# Official Journal C 463/2016

| | ISSN 1977-091X |
| --- | --- |
| Official Journal
  of the European Union | C 463 |
| | |
| English edition | Information and Notices | Volume 5913 December 2016 |

ISSN 1977-091X

Official Journal

of the European Union

C 463

English edition

Information and Notices

Volume 5913 December 2016

---

| Notice No | Contents | page |
| --- | --- | --- |
| | II   Information |
| | INFORMATION FROM EUROPEAN UNION INSTITUTIONS, BODIES, OFFICES AND AGENCIES |
| | European Commission |
| 2016/C 463/01 | Non-opposition to a notified concentration (Case M.8260 — DCNS/SPI/DCNS Energies) (
  1
  ) | 1 |
| 2016/C 463/02 | Non-opposition to a notified concentration (Case M.8268 — Norinco/Delphi’s Mechatronics Business) (
  1
  ) | 1 |

Notice No

Contents

page

II   Information

INFORMATION FROM EUROPEAN UNION INSTITUTIONS, BODIES, OFFICES AND AGENCIES

European Commission

2016/C 463/01

Non-opposition to a notified concentration (Case M.8260 — DCNS/SPI/DCNS Energies) (
  1
  )

1

1

2016/C 463/02

Non-opposition to a notified concentration (Case M.8268 — Norinco/Delphi’s Mechatronics Business) (
  1
  )

1

1

---

| | IV   Notices |
| --- | --- |
| | NOTICES FROM EUROPEAN UNION INSTITUTIONS, BODIES, OFFICES AND AGENCIES |
| | Council |
| 2016/C 463/03 | Notice for the attention of the persons subject to the restrictive measures provided for in Council Decision 2010/788/CFSP, as amended by Council Decision (CFSP) 2016/2231 and Council Regulation (EC) No 1183/2005, as amended by Regulation (EU) 2016/2230 concerning restrictive measures against the Democratic Republic of the Congo | 2 |
| 2016/C 463/04 | Notice for the attention of the data subjects to whom the restrictive measures provided for in Council Regulation (EC) No 1183/2005 imposing certain specific restrictive measures directed against persons acting in violation of the arms embargo with regard to the Democratic Republic of the Congo apply | 3 |
| 2016/C 463/05 | Notice for the attention of the persons subject to the restrictive measures provided for in Council Decision 2011/72/CFSP and Council Regulation (EU) No 101/2011 concerning restrictive measures directed against certain persons, entities and bodies in view of the situation in Tunisia | 4 |
| 2016/C 463/06 | Notice for the attention of the data subjects to whom the restrictive measures provided for in Council Regulation (EU) No 101/2011 concerning restrictive measures directed against certain persons, entities and bodies in view of the situation in Tunisia apply | 5 |
| 2016/C 463/07 | Notice for the attention of a person subject to the restrictive measures provided for in Council Decision 2014/119/CFSP and in Council Regulation (EU) No 208/2014 concerning restrictive measures directed against certain persons, entities and bodies in view of the situation in Ukraine | 6 |
| | European Commission |
| 2016/C 463/08 | Euro exchange rates | 7 |
| | European Data Protection Supervisor |
| 2016/C 463/09 | Executive Summary of the Opinion of the European Data Protection Supervisor on effective enforcement in digital society economy | 8 |
| 2016/C 463/10 | Executive Summary of the Opinion of the European Data Protection Supervisor on Personal Information Management Systems | 10 |
| 2016/C 463/11 | Executive Summary of the Opinion of the European Data Protection Supervisor on the second EU Smart Borders package | 14 |

IV   Notices

NOTICES FROM EUROPEAN UNION INSTITUTIONS, BODIES, OFFICES AND AGENCIES

Council

2016/C 463/03

Notice for the attention of the persons subject to the restrictive measures provided for in Council Decision 2010/788/CFSP, as amended by Council Decision (CFSP) 2016/2231 and Council Regulation (EC) No 1183/2005, as amended by Regulation (EU) 2016/2230 concerning restrictive measures against the Democratic Republic of the Congo

2

2016/C 463/04

Notice for the attention of the data subjects to whom the restrictive measures provided for in Council Regulation (EC) No 1183/2005 imposing certain specific restrictive measures directed against persons acting in violation of the arms embargo with regard to the Democratic Republic of the Congo apply

3

2016/C 463/05

Notice for the attention of the persons subject to the restrictive measures provided for in Council Decision 2011/72/CFSP and Council Regulation (EU) No 101/2011 concerning restrictive measures directed against certain persons, entities and bodies in view of the situation in Tunisia

4

2016/C 463/06

Notice for the attention of the data subjects to whom the restrictive measures provided for in Council Regulation (EU) No 101/2011 concerning restrictive measures directed against certain persons, entities and bodies in view of the situation in Tunisia apply

5

2016/C 463/07

Notice for the attention of a person subject to the restrictive measures provided for in Council Decision 2014/119/CFSP and in Council Regulation (EU) No 208/2014 concerning restrictive measures directed against certain persons, entities and bodies in view of the situation in Ukraine

6

European Commission

2016/C 463/08

Euro exchange rates

7

European Data Protection Supervisor

2016/C 463/09

Executive Summary of the Opinion of the European Data Protection Supervisor on effective enforcement in digital society economy

8

2016/C 463/10

Executive Summary of the Opinion of the European Data Protection Supervisor on Personal Information Management Systems

10

2016/C 463/11

Executive Summary of the Opinion of the European Data Protection Supervisor on the second EU Smart Borders package

14

---

| | V   Announcements |
| --- | --- |
| | PROCEDURES RELATING TO THE IMPLEMENTATION OF COMPETITION POLICY |
| | European Commission |
| 2016/C 463/12 | Prior notification of a concentration (Case M.8288 — Permira/Schustermann & Borenstein) — Candidate case for simplified procedure (
  1
  ) | 18 |
| 2016/C 463/13 | Prior notification of a concentration (Case M.8259 — Groupe H.I.G./Guillaume Dauphin/Ecore) — Candidate case for simplified procedure (
  1
  ) | 19 |
| | OTHER ACTS |
| | European Commission |
| 2016/C 463/14 | Notice for the attention of the natural persons Pak Chun Il, Kim Song Chol, Son Jong Hyok, Kim Se Gon, Ri Won Ho, Jo Yong Chol, Kim Chol Sam, Kim Sok Chol, Chang Chang Ha, Cho Chun Ryong and Son Mun San, and the entities Korea United Development Bank, Ilsim International Bank, Korea Daesong Bank, Singwang Economics and Trading General Corporation, Korea Foreign Technical Trade Center, Korea Pugang Trading Corporation, Korea International Chemical Joint Venture Company, DCB Finance Limited, Korea Taesong Trading Company and Korea Daesong General Trading Corporation, who were added to the list referred to in Article 6(1) of Council Regulation (EC) No 329/2007 imposing certain specific restrictive measures directed against persons entities and bodies designated by the Sanctions Committee or the UN Security Council in accordance with paragraph 8(d) of UN Security Council Resolution 1718 (2006), and paragraph 8 of UN Security Council Resolution 2094 (2013), by virtue of Commission Implementing Regulation (EU) 2016/2215 | 20 |

V   Announcements

PROCEDURES RELATING TO THE IMPLEMENTATION OF COMPETITION POLICY

European Commission

2016/C 463/12

Prior notification of a concentration (Case M.8288 — Permira/Schustermann & Borenstein) — Candidate case for simplified procedure (
  1
  )

1

18

2016/C 463/13

Prior notification of a concentration (Case M.8259 — Groupe H.I.G./Guillaume Dauphin/Ecore) — Candidate case for simplified procedure (
  1
  )

1

19

OTHER ACTS

European Commission

2016/C 463/14

Notice for the attention of the natural persons Pak Chun Il, Kim Song Chol, Son Jong Hyok, Kim Se Gon, Ri Won Ho, Jo Yong Chol, Kim Chol Sam, Kim Sok Chol, Chang Chang Ha, Cho Chun Ryong and Son Mun San, and the entities Korea United Development Bank, Ilsim International Bank, Korea Daesong Bank, Singwang Economics and Trading General Corporation, Korea Foreign Technical Trade Center, Korea Pugang Trading Corporation, Korea International Chemical Joint Venture Company, DCB Finance Limited, Korea Taesong Trading Company and Korea Daesong General Trading Corporation, who were added to the list referred to in Article 6(1) of Council Regulation (EC) No 329/2007 imposing certain specific restrictive measures directed against persons entities and bodies designated by the Sanctions Committee or the UN Security Council in accordance with paragraph 8(d) of UN Security Council Resolution 1718 (2006), and paragraph 8 of UN Security Council Resolution 2094 (2013), by virtue of Commission Implementing Regulation (EU) 2016/2215

20

---

| | |
| --- | --- |
| | (1)   Text with EEA relevance |

---

(1)   Text with EEA relevance

1

| EN | |
| --- | --- |

EN

---

II Information

INFORMATION FROM EUROPEAN UNION INSTITUTIONS, BODIES, OFFICES AND AGENCIES

European Commission

| 13.12.2016 | EN | Official Journal of the European Union | C 463/1 |
| --- | --- | --- | --- |

13.12.2016

EN

Official Journal of the European Union

C 463/1

---

Non-opposition to a notified concentration

(Case M.8260 — DCNS/SPI/DCNS Energies)

(Text with EEA relevance)

(2016/C 463/01)

On 5 December 2016, the Commission decided not to oppose the above notified concentration and to declare it compatible with the internal market. This decision is based on Article 6(1)(b) of Council Regulation (EC) No 139/2004 (1). The full text of the decision is available only in French and will be made public after it is cleared of any business secrets it may contain. It will be available:

| — | in the merger section of the Competition website of the Commission (http://ec.europa.eu/competition/mergers/cases/). This website provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes. |
| --- | --- |

—

in the merger section of the Competition website of the Commission (http://ec.europa.eu/competition/mergers/cases/). This website provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes.

| — | in electronic form on the EUR-Lex website (http://eur-lex.europa.eu/homepage.html?locale=en) under document number 32016M8260. EUR-Lex is the online access to European law. |
| --- | --- |

—

in electronic form on the EUR-Lex website (http://eur-lex.europa.eu/homepage.html?locale=en) under document number 32016M8260. EUR-Lex is the online access to European law.

---

(1)  OJ L 24, 29.1.2004, p. 1.

---

| 13.12.2016 | EN | Official Journal of the European Union | C 463/1 |
| --- | --- | --- | --- |

13.12.2016

EN

Official Journal of the European Union

C 463/1

---

Non-opposition to a notified concentration

(Case M.8268 — Norinco/Delphi’s Mechatronics Business)

(Text with EEA relevance)

(2016/C 463/02)

On 2 December 2016, the Commission decided not to oppose the above notified concentration and to declare it compatible with the internal market. This decision is based on Article 6(1)(b) of Council Regulation (EC) No 139/2004 (1). The full text of the decision is available only in English and will be made public after it is cleared of any business secrets it may contain. It will be available:

| — | in the merger section of the Competition website of the Commission (http://ec.europa.eu/competition/mergers/cases/). This website provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes, |
| --- | --- |

—

in the merger section of the Competition website of the Commission (http://ec.europa.eu/competition/mergers/cases/). This website provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes,

| — | in electronic form on the EUR-Lex website (http://eur-lex.europa.eu/homepage.html?locale=en) under document number 32016M8268. EUR-Lex is the online access to European law. |
| --- | --- |

—

in electronic form on the EUR-Lex website (http://eur-lex.europa.eu/homepage.html?locale=en) under document number 32016M8268. EUR-Lex is the online access to European law.

---

(1)  OJ L 24, 29.1.2004, p. 1.

---

IV Notices

NOTICES FROM EUROPEAN UNION INSTITUTIONS, BODIES, OFFICES AND AGENCIES

Council

| 13.12.2016 | EN | Official Journal of the European Union | C 463/2 |
| --- | --- | --- | --- |

13.12.2016

EN

Official Journal of the European Union

C 463/2

---

Notice for the attention of the persons subject to the restrictive measures provided for in Council Decision 2010/788/CFSP, as amended by Council Decision (CFSP) 2016/2231 and Council Regulation (EC) No 1183/2005, as amended by Regulation (EU) 2016/2230 concerning restrictive measures against the Democratic Republic of the Congo

(2016/C 463/03)

The following information is brought to the attention of the persons that appear in Annex II to Council Decision 2010/788/CFSP (1) and in Annex Ia to Council Regulation (EC) No 1183/2005 (2) concerning restrictive measures against the Democratic Republic of the Congo.

The Council of the European Union has decided that the persons that appear in the above-mentioned Annexes should be included in the list of persons and entities subject to restrictive measures provided for in Decision 2010/788/CFSP and in Regulation (EC) No 1183/2005 concerning restrictive measures against the Democratic Republic of the Congo. The grounds for designations of those persons appear in the relevant entries in those Annexes.

The attention of the persons concerned is drawn to the possibility of making an application to the competent authorities of the relevant Member State(s) as indicated in the web-sites in Annex II to Regulation (EC) No 1183/2005, in order to obtain an authorisation to use frozen funds for basic needs or specific payments (cf. Article 3 of the Regulation).

The persons concerned may submit a request to the Council before 1 October 2017, together with supporting documentation that the decision to include them on the above-mentioned list should be reconsidered to the following address:

| Council of the European Union |
| --- |
| General Secretariat |
| DG C 1C |
| Rue de la Loi/Wetstraat 175 |
| 1048 Bruxelles/Brussel |
| BELGIQUE/BELGIË |
| Email: sanctions@consilium.europa.eu |

Council of the European Union

General Secretariat

DG C 1C

Rue de la Loi/Wetstraat 175

1048 Bruxelles/Brussel

BELGIQUE/BELGIË

Email: sanctions@consilium.europa.eu

Any observations received will be taken into account for the purpose of the Council's next review, pursuant to Article 9 of Decision 2010/788/CFSP.

The attention of the persons concerned is also drawn to the possibility of challenging the Council's decision before the General Court of the European Union, in accordance with the conditions laid down in Article 275, second paragraph, and Article 263, fourth and sixth paragraphs, of the Treaty on the Functioning of the European Union.

---

(1)  OJ L 336, 21.12.2010, p. 30.

(2)  OJ L 193, 23.7.2005, p. 1.

---

| 13.12.2016 | EN | Official Journal of the European Union | C 463/3 |
| --- | --- | --- | --- |

13.12.2016

EN

Official Journal of the European Union

C 463/3

---

Notice for the attention of the data subjects to whom the restrictive measures provided for in Council Regulation (EC) No 1183/2005 imposing certain specific restrictive measures directed against persons acting in violation of the arms embargo with regard to the Democratic Republic of the Congo apply

(2016/C 463/04)

The attention of data subjects is drawn to the following information in accordance with Article 12 of Regulation (EC) No 45/2001 of the European Parliament and of the Council (1):

The legal basis for this processing operation is Council Regulation (EC) No 1183/2005 (2).

The controller of this processing operation is the Council of the European Union represented by the Director General of DG C (Foreign Affairs, Enlargement, Civil Protection) of the General Secretariat of the Council and the department entrusted with the processing operation is the Unit 1C of DG C that can be contacted at:

| Council of the European Union |
| --- |
| General Secretariat |
| DG C 1C |
| Rue de la Loi/Wetstraat 175 |
| 1048 Bruxelles/Brussel |
| BELGIQUE/BELGIË |
| E-mail: sanctions@consilium.europa.eu |

Council of the European Union

General Secretariat

DG C 1C

Rue de la Loi/Wetstraat 175

1048 Bruxelles/Brussel

BELGIQUE/BELGIË

E-mail: sanctions@consilium.europa.eu

The purpose of the processing operation is the establishment and updating of the list of persons subject to restrictive measures in accordance with Regulation (EC) No 1183/2005.

The data subjects are the natural persons who fulfil listing criteria as laid down in that Regulation.

The personal data collected includes data necessary for the correct identification of the person concerned, the Statement of Reasons and any other data related thereto.

The personal data collected may be shared as necessary with the European External Action Service and the Commission.

Without prejudice to restrictions provided for in Article 20(1)(a) and (d) of Regulation (EC) No 45/2001, requests for access, as well as requests for rectification or objection will be answered in accordance with section 5 of Council Decision 2004/644/EC (3).

Personal data will be retained for 5 years from the moment the data subject has been removed from the list of persons subject to the asset freeze or the validity of the measure has expired, or for the duration of court proceedings in the event they had been started.

Data subjects may have recourse to the European Data Protection Supervisor in accordance with Regulation (EC) No 45/2001.

---

(1)  OJ L 8, 12.1.2001, p. 1.

(2)  OJ L 193, 23.7.2005, p. 1.

(3)  OJ L 296, 21.9.2004, p. 16.

---

| 13.12.2016 | EN | Official Journal of the European Union | C 463/4 |
| --- | --- | --- | --- |

13.12.2016

EN

Official Journal of the European Union

C 463/4

---

Notice for the attention of the persons subject to the restrictive measures provided for in Council Decision 2011/72/CFSP and Council Regulation (EU) No 101/2011 concerning restrictive measures directed against certain persons, entities and bodies in view of the situation in Tunisia

(2016/C 463/05)

The following information is brought to the attention of the persons that appear in the Annex to Council Decision 2011/72/CFSP (1), and in Annex I to Council Regulation (EU) No 101/2011 (2), concerning restrictive measures directed against certain persons, entities and bodies in view of the situation in Tunisia.

The Council intends to renew the restrictive measures provided for in Council Decision 2011/72/CFSP. The Council holds on its file new elements concerning all persons listed in the Annex to Decision 2011/72/CFSP and in Annex I to Regulation (EU) No 101/2011. The persons concerned are hereby informed that they may submit a request to the Council to obtain the information that relates to them, before 18 December 2016, to the following address:

| Council of the European Union |
| --- |
| General Secretariat |
| DG C 1C |
| Rue de la Loi/Wetstraat 175 |
| 1048 Bruxelles/Brussel |
| BELGIQUE/BELGIË |
| email: sanctions@consilium.europa.eu |

Council of the European Union

General Secretariat

DG C 1C

Rue de la Loi/Wetstraat 175

1048 Bruxelles/Brussel

BELGIQUE/BELGIË

email: sanctions@consilium.europa.eu

Any observations received will be taken into account for the purpose of the Council’s periodic review, in accordance with Article 5 of Decision 2011/72/CFSP and Article 12(4) of Regulation (EU) No 101/2011.

---

(1)  OJ L 28, 2.2.2011, p. 62.

(2)  OJ L 31, 5.2.2011, p. 1.

---

| 13.12.2016 | EN | Official Journal of the European Union | C 463/5 |
| --- | --- | --- | --- |

13.12.2016

EN

Official Journal of the European Union

C 463/5

---

Notice for the attention of the data subjects to whom the restrictive measures provided for in Council Regulation (EU) No 101/2011 concerning restrictive measures directed against certain persons, entities and bodies in view of the situation in Tunisia apply

(2016/C 463/06)

The attention of data subjects is drawn to the following information in accordance with Article 12 of Regulation (EC) No 45/2001 of the European Parliament and of the Council (1):

The legal basis for this processing operation is Council Regulation (EU) No 101/2011 (2).

The controller of this processing operation is the Council of the European Union represented by the Director-General of DG C (Foreign Affairs, Enlargement, Civil Protection) of the General Secretariat of the Council and the department entrusted with the processing operation is the Unit 1C of DG C that can be contacted at:

| Council of the European Union |
| --- |
| General Secretariat |
| DG C 1C |
| Rue de la Loi/Wetstraat 175 |
| 1048 Bruxelles/Brussel |
| BELGIQUE/BELGIË |
| E-mail: sanctions@consilium.europa.eu |

Council of the European Union

General Secretariat

DG C 1C

Rue de la Loi/Wetstraat 175

1048 Bruxelles/Brussel

BELGIQUE/BELGIË

E-mail: sanctions@consilium.europa.eu

The purpose of the processing operation is the establishment and updating of the list of persons subject to restrictive measures in accordance with Regulation (EU) No 101/2011.

The data subjects are the natural persons who fulfil listing criteria as laid down in that Regulation.

The personal data collected includes data necessary for the correct identification of the person concerned, the Statement of Reasons and any other data related thereto.

The personal data collected may be shared as necessary with the European External Action Service and the Commission.

Without prejudice to restrictions provided for in Article 20(1)(a) and (d) of Regulation (EC) No 45/2001, requests for access, as well as requests for rectification or objection will be answered in accordance with section 5 of Council Decision 2004/644/EC (3).

Personal data will be retained for 5 years from the moment the data subject has been removed from the list of persons subject to the asset freeze or the validity of the measure has expired, or for the duration of court proceedings in the event they had been started.

Data subjects may have recourse to the European Data Protection Supervisor in accordance with Regulation (EC) No 45/2001.

---

(1)  OJ L 8, 12.1.2001, p. 1.

(2)  OJ L 31, 5.2.2011, p. 1.

(3)  OJ L 296, 21.9.2004, p. 16.

---

| 13.12.2016 | EN | Official Journal of the European Union | C 463/6 |
| --- | --- | --- | --- |

13.12.2016

EN

Official Journal of the European Union

C 463/6

---

Notice for the attention of a person subject to the restrictive measures provided for in Council Decision 2014/119/CFSP and in Council Regulation (EU) No 208/2014 concerning restrictive measures directed against certain persons, entities and bodies in view of the situation in Ukraine

(2016/C 463/07)

The following information is brought to the attention of Mr Viktor Ivanovych Ratushniak who appears in the Annex to Council Decision 2014/119/CFSP (1) and in Annex I to Council Regulation (EU) No 208/2014 (2) concerning restrictive measures directed against certain persons, entities and bodies in view of the situation in Ukraine.

Following a review of the list of designated persons in Decision 2014/119/CFSP and Regulation (EU) No 208/2014, the Council intends to renew the measures in those acts.

The Council intends to maintain the restrictive measures against the above-mentioned person. The above-mentioned person is hereby informed that he may submit a request to the Council to obtain the elements the Council holds in its file regarding his designation, before 19 December 2016, to the following address:

| Council of the European Union |
| --- |
| General Secretariat |
| DG C 1C |
| Rue de la Loi/Wetstraat 175 |
| 1048 Bruxelles/Brussel |
| BELGIQUE/BELGIË |
| Email: sanctions@consilium.europa.eu |

Council of the European Union

General Secretariat

DG C 1C

Rue de la Loi/Wetstraat 175

1048 Bruxelles/Brussel

BELGIQUE/BELGIË

Email: sanctions@consilium.europa.eu

In this regard, the attention of the person concerned is drawn to the regular review by the Council of the list of designated persons in Decision 2014/119/CFSP and Regulation (EU) No 208/2014. In order for any observations to be considered at the next review, they should be submitted by 13 January 2017.

---

(1)  OJ L 66, 6.3.2014, p. 26.

(2)  OJ L 66, 6.3.2014, p. 1.

---

European Commission

| 13.12.2016 | EN | Official Journal of the European Union | C 463/7 |
| --- | --- | --- | --- |

13.12.2016

EN

Official Journal of the European Union

C 463/7

---

Euro exchange rates (1)

12 December 2016

(2016/C 463/08)

1 euro =

| | Currency | Exchange rate |
| --- | --- | --- |
| USD | US dollar | 1,0596 |
| JPY | Japanese yen | 122,69 |
| DKK | Danish krone | 7,4371 |
| GBP | Pound sterling | 0,83900 |
| SEK | Swedish krona | 9,7445 |
| CHF | Swiss franc | 1,0772 |
| ISK | Iceland króna | |
| NOK | Norwegian krone | 8,9498 |
| BGN | Bulgarian lev | 1,9558 |
| CZK | Czech koruna | 27,027 |
| HUF | Hungarian forint | 314,02 |
| PLN | Polish zloty | 4,4530 |
| RON | Romanian leu | 4,5073 |
| TRY | Turkish lira | 3,7269 |
| AUD | Australian dollar | 1,4174 |
| CAD | Canadian dollar | 1,3918 |
| HKD | Hong Kong dollar | 8,2211 |
| NZD | New Zealand dollar | 1,4793 |
| SGD | Singapore dollar | 1,5145 |
| KRW | South Korean won | 1 237,73 |
| ZAR | South African rand | 14,5441 |
| CNY | Chinese yuan renminbi | 7,3225 |
| HRK | Croatian kuna | 7,5335 |
| IDR | Indonesian rupiah | 14 121,82 |
| MYR | Malaysian ringgit | 4,6750 |
| PHP | Philippine peso | 52,720 |
| RUB | Russian rouble | 64,8661 |
| THB | Thai baht | 37,764 |
| BRL | Brazilian real | 3,5953 |
| MXN | Mexican peso | 21,4472 |
| INR | Indian rupee | 71,4485 |

Currency

Exchange rate

USD

US dollar

1,0596

JPY

Japanese yen

122,69

DKK

Danish krone

7,4371

GBP

Pound sterling

0,83900

SEK

Swedish krona

9,7445

CHF

Swiss franc

1,0772

ISK

Iceland króna

NOK

Norwegian krone

8,9498

BGN

Bulgarian lev

1,9558

CZK

Czech koruna

27,027

HUF

Hungarian forint

314,02

PLN

Polish zloty

4,4530

RON

Romanian leu

4,5073

TRY

Turkish lira

3,7269

AUD

Australian dollar

1,4174

CAD

Canadian dollar

1,3918

HKD

Hong Kong dollar

8,2211

NZD

New Zealand dollar

1,4793

SGD

Singapore dollar

1,5145

KRW

South Korean won

1 237,73

ZAR

South African rand

14,5441

CNY

Chinese yuan renminbi

7,3225

HRK

Croatian kuna

7,5335

IDR

Indonesian rupiah

14 121,82

MYR

Malaysian ringgit

4,6750

PHP

Philippine peso

52,720

RUB

Russian rouble

64,8661

THB

Thai baht

37,764

BRL

Brazilian real

3,5953

MXN

Mexican peso

21,4472

INR

Indian rupee

71,4485

---

(1)  Source: reference exchange rate published by the ECB.

---

European Data Protection Supervisor

| 13.12.2016 | EN | Official Journal of the European Union | C 463/8 |
| --- | --- | --- | --- |

13.12.2016

EN

Official Journal of the European Union

C 463/8

---

Executive Summary of the Opinion of the European Data Protection Supervisor on effective enforcement in digital society economy

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2016/C 463/09)

Processing personal information is indispensable to web-based services. The EU’s Digital Single Market Strategy recognises the potential of data-driven technologies and services as a catalyst for economic growth. Such services over the internet have become dependent on often covert tracking of individuals, who are generally unaware of the nature and extent of that tracking. Dominant companies in these markets may be able to foreclose new entrants from competing on factors which could benefit the rights and interests of individuals, and may impose unfair terms and conditions which abusively exploit consumers. An apparent growing imbalance between web-based service providers and consumers may diminish choice, innovation and the quality of safeguards for privacy. This imbalance may also raise the effective price — in terms of personal data disclosure — far beyond what might be expected in fully competitive markets.

In 2014 the EDPS issued a Preliminary Opinion on Privacy and Competitiveness in the Age of Big Data. We observed a tendency, despite obvious synergies like transparency, accountability, choice and general welfare, for EU rules on data protection, consumer protection and antitrust enforcement and merger control to be applied in silos. We therefore launched a debate on how the EU’s objectives and standards might be applied more holistically. This new Opinion argues that the Digital Single Market Strategy presents an opportunity for a coherent approach, and updates the 2014 Preliminary Opinion with some practical recommendations to the EU institutions on how to remedy the situation. It addresses the mounting concern that concentration in digital markets could harm the interests of individuals as data subjects and consumers.

The EU institutions and bodies, and national authorities when implementing EU law, are required to uphold the rights and freedoms set out in the Charter of Fundamental Rights of the EU. Several of these provisions, including the rights to privacy and to the protection of personal data, freedom of expression and non-discrimination, are threatened by normative behaviour and standards that now prevail in cyberspace. The EU already has sufficient tools available for addressing market distortions that act against the interests of the individual and society in general. A number of practices in digital markets may infringe two or more applicable legal frameworks, each of which is underpinned by the notion of ‘fairness’. Like several studies in recent months, we are calling for more dialogue, lesson-learning and even collaboration between regulators of conduct in the digital environment. We also stress the need for the EU to create conditions online, as well as offline, in which the rights and freedoms of the Charter may thrive.

This Opinion therefore recommends establishing a Digital Clearing House for enforcement in the EU digital sector, a voluntary network of regulatory bodies to share information, voluntarily and within the bounds of their respective competences, about possible abuses in the digital ecosystem and the most effective way of tackling them. This should be supplemented by guidance on how regulators could coherently apply rules protecting the individual. We also recommend that the EU institutions with external experts explore the creation of a common area, a space on the web where, in line with the Charter, individuals are able to interact without being tracked. Finally, we recommend updating the rules on how authorities apply merger controls better to protect online privacy, personal information and freedom of expression.

I.   OPENING UP THE DEBATE

1.   Background and structure of this Opinion

Our 2014 Preliminary Opinion on ‘Privacy and Competitiveness in the Age of Big Data’ (hereafter, ‘the Preliminary Opinion’) compared EU legal frameworks for data protection, competition and consumers, and concluded that there were some obvious synergies in the context of digital markets (1). We made some tentative recommendations for EU institutions that were refined following a workshop hosted by EDPS in June 2014 (2), including:

| 1. | to understand better the ‘value’ of personal data in digital markets and review approaches to market analysis, in particular for those web-based services promoted as ‘free’, with retrospective or ex post analysis of the impact of enforcement decisions; |
| --- | --- |

1.

to understand better the ‘value’ of personal data in digital markets and review approaches to market analysis, in particular for those web-based services promoted as ‘free’, with retrospective or ex post analysis of the impact of enforcement decisions;

| 2. | to consider how to foster privacy-enhancing technologies as a competitive advantage; |
| --- | --- |

2.

to consider how to foster privacy-enhancing technologies as a competitive advantage;

| 3. | to review EU legislation and relevance for 21st century digital markets; |
| --- | --- |

3.

to review EU legislation and relevance for 21st century digital markets;

| 4. | to consider practical steps for cooperation between authorities, including closer dialogue and joint investigations. |
| --- | --- |

4.

to consider practical steps for cooperation between authorities, including closer dialogue and joint investigations.

VI.   CONCLUSION

Human rights were conceived as means for individuals to be safeguarded against state interference. Antitrust has its roots in political decisions to disrupt abusive monopoly power for the benefit of society at large. Consumer rights emerged as a bulwark against abusive traders.

Big Data opportunities for boosting productivity and connectivity should be accompanied by Big Data Protection safeguards. The EU in recent years has shown great leadership in seeking to stimulate a race-to-the-top on privacy standards in the digital arena. The General Data Protection Regulation provides a benchmark for protecting personal data in the digital economy. For a digital economy and society founded on the EU’s values, the EU can still do more with the tools available to ensure privacy friendly, fundamental-rights-enhancing products and services. Enhanced transparency, fair treatment, effective choice, absence of market foreclosure for non-tracking models are all entirely compatible and complementary goals.

The Digital Single Market Strategy is the right opportunity for the EU to work coherently towards these goals. Effective enforcement of EU law existing rules is of paramount importance. We believe our recommendations for a Digital Enforcement Clearing House, together with a more holistic approach to concentration and the promotion of an EU values-based common area, would be important steps forward. At a time when data protection and privacy laws are proliferating around the world, this should be a platform for greater bridge-building to other regions of the world, permitting greater dialogue and cooperation with all countries facing the same digital challenge.

This is not the final word on this discussion. The EDPS intends to continue to facilitate discussions and help to break down silos which hinder the protection of the interests and rights of the individual.

Done at Brussels, 23 September 2016.

Giovanni BUTTARELLI

European Data Protection Supervisor

---

(1)  EDPS Preliminary Opinion ‘Privacy and Competitiveness in the Age of Big Data, The interplay between data protection, competition law and consumer protection in the Digital Economy’, March 2014.

1

(2)  ‘Report of workshop on Privacy, Consumers, Competition and Big Data 2 June 2014’; https://secure.edps.europa.eu?EDPSWEB/webdav/site/mySite/shared/Documents/consultation/Big%20data

2

---

| 13.12.2016 | EN | Official Journal of the European Union | C 463/10 |
| --- | --- | --- | --- |

13.12.2016

EN

Official Journal of the European Union

C 463/10

---

Executive Summary of the Opinion of the European Data Protection Supervisor on Personal Information Management Systems

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2016/C 463/10)

This Opinion explores the concept of technologies and ecosystems aiming at empowering individuals to control the sharing of their personal data (‘personal information management systems’ or ‘PIMS’ for short).

Our vision is to create a new reality where individuals manage and control their online identity. Our aim to transform the current provider centric system into a human centric system where individuals are protected against unlawful processing of their data and against intrusive tracking and profiling techniques that aim at circumventing key data protection principles.

This new reality will be facilitated by the modernised EU regulatory framework and the possibilities offered by vigorous joined-up enforcement by all relevant supervisory and regulatory authorities.

The recently adopted General Data Protection Regulation (GDPR) strengthens and modernises the regulatory framework so that it remains effective in the era of big data by strengthening individuals’ trust and confidence online and in the Digital Single Market. The new rules, including those on increased transparency and powerful rights of access and data portability, serve to allow users more control over their data, and may also help contribute to more efficient markets for personal data, to the benefit of consumers and businesses.

Most recently we have issued an Opinion on effective enforcement of fundamental rights in the age of big data. This highlights current market conditions and business practices that create obstacles for effective exercise of individuals’ rights to the protection of their personal data and other fundamental rights, and calls for stepping up concerted and consistent enforcement of competition, consumer protection and data protection laws. We hope that this increased enforcement will serve to create market conditions in which privacy-friendly services can thrive. The approach in this Opinion aims at strengthening fundamental rights in our digital world at the same time as opening new opportunities for businesses to develop innovative personal data based services built on mutual trust. PIMS promise to offer not only a new technical architecture and organisation for data management, but also trust frameworks and, as a result, alternative business models for collecting and processing personal data in the era of big data, in a manner more respectful of European data protection law.

In this Opinion, we briefly describe what PIMS are, what problems they are intended to solve, and how. We then analyse how they can contribute to a better protection of personal data and what challenges they face. Finally, we identify ways forward to build upon the opportunities they offer. For new data protection business models to thrive, additional incentives for the service providers offering them may be necessary. It should be explored, in particular, which policy initiatives could motivate data controllers to accept this way of data provision. Furthermore, an initiative by public services to accept PIMS as a data source instead of direct data collection could add critical mass to the acceptance of PIMS.

The emerging landscape of PIMS, aiming at putting individuals and consumers back in control of their personal data, deserves consideration, support and further research with a view to contributing to a sustainable and ethical use of big data and to the effective implementation of the principles of the recently adopted GDPR.

I.   PIMS: SHARING DATA, SHARING BENEFITS?

| 1. | Current conditions for the processing of personal data are often unfair to the individuals whose data are processed. Legal conditions and technical tools make it difficult for individuals to exercise their rights and allow controllers to limit their liability. Data brokers, advertising networks, social network providers and other corporate actors have ever more complete files on individuals participating in today’s digital society, and individuals are losing control over the digital footprints they leave behind. Targeted, profiled and assessed by actors often beyond their control or even knowledge, individuals may feel helpless and need to be empowered to take control of their identity. Even where formally having been given some form of a ‘notice’ and opportunity to ‘consent’ to general terms and conditions, individuals often find themselves inside a system designed to maximise the monetisation of personal data, which leaves no real choice or control to individuals. |
| --- | --- |

1.

Current conditions for the processing of personal data are often unfair to the individuals whose data are processed. Legal conditions and technical tools make it difficult for individuals to exercise their rights and allow controllers to limit their liability. Data brokers, advertising networks, social network providers and other corporate actors have ever more complete files on individuals participating in today’s digital society, and individuals are losing control over the digital footprints they leave behind. Targeted, profiled and assessed by actors often beyond their control or even knowledge, individuals may feel helpless and need to be empowered to take control of their identity. Even where formally having been given some form of a ‘notice’ and opportunity to ‘consent’ to general terms and conditions, individuals often find themselves inside a system designed to maximise the monetisation of personal data, which leaves no real choice or control to individuals.

| 2. | The European Commission’s communication on big data (1) sets out a plan of actions jointly aiming at personal data and consumer protection. This specifically encourages the use of ‘personal data spaces’ as user-centric, safe and secure places to store and possibly allow others to access personal data. We share the view that innovative digital tools and business models based on the empowerment of individuals should be encouraged. These may allow individuals to benefit from such data-sharing, that is to participate in the use and distribution of their personal information. |
| --- | --- |

2.

The European Commission’s communication on big data (1) sets out a plan of actions jointly aiming at personal data and consumer protection. This specifically encourages the use of ‘personal data spaces’ as user-centric, safe and secure places to store and possibly allow others to access personal data. We share the view that innovative digital tools and business models based on the empowerment of individuals should be encouraged. These may allow individuals to benefit from such data-sharing, that is to participate in the use and distribution of their personal information.

| 3. | In our Opinion on ‘Meeting the challenges of big data’ (2) we argued that we should complement the legal obligation of effective consent with real, practical control over personal information. We argued that ‘instead of an administrative burden, providing access rights may become a feature of the service provided to the customers’, and that organisations based on exploiting ‘big data’ should ‘be prepared to share the wealth created by the processing of personal data with those individuals whose data they process’. In that context we noted that ‘personal data stores could help address some of the concerns over the loss of individual control over personal data’. The recently adopted General Data Protection Regulation (GDPR) (3) has strengthened the legal requirements for consent (4) and has introduced effective, modern principles of data protection by design and by default (5), as well as a new right to data portability (6). In order for the new framework for data protection to deliver its promise we need practical tools to enable individuals to exercise their rights in a convenient, user-friendly way. |
| --- | --- |

3.

In our Opinion on ‘Meeting the challenges of big data’ (2) we argued that we should complement the legal obligation of effective consent with real, practical control over personal information. We argued that ‘instead of an administrative burden, providing access rights may become a feature of the service provided to the customers’, and that organisations based on exploiting ‘big data’ should ‘be prepared to share the wealth created by the processing of personal data with those individuals whose data they process’. In that context we noted that ‘personal data stores could help address some of the concerns over the loss of individual control over personal data’. The recently adopted General Data Protection Regulation (GDPR) (3) has strengthened the legal requirements for consent (4) and has introduced effective, modern principles of data protection by design and by default (5), as well as a new right to data portability (6). In order for the new framework for data protection to deliver its promise we need practical tools to enable individuals to exercise their rights in a convenient, user-friendly way.

| 4. | This Opinion explores new technologies and ecosystems which aim to empower individuals to control the collection and sharing of their personal data. We will refer to this concept as ‘personal information management system’ (‘PIMS’) (7). The PIMS concept offers a new approach by which individuals are the holders of their own personal information. It may create a paradigm shift in personal data management and processing, with social and economic consequences. In contrast, the current landscape of online services is characterised by a small number of service providers that dominate the market by monetising users’ personal data in exchange for ‘free’ services. This is often accompanied by an imbalance of power, where the customer is left with a ‘take it or leave it’ approach, and by information asymmetry between service providers and users, with little or no transparency for the individuals on what is going on with their personal data. |
| --- | --- |

4.

This Opinion explores new technologies and ecosystems which aim to empower individuals to control the collection and sharing of their personal data. We will refer to this concept as ‘personal information management system’ (‘PIMS’) (7). The PIMS concept offers a new approach by which individuals are the holders of their own personal information. It may create a paradigm shift in personal data management and processing, with social and economic consequences. In contrast, the current landscape of online services is characterised by a small number of service providers that dominate the market by monetising users’ personal data in exchange for ‘free’ services. This is often accompanied by an imbalance of power, where the customer is left with a ‘take it or leave it’ approach, and by information asymmetry between service providers and users, with little or no transparency for the individuals on what is going on with their personal data.

| 5. | The core idea behind the PIMS concept is to transform the current provider centric system into a system centred on individuals able to manage and control their online identity (8). In principle, individuals should be able to decide whether and with whom to share their personal information, for what purposes, for how long, and to keep track of them and decide to take them back when so wished. It is worth exploring how PIMS could help address some of the concerns over the loss of individual control over personal data that have been highlighted as one of the key concerns about big data (9). |
| --- | --- |

5.

The core idea behind the PIMS concept is to transform the current provider centric system into a system centred on individuals able to manage and control their online identity (8). In principle, individuals should be able to decide whether and with whom to share their personal information, for what purposes, for how long, and to keep track of them and decide to take them back when so wished. It is worth exploring how PIMS could help address some of the concerns over the loss of individual control over personal data that have been highlighted as one of the key concerns about big data (9).

| 6. | This approach aims at strengthening fundamental rights in our digital world at the same time as opening new opportunities for businesses to develop innovative personal data based services built on mutual trust. PIMS promise to offer a new technical architecture and organisation for data management which build trust frameworks. They hope to enable alternative business models for collecting and processing personal data in the era of big data, which do so in a manner more respectful of European data protection law. |
| --- | --- |

6.

This approach aims at strengthening fundamental rights in our digital world at the same time as opening new opportunities for businesses to develop innovative personal data based services built on mutual trust. PIMS promise to offer a new technical architecture and organisation for data management which build trust frameworks. They hope to enable alternative business models for collecting and processing personal data in the era of big data, which do so in a manner more respectful of European data protection law.

| 7. | In this Opinion, we briefly describe what PIMS are, what problems they are intended to solve and how (10). We analyse how they can contribute to a better protection of personal data and what challenges they face. Finally, we identify ways forward to build upon the opportunities they offer. |
| --- | --- |

7.

In this Opinion, we briefly describe what PIMS are, what problems they are intended to solve and how (10). We analyse how they can contribute to a better protection of personal data and what challenges they face. Finally, we identify ways forward to build upon the opportunities they offer.

IV.   CONCLUSIONS AND NEXT STEPS

4.1.   Towards full application of the GDPR — opportunities

| 54. | As noted above, the EU legislator recently adopted a data protection reform package that strengthens and modernises the regulatory framework so that it remains effective in the era of big data. |
| --- | --- |

54.

As noted above, the EU legislator recently adopted a data protection reform package that strengthens and modernises the regulatory framework so that it remains effective in the era of big data.

| 55. | The new GDPR, including rules on increased transparency, and powerful rights of access and data portability, should help give individuals more control over their data, and may also contribute to more efficient markets for personal data, to the benefit of consumers and businesses alike. |
| --- | --- |

55.

The new GDPR, including rules on increased transparency, and powerful rights of access and data portability, should help give individuals more control over their data, and may also contribute to more efficient markets for personal data, to the benefit of consumers and businesses alike.

| 56. | Codes of conduct and certification schemes as provided for by the GDPR are privileged instruments to give specific visibility and role to technology and products that — like PIMS — may serve to more effectively implement data protection law at the practical level. |
| --- | --- |

56.

Codes of conduct and certification schemes as provided for by the GDPR are privileged instruments to give specific visibility and role to technology and products that — like PIMS — may serve to more effectively implement data protection law at the practical level.

| 57. | However, PIMS face the overarching difficulty of penetrating a market dominated by online services based on business models and technical architectures where individuals are not in control of their data, as explained in Section 3.9. Shifting to a situation where individuals have the effective possibility to give a service provider access to some data in their PIMS instead of providing the data directly to the service provider will require additional incentives for the service providers. The Commission may use the initiatives it has announced on data flows and data ownership (11) to explore which additional policy initiatives could motivate data controllers to accept this way of providing data. Furthermore, an initiative by public eGovernment services to accept PIMS as a data source instead of direct data collection could add critical mass to the acceptance of PIMS. |
| --- | --- |

57.

However, PIMS face the overarching difficulty of penetrating a market dominated by online services based on business models and technical architectures where individuals are not in control of their data, as explained in Section 3.9. Shifting to a situation where individuals have the effective possibility to give a service provider access to some data in their PIMS instead of providing the data directly to the service provider will require additional incentives for the service providers. The Commission may use the initiatives it has announced on data flows and data ownership (11) to explore which additional policy initiatives could motivate data controllers to accept this way of providing data. Furthermore, an initiative by public eGovernment services to accept PIMS as a data source instead of direct data collection could add critical mass to the acceptance of PIMS.

| 58. | This analysis could be complemented by measures aiming at laying the technical, societal and economic foundations, including standardisation efforts, economic incentives and fostering research and pilot projects. |
| --- | --- |

58.

This analysis could be complemented by measures aiming at laying the technical, societal and economic foundations, including standardisation efforts, economic incentives and fostering research and pilot projects.

| 59. | The European Union and Member States public administrations, and projects co-financed by them, are the first places where this change of perspective should be tested, fostered and hopefully realised. |
| --- | --- |

59.

The European Union and Member States public administrations, and projects co-financed by them, are the first places where this change of perspective should be tested, fostered and hopefully realised.

4.2.   Supporting PIMS and underlying technology towards effective data protection

| 60. | Good regulation, while crucial, is not sufficient in itself. As we stated in our Opinion on ‘Meeting the challenges of big data’ (12), companies and other organisations that invest a lot of effort into finding innovative ways to make use of personal data, should use the same innovative mind-set when implementing data protection principles. |
| --- | --- |

60.

Good regulation, while crucial, is not sufficient in itself. As we stated in our Opinion on ‘Meeting the challenges of big data’ (12), companies and other organisations that invest a lot of effort into finding innovative ways to make use of personal data, should use the same innovative mind-set when implementing data protection principles.

| 61. | The contribution of technology in the PIMS model is fundamental. PIMS can serve to test data protection by design approaches and technologies supporting them. Relevant research topics, where adequate support and investments are needed, include: interoperable and privacy-friendly identity management; authorisation mechanisms; data interoperability; data security; and mechanisms for automatic enforcement of established ‘contracts’ between individuals and other parties. All this is leveraged by cryptography and encryption and boosted by the cheap availability of computing power. Decisive support by policy makers, such as the Commission, to basic and applied research in these technology domains is necessary in this initial phase so as not to lose current opportunities. |
| --- | --- |

61.

The contribution of technology in the PIMS model is fundamental. PIMS can serve to test data protection by design approaches and technologies supporting them. Relevant research topics, where adequate support and investments are needed, include: interoperable and privacy-friendly identity management; authorisation mechanisms; data interoperability; data security; and mechanisms for automatic enforcement of established ‘contracts’ between individuals and other parties. All this is leveraged by cryptography and encryption and boosted by the cheap availability of computing power. Decisive support by policy makers, such as the Commission, to basic and applied research in these technology domains is necessary in this initial phase so as not to lose current opportunities.

| 62. | In order to foster research and development and deployment to market in the area of PIMS, we recommend that the Commission plan for possible synergies with other areas of the Digital Single Market strategy, such as Cloud Computing and the internet of Things. In this way, pilot projects could be carried out to design and test the interaction of cloud services and IoT with PIMS. |
| --- | --- |

62.

In order to foster research and development and deployment to market in the area of PIMS, we recommend that the Commission plan for possible synergies with other areas of the Digital Single Market strategy, such as Cloud Computing and the internet of Things. In this way, pilot projects could be carried out to design and test the interaction of cloud services and IoT with PIMS.

4.3.   How the EDPS will advance this debate

| 63. | The EDPS aims to contribute to fostering private and public efforts in the direction outlined above. We will continue to facilitate discussions, including via organisation of events/workshops, for example, with the view to identify, encourage and promote best practice to increase transparency and user control and explore the opportunities offered by PIMS. We will also continue to facilitate the work of the internet Privacy Engineering Network (IPEN) as an interdisciplinary knowledge hub for engineers and privacy experts. In this context, we will continue to provide a platform for developers and promoters of PIMS to benefit from exchanges with specialists in other technologies and data protection. |
| --- | --- |

63.

The EDPS aims to contribute to fostering private and public efforts in the direction outlined above. We will continue to facilitate discussions, including via organisation of events/workshops, for example, with the view to identify, encourage and promote best practice to increase transparency and user control and explore the opportunities offered by PIMS. We will also continue to facilitate the work of the internet Privacy Engineering Network (IPEN) as an interdisciplinary knowledge hub for engineers and privacy experts. In this context, we will continue to provide a platform for developers and promoters of PIMS to benefit from exchanges with specialists in other technologies and data protection.

Done at Marrakesh, 20 October 2016.

Giovanni BUTTARELLI

European Data Protection Supervisor

---

(1)  Communication COM(2014) 442 on a thriving data-driven economy: https://ec.europa.eu/digital-single-market/en/news/communication-data-driven-economy

1

(2)  EDPS Opinion 7/2015: https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2015/15-11-19_Big_Data_EN.pdf. See more specifically Section 3.

2

(3)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

3

(4)  See, inter alia, Articles 6(1)(a), 7 and 8 and recitals 42-43 GDPR.

4

(5)  Article 25 GDPR.

5

(6)  Article 20 GDPR.

6

(7)  Related concepts include ‘personal data stores’, ‘personal data spaces’ or ‘personal data vaults.’ We will use the term ‘PIMS’ in this Opinion, as it appears to best describe the concept in a general and easily understandable way. As used in this Opinion, the abbreviation ‘PIMS’ may refer to either the singular or the plural form: personal information management system or personal information management systems.

7

(8)  See recital 7 GDPR: ‘Natural persons should have control of their own personal data’. See also, for example, Doc Searls, The Intention Economy: When Customers Take Charge (Boston: Harvard Business Review Press, 2012).

8

The Intention Economy: When Customers Take Charge

(9)  See, e.g. Ira S. Rubinstein, Big Data: The End of Privacy or a New Beginning? International Data Privacy Law, 2013, Vol 3, No 2.

9

(10)  See, for example, the report on Personal Data Stores drafted by the University of Cambridge for the European Commission: https://ec.europa.eu/digital-single-market/en/news/study-personal-data-stores-conducted-cambridge-university-judge-business-school

10

(11)  Communication: Digitising European Industry — Reaping the full benefits of a Digital Single Market http://europa.eu/rapid/press-release_MEMO-16-1409_en.htm

11

(12)  EDPS Opinion 7/2015, cited above.

12

---

| 13.12.2016 | EN | Official Journal of the European Union | C 463/14 |
| --- | --- | --- | --- |

13.12.2016

EN

Official Journal of the European Union

C 463/14

---

Executive Summary of the Opinion of the European Data Protection Supervisor on the second EU Smart Borders package

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2016/C 463/11)

EXECUTIVE SUMMARY

The establishment of an Entry/Exit System (EES) that will record entries and exits of third country nationals on the territory of the European Union has been envisaged for a long time by the EU legislator. The Commission adopted three proposals as part of the first Smart Borders package in 2013; the co-legislators expressed serious concerns and the package did not reach a consensus. Then the Commission launched a proof of concept exercise in response to those concerns, and released this year a second Smart Borders package now composed of two revised proposals.

The EDPS has carefully analysed these proposals and issues recommendations with a view to assist the legislator so as to ensure that the legal framework applicable to the EES scheme will be fully compliant with EU privacy and data protection law, in particular Articles 7 and 8 of the EU Charter of Fundamental Rights.

The EDPS recognises the need for coherent and effective information systems for borders and security. These proposals come at a crucial moment when the EU is confronted with serious challenges in this area. However the EDPS underlines the significant and potentially intrusive nature of the proposed processing of personal data under the EES, which must therefore be considered under both Articles 7 and 8 of the Charter. Necessity and proportionality of the EES scheme are to be assessed both globally, taking into consideration the already existing large-scale IT systems in the EU, and specifically, in the specific case of these third country nationals who are lawful visitors of the EU. The EDPS notes that EES data will be processed for two different purposes, on the one hand for border management and facilitation purposes and on the other hand for law enforcement purposes. The EDPS strongly recommends clearly introducing the difference between these objectives throughout the 2016 EES Proposal itself, as these purposes entail a different impact on the rights to privacy and data protection.

While he welcomes the attention to privacy and data protection concerns previously expressed and the improvements in the revised proposals, the EDPS raises serious concerns as regards several aspects of the EES Proposal that should be better justified, or even reconsidered by the legislator, in particular:

| — | the five years' retention period of EES data. The EDPS notes that the need for keeping overstayers' data for five years should be better demonstrated, and that a retention period of five years for all personal data stored in the EES appears to be disproportionate, |
| --- | --- |

—

the five years' retention period of EES data. The EDPS notes that the need for keeping overstayers' data for five years should be better demonstrated, and that a retention period of five years for all personal data stored in the EES appears to be disproportionate,

| — | the collection of the facial images of visa-required travellers, whose facial images are already stored in the VIS, |
| --- | --- |

—

the collection of the facial images of visa-required travellers, whose facial images are already stored in the VIS,

| — | the need for access to EES data by law enforcement authorities, which is not sufficiently supported by convincing evidence; |
| --- | --- |

—

the need for access to EES data by law enforcement authorities, which is not sufficiently supported by convincing evidence;

| — | the prerequisite for a data subject to provide fingerprints when exercising his/her rights of access, correction and/or deletion of his/her personal data which could be an important obstacle to the effective exercise of these rights. |
| --- | --- |

—

the prerequisite for a data subject to provide fingerprints when exercising his/her rights of access, correction and/or deletion of his/her personal data which could be an important obstacle to the effective exercise of these rights.

The Opinion further provides additional recommendations in terms of data protection and privacy that should be taken in consideration in the legislative process, including the security of the system.

I.   INTRODUCTION AND BACKGROUND

| 1. | The Commission first announced its intention to build a European Entry/Exit System in order to control entries and exits of third country nationals on the territory of the European Union in 2008 (1). At that time the EDPS first gave his preliminary comments (2) on the idea and then highlighted specific issues in an Opinion of July 2011 (3). The Commission further elaborated its views in a communication (4) entitled ‘Smart borders — Options and the way ahead’ of October 2011, on which the Article 29 Working Party provided comments (5). The EDPS also gave input in a joint round table with various stakeholders (6). |
| --- | --- |

1.

The Commission first announced its intention to build a European Entry/Exit System in order to control entries and exits of third country nationals on the territory of the European Union in 2008 (1). At that time the EDPS first gave his preliminary comments (2) on the idea and then highlighted specific issues in an Opinion of July 2011 (3). The Commission further elaborated its views in a communication (4) entitled ‘Smart borders — Options and the way ahead’ of October 2011, on which the Article 29 Working Party provided comments (5). The EDPS also gave input in a joint round table with various stakeholders (6).

| 2. | In February 2013, the Commission adopted three proposals as part of the first Smart Borders package: a proposal to build and Entry/Exit System (7) (hereinafter ‘the 2013 EES Proposal’), a proposal to establish a Registered Traveller Programme (8) (hereinafter ‘the 2013 RTP Proposal’) and a proposal amending the Schengen Border Code (9) to introduce these changes accordingly. The package immediately faced criticisms from both co-legislators due to technical, operational and cost concerns, as well as important data protection concerns. The same year, the EDPS provided his first concrete recommendations on the three proposals in the form of an Opinion (10). The Article 29 Working Party also issued an Opinion (11), to which the EDPS contributed, which questioned the necessity of the Entry/Exit System as such. |
| --- | --- |

2.

In February 2013, the Commission adopted three proposals as part of the first Smart Borders package: a proposal to build and Entry/Exit System (7) (hereinafter ‘the 2013 EES Proposal’), a proposal to establish a Registered Traveller Programme (8) (hereinafter ‘the 2013 RTP Proposal’) and a proposal amending the Schengen Border Code (9) to introduce these changes accordingly. The package immediately faced criticisms from both co-legislators due to technical, operational and cost concerns, as well as important data protection concerns. The same year, the EDPS provided his first concrete recommendations on the three proposals in the form of an Opinion (10). The Article 29 Working Party also issued an Opinion (11), to which the EDPS contributed, which questioned the necessity of the Entry/Exit System as such.

| 3. | Early 2014, in response to those concerns, the Commission announced the launch of a proof of concept exercise consisting of two steps: first a Technical Study (12) and a Cost Study (13) to identify the most suitable options and solutions to implement Smart Borders, followed in the course of 2015 by a pilot project (14) led by the European Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (hereinafter ‘eu-LISA’) in order to test the different options identified. In parallel, the Commission launched a three-month public consultation (15) in July 2015 to collect views and opinions from citizens and organisations, to which the EDPS also contributed (16). |
| --- | --- |

3.

Early 2014, in response to those concerns, the Commission announced the launch of a proof of concept exercise consisting of two steps: first a Technical Study (12) and a Cost Study (13) to identify the most suitable options and solutions to implement Smart Borders, followed in the course of 2015 by a pilot project (14) led by the European Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (hereinafter ‘eu-LISA’) in order to test the different options identified. In parallel, the Commission launched a three-month public consultation (15) in July 2015 to collect views and opinions from citizens and organisations, to which the EDPS also contributed (16).

| 4. | On 6 April 2016, the Commission released a second Smart Borders package (17). This time, only one system is proposed: the Entry/Exit System (hereinafter ‘the EES’). The Commission decided to revise its 2013 EES Proposal and the 2013 Proposal amending the Schengen Borders Code, but to withdraw its 2013 RTP Proposal. Today's Smart Borders package is composed of:






  — | a communication on ‘Stronger and Smarter Information Systems for Borders and Security’ (18), |
| --- | --- | --- |

4.

On 6 April 2016, the Commission released a second Smart Borders package (17). This time, only one system is proposed: the Entry/Exit System (hereinafter ‘the EES’). The Commission decided to revise its 2013 EES Proposal and the 2013 Proposal amending the Schengen Borders Code, but to withdraw its 2013 RTP Proposal. Today's Smart Borders package is composed of:

—

a communication on ‘Stronger and Smarter Information Systems for Borders and Security’ (18),

| — | a proposal for a Regulation of the European Parliament and of the Council establishing an Entry/Exit System to register entry and exit data and refusal of entry data of third country nationals crossing the external borders of the Member States of the European Union and determining the conditions for access to the EES for law enforcement purposes and amending Regulation (EC) No 767/2008 and Regulation (EU) No 1077/2011 (19) (hereinafter ‘the 2016 EES Proposal’), and |
| --- | --- |

—

a proposal for a Regulation of the European Parliament and of the Council establishing an Entry/Exit System to register entry and exit data and refusal of entry data of third country nationals crossing the external borders of the Member States of the European Union and determining the conditions for access to the EES for law enforcement purposes and amending Regulation (EC) No 767/2008 and Regulation (EU) No 1077/2011 (19) (hereinafter ‘the 2016 EES Proposal’), and

| — | a proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2016/399 (20) as regards the use of the Entry/Exit System (21) (hereinafter ‘the 2016 Proposal Amending the Schengen Borders Code’). |
| --- | --- |

—

a proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2016/399 (20) as regards the use of the Entry/Exit System (21) (hereinafter ‘the 2016 Proposal Amending the Schengen Borders Code’).

| 5. | In addition, a detailed impact assessment (22) accompanies the two proposals. |
| --- | --- |

5.

In addition, a detailed impact assessment (22) accompanies the two proposals.

| 6. | The Smart Borders package has gained new momentum following the current migration crisis and recent terrorist attacks in Europe. The Dutch Presidency and the Slovakian Presidency announced that they plan on working intensely on the package with a view to reaching a political agreement by the end of 2016 (23). |
| --- | --- |

6.

The Smart Borders package has gained new momentum following the current migration crisis and recent terrorist attacks in Europe. The Dutch Presidency and the Slovakian Presidency announced that they plan on working intensely on the package with a view to reaching a political agreement by the end of 2016 (23).

| 7. | The EDPS welcomes that he has been consulted informally by the Commission before the adoption of the new proposals. He also welcomes the good cooperation (24) between DG HOME and the EDPS throughout the process of renewing the first Smart Borders package. |
| --- | --- |

7.

The EDPS welcomes that he has been consulted informally by the Commission before the adoption of the new proposals. He also welcomes the good cooperation (24) between DG HOME and the EDPS throughout the process of renewing the first Smart Borders package.

IV.   CONCLUSION

| 90. | The EDPS welcomes the work done by the Commission in the 2016 EES Proposal to address data protection concerns raised about the 2013 Smart Borders package. Some of the EDPS' recommendations and comments in his previous Opinion on the package have been duly taken into account, for example regarding the introduction of fall-back procedures in case of technical impossibility or failure of the system. |
| --- | --- |

90.

The EDPS welcomes the work done by the Commission in the 2016 EES Proposal to address data protection concerns raised about the 2013 Smart Borders package. Some of the EDPS' recommendations and comments in his previous Opinion on the package have been duly taken into account, for example regarding the introduction of fall-back procedures in case of technical impossibility or failure of the system.

| 91. | The EDPS welcomes the efforts made by the Commission to justify the necessity of setting up the EES scheme, but has main recommendations directly related to its proportionality in order to ensure full compliance of the EES with the essential prerequisite of Article 52(1) of the Charter to be both necessary and proportionate. He points out that necessity and proportionality of the EES scheme are to be assessed both globally, taking into consideration the already existing large-scale IT systems in the EU, and specifically, in the specific case of these third country nationals who are lawful visitors of the EU. He considers that a retention period of five years for all personal data stored in the EES should be fully justified. He also stresses that the following aspects of the 2016 EES Proposal should be better justified and supported by convincing evidence: the collection of the facial image of visa-required travellers, the five years' retention period for overstayers and the need for access to EES data by law enforcement authorities. Quod non, these aspects should be reconsidered by the EU legislator. |
| --- | --- |

91.

The EDPS welcomes the efforts made by the Commission to justify the necessity of setting up the EES scheme, but has main recommendations directly related to its proportionality in order to ensure full compliance of the EES with the essential prerequisite of Article 52(1) of the Charter to be both necessary and proportionate. He points out that necessity and proportionality of the EES scheme are to be assessed both globally, taking into consideration the already existing large-scale IT systems in the EU, and specifically, in the specific case of these third country nationals who are lawful visitors of the EU. He considers that a retention period of five years for all personal data stored in the EES should be fully justified. He also stresses that the following aspects of the 2016 EES Proposal should be better justified and supported by convincing evidence: the collection of the facial image of visa-required travellers, the five years' retention period for overstayers and the need for access to EES data by law enforcement authorities. Quod non, these aspects should be reconsidered by the EU legislator.

| 92. | Furthermore, considering the wide-ranging interference with fundamental rights to privacy and data protection of third country nationals, the EDPS considers that the EES should remain a border management tool purely designed with this purpose in mind. Therefore, the difference between the stated objectives of EES, i.e. the primary objectives of border management and facilitation and the secondary objective of law enforcement, should be clearly introduced and reflected throughout the 2016 EES Proposal, in particular in relation to Articles 1 and 5. |
| --- | --- |

92.

Furthermore, considering the wide-ranging interference with fundamental rights to privacy and data protection of third country nationals, the EDPS considers that the EES should remain a border management tool purely designed with this purpose in mind. Therefore, the difference between the stated objectives of EES, i.e. the primary objectives of border management and facilitation and the secondary objective of law enforcement, should be clearly introduced and reflected throughout the 2016 EES Proposal, in particular in relation to Articles 1 and 5.

| 93. | In addition, the EDPS has concerns regarding the requirement for all data subjects to provide in any event fingerprints to submit any request for access, correction and deletion of their personal data. This could create an important obstacle to the effective exercise of the right of access, an important guarantee for the data subject included in Article 8(2) of the EU Charter. |
| --- | --- |

93.

In addition, the EDPS has concerns regarding the requirement for all data subjects to provide in any event fingerprints to submit any request for access, correction and deletion of their personal data. This could create an important obstacle to the effective exercise of the right of access, an important guarantee for the data subject included in Article 8(2) of the EU Charter.

| 94. | Other recommendations of the EDPS in the present Opinion concern the following aspects and articles:






  — | Article 14 should be detailed so that, in cases where facial images of third country nationals are taken live, a minimum level of quality is reached for these pictures, and Article 33 should specify that the Commission will provide detailed information on how to reach the necessary level of quality for facial images taken live. |
| --- | --- | --- |

94.

Other recommendations of the EDPS in the present Opinion concern the following aspects and articles:

—

Article 14 should be detailed so that, in cases where facial images of third country nationals are taken live, a minimum level of quality is reached for these pictures, and Article 33 should specify that the Commission will provide detailed information on how to reach the necessary level of quality for facial images taken live.

| — | Article 15(3) should be amended so as to specify what information may be collected, stored and use by the border authorities when they request further clarification on the grounds for the temporary impossibility to provide fingerprints. |
| --- | --- |

—

Article 15(3) should be amended so as to specify what information may be collected, stored and use by the border authorities when they request further clarification on the grounds for the temporary impossibility to provide fingerprints.

| — | Article 39 should provide for the strong need for coordination between eu-LISA and Member States with regard to ensuring security of the EES. |
| --- | --- |

—

Article 39 should provide for the strong need for coordination between eu-LISA and Member States with regard to ensuring security of the EES.

| — | The security responsibilities should be made clear in the Proposal in case of interconnection of national facilitation programmes from Member States to the EES. The new Article 8e of the Schengen Borders Code should specify that security must be ensured following a proper information security risk assessment and describe the necessary security measures. |
| --- | --- |

—

The security responsibilities should be made clear in the Proposal in case of interconnection of national facilitation programmes from Member States to the EES. The new Article 8e of the Schengen Borders Code should specify that security must be ensured following a proper information security risk assessment and describe the necessary security measures.

| — | The Proposal should clearly specify that eu-LISA is responsible for the security of the web service, the security of the personal data it contains and the process to get the personal data from the central system into the web service. |
| --- | --- |

—

The Proposal should clearly specify that eu-LISA is responsible for the security of the web service, the security of the personal data it contains and the process to get the personal data from the central system into the web service.

| — | Article 44(1) should be amended in order to include in the information communicated to data subjects: the retention period applying to their data, the right for overstayers to have their personal data deleted in case they provide evidence that they exceeded the authorised duration of stay due to unforeseeable and serious events and an explanation of the fact that the EES data will be accessed for border management and facilitation purposes. |
| --- | --- |

—

Article 44(1) should be amended in order to include in the information communicated to data subjects: the retention period applying to their data, the right for overstayers to have their personal data deleted in case they provide evidence that they exceeded the authorised duration of stay due to unforeseeable and serious events and an explanation of the fact that the EES data will be accessed for border management and facilitation purposes.

| — | Article 46(1) should fix a strict harmonised deadline that would be no longer than a few months to answer access requests. |
| --- | --- |

—

Article 46(1) should fix a strict harmonised deadline that would be no longer than a few months to answer access requests.

| — | Article 9(2) should be amended with a clear description of safeguards that would ensure that a proper attention is given to data relating to children, the elderly and persons with a disability. |
| --- | --- |

—

Article 9(2) should be amended with a clear description of safeguards that would ensure that a proper attention is given to data relating to children, the elderly and persons with a disability.

| — | Article 57 should be amended and require of eu-LISA to develop functionalities that would allow Member States, the Commission, eu-LISA and Frontex to automatically extract the required statistics directly from the EES Central System, without the need for an additional repository. |
| --- | --- |

—

Article 57 should be amended and require of eu-LISA to develop functionalities that would allow Member States, the Commission, eu-LISA and Frontex to automatically extract the required statistics directly from the EES Central System, without the need for an additional repository.

| — | The Proposal should provide the EDPS with the appropriate information and resources so that his new responsibilities as Supervisor of the future EES may be carried out effectively and efficiently. |
| --- | --- |

—

The Proposal should provide the EDPS with the appropriate information and resources so that his new responsibilities as Supervisor of the future EES may be carried out effectively and efficiently.

| — | Article 28(2) should provide a strict deadline for the verifying authorities to perform the ex post verification of the conditions to access EES data for law enforcement purposes in case of emergency. |
| --- | --- |

—

Article 28(2) should provide a strict deadline for the verifying authorities to perform the ex post verification of the conditions to access EES data for law enforcement purposes in case of emergency.

| — | Article 28(3) should be modified to impose that designated authorities and the verifying authority are not part of the same organisation. |
| --- | --- |

—

Article 28(3) should be modified to impose that designated authorities and the verifying authority are not part of the same organisation.

| 95. | The EDPS insists on the need to address these issues in a global perspective. He encourages the legislator to continue his exercise of mapping the different databases in the border and migration context, better coordinating and avoiding overlap between the different systems, while fully respecting data protection standards and in its relations with third countries. |
| --- | --- |

95.

The EDPS insists on the need to address these issues in a global perspective. He encourages the legislator to continue his exercise of mapping the different databases in the border and migration context, better coordinating and avoiding overlap between the different systems, while fully respecting data protection standards and in its relations with third countries.

Done at Brussels, 21 September 2016.

Giovanni BUTTARELLI

European Data Protection Supervisor

---

(1)  Commission communication of 13 February 2008 on ‘Preparing the next steps in border management in the European Union’, COM(2008) 69 final.

1

(2)  EDPS Preliminary comments of 3 March 2008 on three communications on border management.

2

(3)  EDPS Opinion of 7 July 2011 on the communication on Migration.

3

(4)  Commission communication of 25 October 2011 on ‘Smart borders — Options and the way ahead’, COM(2011) 680 final.

4

(5)  The Article 29 Working Party commented on the communication from the Commission on Smart Borders in a letter addressed to Commissioner Malmström of 12 June 2012.

5

(6)  EDPS Round Table on the Smart Borders package and data protection implications, Brussels, 10 April 2013, see summary available at: http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/EDPS/PressNews/Events/2013/13-04-10_Summary_smart_borders_final_EN.pdf.

6

(7)  Proposal for a Regulation of the European Parliament and of the Council establishing an Entry/Exit System (EES) to register entry and exit data of third country nationals crossing the external borders of the Member States of the European Union, COM(2013) 95 final.

7

(8)  Proposal for a Regulation of the European Parliament and of the Council establishing a Registered Traveller Programme, COM(2013) 97 final.

8

(9)  Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 562/2006 as regards the use of the Entry/Exit System (EES) and the Registered Traveller Programme (RTP), COM(2013) 96 final.

9

(10)  EDPS Opinion of 18 July 2013 on the Proposals for a Regulation establishing an Entry/Exit System (EES) and a Regulation establishing a Registered Traveller Programme (RTP).

10

(11)  Article 29 Working Party Opinion 05/2013 of 6 June 2013 on Smart Borders.

11

(12)  Technical Study on Smart Borders — Final Report, October 2014, available at: http://ec.europa.eu/dgs/home-affairs/what-we-do/policies/borders-and-visas/smart-borders/docs/smart_borders_technical_study_en.pdf

12

(13)  Technical Study on Smart Borders — Cost Analysis, October 2014, available at: http://ec.europa.eu/dgs/home-affairs/what-we-do/policies/borders-and-visas/smart-borders/docs/smart_borders_costs_study_en.pdf

13

(14)  eu-LISA Final Report on the Smart Borders Pilot Project, December 2015, available at: http://ec.europa.eu/dgs/home-affairs/what-we-do/policies/borders-and-visas/smart-borders/index_en.htm

14

(15)  Commission public consultation on Smart Borders, available at: http://ec.europa.eu/dgs/home-affairs/what-is-new/public-consultation/2015/consulting_0030_en.htm

15

(16)  EDPS Formal comments of 3 November 2015 on the Commission Public Consultation on Smart Borders.

16

(17)  See press release available at: http://europa.eu/rapid/press-release_IP-16-1247_en.htm

17

(18)  Commission communication of 6 April 2016 on ‘Stronger and Smarter Information Systems for Borders and Security’, COM(2016) 205 final.

18

(19)  COM(2016) 194 final.

19

(20)  Regulation (EU) 2016/399 of the European Parliament and of the Council of 9 March 2016 on a Union Code on the rules governing the movement of persons across borders (Schengen Borders Code) (codification) (OJ L 77, 23.3.2016, p. 1).

20

(21)  COM(2016) 196 final.

21

(22)  Commission Staff Working Document of 6 April 2016 on ‘Impact Assessment on the establishment of an EU Entry/Exit System accompanying the 2016 EES Proposal and the 2016 Proposal amending the Schengen Borders Code’, SWD(2016) 115 final (hereinafter ‘Impact Assessment’).

22

(23)  http://data.consilium.europa.eu/doc/document/ST-8485-2016-INIT/en/pdf

23

(24)  Two workshops between DG Home and the EDPS addressing Smart Borders' aspects were held in 2015: one workshop on 20 March specifically dedicated to the preparation of the Smart Borders proposals, and one interactive workshop on 21 September 2015 on Data Protection and Privacy Considerations in Policies on Migration and Home Affairs during which the 2013 Smart Borders proposals were also touched upon; see Minutes of the workshop of 20 March 2015 in Annex 16 to the Impact Assessment.

24

---

V Announcements

PROCEDURES RELATING TO THE IMPLEMENTATION OF COMPETITION POLICY

European Commission

| 13.12.2016 | EN | Official Journal of the European Union | C 463/18 |
| --- | --- | --- | --- |

13.12.2016

EN

Official Journal of the European Union

C 463/18

---

Prior notification of a concentration

(Case M.8288 — Permira/Schustermann & Borenstein)

Candidate case for simplified procedure

(Text with EEA relevance)

(2016/C 463/12)

| 1. | On 6 December 2016, the Commission received notification of a proposed concentration pursuant to Article 4 of Council Regulation (EC) No 139/2004 (1) by which the undertaking Permira Holdings Limited (‘Permira’, Guernsey), indirectly through funds managed or advised by it, acquires within the meaning of Article 3(1)(b) of the Merger Regulation control of the whole of the undertaking Schustermann & Borenstein Holding GmbH (‘S&B’, Germany) by way of purchase of shares. |
| --- | --- |

1.

On 6 December 2016, the Commission received notification of a proposed concentration pursuant to Article 4 of Council Regulation (EC) No 139/2004 (1) by which the undertaking Permira Holdings Limited (‘Permira’, Guernsey), indirectly through funds managed or advised by it, acquires within the meaning of Article 3(1)(b) of the Merger Regulation control of the whole of the undertaking Schustermann & Borenstein Holding GmbH (‘S&B’, Germany) by way of purchase of shares.

| 2. | The business activities of the undertakings concerned are:
  —   for Permira: Private equity investments in a variety of industries,
  —   for S&B: Retail of fashion products through online website (www.bestsecret.com) and three physical stores, which are located in Austria and Germany. |
| --- | --- |

2.

The business activities of the undertakings concerned are:

—   for Permira: Private equity investments in a variety of industries,

—   for S&B: Retail of fashion products through online website (www.bestsecret.com) and three physical stores, which are located in Austria and Germany.

| 3. | On preliminary examination, the Commission finds that the notified transaction could fall within the scope of the Merger Regulation. However, the final decision on this point is reserved. Pursuant to the Commission Notice on a simplified procedure for treatment of certain concentrations under Council Regulation (EC) No 139/2004 (2) it should be noted that this case is a candidate for treatment under the procedure set out in this Notice. |
| --- | --- |

3.

On preliminary examination, the Commission finds that the notified transaction could fall within the scope of the Merger Regulation. However, the final decision on this point is reserved. Pursuant to the Commission Notice on a simplified procedure for treatment of certain concentrations under Council Regulation (EC) No 139/2004 (2) it should be noted that this case is a candidate for treatment under the procedure set out in this Notice.

| 4. | The Commission invites interested third parties to submit their possible observations on the proposed operation to the Commission.
  Observations must reach the Commission not later than 10 days following the date of this publication. Observations can be sent to the Commission by fax (+32 22964301), by email to COMP-MERGER-REGISTRY@ec.europa.eu or by post, under reference M.8288 — Permira/Schustermann & Borenstein, to the following address:





  European Commission |
| --- | --- |
| Directorate-General for Competition |
| Merger Registry |
| 1049 Bruxelles/Brussel |
| BELGIQUE/BELGIË |

4.

The Commission invites interested third parties to submit their possible observations on the proposed operation to the Commission.

Observations must reach the Commission not later than 10 days following the date of this publication. Observations can be sent to the Commission by fax (+32 22964301), by email to COMP-MERGER-REGISTRY@ec.europa.eu or by post, under reference M.8288 — Permira/Schustermann & Borenstein, to the following address:

European Commission

Directorate-General for Competition

Merger Registry

1049 Bruxelles/Brussel

BELGIQUE/BELGIË

---

(1)  OJ L 24, 29.1.2004, p. 1 (the ‘Merger Regulation’).

(2)  OJ C 366, 14.12.2013, p. 5.

---

| 13.12.2016 | EN | Official Journal of the European Union | C 463/19 |
| --- | --- | --- | --- |

13.12.2016

EN

Official Journal of the European Union

C 463/19

---

Prior notification of a concentration

(Case M.8259 — Groupe H.I.G./Guillaume Dauphin/Ecore)

Candidate case for simplified procedure

(Text with EEA relevance)

(2016/C 463/13)

| 1. | On 1 December 2016, the Commission received notification of a proposed concentration pursuant to Article 4 of Council Regulation (EC) No 139/2004 (1) by which Guillaume Dauphin and H.I.G. Capital LLC (‘Groupe H.I.G.’, of the United States) will acquire, by way of sale and purchase of shares, joint control within the meaning of Article 3(1)(b) of the Merger Regulation over Ecore B.V. (‘Ecore’, of the Netherlands), currently solely controlled by Guillaume Dauphin. |
| --- | --- |

1.

On 1 December 2016, the Commission received notification of a proposed concentration pursuant to Article 4 of Council Regulation (EC) No 139/2004 (1) by which Guillaume Dauphin and H.I.G. Capital LLC (‘Groupe H.I.G.’, of the United States) will acquire, by way of sale and purchase of shares, joint control within the meaning of Article 3(1)(b) of the Merger Regulation over Ecore B.V. (‘Ecore’, of the Netherlands), currently solely controlled by Guillaume Dauphin.

| 2. | The business activities of the undertakings concerned are:






  — | Guillaume Dauphin produces and sells recycled raw materials through Ecore, |
| --- | --- | --- |

2.

The business activities of the undertakings concerned are:

—

Guillaume Dauphin produces and sells recycled raw materials through Ecore,

| — | Groupe H.I.G. is a private equity investment firm with participations in small and medium-sized companies, |
| --- | --- |

—

Groupe H.I.G. is a private equity investment firm with participations in small and medium-sized companies,

| — | Ecore produces and sells recycled raw materials. Ecore is more specifically active in waste collection, treatment of waste and sales of recycled materials, mainly ferrous metals. Ecore also produces and sells other recycled materials, such as non-ferrous metals, paper, carton, and plastics. |
| --- | --- |

—

Ecore produces and sells recycled raw materials. Ecore is more specifically active in waste collection, treatment of waste and sales of recycled materials, mainly ferrous metals. Ecore also produces and sells other recycled materials, such as non-ferrous metals, paper, carton, and plastics.

| 3. | On preliminary examination, the Commission finds that the notified transaction could fall within the scope of the Merger Regulation. However, the final decision on this point is reserved. Pursuant to the Commission Notice on a simplified procedure for treatment of certain concentrations under Council Regulation (EC) No 139/2004 (2), it should be noted that this case is a candidate for treatment under the procedure set out in this Notice. |
| --- | --- |

3.

On preliminary examination, the Commission finds that the notified transaction could fall within the scope of the Merger Regulation. However, the final decision on this point is reserved. Pursuant to the Commission Notice on a simplified procedure for treatment of certain concentrations under Council Regulation (EC) No 139/2004 (2), it should be noted that this case is a candidate for treatment under the procedure set out in this Notice.

| 4. | The Commission invites interested third parties to submit their possible observations on the proposed operation to the Commission.
  Observations must reach the Commission not later than 10 days following the date of this publication. Observations can be sent to the Commission by fax (+32 22964301), by email to COMP-MERGER-REGISTRY@ec.europa.eu or by post, under reference M.8259 — Groupe H.I.G./Guillaume Dauphin/Ecore, to the following address:





  European Commission |
| --- | --- |
| Directorate-General for Competition |
| Merger Registry |
| 1049 Bruxelles/Brussel |
| BELGIQUE/BELGIË |

4.

The Commission invites interested third parties to submit their possible observations on the proposed operation to the Commission.

Observations must reach the Commission not later than 10 days following the date of this publication. Observations can be sent to the Commission by fax (+32 22964301), by email to COMP-MERGER-REGISTRY@ec.europa.eu or by post, under reference M.8259 — Groupe H.I.G./Guillaume Dauphin/Ecore, to the following address:

European Commission

Directorate-General for Competition

Merger Registry

1049 Bruxelles/Brussel

BELGIQUE/BELGIË

---

(1)  OJ L 24, 29.1.2004, p. 1 (the ‘Merger Regulation’).

(2)  OJ C 366, 14.12.2013, p. 5.

---

OTHER ACTS

European Commission

| 13.12.2016 | EN | Official Journal of the European Union | C 463/20 |
| --- | --- | --- | --- |

13.12.2016

EN

Official Journal of the European Union

C 463/20

---

Notice for the attention of the natural persons Pak Chun Il, Kim Song Chol, Son Jong Hyok, Kim Se Gon, Ri Won Ho, Jo Yong Chol, Kim Chol Sam, Kim Sok Chol, Chang Chang Ha, Cho Chun Ryong and Son Mun San, and the entities Korea United Development Bank, Ilsim International Bank, Korea Daesong Bank, Singwang Economics and Trading General Corporation, Korea Foreign Technical Trade Center, Korea Pugang Trading Corporation, Korea International Chemical Joint Venture Company, DCB Finance Limited, Korea Taesong Trading Company and Korea Daesong General Trading Corporation, who were added to the list referred to in Article 6(1) of Council Regulation (EC) No 329/2007 imposing certain specific restrictive measures directed against persons entities and bodies designated by the Sanctions Committee or the UN Security Council in accordance with paragraph 8(d) of UN Security Council Resolution 1718 (2006), and paragraph 8 of UN Security Council Resolution 2094 (2013), by virtue of Commission Implementing Regulation (EU) 2016/2215

(2016/C 463/14)

| 1. | Council Decision (CFSP) 2016/849 (1) calls upon the Union to freeze the funds and economic resources of persons and entities, as designated by the Sanctions Committee or by the UN Security Council as being engaged in or providing support for, including through illicit means, the DPRK’s nuclear-related, ballistic-missile-related or other weapons of mass destruction-related programmes, or persons or entities acting on their behalf or at their direction, or entities owned or controlled by them, including through illicit means. |
| --- | --- |

1.

Council Decision (CFSP) 2016/849 (1) calls upon the Union to freeze the funds and economic resources of persons and entities, as designated by the Sanctions Committee or by the UN Security Council as being engaged in or providing support for, including through illicit means, the DPRK’s nuclear-related, ballistic-missile-related or other weapons of mass destruction-related programmes, or persons or entities acting on their behalf or at their direction, or entities owned or controlled by them, including through illicit means.

| 2. | The UN Security Council decided in Resolution 2321 of 30 November 2016 that the natural persons Pak Chun Il, Kim Song Chol, Son Jong Hyok, Kim Se Gon, Ri Won Ho, Jo Yong Chol, Kim Chol Sam, Kim Sok Chol, Chang Chang Ha, Cho Chun Ryong and Son Mun San, and the entities Korea United Development Bank, Ilsim International Bank, Korea Daesong Bank, Singwang Economics and Trading General Corporation, Korea Foreign Technical Trade Center, Korea Pugang Trading Corporation, Korea International Chemical Joint Venture Company, DCB Finance Limited, Korea Taesong Trading Company and Korea Daesong General Trading Corporation had to be added to the Sanctions Committee’s list.
  Those concerned may submit at any time a request to the United Nations Security Council Committee established pursuant to resolution 1718 (2006), together with any supporting documentation, for the decisions to include them in the UN list to be reconsidered. Such request should be sent to the following address:





  United Nations — Focal point for delisting |
| --- | --- |
| Security Council Subsidiary Organs Branch |
| Room S-3055 E |
| New York, NY 10017 |
| UNITED STATES OF AMERICA |

2.

The UN Security Council decided in Resolution 2321 of 30 November 2016 that the natural persons Pak Chun Il, Kim Song Chol, Son Jong Hyok, Kim Se Gon, Ri Won Ho, Jo Yong Chol, Kim Chol Sam, Kim Sok Chol, Chang Chang Ha, Cho Chun Ryong and Son Mun San, and the entities Korea United Development Bank, Ilsim International Bank, Korea Daesong Bank, Singwang Economics and Trading General Corporation, Korea Foreign Technical Trade Center, Korea Pugang Trading Corporation, Korea International Chemical Joint Venture Company, DCB Finance Limited, Korea Taesong Trading Company and Korea Daesong General Trading Corporation had to be added to the Sanctions Committee’s list.

Those concerned may submit at any time a request to the United Nations Security Council Committee established pursuant to resolution 1718 (2006), together with any supporting documentation, for the decisions to include them in the UN list to be reconsidered. Such request should be sent to the following address:

United Nations — Focal point for delisting

Security Council Subsidiary Organs Branch

Room S-3055 E

New York, NY 10017

UNITED STATES OF AMERICA

See for more information at: https://www.un.org/sc/suborg/en/sanctions/delisting

| 3. | In order to implement the new listings, the Commission has adopted Commission Implementing Regulation (EU) 2016/2215 of 8 December 2016 (2) amending Annex IV to Council Regulation (EC) No 329/2007 accordingly.
  The concerned individuals and entities may submit observations on the decision to list them or maintain them on the list, together with supporting documentation, to the European Commission on the following address:





  European Commission |
| --- | --- |
| ‘Restrictive measures’ |
| Rue de la Loi/Wetstraat 200 |
| 1049 Bruxelles/Brussel |
| BELGIQUE/BELGIË |

3.

In order to implement the new listings, the Commission has adopted Commission Implementing Regulation (EU) 2016/2215 of 8 December 2016 (2) amending Annex IV to Council Regulation (EC) No 329/2007 accordingly.

The concerned individuals and entities may submit observations on the decision to list them or maintain them on the list, together with supporting documentation, to the European Commission on the following address:

European Commission

‘Restrictive measures’

Rue de la Loi/Wetstraat 200

1049 Bruxelles/Brussel

BELGIQUE/BELGIË

| 4. | The attention of the individuals and entities concerned is also drawn to the possibility of challenging Implementing Regulation (EU) 2016/2215 before the General Court of the European Union, in accordance with the conditions laid down in the fourth and sixth paragraphs of Article 263 of the Treaty on the Functioning of the European Union. |
| --- | --- |

4.

The attention of the individuals and entities concerned is also drawn to the possibility of challenging Implementing Regulation (EU) 2016/2215 before the General Court of the European Union, in accordance with the conditions laid down in the fourth and sixth paragraphs of Article 263 of the Treaty on the Functioning of the European Union.

| 5. | Finally, the attention of the listed entities and individuals is drawn to the possibility of making an application to the competent authorities in the relevant Member State(s), as listed in Annex II to Regulation (EC) No 329/2007, in order to obtain an authorisation to use frozen funds and economic resources for essential needs or specific payments in accordance with Article 7 of that Regulation. |
| --- | --- |

5.

Finally, the attention of the listed entities and individuals is drawn to the possibility of making an application to the competent authorities in the relevant Member State(s), as listed in Annex II to Regulation (EC) No 329/2007, in order to obtain an authorisation to use frozen funds and economic resources for essential needs or specific payments in accordance with Article 7 of that Regulation.

---

(1)  OJ L 141, 28.5.2016, p. 79.

(2)  OJ L 334, 9.12.2016, p. 29.

---