services
delivering the goods ordered online and related businesses.

17.2. 
Cost of labour

No material
changes of data protection rules relating to employment relationships are
proposed. Clarification and harmonisation of general data protection concepts
will remove divergences and reduce costs caused by fragmentation.

17.3. 
Other compliance costs

The appointment
of data protection officers will, for those organisations to which the
obligation applies, impose additional costs to the extent that a comparable
function does not already exist internally or in the form of an external consultancy
contract. Data Protection Impact Assessments will also impose costs depending
on the frequency and the level of scrutiny required.

On the one
hand, thresholds and limitations ensure that any additional costs remain
proportionate to the volume of operations. On the other hand, both measures
contribute considerably to increased compliance of the organisation, which can
in the long term protect it from expensive complaint handling, administrative
investigation or litigation. This applies also to an obligation to demonstrate
compliance by documenting internal policies and procedures. Furthermore, for
data controllers established in more than one Member State, these additional
compliance costs would be offset by the reduction of fragmentation (see also
Annex 6).

18. Capacity
to innovate
18.1. 
Capacity to produce and bring R&D to the
market

The current
inconsistent implementation of EU data protection laws impacts the uptake of
online services and new technologies in general. Individuals are affected
because of a lack of trust in the digital environment and fears about possible
misuse of their data. This creates opportunity costs for economic operators and
public authorities and slows down innovation.

Strong growth
of the internet economy, widespread use of new mobile devices and the expansion
of e-commerce and other web-based services could bring sizable economic
benefits, and provide a strong platform for companies able to develop new
products and services and to bring them to market. The EU has supported
research and development in privacy friendly and privacy enhancing
technologies, as well as in secure tools. Market acceptance of these
technologies and tools will improve considerably when they are integrated into
systems offered to a market of 500 million potential customers.

18.2. 
Capacity for product innovation

Clear and
harmonised data protection rules can become a trigger for innovation. For
example, privacy enhancing technologies or privacy by design and data
protection consulting are sectors which could benefit from an environment where
increased data protection safeguards are the norm. European industry could
become world leaders in privacy enhancing technologies or privacy by design
solutions, drawing business, jobs and capital to the European Union. Privacy enhancing
tools for data transfer and aggregation, as well as cloud computing will
generate new business opportunities.

18.3. 
Capacity for process innovation (including
distribution, marketing and after-sales services)

Clarification
and harmonisation of data protection rules across the EU offers a larger,
more streamlined and more open market for investment and increases incentives
for innovation.

19. International
competitiveness
19.1. 
Competition in internal market

Clarification
of data protection concepts and principles, more harmonisation of data
protection law, clarification of applicable law and improved consistency of
enforcement all contribute to creating a level playing field in the EU as far
as data protection is concerned. They will remove incentives for forum shopping
and the distortion of competition by diverse interpretation of existing
principles. This will improve competition in the internal market and increase
the resulting benefits in terms of subsequent downward pressure on prices and
more innovative products and services.

19.2. 
Competition in external markets

The fact that
the EU is reforming its data protection rules to enhance individual rights can
be perceived by many businesses as a competitive advantage, providing a business
environment where the legitimate and safe processing of personal data is
rewarded with the trust of more consumers.

The change in
rules, making the European internal market more effective and creating a more predictable
regulatory environment is in turn expected to make Europe become a more
attractive place for doing business, as the rules will be less heavy and more
streamlined.

The main
elements in the preferred policy option contributing to this effect are the:

Ø 
Clarification of applicable law, ensuring that
only one law applies,

Ø 
Simplification of the conditions and procedures
for third country data transfers, including for groups of companies,

Ø 
General reduction of red tape and fragmentation

Ø 
Consistent and effective enforcement.

EU based
providers will be able to offer a service with higher quality in terms of data
protection and security at competitive prices at a global scale.

19.3. Summary
19.3.1. Impact
on competitiveness

|| Data Processors /  controllers

Cost and price competitiveness || Positive || Negative

Cost of inputs || Strong reduction of compliance costs. An estimated €2.2 billion in the administrative burden of legal fragmentation will be virtually eliminated by the increased harmonisation. ||

Other compliance costs (e.g. reporting obligations) || DPOs and DPIAs, as well as a general assessment of compliance, improve data protection compliance and reduce risk of cost for non-compliance for complaint-handling, administrative investigations or litigation and negative effects for brand and customer base. || Obligation (where applicable) to appoint DPOs may impose additional costs on businesses not already having a similar function. Introduction of mandatory data protection impact assessments can increase cost to a limited extent.

Introducing a general obligation to demonstrate compliance with data protection law is estimated to impose some additional administrative burden.

Price of outputs || Improved consumer confidence in on-line trading environment expected to have positive impact on business ability to trade across borders and in competition. Level playing field in single market creates economy-of-scale benefits ||

Capacity to innovate || Positive || Negative

Capacity to produce and bring R&D to the market || Improved by higher consumer confidence in providing data. Application of privacy by design principle and increased use of PETs enable development of new products and services using privacy as a competitive advantage. ||

Capacity for product innovation

Capacity for process innovation (including distribution, marketing and after-sales services) || Clarification and harmonisation of data protection rules across EU offers larger market for new developments and increases incentive for innovation ||

International competitiveness || Positive || Negative

Market shares internal market || Increased harmonisation will create a more level playing field for businesses and foster their intra-EU and international competitiveness. ||

Market shares external markets || Strong data protection can build consumer confidence and strengthen the potential of the market. Simplification of procedures for data transfers to third countries makes international cooperation easier and reduces costs. ||

-               Based on the definitions in Article 2 of Directive
95/46/EC.

**             Based on the definition in Article 2(i) of Directive
2002/58/EC (as amended by Directive 2009/136/EC).

[1]               OJ L 281/95, p.31. The
Directive builds upon and develops the principles enshrined in the 1981 Council
of Europe Convention No 108 for the protection of Individuals with regard to
Automatic Processing of Data.

[2]               See the full list in Annex 3.

[3]               OJ L 350, 30.12.2008, p. 60

[4]               COM(2010)245 final.

[5]               COM(2010)2020 final.

[6]               Article 16 of the Treaty on
the Functioning of the European Union.

[7]               In the Stockholm Programme - OJ C115, 4 May 2010.

[8]               See the Resolution of the
European Parliament on the Stockholm Programme adopted 25 November 2009.

[9]               Special Eurobarometer (EB)
359, Data Protection and Electronic Identity in the EU (2011): http://ec.europa.eu/public_opinion/archives/ebs/ebs_359_en.pdf
("EB 2011" in future references).

[10]             COM(2010)609. The Commission's general approach was
welcomed and the priorities set out in the Communication were largely supported
by the European Parliament, the Council and the Economic and Social Committee.
The European Parliament adopted an own initiative report (Report on a comprehensive approach on personal data protection in
the European Union, (2011/2025(INI)). The Council issued Conclusions on the Commission Communication (0371st JUSTICE and HOME AFFAIRS
Council meeting, 24 and 25 February 2011). The EESC adopted  an opinion[10] (Report on a comprehensive approach on personal data protection in the European
Union, (2011/2025(INI)).

[11]             See point 3 of the Communication
COM(2010)609, p. 18.

[12]             The studies were carried out,
respectively, by GHK consulting and Trilateral Research. The first study was
more comprehensive (from March 2010 to January 2011) while the second (May/June
2011) focused on the economic and social impacts of key measures.

[13]             The implementation deadline of
the Framework Decision was 27 November 2010. The implementation report is presented
together with the reform proposals.

[14]              http://ec.europa.eu/justice/news/consulting_public/news_consulting_0006_en.htm

[15]             See http://www.enisa.europa.eu/act/it/data-breach-notification/.

[16]             Cit. footnote 9.

[17]             WP29 was set up in 1996 (by
Article 29 of the Directive) with advisory status and composed of
representatives of national Data Protection Supervisory Authorities (DPAs), the
European Data Protection Supervisor (EDPS) and the Commission. For more
information on its activities see http://ec.europa.eu/justice/policies/privacy/workinggroup/index_en.htm.

[18]             See in particular the following
opinions: on the "Future of Privacy" (n° /2009, WP168); on the
Concepts of "Controller" and Processor" (n° 1/2010, WP169); on
Online Behavioural Advertising (n°2/2010, WP 171); on the Principle of
Accountability  (n° 3/2010, WP 173);  on Applicable Law (n° 8/2010, WP 179);
and on consent (n° 15/2011, WP 187). Upon the Commission's request, it adopted
also the three following Advice Papers: on Notifications, on Sensitive Data and
on Article 28(6) of the Data Protection Directive. They can all be retrieved
at: http://ec.europa.eu/justice/policies/privacy/workinggroup/wpdocs/2011_en.htm.

[19]             Available on the EDPS website: http://www.edps.europa.eu/EDPSWEB/.

[20]             See, respectively, COM(2003)265
final and COM (2007)87 final.

[21]             http://ec.europa.eu/justice/policies/privacy/docs/studies/new_privacy_challenges/final_report_en.pdf

[22]             Article 30, 1 a of the
Directive.

[23]             See Annex 2 for a detailed
analysis on divergences in the implementation of the Directive by Member States
and for further examples.

[24]             Articles 2(h) and 7 (a) of the
Directive.

[25]             Express/explicit consent is
required under the national laws of Cyprus, Germany, Greece and Italy, In
addition, under German law consent has to be given in writing (with
exceptions); under Italian law, consent has to be "documented in
writing" as a general principle.

[26]             See the Guidance – issued by UK
Information Commissioner's Office (ICO) in 2002 - on the application of the
Data Protection Act  1998 in relation to Use and disclosure of health data,
retrievable at: http://www.ico.gov.uk/for_organisations/guidance_index/data_protection_and_privacy_and_electronic_communications.aspx#health.

[27]             See Article 8 of the Directive.

[28]             See Articles 18 and 19 of the
Directive.

[29]             DPOs exist today in several
Member States (Germany, Sweden, the Netherlands, Luxembourg, Slovakia, Estonia
and Hungary), with  variable status and competences. Their appointment is
optional in most Member States, except in Germany - where this is a compulsory
obligation for public data controllers and for private controllers permanently
employing at least 10 persons in the automated processing of personal data or
when the processing is subject to prior checking - + Hungary and Slovakia?.

[30]             See WP29 Advice Paper on
notifications, cit. footnote 18.

[31]             Ibidem.

[32]             See Article 4(1) of the
Directive.

[33]             See WP29 opinion on applicable
law: http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2010/wp179_en.pdf

[34]             Based on the example in WP29
Opinion on Applicable Law, p.15.

[35]             See Article 25 of the
Directive.

[36]             See http://ec.europa.eu/justice/data-protection/document/international-transfers/transfer/index_en.htm#h2-3.

[37]             WP29 adopted several opinions
on BCRs available at: http://ec.europa.eu/justice/policies/privacy/workinggroup/wpdocs/index_en.htm#data_transfers.

[38]             Based on information provided
by WP29, 14 BCRs have been approved by DPAs so far, about 25 companies have
provided DPAs with a first draft of BCRs and another 26 are being prepared.
According to stakeholders' feedback, only the biggest companies can afford to
adopt BCRs, due to the complexity of the procedure and the related costs, which
are € 20,000 on average but can amount – for very large companies with many
subsidiaries - to €1 million.

[39]             For the criteria currently used
to determine the "lead DPA"  see Working Document WP107 of  WP29.

[40]             More specifically, BCRs can be
used currently for transfers  of personal data that is originally processed by
the company as controller withint he same corporate group (such as data related
to customers, employees) and not allowing the use of BCRs for data originally
processed in the group as processor (such as processing made in the context of
outsourcing services).

[41]             See the 2010 study on Data
Protection in the European Union: the role of National Data Protection
Authorities, available at

http://fra.europa.eu/fraWebsite/attachments/Data-protection_en.pdf
. See also Annex 2 for more details.

[42]             This is the case, for
instance,  in  Austria, Romania and Slovakia.

[43]             A letter was also sent to the
Commission in July 2011 by the Chair of WP29 highlighting the financial difficulties
of certain DPAs, which would limit their participation in WP29 meetings.

[44]             See Article 28(3), second
indent.

[45]             The Commission has launched
infringement procedures to address this issue: see in particular the recent
judgement by the European Court of Justice (ECJ) in Case-C-518/07, Commission
and EDPS vs. Germany. An infringement procedure on the same ground was launched
against Austria in 2010; the situation in other Member States is currently
being examined.

[46]             See Article 28(6).

[47]             See their Advice Paper on
Article 28(6), cit., footnote 18.

[48]             The result of a survey carried
out by the Commission with Member States showed that few of them have in one or
two occasions modified their law following an opinion of the WP29 (see annex 2
for more details).

[49]             Its members are national DPAS,
the EDPS and the Commission (the latter without voting rights).

[50]             The result of a survey carried
out by the Commission with Member States showed that few of them have in one or
two occasions modified their law following an opinion of the WP29 (see annex 2
for more details).

[51]             WP29 website is also hosted on
the Europa server
http://ec.europa.eu/justice/data-protection/article-29/index_en.htm.

[52]             See for example the – quite
controversial - opinion on behavioural advertising (Opinion 2/2010): http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2010/wp171_en.pdf.,

[53]            See for example WP29 Opinion 10/2011 on the proposal for a
Directive of the European Parliament and of the Council on the use of passenger
name record data for the prevention, detection, investigation and prosecution
of terrorist offences and serious crime:  http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2011/wp181_en.pdf.

[54]             This figure does not include
the administrative burden for companies established outside the EU to which –
due to the current criteria on applicable law– different EU national laws would
also apply.

[55]             "The True Cost of
Compliance – A Benchmark Study of Multinational Organisations" – Research
Report, Independently Conducted by Ponemon Institute LCC, January 2011. 91% of
the study sample concerns companies with over 1000 employees based in the EU,
in North America and other world regions. (http://www.tripwire.com/ponemon-cost-of-compliance/pressKit/True_Cost_of_Compliance_Report.pdf).

[56]             This is estimated to be approximately
€6,5 million, including costs linked to business disruption, reduced
productivity, fees, penalties and other legal and non-legal settlement costs.

[57]             See Articles 168, 114 TFEU and
Article 35 of the EU Charter of Fundamental Rights.

[58]             EB 2011.

[59]             EB 2011.

[60]             For example, individuals do not
always realise that "free" online services generate processing of
their personal data.

[61]             Flash Eurobarometer 226 Data
Protection in the European Union – Data Controllers' Perceptions (2008),
p.34. Available at http://ec.europa.eu/public_opinion/flash/fl_226_en.pdf
("EB 2008" in future references).

[62]             The consultation of SMEs (see
Annex 8)  showed that only 36.3% of respondents have a privacy policy on their
company's website. Furthermore, 48.6% of SMEs state that they have been
providing information to data subjects, as required by data protection laws,
but only 27.4% of them state that they always provide this information. More
than 21% of respondents state that they never provide such information
to data subjects.

[63]             Ibidem.

[64]             EB 2011.

[65]             See for details on the
programme: http://ec.europa.eu/information_society/activities/sip/index_en.htm.

[66]             For details see: http://www2.lse.ac.uk/media@lse/research/EUKidsOnline/ShortSNS.pdf.

[67]             EB 2011.

[68]             Ibidem.

[69]             This is a technique used by
online publishers and advertisers
to increase the effectiveness of their campaigns. Behavioural targeting uses
information collected on an individual's web-browsing behaviour, such as the
pages they have visited or the searches they have made, to select which
advertisements to display to that individual. This allows site owners or ad networks
to display advertising content which is considered to be more relevant to the
interests of the individual viewing the page. On the theory that properly
targeted ads will generate more consumer interest, the web site publisher and
advertising agency may charge a higher price for these advertisements than for random
advertising or ads based on the context of a site.

[70]             EB 2011. See also WP29 Opinion
2/2010 on Online Behavioural Advertising, as well as Opinion 15/2011 on consent
, both available at:  http://ec.europa.eu/justice/policies/privacy/workinggroup/wpdocs/index_search_en.htm.

[71]             E.g. by using satellite
navigation data, WLAN broadcast information and maps of communication network
antenna information.

[72]             Such as IP or MAC addresses,
cookie identifiers, IMEIs and others.

[73]             See WP29 opinion on applicable
law on this matter, cit. footnoie 18, pp. 18-25

[74]             Interesting figures on recent
data breaches and losses can be found at: http://datalossdb.org
(data not verified).

[75]             Special Eurobarometer 362 E-Communications Household Survey,

[76]             See Digital Agenda for Europe,
p.12.

[77]             Access to personal data is part
of the fundamental right to data protection as enshrined in the charter of
fundamental rights.

[78]             EB 2008.

[79]             EB 2011.

[80]             http://www.guardian.co.uk/technology/2011/oct/20/facebook-fine-holding-data-deleted

[81]             EB 2011.

[82]             See the Digital Agenda
Scoreboard 2011, available at http://ec.europa.eu/information_society/digital-agenda/scoreboard/docs/scoreboard.pdf,
p.12-17.

[83]             This figure is based on data
concerning identity thefts in the UK (see the study by the Information
Commissioner's Office The
Privacy Dividend: the business case for investing in proactive privacy
protection, 2010: http://www.ico.gov.uk/upload/documents/library/data_protection/detailed_specialist_guides/privacy_dividend.pdf) and which have been weighted taking into
account the lower frequency of identity thefts in other EU countries (e.g.,
France, Spain, Germany) compared to the UK.

[84]             Ponemon Institute LLC,
Symantec, 2010 Annual Study: UK Encryption Trends.

[85]             Based on March 2011 exchange
rates.

[86]             Information gathered via a
survey by  GHK consulting in the framework of their study.

[87]             Cf. Commission 2010 Report on
the Application of the EU Charter of Fundamental Rights, p. 31;
http://ec.europa.eu/justice/policies/rights/docs/report_EU_charter_FR_2010_en.pdf

[88]             Flash Eurobarometer N° 250
(2008) - Confidence in the Information Society.

[89]             See Annex 3 for further
details.

[90]             This also entails no powers for
the Commission to launch infringement procedures against Member States and limited
powers for the ECJ for a transitional period of 5 years from the entry into
force of the Lisbon Treaty (i.e. until 1st December 2014). See Article 10 of
Protocol No 36 on transitional provisions annexed to the treaties.

[91]             Including information systems
established on the basis of Title VI of the previous Treaty (TEU).

[92]             Specific rules for processing
by Member States in the area of Common Foreign and Security Policy shall be
laid down by a Council Decision based on Article 39 TEU.

[93]             Article 16 states that
"The European Parliament and the Council [...] shall lay down the
rules relating to the protection of individuals with regard to the protection
of individuals with regard to the processing of personal data [...]" (emphasis
added).

[94]             See the Implementation Report
of the Framework decision (COM...)

[95]             Convention for the Protection of
Individuals with regard to Automatic Processing of Personal Data (CETS No.:
108), (‘Convention 108’) and its Additional Protocol (ETS No.: 181), as well
as  Recommendation No R (87) 15 of the Committee of Ministers to Member States
regulating the use of personal data in the police sector.

[96]             See the Annex to the
Implementation Report of the Framework decision (COM...), Table 6.

[97]             See footnote 91.

[98]             S. and Marper v. the United
Kingdom, judgment of 4 December 2008, applications nos. 30562/04 and 30566/04,
which showed the importance of adequately protecting such data particularly in
relation to use by police authorities. The Court ruled, in particular, that as
for the storing and use of this personal information, it was essential to have
clear, detailed rules governing the scope and application of measures, as well
as minimum safeguards.

[99]             See Annex 3 for the list of such acts.

[100]            See Article 28 and recital 39.
Some of these instruments are specifically mentioned (e.g. the acts regulating
the functioning of Europol, Eurojust, the Schengen Information System and the
Customs Information System) but the list is not exhaustive.;

[101]            See recital 40.

[102]            This is confirmed by a
(non-public) study carried out by the International Centre for Migration Policy
Development ("Study on the status of information exchange amongst law
enforcement authorities in the context of existing EU instruments",
September 2010). The study finds that one of the main legal problems in
cross-border information exchange derive from the differences in national
legislation in member States, in particular differences in privacy and data
protection always (or the different definitions of what constitutes a crime).

[103]            This is one of the key targets
of the Digital Agenda for Europe. For more see Digital Agenda Scoreboard 2011,
available at http://ec.europa.eu/information_society/digital-agenda/scoreboard/docs/scoreboard.pdf,
p.16-17.

[104]            Ibidem, p.12.

[105]            In line with Article 52(1) of
the Charter, limitations may be imposed on the exercise of the right to data
protection as long as the limitations are provided for by law, respect the
essence of the right and freedoms and, subject to the principle of
proportionality, are necessary and genuinely meet objectives of general
interest recognised by the European Union or the need to protect the rights and
freedoms of others.

[106]            COM(2011)206 final.

[107]            COM(2010)245 final.

[108]            See http://ec.europa.eu/governance/better_regulation/index_en.htm.

[109]            COM(2008)394 final; cf. on the
review of the "Small Business Act" COM(2011)78 final.

[110]            http://ec.europa.eu/dgs/health_consumer/self_regulation/

[111]            See Articles 9 and 10 of the Protocol.

[112]            See, in particular, Article 10, paragraphs
2 and 3.

[113] See footnote 98.

[114]            The current figures for the
secretarial costs are based on two administrators and one assistant working
full time on matters related to the WP29.

[115]            In the context of the SME
consultation (see Annex 8), approximately 47% of respondents either stated that
there is nobody formally assigned in their company to deal with data protection
issues, or responded "I don’t know / not applicable". 6% stated that
there is a full-time employee dealing with data protection issues, and
approximately 40% that someone carries out these tasks alongside other
activities.

[116]           See Case 9/56, Meroni & Co., Industrie Metallurgiche,
SpA v. High Authority of the European Coal and Steel Community, 1958.

[117]            EB2011.

[118]            Information Commissioner’s
Office (UK), The Privacy Dividend: The Business Case for Investing in
Proactive Privacy Protection, March 2010

[119]            Ponemon Institute and Symantec, 2010 Annual Study: U.S. Cost of a Data Breach,
2011.

[120]            EB2011.

[121]            Directive 95/46/EC of the European Parliament and of the
Council of 24 October 1995 on the protection of individuals with regard to the
processing of personal data and on the free movement of such data, OJ 1995 L
281/31.

[122]            Directive 2002/58/EC of the European Parliament and of
the Council of 12 July 2002 concerning the processing of personal data and the
protection of privacy in the electronic communications sector (Directive on
privacy and electronic communications, OJ 2002 L 201/ 37.

[123]            Directive 2009/136/EC of the European Parliament and of
the Council of 25 November 2009 amending Directive 2002/22/EC on universal
service and users’ rights relating to electronic communications networks and
services, Directive 2002/58/EC concerning the processing of personal data and
the protection of privacy in the electronic communications sector and
Regulation (EC) No 2006/2004 on cooperation between national authorities
responsible for the enforcement of consumer protection laws, OJ 2009 L 337/11.

[124]            Regulation (EC) No 45/2001 of the European Parliament
and of the Council of 18 December 2000 on the protection of individuals with
regard to the processing of personal data by the Community institutions and
bodies and on the free movement of such data; OJ 2001 L 008/1.

[125]            For example: the DPAs at national level, the EDPS, and
the Joint Supervisory Board for Europol, Customs, Schengen (with a common
secretariat), plus Eurojust and its Supervisory Body.

[126]            Council Framework Decision 2008/977/JHA of 27 November
2008 on the protection of personal data processed in the framework of police
and judicial cooperation in criminal matters; OJ 2008 L 350/60.

[127]            See below under 2.7

[128]            Directive 95/46/EC of the European Parliament and of the
Council of 24.10.1995 on the protection of individuals with regard to the
processing of personal data and on the free movement of such data (OJ L 281,
23.11.1995, p. 31).

[129]            Report from the Commission - First Report on the
implementation of the Data Protection Directive (95/46/EC), 15.5.2003, COM
(2003)265final.

[130]            Communication on the follow-up of the Work programme for
a better implementation of the Data Protection Directive, 7.3.2007, COM
(2007)87final.

[131]            Comparative study on different approaches to new privacy
challenges, particularly in the light of technological developments, January
2010       
(http://ec.europa.eu/justice/policies/privacy/docs/studies/new_privacy_challenges/final_report_en.pdf);

European Agency on
Fundamental Rights, Data Protection in the European Union: the role of National
Data Protection Authorities – Strengthening the fundamental rights architecture
in the EU II, 2010, available
at http://fra.europa.eu/fraWebsite/attachments/Data-protection_en.pdf;

Study on the
economic benefits of privacy enhancing technologies, London Economics, July
2010 (http://ec.europa.eu/justice/policies/privacy/docs/studies/final_report_pets_16_07_10_en.pdf);

Study for an
impact assessment for the future legal framework for personal data protection
by GHK Consulting Ltd., February 2011, launched by the Commission to support
the IA process;

Case law on
the circumstances in which IP addresses are considered personal data, by
time.lex CVBA, October 2010; Allocation and Use of IP Addresses, by Vigilio
Consult, 2010; Privacy and Trust in the Ubiquitous Information Society, by
Fraunhofer ISI et al., March 2009; Legal Analysis of a Single Market for the
Information Society: New rules for a new age?, by DLA piper, 2009.

[132]            Working Party on the Protection of Individuals with
regard to the Processing of Personal Data, established by Article 29 of the
Directive; the opinions of the Working Party are accessible under: http://ec.europa.eu/justice/policies/privacy/workinggroup/wpdocs/2011_en.htm.

[133]   National laws of all Member State replicate the definitions of
"personal data" and "data subjects" including, in some
cases, the elements of recital 26 of the Directive[133] (e.g. France, Slovenia,
Spain) or other minor amendments.

[134] Case
law on the circumstances in which IP addresses are considered personal data, by
time.lex CVBA, October 2010;

[135]            SCPP / Marie-Thérèse O. TGI
Montauban, 9 March 2007; Anthony G./SCPP, Appeal Court of Paris, 13th
Ch., sect. B, 27 April 2007; Sacem v. Cyrille Saminadin, Supreme Court,
Criminar Ch., 13 January 2009.

[136]     EMI records & Ors-v-Eircom Ltd, 2010, IEHC 108

[137]            E.g. C-275/06, Productores de Musica de Espana
(Promusicae) v. Telefonica de Espana SAU, 29.1.2008. C-557/07, LSG-Gesellschaft
v. Tele2Telecommunications GmbH, 19.2.2009.

[138]            See also the definition of "traffic data" in
Article 2(b) of the ePrivacy Directive 2002/58/EC, OJ L 201, 31.7.2002, p. 37.

[139]            Opinion 4/2007 on the concept of personal data (WP 136).

[140]            Opinion 1/2010 on the concepts of "controller"
and "processor" (WP 169).

[141]            Working Document on a Common Interpretation of Article
26(1) of the Directive, 25.11.2005 (WP 114).

[142]    Opinion 8/2001, 13.11.2001 (WP 48).

[143]            Opinion 2/2009, 11.2.2009 (WP 160).

[144]            Working Document on the processing of personal data
relating to health in electronic health records, 15.2.2007 (WP 131).

[145]            Opinion 2/2010, 22.6.2010 (WP 171).

[146]            See Flash Eurobarometer No 225 – Data Protection in the
European Union:      
http://ec.europa.eu/public_opinion/flash/fl_225_en.pdf.

[147]            ECJ, Case C-101/01, Bodil Lindqvist, 6.11.2003,
and the Satamedia Case C-73/07, Tietosuojavaltuutettu v. Satakunnan
Markkinapörssi Oy, Satamedia Oy, 16.12.2008, para. 44.

[148]            Cf. recital 12 of the Directive.

[149]            ECJ, Case C-101/01, Bodil Lindqvist, 6.11.2003.

[150]            Opinion 5/2009, 12.6.2009 (WP 163).

[151]            ECJ, Case C-73/07, Satamedia , 16.12.2008.

[152]            ECJ, Case C-101/01, Bodil Lindqvist, 6.11.2003.

[153]            Joint cases C-92/09 and C-93/09, Volker und Markus
Schecke GbR, Hartmut Eifert v. Land Hessen, 9.11.2010; C-28/08, Commission
v. The Bavarian Lager Co Ltd, 29.6.2010.

[154]            Report from the Commission - First Report on the
implementation of the Data Protection Directive (95/46/EC) - COM(2003)265.

[155]            Opinion 1/2008, 4.8.2008 (WP 148).

[156]            Opinion 8/2010, 16.12.2010 (WP 179).

[157]            Opinion 3/2010, 13.7.2010 (WP 173).

[158]            Joint cases C-92/09 and C-93/09, Volker und Markus
Schecke GbR, Hartmut Eifert v. Land Hessen, 9.11.2010; C-524/06, Heinz
Huber v. Germany, 16.12.2008; C-139/01, Rechnungshof, Österreichischer
Rundfunk et al., 20.5.2003.

[159]            See e.g. S. & Marper v. UK, 4.12.2008
(Application Nos. 30562/04 and 30566/04).

[160]            See Opinions 1/2006 and 2/2006 (WP 117 and 118).

[161]            S. and Marper v. the United
Kingdom, judgment of 4 December 2008, applications nos. 30562/04 and 30566/04.

[162]            For a more detailed analysis,
see the Article 29 Working Party “Working Document on Genetic Data” (WP 91).

[163] Despite the Commission's request, the Article
29 Working Party did not include this issue in its Working Programme and thus
has not provided an opinion so far.

[164]            A Eurobarometer survey carried out in 2009 showed that
about half of the respondents considered privacy notices in websites 'very' or
'quite unclear' (see Flash Eurobarometer No 282 :      
http://ec.europa.eu/public_opinion/flash/fl_282_en.pdf).

[165]            See the Safer Internet for Children qualitative study
concerning 9-10 year old and 12-14 year old children, which showed that
children tend to underestimate risks linked to the use of Internet and minimise
the consequences of their risky behaviour (available at:   
http://ec.europa.eu/information_society/activities/sip/surveys/qualitative/index_en.htm).

[166]            Interesting
figures on recent data breaches and losses can be found at: http://datalossdb.org (data not verified).

[167]            Directive 2002/58/EC of the European Parliament and of
the Council of 12.7.2002 concerning the processing of personal data and the
protection of privacy in the electronic communications sector (Directive on
privacy and electronic communications), OJ L 201, 31.7.2002, p. 37, as amended
by Directive 2009/136/EC, OJ L 337, 18.12.2009, p. 11.

[168]            C-553/07, College van burgemeester en wethouders van
Rotterdam v. M.E.E. Rijkeboer, 7.5.2009, European Court reports 2009 Page
I-03889

[169]            See http://online.wsj.com/article/SB10001424052748703396604576087573944344348.html.

[170]            EB 2011.

[171]            Report on the obligation to notify the national
supervisory authorities, the best use of exceptions and simplification and the
role of data protection officers in the European Union, 18.1.2005 (WP 106).

[172]            See CRIDS (University of Namur), Assessment of the
application of Article 25 of Directive 95/46, July 2011.

[173]                   See for the Commission decisions on the adequacy
of third countries' data protection:
       http://ec.europa.eu/justice/policies/privacy/thridcountries/

[174]    Commission
Decision 2010/87/EU of 5.2.2010, OJ L 39, 12.2.2010,
p.5.

[175]                   BCRs
have been developed as a matter of practice by data protection authorities and
by the WP29 on the basis of 
        an extensive interpretation of Article 25(2) of the Directive. - See the overview on BCR:
        http://ec.europa.eu/justice/policies/privacy/binding_rules/index_en.htm.

[176]                   According to information
provided by the WP29, 14 BCRs have been approved by DPAs so far, about 25 
        companies have provided DPAs with a first draft of BCRs and another 26
are being prepared.

[177]                   According to
stakeholders' feedback, only the biggest companies can afford to adopt BCRs,
due to the complexity
        of the procedure and the related costs, which are € 20,000 on average
but can amount – for very large companies
        with many subsidiaries - to €1 million.

[178]                   C-518/07, European Commission v. Germany,
9.3.2010.

[179]            ETS No. 108.

[180]            The Article 29 Working Party is an advisory body
composed of one representative of Member States', Data Protection Authorities,
the European Data Protection Supervisor (EDPS) and the Commission (without
voting rights), which also provides its secretariat. See:       
http://ec.europa.eu/justice/policies/privacy/workinggroup/index_en.htm
.

[181]            In Member States' replies to the survey, particular
reference was made  to the opinions on the concept of personal data (WP 136),
on the concepts of data controller and data processor (WP 169), on online
social networking and on processing by video surveillance (WP 89).

[182]            Directive 95/46/EC of the European Parliament and of the
Council of 24 October 1995 on the protection of individuals with regard to the
processing of personal data and on the free movement of such data (‘Directive’)
(OJ L 281, 23.11.1995, p.31).

[183]            See Article 3(2), first indent, of Directive 95/46/EC: “This
Directive shall not apply to the processing of personal data: - in the course
of an activity which falls outside the scope of Community law, such as those
provided for by Titles V and VI of the Treaty on European Union and in any case
to processing operations concerning public security, defence, State security
(including the economic well-being of the State when the processing operation
relates to State security matters) and the activities of the State in areas of
criminal law”.

[184]            The  majority of Member States apply the Directive to
the activities of police, customs, judicial and other competent authorities
concerned with the prevention of and the fight against crime (see Commission
Staff Working Document SEC(2005)
1241 as well as the replies of Member States to the Commission's questionnaire 
on the implementation of the Framework Decision).

[185]            See the list at the end of this annex.

[186]            Convention for the Protection of Individuals with regard
to Automatic Processing of Personal Data (CETS No.: 108), (‘Convention 108’).

[187]            Additional Protocol to the Convention for the Protection
of Individuals with regard to Automatic Processing of Personal Data, regarding
supervisory authorities and transborder data flows ETS No.: 181, (‘Additional
Protocol’).

[188]            Recommendation No R (87) 15 of the Committee of
Ministers to Member States regulating the use of personal data in the police
sector, (‘Police Recommendation’).

[189]            Council Framework Decision 2008/977/JHA of 27.11.2008 on
the protection of personal data processed in the framework of police and
judicial cooperation in criminal matters (OJ L 350, 30.12.2008, p. 60)
(‘Framework Decision’).

[190]            See separate implementation report, COM(....).

[191]            Council Common Position 2005/69/JHA of 24 January 2005
on exchanging certain data with Interpol, (OJ 2005 L 27, 29.1.2005, p. 61).

[192]            See, e.g. Directive 95/46/EC Articles 3 and 4, and
Articles 25-26.

[193]            See Joined Cases C-465/00,
C-138/01 and C-139/01 Rechnungshof, paragraphs 41-43 (op cit); Case C-376/98
Germany v. Parliament and Council, paragraph 85; Case C-491/01 British American
Tobacco and Imperial Tobacco, paragraph 60.

[194]            In the second subparagraph of
Article 16(2) TFEU a distinction is only made as far as a specific legal
instrument for the Common Foreign and Security Policy is concerned.

[195]            European Data Protection Supervisor, third opinion of 27
April 2007 on the proposal for a Council Framework Decision on the protection
of personal data processed in the framework of police and judicial co-operation
in criminal matters, OJ 2007 C 139, p.1.

[196]            European Parliament legislative resolution of 7 June
2007 on the proposal for a Council Framework Decision on the protection of
personal data processed in the framework of police and judicial cooperation in
criminal matters (renewed consultation) (7315/2007 – C6-0115/2007 –
2005/0202(CNS)).

[197]            See in particular: Declaration adopted by the European
Data Protection Authorities in Cyprus on 11 May 2007 and the Common position of
the European Data Protection Authorities on the use of the concept of
availability in law enforcement Cyprus, 10. - 11. May 2007.

[198]            Directive 2006/24/EC of the European Parliament and of
the Council of 15 March 2006 on the retention of data generated or processed in
connection with the provision of publicly available electronic communications
services or of public communications networks and amending Directive 2002/58/EC
(OJ L 105, 13.4.2006, p. 54).

[199]            See the Opinion of the European Data Protection
Supervisor on the Communication from the Commission to the European Parliament
and the Council on the follow-up of the Work Programme for better
implementation of the Data Protection Directive (OJ C 255, 27.10.2007, p. 1).
See also the EDPS Annual Report 2006, p. 47.

[200]            Council Framework Decision 2009/315/JHA of 26 February
2009 on the organisation and content of the exchange of information extracted
from the criminal record between Member States (OJ L 93 7.4.2009, p. 23).

[201]            Council Decision 2009/316/JHA of 6 April 2009 on
the establishment of the European Criminal Records Information System (ECRIS)
in application of Article 11 of Framework Decision 2009/315/JHA (OJ L 93, 7.4.2009, p. 33).

[202]            Council Decision 2009/371/JHA of 6 April 2009
establishing the European Police Office (Europol), (OJ L 121, 15.5.2009, p. 37).

[203]            Council Decision 2009/936/JHA of 30 November 2009
adopting the implementing rules for Europol analysis work files (OJ L 325,
11.12.2009, p. 14).

[204]            Council Decision 2009/934/JHA of 30 November 2009
adopting the implementing rules governing Europol’s relations with partners,
including the exchange of personal data and classified information
(OJ L 2009, L 325, 11.12.2009, p.
6).

[205]            Council Decision 2009/426/JHA of 16 December 2008 on the
strengthening of Eurojust and amending Decision 2002/187/JHA setting up
Eurojust with a view to reinforcing the fight against serious crime (‘Eurojust Decision 2009’) (OJ L 138, 4.6.2009, p. 14)

[206]            Council Framework Decision 2009/829/JHA of 23 October
2009 on the application, between Member States of the European Union, of the
principle of mutual recognition to decisions on supervision measures as an
alternative to provisional detention (OJ L 294, 11.11.2009, p.20).

[207]            Council Decision 2009/917/JHA of 30 November 2009 on the
use of information technology for customs purposes (OJ L 323, 10.12.2009, p 20).

[208]            Council Framework Decision 2009/948/JHA of 30 November
2009 on prevention and settlement of conflicts of exercise of jurisdiction in
criminal proceedings (OJ L 328, 15.12.2009, p. 42).

[209]            As foreseen by principles 3 and 7 of the Police Recommendation.
See the Opinion of the European Data Protection Supervisor on the Communication
from the Commission to the European Parliament and the Council on the follow-up
of the Work Programme for better implementation of the Data Protection
Directive (OJ C 255, 27.10.2007, p. 1). See also the EDPS Annual Report 2006,
p. 47.

[210]            This latter possibility is destined for those Member
States which have provided for the right of access of the data subject in
criminal matters through a system where the national supervisory authority, in
place of the data subject, has access to all the personal data related to the
data subject without any restriction and may also rectify, erase or update
inaccurate data. In such a case of indirect access, the national law of those Member
States may provide that the national supervisory authority will inform the data
subject only that all the necessary verifications have taken place. This seems
to appliy, in particular, in France and Belgium.

[211]            Council Decision 2008/633/JHA of 23 June 2008 concerning
access for consultation of the Visa Information System (VIS) by designated
authorities of Member States and by Europol for the purposes of the prevention,
detection and investigation of terrorist offences and of other serious criminal
offences  (OJ L 218, 13.8.2008, p. 129).

[212]            OJ L 292, 21.10.2006, p. 2.

[213]            Council Decision of 21 September 2009 on the signing, on
behalf of the European Union, and on the provisional application of certain
provisions of the Agreement between the European Union and Iceland and Norway
on the application of certain provisions of Council Decision 2008/615/JHA on
the stepping up of cross- border cooperation, particularly in combating
terrorism and cross-border crime and Council Decision 2008/616/JHA on the
implementation of Decision 2008/615/JHA on the stepping up of cross-border
cooperation, particularly in combating terrorism and cross-border crime, and
the Annex thereto (2009/1023/JHA), (OJ L 353, 31.12.2009, p.1).

[214]            According to Eurojust
legislation the Joint Supervisory Body comprises a
judge appointed by each Member State who is not a member of Eurojust, whereas
under the CIS Decision, a Joint Supervisory Authority consists of two
representatives from each Member State’s respective independent national
supervisory authority. For the SIS, Europol and the CIS, there is a Joint
secretariat. See Council Decision of 17 October 2000
establishing a secretariat for the joint supervisory data-protection bodies set
up by the Convention on the Establishment of a European Police Office (Europol
Convention), the Convention on the Use of Information Technology for Customs
Purposes and the Convention implementing the Schengen Agreement on the gradual
abolition of checks at the common borders (Schengen Convention) (OJ L 271,
24/10/2000, p.1).

[215]            C-518/07, European Commission v. Germany, 9.3.2010.

[216]            Joint cases C-92/09 and C-93/09, Volker und Markus Schecke
GbR, Hartmut Eifert v. Land Hessen, 9.11.2010.

[217]            See X and Y v Netherlands, judgement of 26 march 1985,
para 23.

[218]            M.S. v Sweden, judgment of 27 August 1997.

[219]            Appl. No. 9072/82, X v. the United Kingdom, 6 Oct. 1982,
30 DR 229.

[220]            Murray v. the United Kingdom, judgment of 28 Oct. 1994,
Series A no. 300-A.

[221]            Leander v. Sweden, judgment of 26 March 1987, Series A
no. 116.

[222]            Appl. No. 14661/81,  9 July 1991, 71 DR 141.

[223]            Appl. No. 9804/82, 7 Dec. 1982, 31 DR 231.

[224]            Friedl v. Austria, Comm. Rep., 19 May 1994, p. 20.

[225]            McVeigh, O’Neill and Evans v. the United Kingdom, 18
March 1981, DR 24 p. 15.

[226]            Leander v. Sweden, judgment of 26 March 1987, para. 59.

[227]            See the aforementioned Volker judgment. See also the
judgment of 20 May 2003 (Österreichischer Rundfunk) in Joined Cases C‑465/00,
C‑138/01 and C‑139/01 (ECR 2003, p. I‑4989).

[228]            Judgment of the Court of Human Rights, Marper, dated 4
December 2008, 30562/04 and 30566/04, paragraph 67.

[229]            See paragraph 62 of the aforementioned Volker judgment
and paragraph 76 of the aforementioned Österreichischer Rundfunk judgment. On
the case‑law of the Court of Human Rights, see also the
aforementioned opinion of the Legal Service 10146/01.

[230]            See paragraph 52 of the aforementioned Rotaru judgment.

[231]            see ECJ, Case C-110/03 Belgium v Commission
[2005] ECR I-2801, paragraph 30; Case C-76/06 P Britannia Alloys &
Chemicals v Commission [2007] ECR I-4405, paragraph 79; and Case
C-226/08 Stadt Papenburg [2010] ECR I-0000, paragraph 45.

[232]            See paragraph 95 of the aforementioned Marper judgment.
See also paragraph 77 of the aforementioned judgment of the Court of Justice on
Österreichischer Rundfunk.

[233]            See paragraph 99 of the aforementioned Marper judgment.

[234]            Judgment of the Court of Human Rights, Klass, dated 6
September 1978, No 5029/71, paragraphs 49 and 50. - See also the
Judgment dated 4 April 2006 of the German Constitutional Court
(BvR 518/02) which overturned a decision authorising searches by
electronic profiling, through cross‑checking data in a number of
databases.

[235]            See paragraph 67 of the aforementioned Volker Judgment
(C-92/09 and C-93/09).

[236]            See paragraph 74 of the aforementioned Schecke Judgment
(C-92/09 and C-93/09).

[237]            See paragraph 76 of the aforementioned Schecke Judgment.

[238]            See paragraph 77 of the aforementioned Schecke Judgment.

[239]            Judgment of the Court of Human Rights, Rotaru, dated 4
May 2000, 2841/95, paragraph 47.

[240]            See paragraph 77 of the aforementioned Schecke judgment.

[241]            See paragraph 71, Schecke judgment.

[242]            See paragraph 101 of the aforementioned Marper Judgment.
See also paragraph 83 of the Österreichischer Rundfunk Judgment.

[243]            See paragraph 83 of the aforementioned Österreichischer
Rundfunk judgment.

[244]            See paragraph 79 of the aforementioned Schecke Judgment.
See also point 86, 88 and 90 of the Österreichischer Rundfunk Judgment.

[245]            See paragraph 17 above and the penultimate subparagraph
of paragraph 5 of the opinion of the Legal Service 10146/01.

[246]            Marper judgment, paragraphs 119 and 125.

[247]            Leander v. Sweden, judgment of 26 March 1987, para. 48.

[248]            Rotaru v Romania, judgment of 4 May 2000, para 43.

[249]            Amann v Switzerland, judgment of 16 February 2000, para
70.

[250]            S. and Marper v. the United Kingdom, judgment of 4
December 2008, applications nos. 30562/04 and 30566/04.

[251]            Similar provisions are also included in the Decision related
to Europol (Articles 12, 14) and Eurojust (Article 15),

[252] 288 out of the 305 responses are available on the website.

[253]            As an example, see the European Codes of practice for
the use of Personal Data in direct marketing by FEDMA, including an annex on
online direct marketing: http://www.fedma.org/index.php?id=56.
It took several years to  have the annex to the Code finalised, due to
discussions with the supervisory authorities and WP29 (see the opinions issued,
one in 2003 and one in 2010): http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2010/wp174_en.pdf
and  http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2003/wp77_en.pdf).

[254] Self-Regulation Practices in SANCO Policy Areas, http://ec.europa.eu/dgs/health_consumer/self_regulation/docs/self-reg-SANCO-final.pdf

[255]            Based on the costs of other information exchange systems
developed by DG JUST, such as the e-Justice portal.

[256] http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/others/2011_04_20_letter_artwp_mme_le_bail_directive_9546ec_annex2_en.pdf

[257]            FP 7, call 8, Objective
ICT-2011.1.4 Trustworthy ICT

[258]            Survey conducted in Q1 2011 by
DG ENTR with companies representative from the security industry.

[259]            Regulation (EU) No 182/2011 of
the European Parliament and of the Council of 16 February 2011 laying down the
rules and general principles concerning mechanisms for control by Member States
of the Commission’s exercise of implementing powers, OJ L 055 , 28/02/2011 P.
013 – 018.

[260]            Within the territory of the EU
the need for more precision in the legal framework and a simplified criterion
to determine the law applicable has been emphasised by the Article 29 Working
Party in a recent opinion (Opinion 8/2010 on applicable law, WP 179).

[261]            This concerns, in particular, the UK DPA
(ICO), which is currently exclusively funded by notification fees. ICO argues
that a fee-based funding model is the application of the ‘polluter pays’
principle (in that those processing personal data are the ones who make it
necessary for there to be a system of supervision, regulation and advice and
guidance services provided by data protection authorities, and they therefore
are the ones who should pay for it).

[262]            See
Advice Paper of WP29 on notifications, p.6.

[263]            Timelex study on case-law
regarding IP addresses [...]

[264]            [Examples to be added]

[265]            Art 29 opinion on Internet of
/19992000

[266]  ECJ judgment in Case C-70/10 Scarlet Extended SA v Société belge des auteurs, compositeurs et éditeurs SCRL (SABAM).

[267]            For example, in the Greek version of the Directive and
in EL national law.

[268]

[269]            ECJ, Case C-101/01, Bodil Lindqvist, 6.11.2003,
ECR [2003] I-12971.

[270]            Consumer organisations (e.g. BEUC, Consumer Focus) and
non-governmental organisations (e.g. Privacy International) have expressed
strong support for the establishment of collective redress mechanisms, both at
national and European levels, as an efficient tool for data subject’s
empowerment and business compliance. The European Economic and Social Committee
is equally of the opinion that consideration should be given for business and
professional organisations and trade unions to represent individuals and bring
an action before courts.

[271]            Study
is available here: http://www.ponemon.org/local/upload/fckjail/generalcontent/16/file/ATC_DPP%20report_FINAL.pdf

[272]            See the Implementation report of the Framework Decision
(COM...)...

[273]            This concerns, in particular, the UK DPA
(ICO), for which notifications represent currently by large the main source of
funding. They consider that a fee-based funding model for DPA is the most
suitable to ensure the actual independence of the DPA from the Government.

[274] From Commission
Staff Working Document "Towards a Coherent European Approach to Collective
Redress" (SEC(2011)173 final), available at http://ec.europa.eu/justice/news/consulting_public/0054/sec_2011_173_en.pdf

[275]            This innovation is also supported by the Data Protection
Authorities in the WP document on the Future of Privacy (op cit). And the EDPS
in his opinion on the Commission’s Communication COM (2010) 609 final , OJ C
181, 22.6.2011, p.1

[276]            http://ec.europa.eu/justice/news/consulting_public/news_consulting_0054_en.htm

[277] Eurostat 2008 figures, available at
http:\epp.eurostat.ec.europa.eu/cache/ITY_OFFPUB/KS-SF-08-031/EN/KS-SF-08-031-EN.pdf

[278] The benefits listed here have been extracted from Wright, David,
and Paul de Hert, “Introduction to privacy impact assessment”, Chapter 1, in
David Wright and Paul de Hert
(eds.), Privacy Impact Assessment, Springer, Dordrecht, 2011
[forthcoming]. The book discusses PIA, rather than a more narrowly scoped DPIA,
but the benefits of a DPIA will be broadly the same.

[279] This labour rate is the EU figure for external consultations.
Conducting a DPIA is assumed to be a comparable exercise in terms of labour
expertise, like other consultation and research exercises. One can expect some
divergences in costs in Member States.

[280] As stated above, this labour rate is the EU figure for external
consultations.

[281] This figure also corresponds to stakeholder
feedback for a large multi-national as to expected costs in conducting a
privacy impact assessment.

[282] This labour rate is the EU figure for external consultations.

[283] Annex 10 of the IA Guidelines defines administrative costs "as
the costs incurred by enterprises, the voluntary sector, public authorities and
citizens in meeting legal obligations to provide information on their action or
production, either to public authorities or to private parties."

[284] EUROSTAT 2008, Key figures on European business with a special
feature on SMEs,Available at http://epp.eurostat.ec.europa.eu/cache/ITY_OFFPUB/KS-ET-11-001/EN/KS-ET-11-001-EN.PDF

[285] SME Panel on data protection, Questions 7 (36% compliance) and 9
(48% compliance).

[286]  Flash Eurobarometer 224 – Business
attitudes towards cross-border sales and consumer protection, available at http://ec.europa.eu/consumers/strategy/docs/fl224%20_eurobar_cbs_summary.pdf
(survey of managers of companies over 10 employees). This figure is
extrapolated to companies of less than 10 employees.

[287]  Flash Eurobarometer 300 - Retailers’ attitudes towards
cross-border trade and consumer protection, available at  http://ec.europa.eu/consumers/strategy/docs/retailers_eurobarometer_2011_en.pdf

[288] This estimate is based on information received from the DPAs in NL
and LU. For example, in Netherlands it takes about half a day to fulfil the
notification requirement. In Luxembourg the company needs to complete 3-4 forms
and the estimated cost for each file is €100. The notification form used in the
UK fits within these estimates, and it can be extrapolated that the situation
is similar in most of the Member States.

[289] Based on 319 data protection breaches reported to the UK DPA in
2008/2009 and extrapolated for the EU; figure of costs based on stakeholder
feedback and desk research.