----

            COUNCIL DECISION         

of 13 September 2004         

adopting implementing rules concerning Regulation (EC) No 45/2001 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data

(2004/644/EC)

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty establishing the European Community, and in particular Article 286 thereof,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council (1), and in particular Article 24(8) thereof,

Whereas:

HAS DECIDED AS FOLLOWS:

SECTION 1

GENERAL PROVISIONS

Article 1

Subject matter and scope

This Decision lays down further implementing rules concerning Regulation (EC) No 45/2001 of the European Parliament and of the Council (hereinafter referred to as the Regulation) as regards the Council of the European Union.

Article 2

Definitions

For the purpose of this Decision and without prejudice to the definitions provided by the Regulation:

SECTION 2

THE DATA PROTECTION OFFICER

Article 3

Appointment and status of the Data Protection Officer

1.   The Deputy Secretary-General of the Council appoints the DPO and registers him with the European Data Protection Supervisor (hereafter referred to as EDPS). The DPO is directly attached to the Deputy Secretary-General of the Council.

2.   The term of office of the DPO shall be three years and is renewable twice.

3.   With respect to the performance of his/her duties, the DPO shall act in an independent manner and in cooperation with the EDPS. In particular, the DPO may not receive any instructions from the Appointing Authority of the GSC or from anyone else regarding the internal application of the provisions of the Regulation or his/her cooperation with the EDPS.

4.   The evaluation of the performance of the DPO's tasks and duties shall take place after prior consultation of the EDPS. The DPO may be dismissed from his/her post only with the consent of the EDPS, if he/she no longer fulfils the conditions required for the performance of his/her duties.

5.   Without prejudice to the procedure foreseen for his/her appointment, the DPO shall be informed of all contacts with external parties relating to the application of the Regulation, notably with regard to interaction with the EDPS.

6.   Without prejudice to the relevant provisions of the Regulation, the DPO and his/her staff shall be subject to the rules and regulations applicable to officials and other servants of the European Communities.

Article 4

Tasks

The DPO shall:

Article 5

Duties

1.   In addition to the general tasks to be fulfilled, the DPO shall:

2.   Without prejudice to Articles 4(b), 5(1)(b), (c) and 15, the DPO and his or her staff shall not divulge information or documents which they obtain in the course of their duties.

Article 6

Powers

In performing his or her tasks and duties the DPO:

Article 7

Resources

The DPO shall be provided with adequate staff and resources necessary to carry out his or her duties.

SECTION 3

RIGHTS AND OBLIGATIONS OF ACTORS IN THE FIELD OF DATA PROTECTION

Article 8

Appointing Authority

1.   In case of a complaint within the meaning of Article 90 of the Staff Regulations relating to a violation of the Regulation, the Appointing Authority shall consult the DPO, who should deliver his/her opinion in writing no later than 15 days after receipt of the request. If, after the end of this period, the DPO has not provided his/her opinion to the Appointing Authority, it is no longer required. The Appointing Authority shall not be bound by the DPO's opinion.

2.   The DPO shall be informed whenever an issue is under consideration which has, or might have, data protection implications.

Article 9

Controllers

1.   The controllers are responsible for ensuring that all processing operations under their control comply with the Regulation.

2.   In particular, the controllers shall:

Article 10

Contact persons

1.   Without prejudice to the responsibilities of the DPO, the contact person shall:

2.   Without prejudice to the responsibilities of the controllers, the contact persons shall:

Article 11

GSC staff

1.   In particular, all GSC staff shall contribute to the application of the confidentiality and security rules for the processing of personal data as provided for in Articles 21 and 22 of the Regulation. No member of the GSC staff with access to personal data shall process them other than on instructions from the controller, unless required to do so by national or Community law.

2.   Any member of GSC staff may lodge a complaint with the EDPS regarding an alleged breach of the provisions of the Regulation governing the processing of personal data, without acting through official channels, as specified by the Rules set by the EDPS.

Article 12

Data subjects

1.   Further to the data subjects’ right to be appropriately informed about any processing of personal data relating to themselves, in accordance with Articles 11 and 12 of the Regulation, the data subjects may approach the controller concerned to exercise their rights according to Articles 13 to 19 of the Regulation, as specified in Section 5 of this Decision.

2.   Without prejudice to any judicial remedy, every data subject may lodge a complaint with the EDPS if he/she considers that his/her rights under the Regulation have been infringed as a result of the processing of his/her personal data by the Council, as specified by the Rules set by the EDPS.

3.   No one shall suffer prejudice on account of a complaint lodged with the EDPS or of a matter brought to the attention of the DPO alleging a breach of the provisions of the Regulation.

SECTION 4

REGISTER OF NOTIFIED PROCESSING OPERATIONS

Article 13

Notification procedure

1.   The Controller shall notify to the DPO any processing operation of personal data on the basis of a notification form made accessible on the GSC's Intranet site (Data Protection). The notification shall be transmitted to the DPO electronically. A confirmatory notification shall be sent to the DPO by note within 10 working days. Upon receipt of the confirmatory notification, the DPO shall publish it in the Register.

2.   The notification shall include all information specified in Article 25(2) of the Regulation. Any change affecting this information shall be notified promptly to the DPO.

3.   Further rules and procedures regarding the notification procedure to be followed by the controllers shall form part of the general recommendations issued by the DPO.

Article 14

The content and the purpose of the Register

1.   The DPO shall keep a Register of processing operations performed upon personal data, which shall be set up on the basis of the notifications received from the controllers.

2.   The Register shall contain at least the information referred to in Article 25(2)(a) to (g) of the Regulation. However, the information entered in the Register by the DPO may exceptionally be limited when it is necessary to safeguard the security of a specific processing operation.

3.   The Register shall serve as an index of the personal data processing operations conducted at the Council. It shall provide information to data subjects and facilitate the exercise of their rights set out in Articles 13 to 19 of the Regulation.

Article 15

Access to the Register

1.   Appropriate measures shall be taken by the DPO to ensure that any person has access to the Register, either directly or indirectly through the EDPS. In particular, the DPO shall provide information and assistance to interested persons on how and where applications for access to the Register can be made.

2.   Except where on-line access is granted, applications for access to the Register are made in any written form, including electronically, in one of the languages referred to in Article 314 of the Treaty and in a sufficiently precise manner to enable the DPO to identify the concerned processing operations. An acknowledgement of receipt shall be sent to the applicant without delay.

3.   If an application is not sufficiently precise, the DPO shall ask the applicant to clarify the application and shall assist the applicant in doing so. In the event of an application relating to a very large number of processing operations, the DPO may confer with the applicant informally, with a view to finding a fair solution.

4.   Any person may request from the DPO a copy of the information which is available in the Register on any notified processing operation.

SECTION 5

PROCEDURE FOR DATA SUBJECTS TO EXERCISE THEIR RIGHTS

Article 16

General provisions

1.   The data subjects’ rights specified in this Section can only be exercised by the individuals concerned or, in exceptional cases, on behalf of the individuals with proper authorisation. Requests shall be addressed in writing to the controller concerned with a copy to the DPO. If necessary, the DPO shall assist the data subject in identifying the controller concerned. The DPO shall make specific forms available. Controllers shall grant the request only if the form has been filled in completely and the complainant's identity has been verified properly. The exercise by data subjects of their rights shall be free of charge.

2.   The controller shall send to the applicant an acknowledgement of receipt within five working days from the registration of the application. Unless otherwise provided, the controller shall reply to the request at the latest within fifteen working days from the registration of the request and shall either give satisfaction or state in writing the reasons for the total or partial refusal, in particular in cases where the applicant is not considered as data subject.

3.   In case of irregularities or obvious misuse by the data subject in exercising his/her rights and where the processing is alleged to be unlawful by the data subject, the controller must consult the DPO on the request and/or refer the data subject to the DPO, who will decide on the eligibility of the request and the appropriate follow-up to be given.

4.   Any person concerned may consult the DPO with regard to the exercise of his/her rights in a specific case. Without prejudice to any judicial remedy, every data subject may lodge a complaint with the EDPS, if he/she considers that his/her rights under the Regulation have been infringed as a result of the processing of his/her personal data.

Article 17

Right of access

The data subject shall have the right to obtain from the controller, without constraint, at any time within three months from the receipt of the request, the information referred to in points (a) to (d) of Article 13 of the Regulation, either by consulting these data on the spot, or by receiving a copy, including, where appropriate, a copy in an electronic form, according to the applicant's preference.

Article 18

Right of rectification

Each data subject’s request for the rectification of inaccurate or incomplete personal data shall specify the data concerned as well as the rectification to be made. It shall be dealt with by the controller without delay.

Article 19

Right of blocking

The controller shall treat any request for the blocking of data under Article 15 of the Regulation without delay. The request shall specify the data concerned as well as the reasons for blocking them. The controller shall inform the data subject who made the request before the data are unblocked.

Article 20

Right of erasure

The data subject may request the controller to erase data without delay in case of unlawful processing, particularly where the provisions of Articles 4 to 10 of the Regulation have been infringed. The request shall specify the data concerned and shall provide the reasons or evidence of the unlawfulness of the processing. In automated filing systems, erasure shall in principle be ensured by all appropriate technical means, excluding the possibility of any further processing of the erased data. If erasure is not possible for technical reasons, the controller, after consultation of the DPO and of the interested person, shall proceed to the immediate blocking of such data.

Article 21

Notification to third parties

In case of any rectification, blocking or erasure following a request made by the data subject, he/she may obtain from the controller the notification to third parties to whom his/her personal data have been disclosed, unless this proves impossible or involves a disproportionate effort.

Article 22

Right to object

The data subject may object to the processing of data relating to him/her and to the disclosure or use of his/her personal data, in conformity with Article 18 of the Regulation. The request shall specify the data concerned and shall provide the reasons justifying the request. Where the objection is justified, the processing in question shall no longer involve those data.

Article 23

Automated individual decisions

The data subject is entitled not to be the subject of automated individual decisions as intended by Article 19 of the Regulation, unless the decision is explicitly authorised pursuant to national or Community legislation, or by an EDPS decision safeguarding the data subject's legitimate interests. In either case, the data subject shall have the opportunity to make known his or her point of view in advance and to consult the DPO.

Article 24

Exceptions and restrictions

1.   To the extent that legitimate reasons as specified in Article 20 of the Regulation clearly justify it, the controller may restrict the rights referred to in Articles 17 to 21 of this Decision. Except in case of absolute necessity, the controller shall first consult the DPO, whose opinion shall not bind the Institution. The controller shall reply to requests relating to the application of exceptions or restrictions to the exercise of rights without delay and shall substantiate this decision.

2.   Any person concerned may request the EDPS to apply Article 47(1)(c) of the Regulation.

SECTION 6

INVESTIGATION PROCEDURE

Article 25

Practical modalities

1.   Requests for an investigation shall be addressed to the DPO in writing by using a specific form made available by him/her. In the case of obvious misuse of the right to request an investigation, for example where the same individual has made an identical request only recently, the DPO is not obliged to report back to the requester.

2.   Within 15 days upon receipt, the DPO shall send acknowledgement of receipt to the Appointing Authority or the person who commissioned the investigation and verify whether the request is to be treated as confidential.

3.   The DPO shall request from the controller who is responsible for the data processing operation in question a written statement on the issue. The controller shall provide his/her response to the DPO within 15 days. The DPO may wish to receive complementary information from other parties, such as the Security Office and Security of Information (Infosec) Office of the GSC. If appropriate, he/she may request an opinion on the issue from the Council Legal Service. The DPO shall be provided with the information or opinion within 30 days.

4.   The DPO shall report back to the Appointing Authority or the person who made the request no later than three months following its receipt.

SECTION 7

FINAL PROVISIONS

Article 26

Effect

This Decision shall take effect on the day following that of its publication in the Official Journal of the European Union.

Done at Brussels, 13 September 2004.

For the Council

The President

B. R. BOT            

----

(1)OJ L 8, 12.1.2001, p. 1.

(2)  Regulation (EC) 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Community documents (OJ L 145, 31.5.2001, p. 43).

(3)  Council Decision 2004/338/EC, Euratom of 22 March 2004 adopting the Council's Rules of Procedure (OJ L 106, 15.4.2004, p. 22).

(4)  Council Decision 2001/264/EC of 19 March 2001 adopting the Council's security regulations (OJ L 101, 11.4.2001, p. 1). Decision as amended by Decision 2004/194/EC (OJ L 63, 28.2.2004, p. 48).

(5)  Decision of the Secretary-General of the Council/High Representative for Common Foreign and Security Policy of 25 June 2001 on a code of good administrative behaviour for the General Secretariat of the Council of the European Union and its staff in their professional relations with the public (OJ C 189, 5.7.2001, p. 1).

(6)OJ L 56, 4.3.1968, p. 1. Regulation as last amended by Regulation (EC, Euratom) No 723/2004 (OJ L 124, 27.4.2004, p. 1).

(7)OJ L 248, 16.9.2002, p. 1.

----