# Official Journal C 276/2009

| | ISSN 1725-2423
  doi:10.3000/17252423.C_2009.276.eng |
| --- | --- |
| Official Journal
  of the European Union | C 276 |
| | |
| English edition | Information and Notices | Volume 5217 November 2009 |

ISSN 1725-2423

doi:10.3000/17252423.C_2009.276.eng

Official Journal

of the European Union

C 276

English edition

Information and Notices

Volume 5217 November 2009

---

| Notice No | Contents | page |
| --- | --- | --- |
| | I   Resolutions, recommendations and opinions |
| | OPINIONS |
| | European Data Protection Supervisor |
| 2009/C 276/01 | Opinion of the European Data Protection Supervisor on the proposal for a Council Regulation amending Regulation (EC) No 881/2002 imposing certain specific restrictive measures directed against certain persons and entities associated with Usama bin Laden, the Al-Qaida network and the Taliban | 1 |
| 2009/C 276/02 | Opinion of the European Data Protection Supervisor on the Communication from the Commission to the European Parliament and the Council on an area of freedom, security and justice serving the citizen | 8 |

Notice No

Contents

page

I   Resolutions, recommendations and opinions

OPINIONS

European Data Protection Supervisor

2009/C 276/01

Opinion of the European Data Protection Supervisor on the proposal for a Council Regulation amending Regulation (EC) No 881/2002 imposing certain specific restrictive measures directed against certain persons and entities associated with Usama bin Laden, the Al-Qaida network and the Taliban

1

2009/C 276/02

Opinion of the European Data Protection Supervisor on the Communication from the Commission to the European Parliament and the Council on an area of freedom, security and justice serving the citizen

8

| | II   Information |
| --- | --- |
| | INFORMATION FROM EUROPEAN UNION INSTITUTIONS AND BODIES |
| | Commission |
| 2009/C 276/03 | Authorisation for State aid pursuant to Articles 87 and 88 of the EC Treaty — Cases where the Commission raises no objections | 21 |

II   Information

INFORMATION FROM EUROPEAN UNION INSTITUTIONS AND BODIES

Commission

2009/C 276/03

Authorisation for State aid pursuant to Articles 87 and 88 of the EC Treaty — Cases where the Commission raises no objections

21

| | IV   Notices |
| --- | --- |
| | NOTICES FROM EUROPEAN UNION INSTITUTIONS AND BODIES |
| | Commission |
| 2009/C 276/04 | Euro exchange rates | 23 |
| | NOTICES FROM MEMBER STATES |
| 2009/C 276/05 | Information communicated by Member States regarding State aid granted under Commission Regulation (EC) No 800/2008 declaring certain categories of aid compatible with the common market in application of Articles 87 and 88 of the Treaty (General block exemption Regulation) (
  1
  ) | 24 |
| 2009/C 276/06 | Information communicated by Member States regarding State aid granted under Commission Regulation (EC) No 800/2008 declaring certain categories of aid compatible with the common market in application of Articles 87 and 88 of the Treaty (General block exemption Regulation) (
  1
  ) | 30 |
| 2009/C 276/07 | Information communicated by Member States regarding State aid granted under Commission Regulation (EC) No 800/2008 declaring certain categories of aid compatible with the common market in application of Articles 87 and 88 of the Treaty (General block exemption Regulation) (
  1
  ) | 35 |

IV   Notices

NOTICES FROM EUROPEAN UNION INSTITUTIONS AND BODIES

Commission

2009/C 276/04

Euro exchange rates

23

NOTICES FROM MEMBER STATES

2009/C 276/05

Information communicated by Member States regarding State aid granted under Commission Regulation (EC) No 800/2008 declaring certain categories of aid compatible with the common market in application of Articles 87 and 88 of the Treaty (General block exemption Regulation) (
  1
  )

1

24

2009/C 276/06

Information communicated by Member States regarding State aid granted under Commission Regulation (EC) No 800/2008 declaring certain categories of aid compatible with the common market in application of Articles 87 and 88 of the Treaty (General block exemption Regulation) (
  1
  )

1

30

2009/C 276/07

Information communicated by Member States regarding State aid granted under Commission Regulation (EC) No 800/2008 declaring certain categories of aid compatible with the common market in application of Articles 87 and 88 of the Treaty (General block exemption Regulation) (
  1
  )

1

35

| | V   Announcements |
| --- | --- |
| | PROCEDURES RELATING TO THE IMPLEMENTATION OF THE COMPETITION POLICY |
| | Commission |
| 2009/C 276/08 | Prior notification of a concentration (Case COMP/M.5686 — Vitol Holding/Petroplus Refining Antwerp/Petroplus Refining Antwerp Bitumen) — Candidate case for simplified procedure (
  1
  ) | 40 |
| 2009/C 276/09 | Decision No 777 of 5 October 2009 on the opening of a procedure for granting authorisation for the prospection and exploration of oil and natural gas — underground natural resources as defined in Article 2(1)(3) of the Underground Natural Resources Act, at Block 1-18 Trakiya, located in Haskovo Province, and announcing that authorisation will be granted on the basis of a competitive tendering procedure | 41 |

V   Announcements

PROCEDURES RELATING TO THE IMPLEMENTATION OF THE COMPETITION POLICY

Commission

2009/C 276/08

Prior notification of a concentration (Case COMP/M.5686 — Vitol Holding/Petroplus Refining Antwerp/Petroplus Refining Antwerp Bitumen) — Candidate case for simplified procedure (
  1
  )

1

40

2009/C 276/09

Decision No 777 of 5 October 2009 on the opening of a procedure for granting authorisation for the prospection and exploration of oil and natural gas — underground natural resources as defined in Article 2(1)(3) of the Underground Natural Resources Act, at Block 1-18 Trakiya, located in Haskovo Province, and announcing that authorisation will be granted on the basis of a competitive tendering procedure

41

| | |
| --- | --- |
| | (1)   Text with EEA relevance |

---

(1)   Text with EEA relevance

1

| EN | |
| --- | --- |

EN

---

I Resolutions, recommendations and opinions

OPINIONS

European Data Protection Supervisor

| 17.11.2009 | EN | Official Journal of the European Union | C 276/1 |
| --- | --- | --- | --- |

17.11.2009

EN

Official Journal of the European Union

C 276/1

---

Opinion of the European Data Protection Supervisor on the proposal for a Council Regulation amending Regulation (EC) No 881/2002 imposing certain specific restrictive measures directed against certain persons and entities associated with Usama bin Laden, the Al-Qaida network and the Taliban

2009/C 276/01

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular its Article 41,

Having regard to the request for an opinion in accordance with Article 28(2) of Regulation (EC) No 45/2001 sent to the EDPS on 22 April 2009,

HAS ADOPTED THE FOLLOWING OPINION:

I.   INTRODUCTION

| 1. | On 22 April 2009, the Commission adopted a proposal for a Council Regulation amending Regulation (EC) No 881/2002 imposing certain specific restrictive measures directed against certain persons and entities associated with Usama bin Laden, the Al-Qaida network and the Taliban (hereinafter ‘the proposal’). On the same day, the proposal was sent by the Commission to the EDPS for consultation, in accordance with Article 28(2) of Regulation (EC) No 45/2001. The EDPS recalls that he provided informal comments on 9 March 2009 on a draft proposal and notes that these comments have been taken into account in the proposal. |
| --- | --- |

1.

On 22 April 2009, the Commission adopted a proposal for a Council Regulation amending Regulation (EC) No 881/2002 imposing certain specific restrictive measures directed against certain persons and entities associated with Usama bin Laden, the Al-Qaida network and the Taliban (hereinafter ‘the proposal’). On the same day, the proposal was sent by the Commission to the EDPS for consultation, in accordance with Article 28(2) of Regulation (EC) No 45/2001. The EDPS recalls that he provided informal comments on 9 March 2009 on a draft proposal and notes that these comments have been taken into account in the proposal.

| 2. | The EDPS welcomes that he is consulted and that reference to this consultation is made in the preamble of the proposal, in a similar way as in a number of other legislative texts on which the EDPS has been consulted, in accordance with Regulation (EC) No 45/2001. |
| --- | --- |

2.

The EDPS welcomes that he is consulted and that reference to this consultation is made in the preamble of the proposal, in a similar way as in a number of other legislative texts on which the EDPS has been consulted, in accordance with Regulation (EC) No 45/2001.

| 3. | The proposal amends Regulation (EC) No 881/2002, one of the Community instruments adopted with a view to fight terrorism by taking restrictive measures — notably, freezing the assets — with regard to natural and legal persons suspected of being associated with terrorist organisations. In particular, the proposal aims at addressing the recent developments in the case law of the Court of Justice, and in particular the Kadi case (1), by laying down ‘a procedure respecting fundamental rights that will be followed as regards individuals and entities newly listed by the UN’ (point 4 of explanatory memorandum). |
| --- | --- |

3.

The proposal amends Regulation (EC) No 881/2002, one of the Community instruments adopted with a view to fight terrorism by taking restrictive measures — notably, freezing the assets — with regard to natural and legal persons suspected of being associated with terrorist organisations. In particular, the proposal aims at addressing the recent developments in the case law of the Court of Justice, and in particular the Kadi case (1), by laying down ‘a procedure respecting fundamental rights that will be followed as regards individuals and entities newly listed by the UN’ (point 4 of explanatory memorandum).

II.   THE LEGAL FRAMEWORK

| 4. | While in its judgements the Court was called to focus specifically on the respect of the fundamental right of defence and in particular on the right to be heard, the case law in this area has broader consequences and could be summarised as follows: the EU standards of protection of fundamental rights should be respected irrespective of whether restrictive measures are adopted at EU level or stem from international organisations such as the United Nations (2). |
| --- | --- |

4.

While in its judgements the Court was called to focus specifically on the respect of the fundamental right of defence and in particular on the right to be heard, the case law in this area has broader consequences and could be summarised as follows: the EU standards of protection of fundamental rights should be respected irrespective of whether restrictive measures are adopted at EU level or stem from international organisations such as the United Nations (2).

| 5. | EU fundamental rights also include the right to the protection of personal data, which has been recognised by the Court of Justice as one of the principles stemming from Article 6(2) TEU and further confirmed by Article 8 of the EU Charter of Fundamental Rights. |
| --- | --- |

5.

EU fundamental rights also include the right to the protection of personal data, which has been recognised by the Court of Justice as one of the principles stemming from Article 6(2) TEU and further confirmed by Article 8 of the EU Charter of Fundamental Rights.

| 6. | In this perspective, the EDPS welcomes not only the recent case law of the Court of Justice, but also the intention of the Commission to address it by enhancing the listing procedure and by taking explicitly into account the right to the protection of personal data. Indeed the EDPS, while fully recognising the objective of fighting terrorism through the processing and the exchange of personal data, firmly believes that protection of personal data is a crucial factor in ensuring the legitimacy and efficiency of the restrictive measures taken by the Commission. These measures are based on processing of personal data, which by itself — irrespective of the freezing of assets — must be subject to data protection rules and guarantees. Therefore, it is extremely important to provide clarity and legal certainty on the applicable rules for processing of personal data of listed individuals, as mentioned in point 8 of the explanatory memorandum. |
| --- | --- |

6.

In this perspective, the EDPS welcomes not only the recent case law of the Court of Justice, but also the intention of the Commission to address it by enhancing the listing procedure and by taking explicitly into account the right to the protection of personal data. Indeed the EDPS, while fully recognising the objective of fighting terrorism through the processing and the exchange of personal data, firmly believes that protection of personal data is a crucial factor in ensuring the legitimacy and efficiency of the restrictive measures taken by the Commission. These measures are based on processing of personal data, which by itself — irrespective of the freezing of assets — must be subject to data protection rules and guarantees. Therefore, it is extremely important to provide clarity and legal certainty on the applicable rules for processing of personal data of listed individuals, as mentioned in point 8 of the explanatory memorandum.

| 7. | This is even more important in view of the entry into force of the Lisbon Treaty, which will not only give binding effect to the EU Charter of Fundamental Rights, but will also lay down, in Articles 16 TFEU and 39 TEU, the need for data protection rules and guarantees in all fields of activity of the European Union. Furthermore, the Court of Justice will be fully competent, even in the area of the Common Foreign and Security Policy, to assess the legality — and in particular the respect of fundamental rights — of decisions providing for restrictive measures against natural or legal persons (Article 275 TFEU). |
| --- | --- |

7.

This is even more important in view of the entry into force of the Lisbon Treaty, which will not only give binding effect to the EU Charter of Fundamental Rights, but will also lay down, in Articles 16 TFEU and 39 TEU, the need for data protection rules and guarantees in all fields of activity of the European Union. Furthermore, the Court of Justice will be fully competent, even in the area of the Common Foreign and Security Policy, to assess the legality — and in particular the respect of fundamental rights — of decisions providing for restrictive measures against natural or legal persons (Article 275 TFEU).

III.   ANALYSIS OF THE PROPOSAL

III.1.   Applicable data protection law and principles

| 8. | The EDPS welcomes the references in the preamble to the need to apply the Regulation in accordance with the fundamental right to the protection of personal data (recital 10) as well as to the need for appropriate specific safeguards when the Commission processes data relating to criminal offences committed by listed natural persons, and to criminal convictions or security measures concerning such persons. |
| --- | --- |

8.

The EDPS welcomes the references in the preamble to the need to apply the Regulation in accordance with the fundamental right to the protection of personal data (recital 10) as well as to the need for appropriate specific safeguards when the Commission processes data relating to criminal offences committed by listed natural persons, and to criminal convictions or security measures concerning such persons.

| 9. | The EDPS also welcomes that the proposal explicitly recognizes in its recital 12 the applicability of data protection rules, and in particular of Regulation (EC) No 45/2001, to the processing of personal data in this area. Indeed, Article 3 of Regulation (EC) No 45/2001 states that the Regulation applies ‘to the processing of personal data by all Community institutions and bodies insofar as such processing is carried out in the exercise of activities all or part of which fall within the scope of Community law’. In this perspective, even if Regulation (EC) No 881/2002 is linked to Common Position 2002/402/CFSP and to United Nations activities in this area, it is based on the Treaty establishing the European Community. |
| --- | --- |

9.

The EDPS also welcomes that the proposal explicitly recognizes in its recital 12 the applicability of data protection rules, and in particular of Regulation (EC) No 45/2001, to the processing of personal data in this area. Indeed, Article 3 of Regulation (EC) No 45/2001 states that the Regulation applies ‘to the processing of personal data by all Community institutions and bodies insofar as such processing is carried out in the exercise of activities all or part of which fall within the scope of Community law’. In this perspective, even if Regulation (EC) No 881/2002 is linked to Common Position 2002/402/CFSP and to United Nations activities in this area, it is based on the Treaty establishing the European Community.

| 10. | As a general remark, the EDPS would like to stress that Regulation (EC) No 45/2001 lays down a series of obligations for controllers — inter alia, data quality, lawfulness of processing, notification, security of processing — as well as rights for data subjects — inter alia access, rectification, blocking, erasure, notification to third parties, remedies — which shall apply except where exemptions and restrictions are laid down pursuant to Article 20. In any case, these restrictions to the fundamental right to data protection should comply with a strict proportionality test, i.e. should be limited — both in their substance and in their application in time — to what is necessary to pursue the public interest at stake, as confirmed by the case law of the Court of Justice, also in the area of restrictive measures. This is even more important since these rights and obligations, together with the need for independent supervision with regard to the processing of personal data, constitute the core of the fundamental right to data protection, as explicitly confirmed by Article 8 of the EU Charter of Fundamental Rights. |
| --- | --- |

10.

As a general remark, the EDPS would like to stress that Regulation (EC) No 45/2001 lays down a series of obligations for controllers — inter alia, data quality, lawfulness of processing, notification, security of processing — as well as rights for data subjects — inter alia access, rectification, blocking, erasure, notification to third parties, remedies — which shall apply except where exemptions and restrictions are laid down pursuant to Article 20. In any case, these restrictions to the fundamental right to data protection should comply with a strict proportionality test, i.e. should be limited — both in their substance and in their application in time — to what is necessary to pursue the public interest at stake, as confirmed by the case law of the Court of Justice, also in the area of restrictive measures. This is even more important since these rights and obligations, together with the need for independent supervision with regard to the processing of personal data, constitute the core of the fundamental right to data protection, as explicitly confirmed by Article 8 of the EU Charter of Fundamental Rights.

| 11. | Furthermore, while welcoming that the proposal addresses, implicitly or explicitly, some of these obligations and rights, the EDPS would like to stress that the proposal cannot be interpreted as excluding or limiting the applicability of those obligations and data subjects’ rights that are not mentioned in it. |
| --- | --- |

11.

Furthermore, while welcoming that the proposal addresses, implicitly or explicitly, some of these obligations and rights, the EDPS would like to stress that the proposal cannot be interpreted as excluding or limiting the applicability of those obligations and data subjects’ rights that are not mentioned in it.

| 12. | Against this background, in the next paragraphs the EDPS will analyze the provisions of the proposal in the light of the most relevant data protection principles, providing recommendations for improvement as well as guidance about how to address some other issues which are currently not addressed but are likely to arise from the application of data protection principles. In some cases, it may be desirable to provide further details about the application of data protection obligations and rights in the area of restrictive measures. |
| --- | --- |

12.

Against this background, in the next paragraphs the EDPS will analyze the provisions of the proposal in the light of the most relevant data protection principles, providing recommendations for improvement as well as guidance about how to address some other issues which are currently not addressed but are likely to arise from the application of data protection principles. In some cases, it may be desirable to provide further details about the application of data protection obligations and rights in the area of restrictive measures.

| 13. | These comments can only reflect the protection of personal data as a crucial factor in ensuring legitimacy and efficiency of the restrictive measures taken by the Commission, and do not address or affect other substantive questions that may be related to the inclusion in a list under the application of other rules. |
| --- | --- |

13.

These comments can only reflect the protection of personal data as a crucial factor in ensuring legitimacy and efficiency of the restrictive measures taken by the Commission, and do not address or affect other substantive questions that may be related to the inclusion in a list under the application of other rules.

III.2.   Articles 7a and 7c: information to the persons concerned and de-listing

| 14. | Article 7a deals with the procedures to list and de-list natural or legal persons and Article 7c provides for a specific procedure applying to those which have been included in the list before 3 September 2008. |
| --- | --- |

14.

Article 7a deals with the procedures to list and de-list natural or legal persons and Article 7c provides for a specific procedure applying to those which have been included in the list before 3 September 2008.

| 15. | The EDPS welcomes these provisions to the extent in which they enhance the respect of fundamental rights by providing means for the persons concerned to be informed about the reasons for inclusion in the lists as well as with an opportunity to express his or her views on the matter. Furthermore, paragraph 4 provides that a de-listing at UN level will automatically trigger a de-listing at EU level, which is in line with the data protection principle that personal data should be kept up to date, as provided for in Article 4(1)(d) of Regulation (EC) No 45/2001. |
| --- | --- |

15.

The EDPS welcomes these provisions to the extent in which they enhance the respect of fundamental rights by providing means for the persons concerned to be informed about the reasons for inclusion in the lists as well as with an opportunity to express his or her views on the matter. Furthermore, paragraph 4 provides that a de-listing at UN level will automatically trigger a de-listing at EU level, which is in line with the data protection principle that personal data should be kept up to date, as provided for in Article 4(1)(d) of Regulation (EC) No 45/2001.

| 16. | However, the EDPS points out that these provisions do not exclude similar obligations arising from Regulation (EC) No 45/2001, such as the obligation to provide information to the data subject pursuant to Article 11 and in particular Article 12 — dealing with information to be supplied when the data have not been obtained from the data subject —, the obligation pursuant to Article 14 to rectify without delay inaccurate or incomplete personal data and the obligation pursuant to Article 17 to notify rectification or erasure of data — as in the case of de-listing — to third parties to whom data have been disclosed, unless this proves impossible or involves a disproportionate effort. |
| --- | --- |

16.

However, the EDPS points out that these provisions do not exclude similar obligations arising from Regulation (EC) No 45/2001, such as the obligation to provide information to the data subject pursuant to Article 11 and in particular Article 12 — dealing with information to be supplied when the data have not been obtained from the data subject —, the obligation pursuant to Article 14 to rectify without delay inaccurate or incomplete personal data and the obligation pursuant to Article 17 to notify rectification or erasure of data — as in the case of de-listing — to third parties to whom data have been disclosed, unless this proves impossible or involves a disproportionate effort.

| 17. | Of course, as already mentioned in point 10, necessary exemptions and restrictions to these provisions may be taken pursuant to Article 20 of Regulation (EC) No 45/2001. For example, information to the persons concerned will need to be delayed, insofar as it is needed to preserve the ‘surprise effect’ of the decision to list this person and to freeze his or her assets. In this perspective, the EDPS recommends the legislator to consider whether to explicitly clarify in the proposal the exemptions to data protection principles that may be necessary, such as for example the need to postpone the information notice pursuant to Article 12 until the provisional decision has been taken. |
| --- | --- |

17.

Of course, as already mentioned in point 10, necessary exemptions and restrictions to these provisions may be taken pursuant to Article 20 of Regulation (EC) No 45/2001. For example, information to the persons concerned will need to be delayed, insofar as it is needed to preserve the ‘surprise effect’ of the decision to list this person and to freeze his or her assets. In this perspective, the EDPS recommends the legislator to consider whether to explicitly clarify in the proposal the exemptions to data protection principles that may be necessary, such as for example the need to postpone the information notice pursuant to Article 12 until the provisional decision has been taken.

III.3.   Article 7d: data subjects’ right of access, supervisory tasks and judicial remedies

| 18. | In the proposed Article 7d it is stated in the first paragraph that if the UN or a State submits classified information, the Commission shall treat such information in accordance with the internal Commission provisions on security (Decision 2001/844/EC, ECSC, Euratom (3)) and, where relevant, agreements on the security of classified information concluded between the EU and the submitting State. In the second paragraph it is specified that documents classified at a level corresponding to ‘EU Top Secret’, ‘EU Secret’ or ‘EU Confidential’ will not be released without the consent of the originator. |
| --- | --- |

18.

In the proposed Article 7d it is stated in the first paragraph that if the UN or a State submits classified information, the Commission shall treat such information in accordance with the internal Commission provisions on security (Decision 2001/844/EC, ECSC, Euratom (3)) and, where relevant, agreements on the security of classified information concluded between the EU and the submitting State. In the second paragraph it is specified that documents classified at a level corresponding to ‘EU Top Secret’, ‘EU Secret’ or ‘EU Confidential’ will not be released without the consent of the originator.

| 19. | This Article raises two issues, the first of which relates to the impact of the provision for the data subject's right of access to his or her personal data as laid down in Article 13 of Regulation (EC) No 45/2001 and the second to the possibility of the EDPS, as well as of the Court of Justice, to have access to personal data contained in classified information in order to effectively perform their respective tasks. |
| --- | --- |

19.

This Article raises two issues, the first of which relates to the impact of the provision for the data subject's right of access to his or her personal data as laid down in Article 13 of Regulation (EC) No 45/2001 and the second to the possibility of the EDPS, as well as of the Court of Justice, to have access to personal data contained in classified information in order to effectively perform their respective tasks.

Data subject's right of access to personal data contained in classified documents

| 20. | The rules on security referred to as well as the agreements between the EU and the submitting State regulate how classified information can be accessed. Only persons with a need-to-know, meaning that they need access in order to be able to perform a function or task, can get access to such information (4). With regard to information carrying the classification levels mentioned in the proposed Article 7d(2), these persons furthermore need a security clearance. |
| --- | --- |

20.

The rules on security referred to as well as the agreements between the EU and the submitting State regulate how classified information can be accessed. Only persons with a need-to-know, meaning that they need access in order to be able to perform a function or task, can get access to such information (4). With regard to information carrying the classification levels mentioned in the proposed Article 7d(2), these persons furthermore need a security clearance.

| 21. | The internal Commission rules on security must be read in conjunction with Regulation (EC) No 1049/2001 on public access to European Parliament, Council and Commission documents, which elaborates the right of anyone to have access to information of the three largest EU institutions. Article 9 of this Regulation deals with the treatment of sensitive documents and refers to the three categories of classification mentioned above. It states in paragraph 3 that sensitive documents will only be released with the consent of the originator, a rule which is contained in the proposed Article 7d(2) as well. |
| --- | --- |

21.

The internal Commission rules on security must be read in conjunction with Regulation (EC) No 1049/2001 on public access to European Parliament, Council and Commission documents, which elaborates the right of anyone to have access to information of the three largest EU institutions. Article 9 of this Regulation deals with the treatment of sensitive documents and refers to the three categories of classification mentioned above. It states in paragraph 3 that sensitive documents will only be released with the consent of the originator, a rule which is contained in the proposed Article 7d(2) as well.

| 22. | The internal Commission rules on security are reconciled with the right to public access to documents. However, this is not the case with regard to specific rights of access, such as the right of data subjects to have access to their own personal data on the basis of Article 13 of Regulation (EC) No 45/2001. The internal security rules make no reference to data protection rules or the rights of data subjects as such. The situation in which a data subject requests access to personal data contained in a classified document is not addressed in the internal Commission security rules. The same holds true for the agreements on security of classified information with individual states. |
| --- | --- |

22.

The internal Commission rules on security are reconciled with the right to public access to documents. However, this is not the case with regard to specific rights of access, such as the right of data subjects to have access to their own personal data on the basis of Article 13 of Regulation (EC) No 45/2001. The internal security rules make no reference to data protection rules or the rights of data subjects as such. The situation in which a data subject requests access to personal data contained in a classified document is not addressed in the internal Commission security rules. The same holds true for the agreements on security of classified information with individual states.

| 23. | Article 13 of Regulation (EC) No 45/2001 grants the data subject the right to obtain, without constraint, at any time within three months from the receipt of the request and free of charge from the controller, inter alia, communication in an intelligible form of the data undergoing processing (see subparagraph (c)). |
| --- | --- |

23.

Article 13 of Regulation (EC) No 45/2001 grants the data subject the right to obtain, without constraint, at any time within three months from the receipt of the request and free of charge from the controller, inter alia, communication in an intelligible form of the data undergoing processing (see subparagraph (c)).

| 24. | The EDPS fully understands that in the context of restrictive measures against certain persons or entities which serve the purpose of preventing terrorist crimes, there are justified reasons not to disclose classified (personal) information to a data subject. This restriction can find its basis in Article 20 of Regulation (EC) No 45/2001, as already mentioned at point 10. The EDPS, however, wishes to point at the requirement of necessity contained in this Article and the procedure foreseen in paragraphs 3 and 4 of Article 20 of Regulation (EC) No 45/2001. |
| --- | --- |

24.

The EDPS fully understands that in the context of restrictive measures against certain persons or entities which serve the purpose of preventing terrorist crimes, there are justified reasons not to disclose classified (personal) information to a data subject. This restriction can find its basis in Article 20 of Regulation (EC) No 45/2001, as already mentioned at point 10. The EDPS, however, wishes to point at the requirement of necessity contained in this Article and the procedure foreseen in paragraphs 3 and 4 of Article 20 of Regulation (EC) No 45/2001.

| 25. | Article 20 requires that restrictions to the provisions mentioned constitute a necessary measure for safeguarding one of the purposes mentioned. Since the internal Commission rules on security as well as the agreements with individual states do not address the issue of data subject access and the proposed Article 7d(2) contains an unconditional obligation to obtain the consent of the originator before classified documents can be released, it is not ensured that a restriction of the right of access only takes place when it is necessary. The provision does not provide any substantive criteria and leaves a full discretion to the originator of the information, which includes parties which are not subject to EU law and EU standards of protection of fundamental rights. |
| --- | --- |

25.

Article 20 requires that restrictions to the provisions mentioned constitute a necessary measure for safeguarding one of the purposes mentioned. Since the internal Commission rules on security as well as the agreements with individual states do not address the issue of data subject access and the proposed Article 7d(2) contains an unconditional obligation to obtain the consent of the originator before classified documents can be released, it is not ensured that a restriction of the right of access only takes place when it is necessary. The provision does not provide any substantive criteria and leaves a full discretion to the originator of the information, which includes parties which are not subject to EU law and EU standards of protection of fundamental rights.

| 26. | Paragraphs 3 and 4 of Article 20 contain rules relating to the application of a restriction. According to paragraph 3 the institution involved should inform the data subject of the principal reasons on which the restriction is based and of his or her right to have recourse to the EDPS. Paragraph 4 contains a further rule which relates specifically to a restriction of the right of access. It states that the EDPS, when investigating a complaint on the basis of the previous paragraph, shall only inform the data subject of whether the data have been processed correctly and if not, whether any necessary corrections have been made (5). The current proposal to amend Regulation (EC) No 881/2002 should ensure that these rules can be complied with. This point is closely linked to the second issue which the proposed Article 7d raises. |
| --- | --- |

26.

Paragraphs 3 and 4 of Article 20 contain rules relating to the application of a restriction. According to paragraph 3 the institution involved should inform the data subject of the principal reasons on which the restriction is based and of his or her right to have recourse to the EDPS. Paragraph 4 contains a further rule which relates specifically to a restriction of the right of access. It states that the EDPS, when investigating a complaint on the basis of the previous paragraph, shall only inform the data subject of whether the data have been processed correctly and if not, whether any necessary corrections have been made (5). The current proposal to amend Regulation (EC) No 881/2002 should ensure that these rules can be complied with. This point is closely linked to the second issue which the proposed Article 7d raises.

Access to classified information by the EDPS

| 27. | The condition contained in Article 7d(2) that classified information shall only be released with the consent of the originator could also impinge on the independent supervision of the EDPS. The applicability of Regulation (EC) No 45/2001 entails that the processing of personal data may be subject to the remedies laid down in its Article 32 as well as to the enforcement powers of the EDPS laid down in its Article 47. In particular, the latter article grants the EDPS the power to obtain from a controller or Community institution or body access to all personal data and to all information necessary for his enquiries (see Article 47(2)(b) of Regulation (EC) No 45/2001). It is possible that in the context of the current proposal the EDPS might use this power in order to perform his task under Article 20(4) of Regulation (EC) No 45/2001. However, the current formulation of Article 7d would make the effective exercise of this power dependant on the full discretion of the originator of the information. |
| --- | --- |

27.

The condition contained in Article 7d(2) that classified information shall only be released with the consent of the originator could also impinge on the independent supervision of the EDPS. The applicability of Regulation (EC) No 45/2001 entails that the processing of personal data may be subject to the remedies laid down in its Article 32 as well as to the enforcement powers of the EDPS laid down in its Article 47. In particular, the latter article grants the EDPS the power to obtain from a controller or Community institution or body access to all personal data and to all information necessary for his enquiries (see Article 47(2)(b) of Regulation (EC) No 45/2001). It is possible that in the context of the current proposal the EDPS might use this power in order to perform his task under Article 20(4) of Regulation (EC) No 45/2001. However, the current formulation of Article 7d would make the effective exercise of this power dependant on the full discretion of the originator of the information.

| 28. | The text of Article 7d as it currently stands would therefore be in conflict with the rules contained in Regulation (EC) No 45/2001. In this respect, the EDPS wishes to underline that Article 20 of Regulation (EC) No 45/2001 does not provide for the restriction of the duties and powers of the EDPS contained in Articles 46 and 47. |
| --- | --- |

28.

The text of Article 7d as it currently stands would therefore be in conflict with the rules contained in Regulation (EC) No 45/2001. In this respect, the EDPS wishes to underline that Article 20 of Regulation (EC) No 45/2001 does not provide for the restriction of the duties and powers of the EDPS contained in Articles 46 and 47.

| 29. | In addition to the remedies available before independent data protection authorities, data protection legislation lays down the right to have a judicial remedy before a Court (see Article 22 of Directive 95/46/EC and Article 32 of Regulation (EC) No 45/2001). Against this background, the EDPS wants to point at the fact that the current text of Article 7d(2) could also affect the effectiveness of this judicial review, by impinging on the ability of the ECJ to review whether a fair balance is struck between the need to combat international terrorism and the protection of fundamental rights. As stated by the CFI in its judgment of 4 December 2008, access to classified information can be necessary to enable the Court to do so (6). |
| --- | --- |

29.

In addition to the remedies available before independent data protection authorities, data protection legislation lays down the right to have a judicial remedy before a Court (see Article 22 of Directive 95/46/EC and Article 32 of Regulation (EC) No 45/2001). Against this background, the EDPS wants to point at the fact that the current text of Article 7d(2) could also affect the effectiveness of this judicial review, by impinging on the ability of the ECJ to review whether a fair balance is struck between the need to combat international terrorism and the protection of fundamental rights. As stated by the CFI in its judgment of 4 December 2008, access to classified information can be necessary to enable the Court to do so (6).

Suggested modifications

| 30. | In the light of the foregoing, the EDPS urges the legislator to modify Article 7d in such a way that it is ensured: 1. that the necessity requirement of Article 20 of Regulation (EC) No 45/2001 will be met in case the Commission denies a data subject access to his or her personal information contained in classified documents; 2. that compliance with the rules set out in Article 20, paragraphs 3 and 4 is ensured; and 3. that the powers of the EDPS as contained in Article 47 are fully respected. |
| --- | --- |

30.

In the light of the foregoing, the EDPS urges the legislator to modify Article 7d in such a way that it is ensured: 1. that the necessity requirement of Article 20 of Regulation (EC) No 45/2001 will be met in case the Commission denies a data subject access to his or her personal information contained in classified documents; 2. that compliance with the rules set out in Article 20, paragraphs 3 and 4 is ensured; and 3. that the powers of the EDPS as contained in Article 47 are fully respected.

| 31. | To achieve this a first step would be to limit the scope of Article 7d(2) through replacing the word ‘released’ with ‘publicly disclosed’. Such a change would also be legally consistent since, as explained above, the provision is taken from Article 9(3) of Regulation (EC) No 1049/2001 which only deals with public access to documents. The suggested modification would to a large extent solve the problems discussed above: the restriction of the right of access for data subjects will no longer be left to the full discretion of the submitting party and also the possibility for the EDPS and the ECJ to access such information for the performance of their respective tasks would not be restricted. |
| --- | --- |

31.

To achieve this a first step would be to limit the scope of Article 7d(2) through replacing the word ‘released’ with ‘publicly disclosed’. Such a change would also be legally consistent since, as explained above, the provision is taken from Article 9(3) of Regulation (EC) No 1049/2001 which only deals with public access to documents. The suggested modification would to a large extent solve the problems discussed above: the restriction of the right of access for data subjects will no longer be left to the full discretion of the submitting party and also the possibility for the EDPS and the ECJ to access such information for the performance of their respective tasks would not be restricted.

| 32. | However, as long as the internal Commission rules and agreements on information security do not explicitly address the issue of data subject access and ensure that the necessity requirement of Article 20 of Regulation (EC) No 45/2001 is met, a problem remains. Whereas the EDPS (and the ECJ) can have access on the basis of the need-to-know principle and after a security clearance of the people who are in fact dealing with the information, it is doubtful whether this is possible for the data subject as well. The EDPS therefore urges the Commission to ensure that the right of access to personal information in classified documents is only restricted when necessary. |
| --- | --- |

32.

However, as long as the internal Commission rules and agreements on information security do not explicitly address the issue of data subject access and ensure that the necessity requirement of Article 20 of Regulation (EC) No 45/2001 is met, a problem remains. Whereas the EDPS (and the ECJ) can have access on the basis of the need-to-know principle and after a security clearance of the people who are in fact dealing with the information, it is doubtful whether this is possible for the data subject as well. The EDPS therefore urges the Commission to ensure that the right of access to personal information in classified documents is only restricted when necessary.

III.4.   Article 7e: legal grounds for processing, categories of data processed, appointment of controller

| 33. | Article 7e defines with a good level of detail both the Commission tasks to process personal data (paragraph 1) and the personal data that will be processed (paragraphs 2-4). Its paragraph 5 appoints a Commission unit as controller within the meaning of Article 2(d) of Regulation (EC) No 45/2001. |
| --- | --- |

33.

Article 7e defines with a good level of detail both the Commission tasks to process personal data (paragraph 1) and the personal data that will be processed (paragraphs 2-4). Its paragraph 5 appoints a Commission unit as controller within the meaning of Article 2(d) of Regulation (EC) No 45/2001.

| 34. | The EDPS welcomes the first paragraph of Article 7e to the extent in which it aims at providing a legal basis for processing of personal data, pursuant to Article 5 of Regulation (EC) No 45/2001. Indeed, all processing activities of personal data should be based on one of the legal grounds listed by this Article. In this perspective, the EDPS acknowledges that letters (a): ‘necessary for the performance of a task carried out in the public interest (...)’, and (b): ‘necessary for compliance with a legal obligation to which the controller is subject’, may be particularly relevant in the context of restrictive measures. |
| --- | --- |

34.

The EDPS welcomes the first paragraph of Article 7e to the extent in which it aims at providing a legal basis for processing of personal data, pursuant to Article 5 of Regulation (EC) No 45/2001. Indeed, all processing activities of personal data should be based on one of the legal grounds listed by this Article. In this perspective, the EDPS acknowledges that letters (a): ‘necessary for the performance of a task carried out in the public interest (...)’, and (b): ‘necessary for compliance with a legal obligation to which the controller is subject’, may be particularly relevant in the context of restrictive measures.

| 35. | However, the EDPS recalls that pursuant to Article 4 of Regulation (EC) No 45/2001, personal data should be ‘adequate, relevant and not excessive in relation to the purposes for which they are collected (...)’, and that therefore the Commission should ensure that personal data collected are necessary for the purpose of imposing the restrictive measures envisaged by the draft Regulation. |
| --- | --- |

35.

However, the EDPS recalls that pursuant to Article 4 of Regulation (EC) No 45/2001, personal data should be ‘adequate, relevant and not excessive in relation to the purposes for which they are collected (...)’, and that therefore the Commission should ensure that personal data collected are necessary for the purpose of imposing the restrictive measures envisaged by the draft Regulation.

| 36. | In this perspective, the EDPS recommends to amend Article 7e, paragraph 1, as follows: ‘The Commission shall process personal data necessary to carry out its tasks under this Regulation’. |
| --- | --- |

36.

In this perspective, the EDPS recommends to amend Article 7e, paragraph 1, as follows: ‘The Commission shall process personal data necessary to carry out its tasks under this Regulation’.

| 37. | Furthermore, the relevance of the categories of data used in connection with restrictive measures — including elements such as general identifiers (i.e., fiscal and social security numbers) and ‘function or profession’ — should be carefully checked, both in general and on a case-by-case basis, especially to the extent in which these pieces of information may include special categories of data and may need specific safeguards. |
| --- | --- |

37.

Furthermore, the relevance of the categories of data used in connection with restrictive measures — including elements such as general identifiers (i.e., fiscal and social security numbers) and ‘function or profession’ — should be carefully checked, both in general and on a case-by-case basis, especially to the extent in which these pieces of information may include special categories of data and may need specific safeguards.

| 38. | Against this background, the EDPS welcomes the principle laid down in paragraph 3, according to which the name and surname of the natural person's parents may be included in the Annex when they are necessary in a specific case for the sole purpose of verification of the identity of the listed natural person in question. This provision well reflects the data protection principle of purpose limitation, which should be adequately specified and applied with regard to the whole article. Therefore, the EDPS recommends explicitly applying this principle to all categories of data, by amending Article 7e, paragraph 2, as follows: ‘Annex I shall only include the information necessary for the purpose of verification of the identity of the listed natural persons and in any case no more than the following information’. |
| --- | --- |

38.

Against this background, the EDPS welcomes the principle laid down in paragraph 3, according to which the name and surname of the natural person's parents may be included in the Annex when they are necessary in a specific case for the sole purpose of verification of the identity of the listed natural person in question. This provision well reflects the data protection principle of purpose limitation, which should be adequately specified and applied with regard to the whole article. Therefore, the EDPS recommends explicitly applying this principle to all categories of data, by amending Article 7e, paragraph 2, as follows: ‘Annex I shall only include the information necessary for the purpose of verification of the identity of the listed natural persons and in any case no more than the following information’.

| 39. | The EDPS also welcomes paragraph 4, which establishes that specific categories of personal data such as criminal offences, criminal convictions or security measures can only be processed in specific cases, subject to appropriate specific safeguards and shall not be made public or exchanged. |
| --- | --- |

39.

The EDPS also welcomes paragraph 4, which establishes that specific categories of personal data such as criminal offences, criminal convictions or security measures can only be processed in specific cases, subject to appropriate specific safeguards and shall not be made public or exchanged.

| 40. | With regard to paragraph 5, the EDPS acknowledges that the appointment of a controller in Annex II to Regulation (EC) No 881/2002 will enhance the visibility of the controller and its role of ‘point of contact’, thus facilitating the exercise of data subjects’ rights under Regulation (EC) No 45/2001. However, the EDPS recalls that it is also necessary to make sure that the controller is in a position to effectively ensure not only the exercise of data subjects’ rights, but also the compliance with all other obligations stemming from Regulation (EC) No 45/2001. In this perspective, the Commission may consider clarifying this point of the proposal for example by adding to paragraph 5 an explicit reference to the need for the controller to ensure the compliance with obligations stemming from Regulation (EC) No 45/2001. |
| --- | --- |

40.

With regard to paragraph 5, the EDPS acknowledges that the appointment of a controller in Annex II to Regulation (EC) No 881/2002 will enhance the visibility of the controller and its role of ‘point of contact’, thus facilitating the exercise of data subjects’ rights under Regulation (EC) No 45/2001. However, the EDPS recalls that it is also necessary to make sure that the controller is in a position to effectively ensure not only the exercise of data subjects’ rights, but also the compliance with all other obligations stemming from Regulation (EC) No 45/2001. In this perspective, the Commission may consider clarifying this point of the proposal for example by adding to paragraph 5 an explicit reference to the need for the controller to ensure the compliance with obligations stemming from Regulation (EC) No 45/2001.

III.5.   Transfer of personal data to third countries and international organisations

| 41. | An important question, which is not explicitly addressed by the proposal but is implicit in the listing procedure, is to which extent personal data processed by Community institutions could be shared with the United Nations and/or third countries and, if so, under which conditions. |
| --- | --- |

41.

An important question, which is not explicitly addressed by the proposal but is implicit in the listing procedure, is to which extent personal data processed by Community institutions could be shared with the United Nations and/or third countries and, if so, under which conditions.

| 42. | In this regard, the EDPS would like to draw attention to Article 9 of Regulation (EC) No 45/2001, which lays down the conditions for transfer of personal data to recipients, other than Community bodies, which are not subject to Directive 95/46/EC. A broad gamut of solutions is available, ranging from the consent of the data subject (paragraph 6(a)) and the exercise of legal claims (paragraph 6(d)) — which could be useful in case the information has been provided by the listed person with a view to trigger a review of the listing — to the existence within the UN of mechanisms to ensure an adequate protection for personal data transmitted from the EU. |
| --- | --- |

42.

In this regard, the EDPS would like to draw attention to Article 9 of Regulation (EC) No 45/2001, which lays down the conditions for transfer of personal data to recipients, other than Community bodies, which are not subject to Directive 95/46/EC. A broad gamut of solutions is available, ranging from the consent of the data subject (paragraph 6(a)) and the exercise of legal claims (paragraph 6(d)) — which could be useful in case the information has been provided by the listed person with a view to trigger a review of the listing — to the existence within the UN of mechanisms to ensure an adequate protection for personal data transmitted from the EU.

| 43. | The EDPS recalls that the various processing activities envisaged should be in line with this system, with a view to ensure an adequate protection of personal data exchanged with third countries and international organisations, and that specifications in the proposal as well as arrangements with the UN may be needed accordingly. |
| --- | --- |

43.

The EDPS recalls that the various processing activities envisaged should be in line with this system, with a view to ensure an adequate protection of personal data exchanged with third countries and international organisations, and that specifications in the proposal as well as arrangements with the UN may be needed accordingly.

III.6.   Other issues: liability, prior checking, EDPS consultation

| 44. | Article 6 of the proposal excludes liability, except in case of negligence, for those natural and legal persons implementing restrictive measures. In this regard, the EDPS wishes to clarify that this Article shall not be considered as excluding non-contractual liability, pursuant to Article 32(4) of Regulation (EC) No 45/2001 as well as Article 23 of Directive 95/46/EC, for a processing of personal data in breach of applicable data protection law. In this perspective, restrictive measures are based on processing and publication of personal data, which in case of unlawfulness may by itself — irrespective of the restrictive measures taken — give rise to non-material damage, as already recognised by the Court of Justice (7). |
| --- | --- |

44.

Article 6 of the proposal excludes liability, except in case of negligence, for those natural and legal persons implementing restrictive measures. In this regard, the EDPS wishes to clarify that this Article shall not be considered as excluding non-contractual liability, pursuant to Article 32(4) of Regulation (EC) No 45/2001 as well as Article 23 of Directive 95/46/EC, for a processing of personal data in breach of applicable data protection law. In this perspective, restrictive measures are based on processing and publication of personal data, which in case of unlawfulness may by itself — irrespective of the restrictive measures taken — give rise to non-material damage, as already recognised by the Court of Justice (7).

| 45. | It should be noted that a prior checking by the EDPS pursuant to Article 27 of Regulation (EC) No 45/2001 may be necessary, to the extent in which the proposal establishes processing operations relating to special categories of data (suspected offences, criminal convictions or security measures) and for the purpose of excluding individuals from the full enjoyment of their right to property. |
| --- | --- |

45.

It should be noted that a prior checking by the EDPS pursuant to Article 27 of Regulation (EC) No 45/2001 may be necessary, to the extent in which the proposal establishes processing operations relating to special categories of data (suspected offences, criminal convictions or security measures) and for the purpose of excluding individuals from the full enjoyment of their right to property.

| 46. | The EDPS, pursuant to Article 28 of Regulation (EC) No 45/2001, expects to be consulted with regard to legislative proposals and administrative measures relating to the processing of personal data which may be put forward in the area of restrictive measures on suspected terrorists. |
| --- | --- |

46.

The EDPS, pursuant to Article 28 of Regulation (EC) No 45/2001, expects to be consulted with regard to legislative proposals and administrative measures relating to the processing of personal data which may be put forward in the area of restrictive measures on suspected terrorists.

IV.   CONCLUSIONS

| 47. | The EDPS welcomes the intention of the Commission's proposal to address the recent case law of the Court of Justice by enhancing the listing procedure and by taking explicitly into account the right to the protection of personal data, which represents a crucial factor in ensuring the legitimacy and efficiency of the restrictive measures taken by the Commission. |
| --- | --- |

47.

The EDPS welcomes the intention of the Commission's proposal to address the recent case law of the Court of Justice by enhancing the listing procedure and by taking explicitly into account the right to the protection of personal data, which represents a crucial factor in ensuring the legitimacy and efficiency of the restrictive measures taken by the Commission.

| 48. | The EDPS welcomes the references in the preamble to the need to apply the Regulation in accordance with the fundamental right to the protection of personal data and that the proposal explicitly recognizes in its recital 12 the applicability of data protection rules, and in particular of Regulation (EC) No 45/2001, to the processing of personal data in this area. |
| --- | --- |

48.

The EDPS welcomes the references in the preamble to the need to apply the Regulation in accordance with the fundamental right to the protection of personal data and that the proposal explicitly recognizes in its recital 12 the applicability of data protection rules, and in particular of Regulation (EC) No 45/2001, to the processing of personal data in this area.

| 49. | As a general remark, the EDPS would like to stress that Regulation (EC) No 45/2001 lays down a series of obligations for controllers as well as rights for data subjects which shall apply even when they are not explicitly mentioned by the proposal. However, in some cases, it may be desirable to provide further details about the application — and possible exemptions and restrictions — of data protection obligations and rights in the area of restrictive measures. |
| --- | --- |

49.

As a general remark, the EDPS would like to stress that Regulation (EC) No 45/2001 lays down a series of obligations for controllers as well as rights for data subjects which shall apply even when they are not explicitly mentioned by the proposal. However, in some cases, it may be desirable to provide further details about the application — and possible exemptions and restrictions — of data protection obligations and rights in the area of restrictive measures.

| 50. | The EDPS welcomes Articles 7a and 7c to the extent in which they enhance the respect of fundamental rights by providing means for the persons concerned to be informed about the reasons for inclusion in the list. However, the EDPS points out that these provisions do not exclude similar obligations arising from Regulation (EC) No 45/2001. In this perspective, the EDPS recommends the legislator to consider whether to explicitly clarify in the proposal the exemptions to data protection principles that may be necessary, such as for example the need to postpone the information notice pursuant to Article 12 until the provisional decision has been taken. |
| --- | --- |

50.

The EDPS welcomes Articles 7a and 7c to the extent in which they enhance the respect of fundamental rights by providing means for the persons concerned to be informed about the reasons for inclusion in the list. However, the EDPS points out that these provisions do not exclude similar obligations arising from Regulation (EC) No 45/2001. In this perspective, the EDPS recommends the legislator to consider whether to explicitly clarify in the proposal the exemptions to data protection principles that may be necessary, such as for example the need to postpone the information notice pursuant to Article 12 until the provisional decision has been taken.

| 51. | The EDPS considers that Article 7d, by making the release of confidential documents subject to the consent of the originator, may impinge on the data subject's right of access to his or her personal data as laid down in Article 13 of Regulation (EC) No 45/2001 and on the possibility of the EDPS, as well as of the Court of Justice, to have access to personal data contained in classified information in order to effectively perform their respective tasks. In this perspective, the EDPS urges the legislator to amend this provision, in particular by replacing the word ‘released’ with ‘publicly disclosed’. |
| --- | --- |

51.

The EDPS considers that Article 7d, by making the release of confidential documents subject to the consent of the originator, may impinge on the data subject's right of access to his or her personal data as laid down in Article 13 of Regulation (EC) No 45/2001 and on the possibility of the EDPS, as well as of the Court of Justice, to have access to personal data contained in classified information in order to effectively perform their respective tasks. In this perspective, the EDPS urges the legislator to amend this provision, in particular by replacing the word ‘released’ with ‘publicly disclosed’.

| 52. | The EDPS welcomes Article 7e to the extent in which it aims at providing a legal basis for processing of personal data, pursuant to Article 5 of Regulation (EC) No 45/2001. However, he recommends some amendments so as to ensure that data processed are used for specific purposes and are relevant, and that the role of the controller is in line with Regulation (EC) No 45/2001. |
| --- | --- |

52.

The EDPS welcomes Article 7e to the extent in which it aims at providing a legal basis for processing of personal data, pursuant to Article 5 of Regulation (EC) No 45/2001. However, he recommends some amendments so as to ensure that data processed are used for specific purposes and are relevant, and that the role of the controller is in line with Regulation (EC) No 45/2001.

| 53. | The EDPS recalls that possible transfers to third countries and international organisations should be in line with Article 9 of Regulation (EC) No 45/2001, with a view to ensure an adequate protection of these data. In this regard, specifications in the proposal as well as arrangements with the UN may be needed. |
| --- | --- |

53.

The EDPS recalls that possible transfers to third countries and international organisations should be in line with Article 9 of Regulation (EC) No 45/2001, with a view to ensure an adequate protection of these data. In this regard, specifications in the proposal as well as arrangements with the UN may be needed.

| 54. | The EDPS furthermore notes that the proposal leaves unprejudiced the liability which may arise in case of unlawful processing and publication of personal data; that a prior checking pursuant to Article 27 of Regulation (EC) No 45/2001 may be necessary, and that he expects to be consulted with regard to further legislative proposals and administrative measures in this area. |
| --- | --- |

54.

The EDPS furthermore notes that the proposal leaves unprejudiced the liability which may arise in case of unlawful processing and publication of personal data; that a prior checking pursuant to Article 27 of Regulation (EC) No 45/2001 may be necessary, and that he expects to be consulted with regard to further legislative proposals and administrative measures in this area.

Done at Brussels, 28 July 2009.

Peter HUSTINX

European Data Protection Supervisor

---

(1)  ECJ, 3.9.2008, Kadi and Al Barakaat International Foundation v Council, C-402/05 P and C-415/05 P, not yet released.

1

Kadi and Al Barakaat International Foundation

Council

(2)  Kadi, cited supra note 1, see notably paragraph 285.

2

Kadi

supra

(3)  Commission Decision 2001/844/EC, ECSC, Euratom of 29 November 2001 amending its internal Rules of Procedure (OJ L 317, 3.12.2001, p. 1).

3

(4)  See part 19 of Decision 2001/844/EC, ECSC, Euratom and, for instance, Article 4(7) of the Agreement between the European Union and the government of the United States of America on the security of classified information (OJ L 115, 3.5.2007, p. 30).

4

(5)  The provision of information mentioned in Article 20(3) and (4) may be deferred for as long as such information would deprive the restriction of its effect (see Article 20(5)).

5

(6)  CFI, 4.12.2008, PMOI v Council, T-284/08, not yet released, see notably paragraphs 74-76.

6

PMOI

Council

(7)  CFI, 12.9.2007, Kalliopi Nikolau v Commission, T-259/03, [2007] ECR II-99; CFI, 8.7.2008, Franchet and Byk v Commission, T-48/05, not yet released.

7

Kalliopi Nikolau

Commission

Franchet and Byk

Commission

---

| 17.11.2009 | EN | Official Journal of the European Union | C 276/8 |
| --- | --- | --- | --- |

17.11.2009

EN

Official Journal of the European Union

C 276/8

---

Opinion of the European Data Protection Supervisor on the Communication from the Commission to the European Parliament and the Council on an area of freedom, security and justice serving the citizen

2009/C 276/02

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular its Article 41,

HAS ADOPTED THE FOLLOWING OPINION:

I.   INTRODUCTION

| 1. | On 10 June 2009, the Commission adopted its Communication to the European Parliament and the Council on an area of freedom, security and justice serving the citizen (1). In accordance with Article 41 of Regulation (EC) No 45/2001, the EDPS presents this opinion. |
| --- | --- |

1.

On 10 June 2009, the Commission adopted its Communication to the European Parliament and the Council on an area of freedom, security and justice serving the citizen (1). In accordance with Article 41 of Regulation (EC) No 45/2001, the EDPS presents this opinion.

| 2. | Prior to the adoption of the Communication, the Commission informally consulted the EDPS on it, by letter of 19 May 2009. The EDPS responded to this consultation on 20 May 2009 by sending informal comments which were intended to further improve the text of the Communication. Furthermore, the EDPS has actively contributed to the letter of 14 January 2009 of the Working Party on Police and Justice on the multi-annual programme in the Area of freedom, security and justice (2). |
| --- | --- |

2.

Prior to the adoption of the Communication, the Commission informally consulted the EDPS on it, by letter of 19 May 2009. The EDPS responded to this consultation on 20 May 2009 by sending informal comments which were intended to further improve the text of the Communication. Furthermore, the EDPS has actively contributed to the letter of 14 January 2009 of the Working Party on Police and Justice on the multi-annual programme in the Area of freedom, security and justice (2).

| 3. | The Communication (paragraph 1) emphasises that the Union ‘needs a new multi-annual programme that builds on the progress made so far and learns the lessons of the current weaknesses in order to make an ambitious push forward. The new programme should define the priorities for the next five years’. This multi-annual programme (already known as the Stockholm programme) will be the follow up of the Tampere and Hague programmes which gave a strong political impetus to the Area of freedom, security and justice. |
| --- | --- |

3.

The Communication (paragraph 1) emphasises that the Union ‘needs a new multi-annual programme that builds on the progress made so far and learns the lessons of the current weaknesses in order to make an ambitious push forward. The new programme should define the priorities for the next five years’. This multi-annual programme (already known as the Stockholm programme) will be the follow up of the Tampere and Hague programmes which gave a strong political impetus to the Area of freedom, security and justice.

| 4. | The Communication is meant to be the basis of this new multi-annual programme. The EDPS notes in this context that, even if multi-annual programmes are not as such binding instruments, they have a considerable impact on the policy that the institutions will develop in the area concerned, as many of the concrete legislative and non-legislative actions will stem from the programme. |
| --- | --- |

4.

The Communication is meant to be the basis of this new multi-annual programme. The EDPS notes in this context that, even if multi-annual programmes are not as such binding instruments, they have a considerable impact on the policy that the institutions will develop in the area concerned, as many of the concrete legislative and non-legislative actions will stem from the programme.

| 5. | The Communication itself must be seen in this perspective. It is the next step in a debate which more or less started with two reports presented in June 2008 of the so-called ‘Future Groups’ set up by the presidency of the Council to provide ideas: ‘Freedom, Security, Privacy — European Home Affairs in an open world’ (3) and ‘Proposed Solutions for the Future EU Justice Programme’ (4). |
| --- | --- |

5.

The Communication itself must be seen in this perspective. It is the next step in a debate which more or less started with two reports presented in June 2008 of the so-called ‘Future Groups’ set up by the presidency of the Council to provide ideas: ‘Freedom, Security, Privacy — European Home Affairs in an open world’ (3) and ‘Proposed Solutions for the Future EU Justice Programme’ (4).

II.   MAIN CONTENT OF THE OPINION

| 6. | The present opinion not only provides a reaction to the Communication, but is also a contribution of the EDPS to the more general debate on the future of the Area of freedom, security and justice which must result in a new strategic work programme (the Stockholm programme) as announced by the Swedish presidency of the EU (5). This opinion will also deal with some consequences of the possible entry into force of the Lisbon Treaty. |
| --- | --- |

6.

The present opinion not only provides a reaction to the Communication, but is also a contribution of the EDPS to the more general debate on the future of the Area of freedom, security and justice which must result in a new strategic work programme (the Stockholm programme) as announced by the Swedish presidency of the EU (5). This opinion will also deal with some consequences of the possible entry into force of the Lisbon Treaty.

| 7. | After a specification of the main perspectives of the Opinion in Part III, a general assessment of the Communication will be given in Part IV. |
| --- | --- |

7.

After a specification of the main perspectives of the Opinion in Part III, a general assessment of the Communication will be given in Part IV.

| 8. | Part V deals with the question how to respond to the need for continued respect for the protection of privacy and personal data in a context of increasing exchanges of personal data. The focus will be on paragraph 2.3 of the Communication on protection of personal data and privacy, and more in general the needs for further legislative and non-legislative actions to improve the framework for data protection. |
| --- | --- |

8.

Part V deals with the question how to respond to the need for continued respect for the protection of privacy and personal data in a context of increasing exchanges of personal data. The focus will be on paragraph 2.3 of the Communication on protection of personal data and privacy, and more in general the needs for further legislative and non-legislative actions to improve the framework for data protection.

| 9. | Part VI discusses the needs and possibilities for the storage, access and exchange of information as instruments for law enforcement, or in the words of the Communication, for ‘a Europe that protects’. Paragraph 4 of the Communication contains a number of objectives on the flow of information and technological tools, in particular in paragraphs 4.1.2 (Controlling the flow of information), 4.1.3 (Mobilising the necessary technological tools) and 4.2.3.2 (Information Systems). The development of a European information model (in paragraph 4.1.2) can be seen as the most challenging proposal in this context. The EDPS opinion analyses this proposal in depth. |
| --- | --- |

9.

Part VI discusses the needs and possibilities for the storage, access and exchange of information as instruments for law enforcement, or in the words of the Communication, for ‘a Europe that protects’. Paragraph 4 of the Communication contains a number of objectives on the flow of information and technological tools, in particular in paragraphs 4.1.2 (Controlling the flow of information), 4.1.3 (Mobilising the necessary technological tools) and 4.2.3.2 (Information Systems). The development of a European information model (in paragraph 4.1.2) can be seen as the most challenging proposal in this context. The EDPS opinion analyses this proposal in depth.

| 10. | Part VII briefly touches upon a specific topic within the Areas of freedom, security and justice with relevance for data protection, namely access to justice and e-Justice. |
| --- | --- |

10.

Part VII briefly touches upon a specific topic within the Areas of freedom, security and justice with relevance for data protection, namely access to justice and e-Justice.

III.   PERSPECTIVES OF THE OPINION

| 11. | This opinion will take the need for protection of fundamental rights as main angle for the analysis of the Communication and more in general the future of the Area of freedom, security and justice, as shaped by a new multi-annual programme. It will furthermore build on the contributions of the EDPS to the development of the EU policy in this area, mainly in his consultative role. Until now, the EDPS has adopted more than 30 opinions and comments about initiatives stemming from the Hague programme which all can be found on the website of the EDPS. |
| --- | --- |

11.

This opinion will take the need for protection of fundamental rights as main angle for the analysis of the Communication and more in general the future of the Area of freedom, security and justice, as shaped by a new multi-annual programme. It will furthermore build on the contributions of the EDPS to the development of the EU policy in this area, mainly in his consultative role. Until now, the EDPS has adopted more than 30 opinions and comments about initiatives stemming from the Hague programme which all can be found on the website of the EDPS.

| 12. | In his assessment of the Communication, the EDPS will take into account in particular the following four perspectives that are relevant for the future of the Area of freedom, security and justice. All these perspectives have a key role in the Communication as well. |
| --- | --- |

12.

In his assessment of the Communication, the EDPS will take into account in particular the following four perspectives that are relevant for the future of the Area of freedom, security and justice. All these perspectives have a key role in the Communication as well.

| 13. | The first perspective is the exponential growth of digital information on citizens as a result of evolving information and communication technologies (6). The society is moving towards what is often called a ‘surveillance society’ in which every transaction and almost every move of the citizens is likely to create a digital record. The so-called Internet of things and ‘ambient intelligence’ are already developing fast through the use of RFID tags. Digitalised characteristics of the human body (biometrics) are increasingly used. This leads to an increasingly connected world in which public security organisations may have access to vast amounts of potentially useful information, which can directly affect the life of the persons concerned. |
| --- | --- |

13.

The first perspective is the exponential growth of digital information on citizens as a result of evolving information and communication technologies (6). The society is moving towards what is often called a ‘surveillance society’ in which every transaction and almost every move of the citizens is likely to create a digital record. The so-called Internet of things and ‘ambient intelligence’ are already developing fast through the use of RFID tags. Digitalised characteristics of the human body (biometrics) are increasingly used. This leads to an increasingly connected world in which public security organisations may have access to vast amounts of potentially useful information, which can directly affect the life of the persons concerned.

| 14. | The second perspective is internationalisation. On the one hand, in the digital age data exchange is not bound by the external borders of the European Union, while on the other hand there is an increasing need of international cooperation in the whole range of EU activities in the Area of freedom, security and justice: fight against terrorism, police and judicial cooperation, civil justice and border control are only some examples. |
| --- | --- |

14.

The second perspective is internationalisation. On the one hand, in the digital age data exchange is not bound by the external borders of the European Union, while on the other hand there is an increasing need of international cooperation in the whole range of EU activities in the Area of freedom, security and justice: fight against terrorism, police and judicial cooperation, civil justice and border control are only some examples.

| 15. | The third perspective is the use of data for law enforcement purposes: recent threats to society, whether or not related to terrorism, have led to (demands for) more possibilities for law enforcement authorities to collect, store and exchange personal data. In many cases, private parties are actively involved, as, inter alia, shown by the Data Retention Directive (7) and the various instruments relating to PNR (8). |
| --- | --- |

15.

The third perspective is the use of data for law enforcement purposes: recent threats to society, whether or not related to terrorism, have led to (demands for) more possibilities for law enforcement authorities to collect, store and exchange personal data. In many cases, private parties are actively involved, as, inter alia, shown by the Data Retention Directive (7) and the various instruments relating to PNR (8).

| 16. | The fourth perspective is free movement. The gradual development of an area of freedom, security and justice requires that the internal borders and possible barriers for free movement within the area are further removed. New instruments in this area should in any event not reinstall barriers. Free movement comprises in the present context, on the one hand, the free movement of persons, and on the other hand, the free movement of (personal) data. |
| --- | --- |

16.

The fourth perspective is free movement. The gradual development of an area of freedom, security and justice requires that the internal borders and possible barriers for free movement within the area are further removed. New instruments in this area should in any event not reinstall barriers. Free movement comprises in the present context, on the one hand, the free movement of persons, and on the other hand, the free movement of (personal) data.

| 17. | These four perspectives demonstrate that the context in which information is used is changing rapidly. In such a context, there can be no doubt about the importance of a strong mechanism for the protection of fundamental rights of the citizen, and in particular privacy and data protection. It is for these reasons that the EDPS chooses the need for protection as main angle for his analysis, as mentioned in point 11. |
| --- | --- |

17.

These four perspectives demonstrate that the context in which information is used is changing rapidly. In such a context, there can be no doubt about the importance of a strong mechanism for the protection of fundamental rights of the citizen, and in particular privacy and data protection. It is for these reasons that the EDPS chooses the need for protection as main angle for his analysis, as mentioned in point 11.

IV.   GENERAL ASSESSMENT

| 18. | The Communication and the Stockholm programme are set to specify the intentions in the EU for the coming five years, with effects possibly on an even longer term. The EDPS notes that the Communication is written in a so-called Lisbon neutral-manner. The EDPS understands fully why the Commission has taken this approach, but also regrets that the Communication could not fully take advantage of the additional possibilities offered by the Lisbon Treaty. The perspective of the Lisbon Treaty will be given more emphasis in this opinion. |
| --- | --- |

18.

The Communication and the Stockholm programme are set to specify the intentions in the EU for the coming five years, with effects possibly on an even longer term. The EDPS notes that the Communication is written in a so-called Lisbon neutral-manner. The EDPS understands fully why the Commission has taken this approach, but also regrets that the Communication could not fully take advantage of the additional possibilities offered by the Lisbon Treaty. The perspective of the Lisbon Treaty will be given more emphasis in this opinion.

| 19. | The Communication builds on the results of the actions of the EU in the Area of freedom, security and justice in recent years. Those results can be characterised as event driven, with an emphasis on measures extending the powers of law enforcement authorities and intrusive for the citizen. This is certainly the case in the domains where personal data are intensively used and exchanged and that are therefore crucial for data protection. The results are event driven since external events, like 9/11 and the bombings in Madrid and London, gave a strong impetus to legislative activities. For instance, the transfer of passenger data to the United States can be seen as the consequence of 9/11 (9), whereas the London bombings led to the Data Retention Directive 2006/24/EC (10). The emphasis was on more intrusive measures, since the EU legislator focused on measures that facilitate data use and exchange whereas measures aiming to guarantee the protection of personal data were discussed with less urgency. The main protective measure that was adopted is Council Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters (11), after discussions of three years in Council. The result was a Council framework decision that is not fully satisfactory (see points 29-30). |
| --- | --- |

19.

The Communication builds on the results of the actions of the EU in the Area of freedom, security and justice in recent years. Those results can be characterised as event driven, with an emphasis on measures extending the powers of law enforcement authorities and intrusive for the citizen. This is certainly the case in the domains where personal data are intensively used and exchanged and that are therefore crucial for data protection. The results are event driven since external events, like 9/11 and the bombings in Madrid and London, gave a strong impetus to legislative activities. For instance, the transfer of passenger data to the United States can be seen as the consequence of 9/11 (9), whereas the London bombings led to the Data Retention Directive 2006/24/EC (10). The emphasis was on more intrusive measures, since the EU legislator focused on measures that facilitate data use and exchange whereas measures aiming to guarantee the protection of personal data were discussed with less urgency. The main protective measure that was adopted is Council Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters (11), after discussions of three years in Council. The result was a Council framework decision that is not fully satisfactory (see points 29-30).

| 20. | The experience in recent years demonstrates that there is a need for reflection on the consequences for law enforcement authorities and for European citizens before new instruments are adopted. This reflection should duly take into account the costs for privacy and the effectiveness for law enforcement, in the first place when new instruments are proposed and discussed, but also after those instruments are implemented, by means of periodic reviews. Such reflection is also essential before a new multi-annual programme is to set out main initiatives for the near future. |
| --- | --- |

20.

The experience in recent years demonstrates that there is a need for reflection on the consequences for law enforcement authorities and for European citizens before new instruments are adopted. This reflection should duly take into account the costs for privacy and the effectiveness for law enforcement, in the first place when new instruments are proposed and discussed, but also after those instruments are implemented, by means of periodic reviews. Such reflection is also essential before a new multi-annual programme is to set out main initiatives for the near future.

| 21. | The EDPS is glad that the Communication recognises the protection of fundamental rights, and in particular the protection of personal data, as one of the key issues of the future of the Area of freedom, security and justice. Paragraph 2 of the Communication qualifies the EU as a unique area for the protection of fundamental rights based on common values. It is also good that the accession to the European Convention on Human Rights is mentioned as priority issue — even the first priority issue in the Communication. Accession is an important step forward in ensuring a harmonious and coherent system for the protection of fundamental rights. Last but not least, data protection has been given a prominent place in the Communication. |
| --- | --- |

21.

The EDPS is glad that the Communication recognises the protection of fundamental rights, and in particular the protection of personal data, as one of the key issues of the future of the Area of freedom, security and justice. Paragraph 2 of the Communication qualifies the EU as a unique area for the protection of fundamental rights based on common values. It is also good that the accession to the European Convention on Human Rights is mentioned as priority issue — even the first priority issue in the Communication. Accession is an important step forward in ensuring a harmonious and coherent system for the protection of fundamental rights. Last but not least, data protection has been given a prominent place in the Communication.

| 22. | This focus of the Communication shows a strong intention to ensure the protection of the rights of the citizen and — by doing so — take a more balanced approach. Governments need appropriate instruments to guarantee the security of the citizen, but within our European society they have to fully respect the citizen's fundamental rights. Serving the citizen (12) requires a European Union that guards this balance. |
| --- | --- |

22.

This focus of the Communication shows a strong intention to ensure the protection of the rights of the citizen and — by doing so — take a more balanced approach. Governments need appropriate instruments to guarantee the security of the citizen, but within our European society they have to fully respect the citizen's fundamental rights. Serving the citizen (12) requires a European Union that guards this balance.

| 23. | In the view of the EDPS, the Communication takes the need for this balance very well into account, including the need for protection of personal data. It recognises the need for a change of emphasis. This is important since the policies in the Area of freedom, security and justice should not foster the gradual move towards a surveillance society. The EDPS expects the Council to take the same approach in the Stockholm programme, also by acknowledging the orientations in point 25 hereinafter. |
| --- | --- |

23.

In the view of the EDPS, the Communication takes the need for this balance very well into account, including the need for protection of personal data. It recognises the need for a change of emphasis. This is important since the policies in the Area of freedom, security and justice should not foster the gradual move towards a surveillance society. The EDPS expects the Council to take the same approach in the Stockholm programme, also by acknowledging the orientations in point 25 hereinafter.

| 24. | This is all the more important since the Area of freedom, security and justice is an area which ‘shapes the citizens circumstances of life, in particular the private space of their own responsibility and of political and social security, which is protected by the fundamental rights’, as very recently emphasised by the German Constitutional Court in its judgment of 30 June 2009 relating to the Lisbon Treaty (13). |
| --- | --- |

24.

This is all the more important since the Area of freedom, security and justice is an area which ‘shapes the citizens circumstances of life, in particular the private space of their own responsibility and of political and social security, which is protected by the fundamental rights’, as very recently emphasised by the German Constitutional Court in its judgment of 30 June 2009 relating to the Lisbon Treaty (13).

| 25. | The EDPS underlines that in such an area:






  — | information should be exchanged between the authorities of the Member States, including where relevant European bodies or databases, on the basis of adequate and effective mechanisms that fully respect the fundamental rights of the citizen and ensure mutual trust, |
| --- | --- | --- |

25.

The EDPS underlines that in such an area:

—

information should be exchanged between the authorities of the Member States, including where relevant European bodies or databases, on the basis of adequate and effective mechanisms that fully respect the fundamental rights of the citizen and ensure mutual trust,

| — | this requires not only availability of information, combined with mutual recognition of the legal systems of the Member States (and the EU), but also a harmonisation of standards of protection of information, for instance, but not solely, through a common framework of data protection, |
| --- | --- |

—

this requires not only availability of information, combined with mutual recognition of the legal systems of the Member States (and the EU), but also a harmonisation of standards of protection of information, for instance, but not solely, through a common framework of data protection,

| — | these common standards should not only be applicable to situations with cross-border dimensions. Mutual trust can only exist when the standards are solid, and are always respected, without a risk that they will not apply once the cross-border dimension is not or no longer evident. Apart from this, especially when it comes to the use of information, differences between ‘internal’ and ‘cross-border’ data cannot work in practice (14). |
| --- | --- |

—

these common standards should not only be applicable to situations with cross-border dimensions. Mutual trust can only exist when the standards are solid, and are always respected, without a risk that they will not apply once the cross-border dimension is not or no longer evident. Apart from this, especially when it comes to the use of information, differences between ‘internal’ and ‘cross-border’ data cannot work in practice (14).

V.   INSTRUMENTS FOR DATA PROTECTION

V.1.   Towards a comprehensive data protection scheme

| 26. | The EDPS endorses the strategic approach of giving data protection a prominent place in the Communication. Indeed, many initiatives in the Area of freedom, security and justice rely on the use of personal data, and good data protection is crucial for their success. Respect of privacy and data protection is not only a legal obligation with an increasing recognition at EU level, but is also an issue which is crucial for European citizens, as shown by the results of the Eurobarometer (15). Moreover, restricting access to personal data is also crucial to ensure trust by law enforcement agencies. |
| --- | --- |

26.

The EDPS endorses the strategic approach of giving data protection a prominent place in the Communication. Indeed, many initiatives in the Area of freedom, security and justice rely on the use of personal data, and good data protection is crucial for their success. Respect of privacy and data protection is not only a legal obligation with an increasing recognition at EU level, but is also an issue which is crucial for European citizens, as shown by the results of the Eurobarometer (15). Moreover, restricting access to personal data is also crucial to ensure trust by law enforcement agencies.

| 27. | Paragraph 2.3 of the Communication states that a comprehensive data protection scheme is needed that covers all areas of EU competence (16). The EDPS fully supports this objective, independently of the entry into force of the Lisbon Treaty. He also notes that such a scheme does not necessarily mean one legal framework applying to all processing. Under the current treaties, the possibilities for adopting one, comprehensive legal framework applying to all processing are limited due to the pillar structure and due to the fact that — in the first pillar at least — protection of data processed by European institutions takes place on a separate legal basis (Article 286 EC). However, the EDPS points out that some improvements may be implemented by fully exploiting the possibilities offered by the current treaties, as already highlighted by the Commission in its Communication ‘Implementing the Hague programme — The way forward’ (17). After the entry into force of the Lisbon Treaty, Article 16 TFEU will provide for the necessary legal basis for one comprehensive legal framework applying to all processing. |
| --- | --- |

27.

Paragraph 2.3 of the Communication states that a comprehensive data protection scheme is needed that covers all areas of EU competence (16). The EDPS fully supports this objective, independently of the entry into force of the Lisbon Treaty. He also notes that such a scheme does not necessarily mean one legal framework applying to all processing. Under the current treaties, the possibilities for adopting one, comprehensive legal framework applying to all processing are limited due to the pillar structure and due to the fact that — in the first pillar at least — protection of data processed by European institutions takes place on a separate legal basis (Article 286 EC). However, the EDPS points out that some improvements may be implemented by fully exploiting the possibilities offered by the current treaties, as already highlighted by the Commission in its Communication ‘Implementing the Hague programme — The way forward’ (17). After the entry into force of the Lisbon Treaty, Article 16 TFEU will provide for the necessary legal basis for one comprehensive legal framework applying to all processing.

| 28. | The EDPS notes that it is crucial — in any event — to ensure consistency within the legal framework for data protection where necessary through harmonisation and consolidation of the various legal instruments applicable in the Area of freedom, security and justice. |
| --- | --- |

28.

The EDPS notes that it is crucial — in any event — to ensure consistency within the legal framework for data protection where necessary through harmonisation and consolidation of the various legal instruments applicable in the Area of freedom, security and justice.

Under the current treaties

| 29. | A first step was recently taken through the adoption of Council Framework Decision 2008/977/JHA (18). However, this legal instrument can not be qualified as a comprehensive framework, in essence because its provisions do not have general application. They do not apply to internal situations, when personal data originate from the Member State which uses them. Such a limitation is bound to diminish the added value of the Council Framework Decision, unless all the Member States would decide to include the internal situations in the national implementing legislation which is not likely to happen. |
| --- | --- |

29.

A first step was recently taken through the adoption of Council Framework Decision 2008/977/JHA (18). However, this legal instrument can not be qualified as a comprehensive framework, in essence because its provisions do not have general application. They do not apply to internal situations, when personal data originate from the Member State which uses them. Such a limitation is bound to diminish the added value of the Council Framework Decision, unless all the Member States would decide to include the internal situations in the national implementing legislation which is not likely to happen.

| 30. | A second reason why the EDPS considers that in the long run the Council Framework Decision 2008/977/JHA does not contain a satisfactory data protection framework in an area of freedom, security and justice is that several essential provisions are not in line with Directive 95/46/EC. Under the current treaties, a second step could be set by widening the scope and aligning the Council Framework Decision to Directive 95/46/EC. |
| --- | --- |

30.

A second reason why the EDPS considers that in the long run the Council Framework Decision 2008/977/JHA does not contain a satisfactory data protection framework in an area of freedom, security and justice is that several essential provisions are not in line with Directive 95/46/EC. Under the current treaties, a second step could be set by widening the scope and aligning the Council Framework Decision to Directive 95/46/EC.

| 31. | Another impetus to the realisation of a comprehensive data protection scheme could be given by establishing a clear and long-term vision. This vision could contain a global and coherent approach to define collection and exchanges of data — as well as the exploitation of existing databases — and at the same time the data protection guarantees. This vision should prevent useless overlapping and duplication of instruments (and thus of processing of personal data). It should also foster the consistency of the EU policies in this area as well as the trust about how public authorities handle citizen data. The EDPS recommends Council to announce the need for a clear and long-term vision in the Stockholm programme. |
| --- | --- |

31.

Another impetus to the realisation of a comprehensive data protection scheme could be given by establishing a clear and long-term vision. This vision could contain a global and coherent approach to define collection and exchanges of data — as well as the exploitation of existing databases — and at the same time the data protection guarantees. This vision should prevent useless overlapping and duplication of instruments (and thus of processing of personal data). It should also foster the consistency of the EU policies in this area as well as the trust about how public authorities handle citizen data. The EDPS recommends Council to announce the need for a clear and long-term vision in the Stockholm programme.

| 32. | A further recommendation of the EDPS is to evaluate and put into perspective the measures that have already been adopted in this area, their concrete implementation and their effectiveness. This evaluation should duly take into account the costs for privacy and the effectiveness for law enforcement. Should these evaluations prove that certain measures do not deliver the results envisaged or are not proportionate to the purposes pursued, the following steps should be considered:






  — | as a first step, amending or repealing the measures insofar as they do not appear to be sufficiently justified in generating a concrete added value for law enforcement authorities and for European citizens, |
| --- | --- | --- |

32.

A further recommendation of the EDPS is to evaluate and put into perspective the measures that have already been adopted in this area, their concrete implementation and their effectiveness. This evaluation should duly take into account the costs for privacy and the effectiveness for law enforcement. Should these evaluations prove that certain measures do not deliver the results envisaged or are not proportionate to the purposes pursued, the following steps should be considered:

—

as a first step, amending or repealing the measures insofar as they do not appear to be sufficiently justified in generating a concrete added value for law enforcement authorities and for European citizens,

| — | as a second step, assessing the possibilities for improving the application of the existing measures, |
| --- | --- |

—

as a second step, assessing the possibilities for improving the application of the existing measures,

| — | only as a third step, proposing new legislative measures if it is probable that those new measures are needed for the purposes envisaged. New instruments should only be adopted if they have a clear and concrete added value for law enforcement authorities and for European citizens. |
| --- | --- |

—

only as a third step, proposing new legislative measures if it is probable that those new measures are needed for the purposes envisaged. New instruments should only be adopted if they have a clear and concrete added value for law enforcement authorities and for European citizens.

The EDPS recommends making a reference to a system of evaluation of existing measures in the Stockholm programme.

| 33. | Last but not least, special emphasis should be put on the better implementation of existing safeguards, in line with the Commission Communication on the follow-up of the Work Programme for better implementation of the Data Protection Directive (19) and the suggestions made by the EDPS in his opinion on that Communication (20). Unfortunately, in the third pillar the Commission lacks the possibility of starting infringement procedures. |
| --- | --- |

33.

Last but not least, special emphasis should be put on the better implementation of existing safeguards, in line with the Commission Communication on the follow-up of the Work Programme for better implementation of the Data Protection Directive (19) and the suggestions made by the EDPS in his opinion on that Communication (20). Unfortunately, in the third pillar the Commission lacks the possibility of starting infringement procedures.

Under the Lisbon Treaty

| 34. | The Lisbon Treaty opens up for a genuine comprehensive data protection framework. Article 16.2 of the Treaty on the functioning of the European Union requires from Council and European Parliament to lay down the rules relating to data protection by Union institutions, bodies, offices and agencies, by the Member States when carrying out activities which fall within the scope of Union law, and by private parties. |
| --- | --- |

34.

The Lisbon Treaty opens up for a genuine comprehensive data protection framework. Article 16.2 of the Treaty on the functioning of the European Union requires from Council and European Parliament to lay down the rules relating to data protection by Union institutions, bodies, offices and agencies, by the Member States when carrying out activities which fall within the scope of Union law, and by private parties.

| 35. | The EDPS understands the emphasis of the Communication on a comprehensive data protection scheme as an ambition of the Commission to propose a legal framework which applies to all processing activities. He fully endorses this ambition, which enhances the consistency of the system, ensures legal certainty and by doing so improves the protection. In particular, it would avoid in the future the difficulties of finding a dividing line between the pillars when data collected in the private sector for commercial purposes are later on used for law enforcement purposes. This dividing line between the pillars does not fully reflect reality, as the important judgments of the Court of Justice in PNR (21) and in data retention (22) prove. |
| --- | --- |

35.

The EDPS understands the emphasis of the Communication on a comprehensive data protection scheme as an ambition of the Commission to propose a legal framework which applies to all processing activities. He fully endorses this ambition, which enhances the consistency of the system, ensures legal certainty and by doing so improves the protection. In particular, it would avoid in the future the difficulties of finding a dividing line between the pillars when data collected in the private sector for commercial purposes are later on used for law enforcement purposes. This dividing line between the pillars does not fully reflect reality, as the important judgments of the Court of Justice in PNR (21) and in data retention (22) prove.

| 36. | The EDPS suggests emphasising this rationale of a comprehensive data protection scheme in the Stockholm programme. It shows that such a scheme is not just a simple preference but is a necessity due to the changing practices in data use. He recommends including as a priority in the Stockholm-programme the need for a new legislative framework, inter alia, replacing Council Framework Decision 2008/977/JHA. |
| --- | --- |

36.

The EDPS suggests emphasising this rationale of a comprehensive data protection scheme in the Stockholm programme. It shows that such a scheme is not just a simple preference but is a necessity due to the changing practices in data use. He recommends including as a priority in the Stockholm-programme the need for a new legislative framework, inter alia, replacing Council Framework Decision 2008/977/JHA.

| 37. | The EDPS underlines that the notion of a comprehensive data protection scheme based on a general legal framework does not exclude the adoption of additional rules for data protection for the police and the judicial sector. Those additional rules could take into account the specific needs for law enforcement, as foreseen by Declaration 21, attached to the Lisbon Treaty (23). |
| --- | --- |

37.

The EDPS underlines that the notion of a comprehensive data protection scheme based on a general legal framework does not exclude the adoption of additional rules for data protection for the police and the judicial sector. Those additional rules could take into account the specific needs for law enforcement, as foreseen by Declaration 21, attached to the Lisbon Treaty (23).

V.2.   Restating data protection principles

| 38. | The Communication notes the technological changes transforming the communication between individuals and public and private organisations. This calls according to the Commission for restating a number of basic principles of data protection. |
| --- | --- |

38.

The Communication notes the technological changes transforming the communication between individuals and public and private organisations. This calls according to the Commission for restating a number of basic principles of data protection.

| 39. | The EDPS welcomes these intentions of the Communication. An evaluation of the effectiveness of these principles in the perspective of technological changes is extremely useful. As a first point, it is important to note that restating and reaffirming data protection principles must not always be directly related to technological developments. It could also be needed in the light of other perspectives, mentioned in Part III above, the internationalisation, the growing use of data for law enforcement and the free movement. |
| --- | --- |

39.

The EDPS welcomes these intentions of the Communication. An evaluation of the effectiveness of these principles in the perspective of technological changes is extremely useful. As a first point, it is important to note that restating and reaffirming data protection principles must not always be directly related to technological developments. It could also be needed in the light of other perspectives, mentioned in Part III above, the internationalisation, the growing use of data for law enforcement and the free movement.

| 40. | Moreover, in the view of the EDPS, this evaluation can be included in the public consultation that was announced by the Commission in the Conference ‘Personal data — more use, more protection’ on 19 and 20 May 2009. This public consultation could give valuable input (24). The EDPS suggests emphasising the link between the intentions of the Communication in paragraph 2.3 and the public consultation on the future of data protection, by the Council in the text of the Stockholm programme and by the Commission in its public statements on the consultation. |
| --- | --- |

40.

Moreover, in the view of the EDPS, this evaluation can be included in the public consultation that was announced by the Commission in the Conference ‘Personal data — more use, more protection’ on 19 and 20 May 2009. This public consultation could give valuable input (24). The EDPS suggests emphasising the link between the intentions of the Communication in paragraph 2.3 and the public consultation on the future of data protection, by the Council in the text of the Stockholm programme and by the Commission in its public statements on the consultation.

| 41. | As an illustration of what such evaluation could cover, the following points are mentioned:






  — | personal data in the area of FSJ are likely to be of an especially sensitive nature, such as data relating to criminal convictions, police data and biometric data such as fingerprints and DNA profiles, |
| --- | --- | --- |

41.

As an illustration of what such evaluation could cover, the following points are mentioned:

—

personal data in the area of FSJ are likely to be of an especially sensitive nature, such as data relating to criminal convictions, police data and biometric data such as fingerprints and DNA profiles,

| — | their processing may entail negative consequences for the data subjects, especially when considering the coercive powers of law enforcement authorities. Moreover, data monitoring and analysis is increasingly automated, quite often without human intervention. Technology allows use of databases with personal data for general searches (data mining, profiling, etc.). Legal obligations on which data processing is based should be clearly laid down, |
| --- | --- |

—

their processing may entail negative consequences for the data subjects, especially when considering the coercive powers of law enforcement authorities. Moreover, data monitoring and analysis is increasingly automated, quite often without human intervention. Technology allows use of databases with personal data for general searches (data mining, profiling, etc.). Legal obligations on which data processing is based should be clearly laid down,

| — | a cornerstone of data protection law is that personal data shall be collected for specified purposes and not used in a way incompatible with those purposes. Use for incompatible purposes should only be allowed insofar as it is laid down by law and necessary to pursue specific public interests, as those laid down by Article 8.2 ECHR, |
| --- | --- |

—

a cornerstone of data protection law is that personal data shall be collected for specified purposes and not used in a way incompatible with those purposes. Use for incompatible purposes should only be allowed insofar as it is laid down by law and necessary to pursue specific public interests, as those laid down by Article 8.2 ECHR,

| — | the need to respect the purpose limitation principle might have consequences for current trends in data use. Law enforcement uses data which were collected by private companies for commercial purposes, in the telecommunications, transport and financial sectors. Furthermore, large-scale information systems are set up, for example in the areas of immigration and borders control. Moreover, interconnections and accesses to databases are allowed, thus expanding the purposes for which personal data were originally collected. A reflection on these current trends is needed, including any possible adjustments and/or additional safeguards, where required, |
| --- | --- |

—

the need to respect the purpose limitation principle might have consequences for current trends in data use. Law enforcement uses data which were collected by private companies for commercial purposes, in the telecommunications, transport and financial sectors. Furthermore, large-scale information systems are set up, for example in the areas of immigration and borders control. Moreover, interconnections and accesses to databases are allowed, thus expanding the purposes for which personal data were originally collected. A reflection on these current trends is needed, including any possible adjustments and/or additional safeguards, where required,

| — | in addition to the principles of data protection mentioned in the Communication, the evaluation should pay attention to the need for transparency of the processing, allowing the data subject to exercise his rights. Transparency is an especially difficult issue in the law enforcement area, in particular since transparency should be weighed against risks for the investigations, |
| --- | --- |

—

in addition to the principles of data protection mentioned in the Communication, the evaluation should pay attention to the need for transparency of the processing, allowing the data subject to exercise his rights. Transparency is an especially difficult issue in the law enforcement area, in particular since transparency should be weighed against risks for the investigations,

| — | solutions should be found for the exchanges with third countries. |
| --- | --- |

—

solutions should be found for the exchanges with third countries.

| 42. | This evaluation should furthermore focus on the possibilities for improving the effectiveness of the application of data protection principles. In this context, it could be useful to concentrate on instruments that can reinforce the responsibilities of the data controllers. These instruments must allow full accountability of the data controllers for data management. ‘Data governance’ is a useful notion in this context. This covers all legal, technical and organisational means by which organisations ensure full responsibility over the way in which data are handled, such as planning and control, use of sound technology, adequate training of staff, compliance audits, etc. |
| --- | --- |

42.

This evaluation should furthermore focus on the possibilities for improving the effectiveness of the application of data protection principles. In this context, it could be useful to concentrate on instruments that can reinforce the responsibilities of the data controllers. These instruments must allow full accountability of the data controllers for data management. ‘Data governance’ is a useful notion in this context. This covers all legal, technical and organisational means by which organisations ensure full responsibility over the way in which data are handled, such as planning and control, use of sound technology, adequate training of staff, compliance audits, etc.

V.3.   Privacy-aware technologies

| 43. | The EDPS is glad that paragraph 2.3 of the Communication mentions privacy certification. In addition to this, reference could be made to ‘privacy by design’ and the need to identify ‘Best Available Techniques’ compliant to the data protection framework of the EU. |
| --- | --- |

43.

The EDPS is glad that paragraph 2.3 of the Communication mentions privacy certification. In addition to this, reference could be made to ‘privacy by design’ and the need to identify ‘Best Available Techniques’ compliant to the data protection framework of the EU.

| 44. | In the view of the EDPS, ‘privacy by design’ and privacy-aware technologies, could be helpful tools for a better protection, as well as for a more effective use of information. The EDPS suggests two — not mutually exclusive — ways forward:






  — | a privacy and data protection certification scheme (25) as option for builders and users of information systems, either or not supported by EU funding or EU legislation, |
| --- | --- | --- |

44.

In the view of the EDPS, ‘privacy by design’ and privacy-aware technologies, could be helpful tools for a better protection, as well as for a more effective use of information. The EDPS suggests two — not mutually exclusive — ways forward:

—

a privacy and data protection certification scheme (25) as option for builders and users of information systems, either or not supported by EU funding or EU legislation,

| — | a legal obligation for builders and users of information systems to use systems which are in accordance with the principle of privacy by design. This might require enlarging the present scope of data protection law to make builders responsible for the information systems they develop (26). |
| --- | --- |

—

a legal obligation for builders and users of information systems to use systems which are in accordance with the principle of privacy by design. This might require enlarging the present scope of data protection law to make builders responsible for the information systems they develop (26).

The EDPS suggests mentioning these possible ways forward in the Stockholm programme.

V.4.   External aspects

| 45. | Another subject mentioned in the Communication is the development and promotion of international standards for data protection. Presently, many activities take place in view of the establishment of feasible standards for global application, for instance by the International Conference of Privacy and Data Protection Commissioners. In the near future, this might lead to an international agreement. The EDPS suggests that the Stockholm programme supports these activities. |
| --- | --- |

45.

Another subject mentioned in the Communication is the development and promotion of international standards for data protection. Presently, many activities take place in view of the establishment of feasible standards for global application, for instance by the International Conference of Privacy and Data Protection Commissioners. In the near future, this might lead to an international agreement. The EDPS suggests that the Stockholm programme supports these activities.

| 46. | The Communication also mentions the conclusion of bilateral agreements, based on the progress already made together with the United States. The EDPS shares the need for a clear legal framework for transferring data to third countries, and thus welcomed the joint work of the EU and the US authorities in the High-Level Contact Group on a possible transatlantic instrument on data protection, while calling for more clarity and attention to specific issues (27). In this perspective, it is also interesting to note the ideas in the Home Affairs Report for a Euro-Atlantic Area of cooperation in freedom, security, justice on which, according to this report, the EU should decide by 2014. Such area would not be possible without proper guarantees on data protection. |
| --- | --- |

46.

The Communication also mentions the conclusion of bilateral agreements, based on the progress already made together with the United States. The EDPS shares the need for a clear legal framework for transferring data to third countries, and thus welcomed the joint work of the EU and the US authorities in the High-Level Contact Group on a possible transatlantic instrument on data protection, while calling for more clarity and attention to specific issues (27). In this perspective, it is also interesting to note the ideas in the Home Affairs Report for a Euro-Atlantic Area of cooperation in freedom, security, justice on which, according to this report, the EU should decide by 2014. Such area would not be possible without proper guarantees on data protection.

| 47. | According to the EDPS, the European standards for data protection, based on Council of Europe Convention 108 for the protection of individuals with regard to automatic processing of personal data (28) and the case law of the European Court of Justice and the European Court for Human Rights, should determine the level of protection in a general agreement with the United States on data protection and data exchange. Such a general agreement could be the basis for specific arrangements for the exchange of personal data. This is even more important in the light of the intention formulated in paragraph 4.2.1 of the Communication that the European Union must conclude police cooperation agreements wherever necessary. |
| --- | --- |

47.

According to the EDPS, the European standards for data protection, based on Council of Europe Convention 108 for the protection of individuals with regard to automatic processing of personal data (28) and the case law of the European Court of Justice and the European Court for Human Rights, should determine the level of protection in a general agreement with the United States on data protection and data exchange. Such a general agreement could be the basis for specific arrangements for the exchange of personal data. This is even more important in the light of the intention formulated in paragraph 4.2.1 of the Communication that the European Union must conclude police cooperation agreements wherever necessary.

| 48. | The EDPS fully understands the need of enhancing international cooperation, in some cases also with countries not protecting fundamental rights. However (29), it is crucial to take into account that this international cooperation is likely to generate a large increase in the collection and international transfer of data. Therefore, it is essential that principles of fair and lawful processing — as well as principles of due process in general — apply to the collection and transfer of personal data across Union borders, and that personal data are transferred to third countries or international organisations only if an adequate level of protection or other appropriate safeguards are guaranteed by those third parties concerned. |
| --- | --- |

48.

The EDPS fully understands the need of enhancing international cooperation, in some cases also with countries not protecting fundamental rights. However (29), it is crucial to take into account that this international cooperation is likely to generate a large increase in the collection and international transfer of data. Therefore, it is essential that principles of fair and lawful processing — as well as principles of due process in general — apply to the collection and transfer of personal data across Union borders, and that personal data are transferred to third countries or international organisations only if an adequate level of protection or other appropriate safeguards are guaranteed by those third parties concerned.

| 49. | To conclude, the EDPS recommends emphasising in the Stockholm programme the importance of general agreements with the United States and other third countries on data protection and data exchange, based on the level of protection guaranteed within the territory of the EU. In a broader perspective, the EDPS points at the importance of actively promoting the respect of fundamental rights, and in particular of data protection, in relation with third countries and with international organisations (30). Furthermore, the Stockholm programme could mention the general notion that exchange of personal data with third countries requires an adequate level of protection or other appropriate safeguards in those third countries. |
| --- | --- |

49.

To conclude, the EDPS recommends emphasising in the Stockholm programme the importance of general agreements with the United States and other third countries on data protection and data exchange, based on the level of protection guaranteed within the territory of the EU. In a broader perspective, the EDPS points at the importance of actively promoting the respect of fundamental rights, and in particular of data protection, in relation with third countries and with international organisations (30). Furthermore, the Stockholm programme could mention the general notion that exchange of personal data with third countries requires an adequate level of protection or other appropriate safeguards in those third countries.

VI.   THE USE OF INFORMATION

VI.1.   Towards a European information model

| 50. | A better exchange of information is an essential policy goal for the European Union, in the Area of freedom, security and justice. Paragraph 4.1.2 of the Communication emphasises that security in the European Union depends on effective mechanisms for exchanging information between national authorities and other European players. This emphasis on information exchange is logical, in the absence of a European police force, a European criminal justice system and a European border control. Measures relating to information are therefore essential contributions of the European Union allowing the authorities of the Member States to address cross-border crime in an effective way and to effectively protect the external borders. However, they do not only contribute to the security of the citizens but also to their freedom — the free movement of persons was mentioned before as a perspective of this opinion — and to justice. |
| --- | --- |

50.

A better exchange of information is an essential policy goal for the European Union, in the Area of freedom, security and justice. Paragraph 4.1.2 of the Communication emphasises that security in the European Union depends on effective mechanisms for exchanging information between national authorities and other European players. This emphasis on information exchange is logical, in the absence of a European police force, a European criminal justice system and a European border control. Measures relating to information are therefore essential contributions of the European Union allowing the authorities of the Member States to address cross-border crime in an effective way and to effectively protect the external borders. However, they do not only contribute to the security of the citizens but also to their freedom — the free movement of persons was mentioned before as a perspective of this opinion — and to justice.

| 51. | It is precisely for these reasons that the principle of availability was introduced in the Hague programme. It entails that information needed for the fight against crime should cross the internal borders of the EU without obstacles. Recent experiences show that it was difficult to implement this principle into legislative measures. The Commission proposal for a Council framework decision on the exchange of information under the principle of availability of 12 October 2005 (31) was not accepted in the Council. The Member States were not ready to accept the consequences of the principle of availability to its full extent. Instead, more limited instruments (32) were adopted such as the Council Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime (‘Prüm-decision’) (33). |
| --- | --- |

51.

It is precisely for these reasons that the principle of availability was introduced in the Hague programme. It entails that information needed for the fight against crime should cross the internal borders of the EU without obstacles. Recent experiences show that it was difficult to implement this principle into legislative measures. The Commission proposal for a Council framework decision on the exchange of information under the principle of availability of 12 October 2005 (31) was not accepted in the Council. The Member States were not ready to accept the consequences of the principle of availability to its full extent. Instead, more limited instruments (32) were adopted such as the Council Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime (‘Prüm-decision’) (33).

| 52. | While the principle of availability was at the core of the Hague programme, the Commission now seems to take a more modest approach. It envisages further stimulating the exchange of information between authorities of the Member States by introducing the European information model. The Swedish EU presidency thinks in the same line (34). It will present a proposal for a strategy for the exchange of information. The Council already started its work on this ambitious project of a European Union Information Management Strategy, which is closely linked to the European information model. The EDPS notes these developments with great interest and underlines the attention that should be given in these projects to data protection elements. |
| --- | --- |

52.

While the principle of availability was at the core of the Hague programme, the Commission now seems to take a more modest approach. It envisages further stimulating the exchange of information between authorities of the Member States by introducing the European information model. The Swedish EU presidency thinks in the same line (34). It will present a proposal for a strategy for the exchange of information. The Council already started its work on this ambitious project of a European Union Information Management Strategy, which is closely linked to the European information model. The EDPS notes these developments with great interest and underlines the attention that should be given in these projects to data protection elements.

A European information model and data protection

| 53. | As a starting point, it should be emphasised that the future of the Area of freedom, security and justice should not be ‘technology-driven’, in the sense that the almost limitless opportunities offered by new technologies should always be checked against relevant data protection principles and used only insofar as they comply with those principles. |
| --- | --- |

53.

As a starting point, it should be emphasised that the future of the Area of freedom, security and justice should not be ‘technology-driven’, in the sense that the almost limitless opportunities offered by new technologies should always be checked against relevant data protection principles and used only insofar as they comply with those principles.

| 54. | The EDPS notes that the Communication presents the information model not only as a technical model: a powerful strategic analysis capacity and better gathering and processing of operational information. It also acknowledges that policy related aspects — like criteria for gathering, sharing and processing of information — should be taken into account, while complying with data protection principles. |
| --- | --- |

54.

The EDPS notes that the Communication presents the information model not only as a technical model: a powerful strategic analysis capacity and better gathering and processing of operational information. It also acknowledges that policy related aspects — like criteria for gathering, sharing and processing of information — should be taken into account, while complying with data protection principles.

| 55. | Information technology and legal conditions are — and will continue to be — both essential. The EDPS welcomes the Communication that starts from the assumption that a European information model may not be construed on the basis of technical considerations. It is essential that information is gathered, shared and processed only on the basis of concrete needs for security and taking into account data protection principles. The EDPS also fully subscribes the need for defining a follow up mechanism for assessing how the exchange of information operates. He suggests that the Council further elaborates these elements in the Stockholm programme. |
| --- | --- |

55.

Information technology and legal conditions are — and will continue to be — both essential. The EDPS welcomes the Communication that starts from the assumption that a European information model may not be construed on the basis of technical considerations. It is essential that information is gathered, shared and processed only on the basis of concrete needs for security and taking into account data protection principles. The EDPS also fully subscribes the need for defining a follow up mechanism for assessing how the exchange of information operates. He suggests that the Council further elaborates these elements in the Stockholm programme.

| 56. | In this context, the EDPS underlines that data protection, aiming to protect the citizen, should not be seen as hampering effective data management. It provides important tools to improve the storage, access and exchange of information. The rights of the data subject to be informed about which information concerning him or her is processed and to rectify incorrect information can also strengthen the accuracy of data in data management systems. |
| --- | --- |

56.

In this context, the EDPS underlines that data protection, aiming to protect the citizen, should not be seen as hampering effective data management. It provides important tools to improve the storage, access and exchange of information. The rights of the data subject to be informed about which information concerning him or her is processed and to rectify incorrect information can also strengthen the accuracy of data in data management systems.

| 57. | Data protection law has in essence the following consequences: if data are needed for a specific and legitimate purpose they can be used; if they are not needed for a well-defined purpose, personal data should not be used. In the first case, it may well take additional measures to provide adequate safeguards. |
| --- | --- |

57.

Data protection law has in essence the following consequences: if data are needed for a specific and legitimate purpose they can be used; if they are not needed for a well-defined purpose, personal data should not be used. In the first case, it may well take additional measures to provide adequate safeguards.

| 58. | The EDPS however is critical to the extent in which the Communication mentions the ‘identification of future needs’ as part of the information model. He emphasises that also in the future the purpose limitation principle should be guiding when building information systems (35). It is one of the essential guarantees that the data protection system gives to the citizen: he must be able to know in advance for what purpose data relating to him are collected and that it will be used only for that purpose, notably in the future. This guarantee is even enshrined in Article 8 of the Charter of the Fundamental Rights of the Union. The purpose limitation principle allows exceptions — which are in particular relevant in the Area of freedom, security and justice — but those exceptions should not determine the construction of a system. |
| --- | --- |

58.

The EDPS however is critical to the extent in which the Communication mentions the ‘identification of future needs’ as part of the information model. He emphasises that also in the future the purpose limitation principle should be guiding when building information systems (35). It is one of the essential guarantees that the data protection system gives to the citizen: he must be able to know in advance for what purpose data relating to him are collected and that it will be used only for that purpose, notably in the future. This guarantee is even enshrined in Article 8 of the Charter of the Fundamental Rights of the Union. The purpose limitation principle allows exceptions — which are in particular relevant in the Area of freedom, security and justice — but those exceptions should not determine the construction of a system.

Choosing the right architecture

| 59. | Choosing the right architecture for information exchange is the start of it all. The importance of proper information architectures is recognised in the Communication (paragraph 4.1.3) but unfortunately only in relation to interoperability. |
| --- | --- |

59.

Choosing the right architecture for information exchange is the start of it all. The importance of proper information architectures is recognised in the Communication (paragraph 4.1.3) but unfortunately only in relation to interoperability.

| 60. | The EDPS stresses another aspect: within the European information model, data protection requirements should be an integral part of all system development and should not just be seen as a necessary condition for the legality of a system (36). Use should be made of the concepts of ‘privacy by design’ and need to identify ‘Best Available Techniques’ (37), as introduced in point 43 above. The European information model should build on these concepts. This means, more concretely, that information systems which are designed for purposes of public security should always be built in accordance with the principle of ‘privacy by design’. The EDPS recommends the Council to include these elements in the Stockholm programme. |
| --- | --- |

60.

The EDPS stresses another aspect: within the European information model, data protection requirements should be an integral part of all system development and should not just be seen as a necessary condition for the legality of a system (36). Use should be made of the concepts of ‘privacy by design’ and need to identify ‘Best Available Techniques’ (37), as introduced in point 43 above. The European information model should build on these concepts. This means, more concretely, that information systems which are designed for purposes of public security should always be built in accordance with the principle of ‘privacy by design’. The EDPS recommends the Council to include these elements in the Stockholm programme.

Interoperability of systems

| 61. | The EDPS underlines that interoperability is not a purely technical issue but also has consequences for the protection of the citizen, in particular data protection. From the perspective of data protection, interoperability of systems, if done well, has clear advantages in terms of avoiding double storage. However, it is also obvious that making access to or exchange of data technically feasible becomes, in many cases, a powerful drive for de facto acceding or exchanging these data. In other words, interoperability has particular risks of interconnection between databases having different purposes (38). It can affect the strict limitations on the purpose of databases. |
| --- | --- |

61.

The EDPS underlines that interoperability is not a purely technical issue but also has consequences for the protection of the citizen, in particular data protection. From the perspective of data protection, interoperability of systems, if done well, has clear advantages in terms of avoiding double storage. However, it is also obvious that making access to or exchange of data technically feasible becomes, in many cases, a powerful drive for de facto acceding or exchanging these data. In other words, interoperability has particular risks of interconnection between databases having different purposes (38). It can affect the strict limitations on the purpose of databases.

| 62. | In short, the mere fact that it is technically possible to exchange digital information between interoperable databases or to merge these databases does not justify an exception to the purpose limitation principle. Interoperability should in concrete cases be based on clear and careful policy choices. The EDPS suggests specifying this notion in the Stockholm programme. |
| --- | --- |

62.

In short, the mere fact that it is technically possible to exchange digital information between interoperable databases or to merge these databases does not justify an exception to the purpose limitation principle. Interoperability should in concrete cases be based on clear and careful policy choices. The EDPS suggests specifying this notion in the Stockholm programme.

VI.2.   The use of information collected for other purposes

| 63. | The Communication does not explicitly address one of the most important tendencies of the recent years, namely the use for law enforcement purposes of data collected in the private sector for commercial purposes. This tendency does not only relate to the traffic data of electronic communications and the passenger data of individuals flying to (certain) third countries (39) but also focuses on the financial sector. An example is Directive 2005/60/EC of the European Parliament and of the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing (40). Another well known and much debated example concerns the processing of personal data by the Society for Worldwide Interbank Financial Telecommunication (SWIFT) (41) of data which are necessary for the purpose of the US Treasury Department's Terrorist Finance Tracking Programme. |
| --- | --- |

63.

The Communication does not explicitly address one of the most important tendencies of the recent years, namely the use for law enforcement purposes of data collected in the private sector for commercial purposes. This tendency does not only relate to the traffic data of electronic communications and the passenger data of individuals flying to (certain) third countries (39) but also focuses on the financial sector. An example is Directive 2005/60/EC of the European Parliament and of the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing (40). Another well known and much debated example concerns the processing of personal data by the Society for Worldwide Interbank Financial Telecommunication (SWIFT) (41) of data which are necessary for the purpose of the US Treasury Department's Terrorist Finance Tracking Programme.

| 64. | The EDPS considers that these tendencies require specific attention in the Stockholm programme. They can be seen as derogations from the purpose limitation principle and are often very privacy-intrusive since the use of these data can reveal a lot about the behaviour of individuals. In each case where such measures are proposed, there must be very strong evidence that such an intrusive measure is needed. If this evidence is given, it must be ensured that rights of individuals are fully safeguarded. |
| --- | --- |

64.

The EDPS considers that these tendencies require specific attention in the Stockholm programme. They can be seen as derogations from the purpose limitation principle and are often very privacy-intrusive since the use of these data can reveal a lot about the behaviour of individuals. In each case where such measures are proposed, there must be very strong evidence that such an intrusive measure is needed. If this evidence is given, it must be ensured that rights of individuals are fully safeguarded.

| 65. | According to the EDPS the use for law enforcement of personal data collected for commercial purposes should only be allowed under strict conditions, such as:






  — | data are only used for specifically defined purposes such as the fight against terrorism or serious crime, to be determined on a case-by-case basis, |
| --- | --- | --- |

65.

According to the EDPS the use for law enforcement of personal data collected for commercial purposes should only be allowed under strict conditions, such as:

—

data are only used for specifically defined purposes such as the fight against terrorism or serious crime, to be determined on a case-by-case basis,

| — | data are transferred through a ‘push’ rather than a ‘pull’ system (42), |
| --- | --- |

—

data are transferred through a ‘push’ rather than a ‘pull’ system (42),

| — | requests for data should be proportionate, narrowly targeted and, in principle, based on suspicions on specific persons, |
| --- | --- |

—

requests for data should be proportionate, narrowly targeted and, in principle, based on suspicions on specific persons,

| — | routine searches, data mining and profiling should be avoided, |
| --- | --- |

—

routine searches, data mining and profiling should be avoided,

| — | all use of the data for law enforcement purposes should be logged in order to allow effective control on the use, by the data subject exercising his rights, by data protection authorities and by the judiciary. |
| --- | --- |

—

all use of the data for law enforcement purposes should be logged in order to allow effective control on the use, by the data subject exercising his rights, by data protection authorities and by the judiciary.

VI.3.   Information systems and EU bodies

Information systems with or without centralised storage
   (43)

| 66. | Over the last years, the number of information systems based on EU law has significantly grown within the Area of freedom, security and justice. Sometimes decisions are made to establish a system which entails centralised storage of data on the European level, in other cases the law only foresees exchange of information between national databases. The Schengen Information System is probably the best example of a system with centralised storage. Council Decision 2008/615/JHA (Prüm-decision) (44) is from the perspective of data protection the most significant example of a system without centralised storage since it foresees a massive exchange of biometric data between the authorities in the Member States. |
| --- | --- |

66.

Over the last years, the number of information systems based on EU law has significantly grown within the Area of freedom, security and justice. Sometimes decisions are made to establish a system which entails centralised storage of data on the European level, in other cases the law only foresees exchange of information between national databases. The Schengen Information System is probably the best example of a system with centralised storage. Council Decision 2008/615/JHA (Prüm-decision) (44) is from the perspective of data protection the most significant example of a system without centralised storage since it foresees a massive exchange of biometric data between the authorities in the Member States.

| 67. | The Communication illustrates that this tendency of creating new systems will continue. A first example, taken from paragraph 4.2.2 is an information system expanding the European Criminal Records Information System (ECRIS) to cover nationals of non-EU countries. The Commission already commissioned a study on the European Index for Convicted Third Country Nationals (EICTCN), possibly leading to a centralised database. A second example is the exchange of information of individuals in insolvency registers in other Member States, in the frame of e-Justice (paragraph 3.4.1 of the Communication) without centralised storage. |
| --- | --- |

67.

The Communication illustrates that this tendency of creating new systems will continue. A first example, taken from paragraph 4.2.2 is an information system expanding the European Criminal Records Information System (ECRIS) to cover nationals of non-EU countries. The Commission already commissioned a study on the European Index for Convicted Third Country Nationals (EICTCN), possibly leading to a centralised database. A second example is the exchange of information of individuals in insolvency registers in other Member States, in the frame of e-Justice (paragraph 3.4.1 of the Communication) without centralised storage.

| 68. | A decentralised system would have certain advantages from the perspective of data protection. It avoids double storage of data by the authority of the Member State and by the centralised system, the responsibility for the data is clear since the authority of the Member State will be the controller, and control by the judiciary and by data protection authorities can take place on Member States level. But this system also has weaknesses when data are exchanged with other jurisdictions, for instance in ensuring that information is kept up to date both in the country of origin and the country of destination and how to ensure effective control on both sides. It is even more complicated to ensure responsibility for the technical system for the exchange. These weaknesses can be overcome by choosing for a centralised system with a responsibility for European bodies at least for parts of the system (such as the technical infrastructure). |
| --- | --- |

68.

A decentralised system would have certain advantages from the perspective of data protection. It avoids double storage of data by the authority of the Member State and by the centralised system, the responsibility for the data is clear since the authority of the Member State will be the controller, and control by the judiciary and by data protection authorities can take place on Member States level. But this system also has weaknesses when data are exchanged with other jurisdictions, for instance in ensuring that information is kept up to date both in the country of origin and the country of destination and how to ensure effective control on both sides. It is even more complicated to ensure responsibility for the technical system for the exchange. These weaknesses can be overcome by choosing for a centralised system with a responsibility for European bodies at least for parts of the system (such as the technical infrastructure).

| 69. | In this context, it would be useful to develop substantive criteria for the choice between centralised and decentralised systems, ensuring clear and careful policy choices in concrete cases. These criteria can contribute to the functioning of the systems themselves, as well as to the protection of the citizen's data. The EDPS suggests including the intention of developing such criteria in the Stockholm programme. |
| --- | --- |

69.

In this context, it would be useful to develop substantive criteria for the choice between centralised and decentralised systems, ensuring clear and careful policy choices in concrete cases. These criteria can contribute to the functioning of the systems themselves, as well as to the protection of the citizen's data. The EDPS suggests including the intention of developing such criteria in the Stockholm programme.

Large-scale information systems

| 70. | Paragraph 4.2.3.2 of the Communication briefly discusses the future of the large-scale information systems with an emphasis on the Schengen Information System (SIS) and the Visa Information System (VIS). |
| --- | --- |

70.

Paragraph 4.2.3.2 of the Communication briefly discusses the future of the large-scale information systems with an emphasis on the Schengen Information System (SIS) and the Visa Information System (VIS).

| 71. | Paragraph 4.2.3.2 also mentions the establishment of an electronic system for entry to and exit from Member States’ territory alongside registered traveller programmes. This system was announced earlier by the Commission as part of the ‘borders package’ on the initiative of Vice-President Frattini (45). In his preliminary comments (46), the EDPS was fairly critical about this proposal because the need for such an intrusive system, on top of existing large-scale systems was not sufficiently demonstrated. The EDPS does not notice any additional evidence of the need for such a system and therefore suggests to the Council not to mention this idea in the Stockholm programme. |
| --- | --- |

71.

Paragraph 4.2.3.2 also mentions the establishment of an electronic system for entry to and exit from Member States’ territory alongside registered traveller programmes. This system was announced earlier by the Commission as part of the ‘borders package’ on the initiative of Vice-President Frattini (45). In his preliminary comments (46), the EDPS was fairly critical about this proposal because the need for such an intrusive system, on top of existing large-scale systems was not sufficiently demonstrated. The EDPS does not notice any additional evidence of the need for such a system and therefore suggests to the Council not to mention this idea in the Stockholm programme.

| 72. | In this context, the EDPS wishes to refer to his opinions on various initiatives in the field of EU information exchange (47) in which he made numerous suggestions and comments on the data protection implications of the use of the large databases at EU level. Amongst other issues, he paid particular attention to the need for strong and tailor-made safeguards that should be in place as well as the proportionality and necessity of impact assessments before any measures are proposed or undertaken in this area. The EDPS has always advocated a right and data protection compliant balance between security requirements and the protection of privacy of individuals subject to the systems. He took the same position when acting as the supervisor of the central parts of the systems. |
| --- | --- |

72.

In this context, the EDPS wishes to refer to his opinions on various initiatives in the field of EU information exchange (47) in which he made numerous suggestions and comments on the data protection implications of the use of the large databases at EU level. Amongst other issues, he paid particular attention to the need for strong and tailor-made safeguards that should be in place as well as the proportionality and necessity of impact assessments before any measures are proposed or undertaken in this area. The EDPS has always advocated a right and data protection compliant balance between security requirements and the protection of privacy of individuals subject to the systems. He took the same position when acting as the supervisor of the central parts of the systems.

| 73. | Furthermore, the EDPS takes this opportunity to emphasise the need for a consistent approach to the EU information exchange as a whole, in terms of legal, technical and supervisory consistency between the systems already in place and those which are being developed. Indeed, nowadays, more than before, there is a clear need for a courageous and comprehensive vision on how the EU information exchange and the future of large-scale information systems should look like. Only on the basis of such a vision, an electronic system for entry to and exit from Member States’ territory could possibly be reconsidered. |
| --- | --- |

73.

Furthermore, the EDPS takes this opportunity to emphasise the need for a consistent approach to the EU information exchange as a whole, in terms of legal, technical and supervisory consistency between the systems already in place and those which are being developed. Indeed, nowadays, more than before, there is a clear need for a courageous and comprehensive vision on how the EU information exchange and the future of large-scale information systems should look like. Only on the basis of such a vision, an electronic system for entry to and exit from Member States’ territory could possibly be reconsidered.

| 74. | The EDPS suggests referring in the Stockholm programme to the intention to develop such a vision, which should include a reflection on the possible entry into force of the Lisbon Treaty and its implications on the systems based on a first and third pillar legal basis. |
| --- | --- |

74.

The EDPS suggests referring in the Stockholm programme to the intention to develop such a vision, which should include a reflection on the possible entry into force of the Lisbon Treaty and its implications on the systems based on a first and third pillar legal basis.

| 75. | Finally, the Communication mentions the setting up of a new agency which according to the Communication should also become competent for the electronic entry and exit system. In the meantime, the Commission adopted a proposal for the setting up of such an agency (48). The EDPS supports this proposal in principle since it can make the functioning of these systems, including data protection more effective. He will present an opinion on this proposal in due time. |
| --- | --- |

75.

Finally, the Communication mentions the setting up of a new agency which according to the Communication should also become competent for the electronic entry and exit system. In the meantime, the Commission adopted a proposal for the setting up of such an agency (48). The EDPS supports this proposal in principle since it can make the functioning of these systems, including data protection more effective. He will present an opinion on this proposal in due time.

Europol and Eurojust

| 76. | The role of Europol is mentioned at several places in the Communication which emphasises as a priority issue that Europol must play a central role in coordination, exchange of information, and training of professionals. Equally, paragraph 4.2.2 of the Communication refers to the recent changes in the legal framework of cooperation between Eurojust and Europol and announces that work will continue on strengthening Eurojust, particularly as regards investigations into areas of cross-border organised crime. The EDPS fully supports these objectives, provided that safeguards for data protection are respected in an appropriate way. |
| --- | --- |

76.

The role of Europol is mentioned at several places in the Communication which emphasises as a priority issue that Europol must play a central role in coordination, exchange of information, and training of professionals. Equally, paragraph 4.2.2 of the Communication refers to the recent changes in the legal framework of cooperation between Eurojust and Europol and announces that work will continue on strengthening Eurojust, particularly as regards investigations into areas of cross-border organised crime. The EDPS fully supports these objectives, provided that safeguards for data protection are respected in an appropriate way.

| 77. | In this context, the EDPS welcomes the new draft agreement recently reached between Europol and Eurojust (49), which aims at improving and enhancing mutual cooperation between the two bodies and providing for efficient exchange of information between them. This is a work in which efficient and effective data protection plays a crucial role. |
| --- | --- |

77.

In this context, the EDPS welcomes the new draft agreement recently reached between Europol and Eurojust (49), which aims at improving and enhancing mutual cooperation between the two bodies and providing for efficient exchange of information between them. This is a work in which efficient and effective data protection plays a crucial role.

VI.4.   The use of biometric data

| 78. | The EDPS notes that the Communication does not address the issue of the increasing use of biometric data in different legal instruments of the European Union on the use of information exchange, including the instruments establishing the large-scale information systems. This is regrettable given that it is a matter of particular importance and sensitivity from the perspectives of data protection and privacy. |
| --- | --- |

78.

The EDPS notes that the Communication does not address the issue of the increasing use of biometric data in different legal instruments of the European Union on the use of information exchange, including the instruments establishing the large-scale information systems. This is regrettable given that it is a matter of particular importance and sensitivity from the perspectives of data protection and privacy.

| 79. | Although the EDPS recognises the general advantages of the use of biometrics, he has been constantly stressing the major impacts of the use of such data on individuals’ rights and has been suggesting the insertion of stringent safeguards for the use of biometrics in each particular system. The recent judgment of the European Court of Human Rights in S. and Marper v the United Kingdom (50) provides useful indications in this context, in particular on the justification and the limits of the use of biometric data. In particular the use of DNA information can reveal sensitive information about individuals, also taking into account that the technical possibilities of extracting information from DNA are still growing. In the case of large-scale use of biometric data in information systems, there is also a problem due to inherent inaccuracies in the collection and comparison of biometric data. For these reasons, the EU legislator should show restraint with the use of these data. |
| --- | --- |

79.

Although the EDPS recognises the general advantages of the use of biometrics, he has been constantly stressing the major impacts of the use of such data on individuals’ rights and has been suggesting the insertion of stringent safeguards for the use of biometrics in each particular system. The recent judgment of the European Court of Human Rights in S. and Marper v the United Kingdom (50) provides useful indications in this context, in particular on the justification and the limits of the use of biometric data. In particular the use of DNA information can reveal sensitive information about individuals, also taking into account that the technical possibilities of extracting information from DNA are still growing. In the case of large-scale use of biometric data in information systems, there is also a problem due to inherent inaccuracies in the collection and comparison of biometric data. For these reasons, the EU legislator should show restraint with the use of these data.

| 80. | Another recurring issue in recent years has been the use of fingerprints of children and of elderly people, because of the inherent imperfections of biometric systems for those age groups. The EDPS asked for an in-depth study in order to identify properly the accuracy of the systems (51). He proposed an age limit of 14 years for children, unless this study proves otherwise. The EDPS recommends mentioning this issue in the Stockholm programme. |
| --- | --- |

80.

Another recurring issue in recent years has been the use of fingerprints of children and of elderly people, because of the inherent imperfections of biometric systems for those age groups. The EDPS asked for an in-depth study in order to identify properly the accuracy of the systems (51). He proposed an age limit of 14 years for children, unless this study proves otherwise. The EDPS recommends mentioning this issue in the Stockholm programme.

| 81. | Having said this, the EDPS suggests it would be useful to develop substantive criteria for the use of biometric data. Those criteria should ensure that the data are only used when necessary, adequate and proportionate, and when an explicit, specified and legitimate purpose has been demonstrated by the legislator. To be more specific, biometric data and in particular DNA data should not be used if the same effect can be reached by using other, less sensitive information. |
| --- | --- |

81.

Having said this, the EDPS suggests it would be useful to develop substantive criteria for the use of biometric data. Those criteria should ensure that the data are only used when necessary, adequate and proportionate, and when an explicit, specified and legitimate purpose has been demonstrated by the legislator. To be more specific, biometric data and in particular DNA data should not be used if the same effect can be reached by using other, less sensitive information.

VII.   ACCESS TO JUSTICE AND E-JUSTICE

| 82. | Technology will also be used as a tool for better judicial cooperation. In paragraph 3.4.1 of the Communication, e-Justice is presented as providing the citizens easier access to justice. It consists of a portal with information and videoconferences as part of the legal procedure. It furthermore opens up for online legal procedures and it foresees the interconnection of national registers, such as insolvency registers. The EDPS notes that the Communication does not mention new initiatives about e-Justice but consolidates actions that are already set in motion. The EDPS is involved in some of these actions, as a follow up of the Opinion he issued on 19 December 2008 on the Communication from the Commission towards a European e-Justice Strategy (52). |
| --- | --- |

82.

Technology will also be used as a tool for better judicial cooperation. In paragraph 3.4.1 of the Communication, e-Justice is presented as providing the citizens easier access to justice. It consists of a portal with information and videoconferences as part of the legal procedure. It furthermore opens up for online legal procedures and it foresees the interconnection of national registers, such as insolvency registers. The EDPS notes that the Communication does not mention new initiatives about e-Justice but consolidates actions that are already set in motion. The EDPS is involved in some of these actions, as a follow up of the Opinion he issued on 19 December 2008 on the Communication from the Commission towards a European e-Justice Strategy (52).

| 83. | e-Justice is an ambitious project that needs full support. It can effectively improve the justice system in Europe and the judicial protection of the citizen. It is a significant step forward towards a European Area of Justice. Keeping this positive appreciation in mind, a few remarks can be made:






  — | the technological systems for e-Justice should be built in accordance with the principle of ‘privacy by design’. As said before, in relation to the European information model, choosing the right architecture is the start of it all, |
| --- | --- | --- |

83.

e-Justice is an ambitious project that needs full support. It can effectively improve the justice system in Europe and the judicial protection of the citizen. It is a significant step forward towards a European Area of Justice. Keeping this positive appreciation in mind, a few remarks can be made:

—

the technological systems for e-Justice should be built in accordance with the principle of ‘privacy by design’. As said before, in relation to the European information model, choosing the right architecture is the start of it all,

| — | the interconnection and interoperability of systems should respect the purpose limitation principle, |
| --- | --- |

—

the interconnection and interoperability of systems should respect the purpose limitation principle,

| — | the responsibilities of the different actors should be precisely defined, |
| --- | --- |

—

the responsibilities of the different actors should be precisely defined,

| — | the consequences for individuals of the interconnection of national registers with delicate personal data, such as insolvency registers, should be analysed in advance. |
| --- | --- |

—

the consequences for individuals of the interconnection of national registers with delicate personal data, such as insolvency registers, should be analysed in advance.

VIII.   CONCLUSIONS

| 84. | The EDPS endorses the emphasis in the Communication on the protection of fundamental rights, and in particular the protection of personal data, as one of the key issues of the future of the Area of freedom, security and justice. In the view of the EDPS, the Communication rightly promotes a balance between the needs for appropriate instruments to guarantee the security of the citizen and the protection of their fundamental rights. It recognises that more emphasis should be given to the protection of personal data. |
| --- | --- |

84.

The EDPS endorses the emphasis in the Communication on the protection of fundamental rights, and in particular the protection of personal data, as one of the key issues of the future of the Area of freedom, security and justice. In the view of the EDPS, the Communication rightly promotes a balance between the needs for appropriate instruments to guarantee the security of the citizen and the protection of their fundamental rights. It recognises that more emphasis should be given to the protection of personal data.

| 85. | The EDPS fully supports paragraph 2.3 of the Communication that calls for a comprehensive data protection scheme covering all areas of EU competence, independently of the entry into force of the Lisbon Treaty. He recommends in this context:






  — | to announce the need for a clear and long-term vision on such a comprehensive scheme, in the Stockholm-programme, |
| --- | --- | --- |

85.

The EDPS fully supports paragraph 2.3 of the Communication that calls for a comprehensive data protection scheme covering all areas of EU competence, independently of the entry into force of the Lisbon Treaty. He recommends in this context:

—

to announce the need for a clear and long-term vision on such a comprehensive scheme, in the Stockholm-programme,

| — | to evaluate the measures that have been adopted in this area, their concrete implementation and their effectiveness, taking into account the costs for privacy and the effectiveness for law enforcement, |
| --- | --- |

—

to evaluate the measures that have been adopted in this area, their concrete implementation and their effectiveness, taking into account the costs for privacy and the effectiveness for law enforcement,

| — | to include as a priority in the Stockholm programme, the need for a new legislative framework, inter alia, replacing Council Framework Decision 2008/977/JHA. |
| --- | --- |

—

to include as a priority in the Stockholm programme, the need for a new legislative framework, inter alia, replacing Council Framework Decision 2008/977/JHA.

| 86. | The EDPS welcomes the intentions of the Commission to reaffirm the data protection principles, which must be connected to the public consultation announced by the Commission in the Conference ‘Personal data — more use, more protection?’ on 19 and 20 May 2009. On substance, the EDPS emphasises the importance of the purpose limitation principle as a cornerstone of data protection law, and of focusing on the possibilities for improving the effectiveness of the application of data protection principles, by instruments that can reinforce the responsibilities of the data controllers. |
| --- | --- |

86.

The EDPS welcomes the intentions of the Commission to reaffirm the data protection principles, which must be connected to the public consultation announced by the Commission in the Conference ‘Personal data — more use, more protection?’ on 19 and 20 May 2009. On substance, the EDPS emphasises the importance of the purpose limitation principle as a cornerstone of data protection law, and of focusing on the possibilities for improving the effectiveness of the application of data protection principles, by instruments that can reinforce the responsibilities of the data controllers.

| 87. | ‘Privacy by design’ and privacy-aware technologies, could be promoted by:






  — | a privacy and data protection certification scheme as option for builders and users of information systems, |
| --- | --- | --- |

87.

‘Privacy by design’ and privacy-aware technologies, could be promoted by:

—

a privacy and data protection certification scheme as option for builders and users of information systems,

| — | a legal obligation for builders and users of information systems to use systems which are in accordance with the principle of ‘privacy by design’. |
| --- | --- |

—

a legal obligation for builders and users of information systems to use systems which are in accordance with the principle of ‘privacy by design’.

| 88. | As to the external aspects of data protection, the EDPS recommends:






  — | emphasising in the Stockholm programme the importance of general agreements with the United States and other third countries on data protection and data exchange, |
| --- | --- | --- |

88.

As to the external aspects of data protection, the EDPS recommends:

—

emphasising in the Stockholm programme the importance of general agreements with the United States and other third countries on data protection and data exchange,

| — | actively promoting the respect of fundamental rights, and in particular of data protection, in relation with third countries and with international organisations, |
| --- | --- |

—

actively promoting the respect of fundamental rights, and in particular of data protection, in relation with third countries and with international organisations,

| — | mentioning in the Stockholm programme that exchange of personal data with third countries requires an adequate level of protection or other appropriate safeguards in those third countries. |
| --- | --- |

—

mentioning in the Stockholm programme that exchange of personal data with third countries requires an adequate level of protection or other appropriate safeguards in those third countries.

| 89. | The EDPS notes the developments towards a European Union Information Management Strategy and a European information model with great interest and underlines the attention that should be given in these projects to data protection elements, to be further elaborated in the Stockholm programme. The architecture for information exchange should be based on ‘privacy by design’ and ‘Best Available Techniques’. |
| --- | --- |

89.

The EDPS notes the developments towards a European Union Information Management Strategy and a European information model with great interest and underlines the attention that should be given in these projects to data protection elements, to be further elaborated in the Stockholm programme. The architecture for information exchange should be based on ‘privacy by design’ and ‘Best Available Techniques’.

| 90. | The mere fact that it is technically possible to exchange digital information between interoperable databases or to merge these databases does not justify an exception to the purpose limitation principle. Interoperability should in concrete cases be based on clear and careful policy choices. The EDPS suggests specifying this notion in the Stockholm programme. |
| --- | --- |

90.

The mere fact that it is technically possible to exchange digital information between interoperable databases or to merge these databases does not justify an exception to the purpose limitation principle. Interoperability should in concrete cases be based on clear and careful policy choices. The EDPS suggests specifying this notion in the Stockholm programme.

| 91. | The use for law enforcement of personal data collected for commercial purposes should, according to the EDPS, only be allowed under strict conditions, specified in point 65 of this opinion. |
| --- | --- |

91.

The use for law enforcement of personal data collected for commercial purposes should, according to the EDPS, only be allowed under strict conditions, specified in point 65 of this opinion.

| 92. | Other suggestions as to the use of personal information include:






  — | develop substantive criteria for the choice between centralised and decentralised systems, and include the intention of developing such criteria in the Stockholm programme, |
| --- | --- | --- |

92.

Other suggestions as to the use of personal information include:

—

develop substantive criteria for the choice between centralised and decentralised systems, and include the intention of developing such criteria in the Stockholm programme,

| — | the establishment of an electronic system for entry to and exit from Member States’ territory alongside registered travellers programmes should not be mentioned in the Stockholm programme, |
| --- | --- |

—

the establishment of an electronic system for entry to and exit from Member States’ territory alongside registered travellers programmes should not be mentioned in the Stockholm programme,

| — | support for the strengthening of Europol and Eurojust and for the new agreement recently elaborated between Europol and Eurojust, |
| --- | --- |

—

support for the strengthening of Europol and Eurojust and for the new agreement recently elaborated between Europol and Eurojust,

| — | develop substantive criteria for the use of biometric data, ensuring that the data are only used when necessary, adequate and proportionate, and when an explicit, specified and legitimate purpose has been demonstrated by the legislator. DNA data should not be used if the same effect can be reached by using other, less sensitive information. |
| --- | --- |

—

develop substantive criteria for the use of biometric data, ensuring that the data are only used when necessary, adequate and proportionate, and when an explicit, specified and legitimate purpose has been demonstrated by the legislator. DNA data should not be used if the same effect can be reached by using other, less sensitive information.

| 93. | The EDPS supports e-Justice and has made a few remarks on how to improve the project (see point 83). |
| --- | --- |

93.

The EDPS supports e-Justice and has made a few remarks on how to improve the project (see point 83).

Done at Brussels, 10 July 2009.

Peter HUSTINX

European Data Protection Supervisor

---

(1)  COM(2009) 262 final (‘the Communication’).

1

(2)  Not published. The Working Party on Police and Justice (WPPJ) was established by the European Conference of Data Protection Commissioners to prepare its positions in the area of law enforcement, and to act on its behalf in urgent matters.

2

(3)  Council Document No 11657/08. Hereinafter ‘the Home Affairs Report’.

3

(4)  Council Document No 11549/08 (‘the Justice Report’).

4

(5)  The Government’s EU work programme, http://www.regeringen.se

5

(6)  The Home Affairs Report speaks in this context even of a ‘digital tsunami’.

6

(7)  Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC, OJ L 105, 13.4.2006, p. 54.

7

(8)  See e.g. Agreement between the European Union and the United States of America on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the United States Department of Homeland Security (DHS) (2007 PNR Agreement), OJ L 204, 4.8.2007, p. 18 and Proposal for a Council framework decision on the use of Passenger Name Record (PNR) for law enforcement purposes, COM(2007) 654 final.

8

(9)  The 2007 PNR Agreement mentioned in the previous footnote and its predecessors.

9

(10)  Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC, OJ L 105, 13.4.2006, p. 54. Although the legal basis is Article 95 EC, it was an immediate reaction to the London bombings.

10

(11)  Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, OJ L 350, 30.12.2008, p. 60.

11

(12)  See the title of the Communication.

12

(13)  Press Release No 72/2009 of 30 June 2009 of the Federal Constitutional Court of Germany, paragraph 2c).

13

(14)  The EDPS has elaborated this last point in his Opinion of 19 December 2005 on the proposal for a Council framework decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters (COM(2005) 475 final), OJ C 47, 25.2.2006, p. 27, paragraphs 30-32.

14

(15)  Data Protection in the European Union — Citizens’ perceptions — Analytical report, Flash Eurobarometer Series 225, January 2008, http://www.ec.europa.eu/public_opinion/flash/fl_225_en.pdf

15

(16)  See also the priority issues of the Communication.

16

(17)  COM(2006) 331 final of 28 June 2006.

17

(18)  See footnote 11.

18

(19)  COM(2007) 87 final of 7 March 2007.

19

(20)  Opinion of 25 July 2007, OJ C 255, 27.10.2007, p. 1, in particular paragraph 30.

20

(21)  Judgment of the Court of 30 May 2006, European Parliament v Council of the European Union (C-317/04) and Commission of the European Communities (C-318/04), joined cases C-317/04 and C-318/04, ECR (2006), p. I-4721.

21

(22)  Judgment of the Court of 10 February 2009, Ireland v European Parliament and Council of the European Union, Case C-301/06, not yet released.

22

(23)  See Declaration 21 on the protection of personal data in the field of judicial cooperation in criminal matters and police cooperation, annexed to the final act of the intergovernmental conference that adopted the Treaty of Lisbon, OJ C 115, 9.5.2008, p. 345.

23

(24)  The Article 29 Working Party on Data Protection, in which the EDPS participates, has decided to work intensively on its contribution to this public consultation.

24

(25)  An example of such a scheme is the European Privacy Seal (EuroPriSe).

25

(26)  Users of information are covered by data protection law, as data controllers or processors.

26

(27)  See EDPS Opinion of 11 November 2008 on the Final Report by the EU-US High-Level Contact Group on information sharing and privacy and personal data protection, OJ C 128, 6.6.2009, p. 1.

27

(28)  ETS No 108, 28.1.1981.

28

(29)  See letter EDPS of 28 November 2005 on the Commission communication on the external dimension of the Area of freedom, security and justice available at the EDPS website.

29

(30)  The recent case law on terrorists’ lists confirms that guarantees are needed — also in the relations with the United Nations — in order to ensure that counterterrorism measures comply with EU standards on fundamental rights (joined Cases C-402/05 P and C-415/05 P, Kadi and Al Barakaat Foundation v Council, judgment of 3 September 2008, not yet released).

30

(31)  COM(2005) 490 final.

31

(32)  In the perspective of availability; the Prüm Decision contains far reaching provisions for the use of biometric data (DNA and fingerprints).

32

(33)  OJ L 210, 6.8.2008, p. 1.

33

(34)  See the governments’ EU Work programme cited in footnote 5, p. 23.

34

(35)  See also point 41 above.

35

(36)  See ‘Guidelines and criteria for the development, implementation and use of privacy enhancing security technologies’ developed in the PRISE project (http://www.prise.oeaw.ac.at).

36

(37)  Best Available Techniques shall mean the most effective and advanced stage in the development of activities and their methods of operation which indicate the practical suitability of particular techniques for providing in principle the basis for ITS applications and systems to be compliant with privacy, data protection and security requirement of the EU regulatory framework.

37

(38)  See EDPS Comments on the Communication of the Commission on interoperability of European databases, 10 March 2006, available at: http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Comments/2006/06-03-10_Interoperability_EN.pdf

38

(39)  See e.g. point 15 above.

39

(40)  OJ L 309, 25.11.2005, p. 15.

40

(41)  See Opinion 10/2006 on the processing of personal data by the Society for Worldwide Interbank Financial Telecommunication (SWIFT) of the Article 29 Working Party.

41

(42)  Under the ‘push’ system the data controller sends the data on request (pushes) to the law enforcement agency. Under the ‘pull’ system the law enforcement agency has access to the database of the controller and extracts (pulls) information from this database. Under the ‘pull’ system it is more difficult for the controller to resume its responsibility.

42

(43)  Centralised storage is in this context understood as storage on a central European level, whereas decentralised storage means storage on the level of the Member States.

43

(44)  See footnote 33.

44

(45)  Communication of the Commission ‘Preparing the next steps in border management in the European Union’, 13.2.2008, COM(2008) 69.

45

(46)  Preliminary comments EDPS on three communications from the Commission on border management (COM(2008) 69, COM(2008) 68 and COM(2008) 67), 3 March 2008: http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Comments/2008/08-03-03_Comments_border_package_EN.pdf

46

(47)  In particular: Opinion of 23 March 2005 on the proposal for a regulation of the European Parliament and of the Council concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas, OJ C 181, 23.7.2005, p. 13, and Opinion of 19 October 2005 on three proposals regarding the second generation Schengen Information System (SIS II), OJ C 91, 19.4.2006, p. 38.

47

(48)  Commission proposal of 24 June 2009 for a regulation of the European Parliament and of the Council establishing an Agency for the operational management of the Schengen Information System (SIS II), Visa Information System (VIS), EURODAC and other large-scale IT systems in the Area of freedom, security and justice (COM(2009) 293/2).

48

(49)  Draft agreement, approved by Council, and still to be signed by both parties. See Council register:

49

http://register.consilium.europa.eu/pdf/en/09/st10/st10019.en09.pdf

http://register.consilium.europa.eu/pdf/en/09/st10/st10107.en09.pdf

(50)  Joined applications 30562/04 and 30566/04, S. and Marper v United Kingdom, judgment of 4 December 2008, ECHR not yet released.

50

(51)  Opinion of 26 March 2008 on the proposal for a regulation amending Council Regulation (EC) No 2252/2004 on standards for security features and biometrics in passports and travel documents issued by Member States, OJ C 200, 6.8.2008, p. 1.

51

(52)  EDPS Opinion of 19 December 2008 on the Communication from the Commission towards a European e-Justice Strategy, OJ C 128, 6.6.2009, p. 13.

52

---

II Information

INFORMATION FROM EUROPEAN UNION INSTITUTIONS AND BODIES

Commission

| 17.11.2009 | EN | Official Journal of the European Union | C 276/21 |
| --- | --- | --- | --- |

17.11.2009

EN

Official Journal of the European Union

C 276/21

---

Authorisation for State aid pursuant to Articles 87 and 88 of the EC Treaty

Cases where the Commission raises no objections

2009/C 276/03

| Date of adoption of the decision | 25.8.2009 |
| --- | --- |
| Reference number of State Aid | NN 25/06 (ex N 191/06) |
| Member State | France |
| Region | Ain |
| Title (and/or name of the beneficiary) | Aide aux éleveurs de volailles du département de l’Ain |
| Legal basis | — | Articles L 221-1 et suivants du Code rural; |

Date of adoption of the decision

25.8.2009

Reference number of State Aid

NN 25/06 (ex N 191/06)

Member State

France

Region

Ain

Title (and/or name of the beneficiary)

Aide aux éleveurs de volailles du département de l’Ain

Legal basis

—

Articles L 221-1 et suivants du Code rural;

| — | Arrêté préfet de l’Ain du 2 mars 2006 |
| --- | --- |

—

Arrêté préfet de l’Ain du 2 mars 2006

| — | Commission Decision of 17 February 2006 (OJ L 48, 18.2.2006) concerning certain protection measures in relation to highly pathogenic avian influenza in wild birds in the Community |
| --- | --- |

—

Commission Decision of 17 February 2006 (OJ L 48, 18.2.2006) concerning certain protection measures in relation to highly pathogenic avian influenza in wild birds in the Community

| — | Commission Decision of 22 February 2006 (OJ L 52, 23.2.2006) concerning certain protection measures in relation to highly pathogenic avian influenza in wild birds in the Community |
| --- | --- |

—

Commission Decision of 22 February 2006 (OJ L 52, 23.2.2006) concerning certain protection measures in relation to highly pathogenic avian influenza in wild birds in the Community

| — | Les arrêtés interministériels du 24 octobre 2005 (paru au JORF du 25.10.2005) et des 18, 23 et 24 février 2006 (parus aux JORF des 19 et 25.2.2006). |
| --- | --- |

—

Les arrêtés interministériels du 24 octobre 2005 (paru au JORF du 25.10.2005) et des 18, 23 et 24 février 2006 (parus aux JORF des 19 et 25.2.2006).

Type of measure

Aid scheme

Objective

Aid to combat animal diseases

Form of aid

Direct grant

Budget

EUR 1,63 million

Intensity

100 %

Duration (period)

2006

Economic sectors

Agriculture

Name and address of the granting authority

| M. le Préfet de l'Ain |
| --- |
| Préfecture |
| 45 avenue Alsace-Lorraine |
| 01000 Bourg-en-Bresse |
| FRANCE |

M. le Préfet de l'Ain

Préfecture

45 avenue Alsace-Lorraine

01000 Bourg-en-Bresse

FRANCE

Other information

—

The authentic text(s) of the decision, from which all confidential information has been removed, can be found at:

http://ec.europa.eu/community_law/state_aids/state_aids_texts_en.htm

---

IV Notices

NOTICES FROM EUROPEAN UNION INSTITUTIONS AND BODIES

Commission

| 17.11.2009 | EN | Official Journal of the European Union | C 276/23 |
| --- | --- | --- | --- |

17.11.2009

EN

Official Journal of the European Union

C 276/23

---

Euro exchange rates (1)

16 November 2009

2009/C 276/04

1 euro =

| | Currency | Exchange rate |
| --- | --- | --- |
| USD | US dollar | 1,4965 |
| JPY | Japanese yen | 134,02 |
| DKK | Danish krone | 7,4408 |
| GBP | Pound sterling | 0,89485 |
| SEK | Swedish krona | 10,1943 |
| CHF | Swiss franc | 1,5093 |
| ISK | Iceland króna | |
| NOK | Norwegian krone | 8,3370 |
| BGN | Bulgarian lev | 1,9558 |
| CZK | Czech koruna | 25,510 |
| EEK | Estonian kroon | 15,6466 |
| HUF | Hungarian forint | 267,43 |
| LTL | Lithuanian litas | 3,4528 |
| LVL | Latvian lats | 0,7083 |
| PLN | Polish zloty | 4,0960 |
| RON | Romanian leu | 4,2990 |
| TRY | Turkish lira | 2,2092 |
| AUD | Australian dollar | 1,6004 |
| CAD | Canadian dollar | 1,5635 |
| HKD | Hong Kong dollar | 11,5978 |
| NZD | New Zealand dollar | 2,0102 |
| SGD | Singapore dollar | 2,0733 |
| KRW | South Korean won | 1 728,79 |
| ZAR | South African rand | 11,0517 |
| CNY | Chinese yuan renminbi | 10,2166 |
| HRK | Croatian kuna | 7,3000 |
| IDR | Indonesian rupiah | 14 060,07 |
| MYR | Malaysian ringgit | 5,0395 |
| PHP | Philippine peso | 69,704 |
| RUB | Russian rouble | 42,9545 |
| THB | Thai baht | 49,690 |
| BRL | Brazilian real | 2,5662 |
| MXN | Mexican peso | 19,4395 |
| INR | Indian rupee | 69,1230 |

Currency

Exchange rate

USD

US dollar

1,4965

JPY

Japanese yen

134,02

DKK

Danish krone

7,4408

GBP

Pound sterling

0,89485

SEK

Swedish krona

10,1943

CHF

Swiss franc

1,5093

ISK

Iceland króna

NOK

Norwegian krone

8,3370

BGN

Bulgarian lev

1,9558

CZK

Czech koruna

25,510

EEK

Estonian kroon

15,6466

HUF

Hungarian forint

267,43

LTL

Lithuanian litas

3,4528

LVL

Latvian lats

0,7083

PLN

Polish zloty

4,0960

RON

Romanian leu

4,2990

TRY

Turkish lira

2,2092

AUD

Australian dollar

1,6004

CAD

Canadian dollar

1,5635

HKD

Hong Kong dollar

11,5978

NZD

New Zealand dollar

2,0102

SGD

Singapore dollar

2,0733

KRW

South Korean won

1 728,79

ZAR

South African rand

11,0517

CNY

Chinese yuan renminbi

10,2166

HRK

Croatian kuna

7,3000

IDR

Indonesian rupiah

14 060,07

MYR

Malaysian ringgit

5,0395

PHP

Philippine peso

69,704

RUB

Russian rouble

42,9545

THB

Thai baht

49,690

BRL

Brazilian real

2,5662

MXN

Mexican peso

19,4395

INR

Indian rupee

69,1230

---

(1)  Source: reference exchange rate published by the ECB.

---

NOTICES FROM MEMBER STATES

| 17.11.2009 | EN | Official Journal of the European Union | C 276/24 |
| --- | --- | --- | --- |

17.11.2009

EN

Official Journal of the European Union

C 276/24

---

Information communicated by Member States regarding State aid granted under Commission Regulation (EC) No 800/2008 declaring certain categories of aid compatible with the common market in application of Articles 87 and 88 of the Treaty (General block exemption Regulation)

(Text with EEA relevance)

2009/C 276/05

| Reference number of State Aid | X 122/08 |
| --- | --- |
| Member State | Czech Republic |
| Member State reference number | NVF/ESF/RF/254/2008/RV |
| Name of the Region (NUTS) | Czech Republic
  Article 87(3)(a), Article 87(3)(c) |
| Granting authority | Národní vzdělávací fond, o. p. s. |
| Opletalova 25 |
| 110 00 Praha 1 |
| ČESKÁ REPUBLIKA |
| http://www.nvf.cz |

Reference number of State Aid

X 122/08

Member State

Czech Republic

Member State reference number

NVF/ESF/RF/254/2008/RV

Name of the Region (NUTS)

Czech Republic

Article 87(3)(a), Article 87(3)(c)

Granting authority

Národní vzdělávací fond, o. p. s.

Opletalova 25

110 00 Praha 1

ČESKÁ REPUBLIKA

http://www.nvf.cz

Title of the aid measure

Blokový grant – Fond pro podporu výzkumu/2. výzva opatření A

National legal basis (Reference to the relevant national official publication)

Memorandum o porozumění pro implementaci Norského finančního mechanizmu pro 2004–2009 (mezi Českou republikou a Norskem)

Memorandum o porozumění pro implementaci EHP finančního mechanizmu pro 2004–2009 (mezi Českou republikou a Islandem, Lichtenštejnskem a Norskem)

Web link to the full text of the aid measure

http://www.eea-researchfund.cz

Type of measure

Scheme

Amendment of an existing aid measure

—

Duration

3.11.2008-31.7.2009

Economic sector(s) concerned

All economic sectors eligible to receive aid

Type of beneficiary

SME

large enterprise

Annual overall amount of the budget planned under the scheme

CZK 59,55 million

For guarantees

—

Aid Instrument (Article 5)

Grant

Reference to the Commission decision

—

If co-financed by Community funds

—

Objectives

Maximum aid intensity in % or maximum aid amount in national currency

SME-bonuses in %

Fundamental research (Article 31(2)(a))

90 %

—

Industrial research (Article 31(2)(b))

65 %

15 %

Experimental development (Article 31(2)(c))

40 %

20 %

| Reference number of State Aid | X 123/08 |
| --- | --- |
| Member State | Germany |
| Member State reference number | Das Programm wird nach der „De-minimis“- bzw. Kleinbeihilfenregelung abgewickelt. |
| Name of the Region (NUTS) | Hessen
  Non-assisted areas |
| Granting authority | BM H Beteiligungs-Managementgesellschaft Hessen mbH |
| Bewilligungsausschuss des Fonds „Mittelhessenfonds GmbH“ |
| IB H Beteiligungs-Managementgesellschaft mbH (BM H) |
| Schumannstraße 4—6 |
| 60325 Frankfurt am Main |
| DEUTSCHLAND |
| http://www.bmh-hessen.de |

Reference number of State Aid

X 123/08

Member State

Germany

Member State reference number

Das Programm wird nach der „De-minimis“- bzw. Kleinbeihilfenregelung abgewickelt.

Name of the Region (NUTS)

Hessen

Non-assisted areas

Granting authority

BM H Beteiligungs-Managementgesellschaft Hessen mbH

Bewilligungsausschuss des Fonds „Mittelhessenfonds GmbH“

IB H Beteiligungs-Managementgesellschaft mbH (BM H)

Schumannstraße 4—6

60325 Frankfurt am Main

DEUTSCHLAND

http://www.bmh-hessen.de

Title of the aid measure

Mittelhessenfonds GmbH: Ein Finanzierungsangebot für Gründer und Mittelstand im Regierungsbezirk Gießen, Schwerpunkt Medizintechnik

hier: Investitionsbeteiligungen im Rahmen des „Mittelhessenfonds“ Zinsverbilligung von marktgerecht vergüteten darlehensähnlichen stillen Beteiligungen und gegebenenfalls Nachrangdarlehen, soweit zur Finanzierung von Investitionen verwendet

National legal basis (Reference to the relevant national official publication)

Operationelles EFRE-Programm „Regionale Wettbewerbsfähigkeit und Beschäftigung“ 2007 bis 2013 des Landes Hessen

Haushaltsgesetze des Landes Hessen

Hessisches Mittelstandsförderprogramm

Web link to the full text of the aid measure

http://www.mittelhessenfonds.de

Type of measure

Scheme

Amendment of an existing aid measure

Modification XS 184/07

Duration

1.1.2009-31.12.2013

Economic sector(s) concerned

All economic sectors eligible to receive aid

Type of beneficiary

SME

Annual overall amount of the budget planned under the scheme

EUR 2,00 million

For guarantees

—

Aid Instrument (Article 5)

Loan, Interest rate subsidy

Reference to the Commission decision

—

If co-financed by Community funds

II 2 — 069-d-60-15 — 5,00 EUR (in Mio.)

Objectives

Maximum aid intensity in % or maximum aid amount in national currency

SME-bonuses in %

SME investment and employment aid (Article 15)

—

—

| Reference number of State Aid | X 124/08 |
| --- | --- |
| Member State | Germany |
| Member State reference number | — |
| Name of the Region (NUTS) | Deutschland
  Non-assisted areas |
| Granting authority | Niedersächsisches Ministerium für Ernährung, Landwirtschaft, Verbraucherschutz und Landesentwicklung |
| Calenberger Straße 2 |
| 30169 Hannover |
| DEUTSCHLAND |
| http://www.ml.niedersachsen.de |

Reference number of State Aid

X 124/08

Member State

Germany

Member State reference number

—

Name of the Region (NUTS)

Deutschland

Non-assisted areas

Granting authority

Niedersächsisches Ministerium für Ernährung, Landwirtschaft, Verbraucherschutz und Landesentwicklung

Calenberger Straße 2

30169 Hannover

DEUTSCHLAND

http://www.ml.niedersachsen.de

Title of the aid measure

Verfahrenstechnische und mikrobiologische Optimierung der stofflichen Umsetzung von primär cellulosehaltigen landwirtschaftlichen Reststoffen zur Erzeugung von Biogas

National legal basis (Reference to the relevant national official publication)

Verwaltungsvorschriften zu § 44 LHO (Nds. MBl. 1996, S. 1868)

Bewilligungsbescheid (s. Web Link)

Web link to the full text of the aid measure

http://www.ml.niedersachsen.de/master/C51585202_N51583645_L20_D0_I655.html

Type of measure

Ad hoc aid

Fa. ARES

Amendment of an existing aid measure

—

Duration

15.11.2008

Economic sector(s) concerned

Professional, scientific and technical activities

Type of beneficiary

SME

Annual overall amount of the budget planned under the scheme

EUR 0,37 million

For guarantees

—

Aid Instrument (Article 5)

Grant

Reference to the Commission decision

—

If co-financed by Community funds

—

Objectives

Maximum aid intensity in % or maximum aid amount in national currency

SME-bonuses in %

Industrial research (Article 31(2)(b))

80 %

—

| Reference number of State Aid | X 125/08 |
| --- | --- |
| Member State | Spain |
| Member State reference number | ES51 |
| Name of the Region (NUTS) | Cataluna
  Non-assisted areas |
| Granting authority | Centro de Innovación y Desarrollo Empresarial (CIDEM) |
| Paseo de Gracia, 129 |
| 08008 Barcelona |
| ESPAÑA |
| http://www.acc10.cat |

Reference number of State Aid

X 125/08

Member State

Spain

Member State reference number

ES51

Name of the Region (NUTS)

Cataluna

Non-assisted areas

Granting authority

Centro de Innovación y Desarrollo Empresarial (CIDEM)

Paseo de Gracia, 129

08008 Barcelona

ESPAÑA

http://www.acc10.cat

Title of the aid measure

Ayudas para la creación de ocupación ligada a proyectos de inversión empresarial considerados estratégicos para la economía catalana

National legal basis (Reference to the relevant national official publication)

Resolución IUE/812/2008, de 4 de marzo, por la que se aprueban las bases reguladoras del programa de ayudas a proyectos de inversión empresarial considerados estratégicos para la economía catalana i se hacen públicas las convocatorias para el año 2008 (DOGC núm. 5096 de 25.3.2008)

Web link to the full text of the aid measure

http://www.gencat.net/eadop/imagenes/5096/08059014.pdf

Type of measure

Scheme

Amendment of an existing aid measure

—

Duration

26.3.2008-31.12.2008

Economic sector(s) concerned

All economic sectors eligible to receive aid

Type of beneficiary

SME

large enterprise

Annual overall amount of the budget planned under the scheme

EUR 2,00 million

For guarantees

—

Aid Instrument (Article 5)

Grant

Reference to the Commission decision

—

If co-financed by Community funds

—

Objectives

Maximum aid intensity in % or maximum aid amount in national currency

SME-bonuses in %

Regional investment and employment aid (Article 13) Scheme

15 %

10 %

SME investment and employment aid (Article 15)

15 %

—

| Reference number of State Aid | X 126/08 |
| --- | --- |
| Member State | Denmark |
| Member State reference number | 07/07410 |
| Name of the Region (NUTS) | Danmark
  Mixed |
| Granting authority | Erhvervs- og Byggestyrelsen |
| Langelinie Allé 17 |
| 2100 København Ø |
| DANMARK |
| http://ebst@ebst.dk |

Reference number of State Aid

X 126/08

Member State

Denmark

Member State reference number

07/07410

Name of the Region (NUTS)

Danmark

Mixed

Granting authority

Erhvervs- og Byggestyrelsen

Langelinie Allé 17

2100 København Ø

DANMARK

http://ebst@ebst.dk

Title of the aid measure

Innovation og Viden — dansk regionalfondsprogram under målet om regional konkurrenceevne og beskæftigelse

Flere og bedre job — dansk socialfondsprogram under målet om regional konkurrenceevne og beskæftigelse

National legal basis (Reference to the relevant national official publication)

Rådets Forordning (EF) nr. 1083/2006 af 11. juli 2006 om generelle bestemmelser for Den Europæiske Fond for Regionaludvikling, Den Europæiske Socialfond og Samhørighedsfonden og ophævelse af forordning (EF) nr. 1260/1999

Lov nr. 1599 af 20. december 2006 om administration af tilskud fra Den Europæiske Regionalfond og Den Europæiske Socialfond

Web link to the full text of the aid measure

http://www.ebst.dk/file/5467/Regionalfondsprogram

http://www.ebst.dk/file/5469/Socialfondsprogram

Type of measure

Scheme

Amendment of an existing aid measure

—

Duration

1.1.2007-31.12.2013

Economic sector(s) concerned

All economic sectors eligible to receive aid

Type of beneficiary

SME

large enterprise

Annual overall amount of the budget planned under the scheme

DKK 400,00 (in millions)

For guarantees

—

Aid Instrument (Article 5)

Loan, Risk capital, Grant

Reference to the Commission decision

—

If co-financed by Community funds

nævnt ovenfor, forordning 1083/2006 — 248,00 DKK (mio.)

Objectives

Maximum aid intensity in % or maximum aid amount in national currency

SME-bonuses in %

Aid for newly created small enterprises (Article 14)

25 %

—

Aid for small enterprises newly created by female entrepreneurs (Article 16)

15 %

—

Aid for environmental studies (Article 24)

50 %

10 %

Aid for consultancy in favour of SMEs (Article 26)

50 %

—

Aid for SME participation in fairs (Article 27)

50 %

—

Aid in the form of risk capital (Articles 28-29)

DKK 10 000 000

—

Industrial research (Article 31(2)(b))

65 %

10 %

Experimental development (Article 31(2)(c))

40 %

10 %

Aid for technical feasibility studies (Article 32)

75 %

—

Aid for industrial property rights costs for SMEs (Article 33)

75 %

—

Aid to young innovative enterprises (Article 35)

DKK 10 000 000

—

Aid for innovation advisory services and for innovation support services (Article 36)

DKK 10 000 000

—

Aid for the loan of highly qualified personnel (Article 37)

DKK 10 000 000

—

Specific training (Article 38(1))

35 %

10 %

General training (Article 38(2))

70 %

10 %

---

| 17.11.2009 | EN | Official Journal of the European Union | C 276/30 |
| --- | --- | --- | --- |

17.11.2009

EN

Official Journal of the European Union

C 276/30

---

Information communicated by Member States regarding State aid granted under Commission Regulation (EC) No 800/2008 declaring certain categories of aid compatible with the common market in application of Articles 87 and 88 of the Treaty (General block exemption Regulation)

(Text with EEA relevance)

2009/C 276/06

| Reference number of State Aid | X 129/08 |
| --- | --- |
| Member State | United Kingdom |
| Member State reference number | — |
| Name of the Region (NUTS) | North East, Tees Valley and Durham, Northumberland and Tyne and Wear
  Mixed |
| Granting authority | One North East |
| Stella House |
| Goldcrest Way |
| Newburn Riverside |
| Newcastle upon Tyne |
| NE15 8NY |
| UNITED KINGDOM |
| http://www.OneNorthEast.co.uk |

Reference number of State Aid

X 129/08

Member State

United Kingdom

Member State reference number

—

Name of the Region (NUTS)

North East, Tees Valley and Durham, Northumberland and Tyne and Wear

Mixed

Granting authority

One North East

Stella House

Goldcrest Way

Newburn Riverside

Newcastle upon Tyne

NE15 8NY

UNITED KINGDOM

http://www.OneNorthEast.co.uk

Title of the aid measure

NEPA (North East Productivity Alliance)

National legal basis (Reference to the relevant national official publication)

Regional Development Agencies Act 1998

Web link to the full text of the aid measure

http://www.onenortheast.co.uk/page/stateaid.cfm

http://www.onenortheast.co.uk/lib/liDownload/13946/MAS-NEPA%20state%20aid%20desc.doc?CFID=2425574&CF

Type of measure

Scheme

Amendment of an existing aid measure

—

Duration

1.10.2008-31.3.2013

Economic sector(s) concerned

Manufacturing

Type of beneficiary

SME

large enterprise

Annual overall amount of the budget planned under the scheme

GBP 6,79 million

For guarantees

—

Aid Instrument (Article 5)

Grant

Reference to the Commission decision

—

If co-financed by Community funds

—

Objectives

Maximum aid intensity in % or maximum aid amount in national currency

SME-bonuses in %

General training (Article 38(2))

60 %

20 %

| Reference number of State Aid | X 130/08 |
| --- | --- |
| Member State | Germany |
| Member State reference number | UEP II a |
| Name of the Region (NUTS) | Berlin
  Article 87(3)(c) |
| Granting authority | Senatsverwaltung für Gesundheit, Umweltschutz und Verbraucherschutz Berlin |
| Brückenstraße 6 |
| 10179 Berlin |
| DEUTSCHLAND |
| http://www.berlin.de/sen/guv |

Reference number of State Aid

X 130/08

Member State

Germany

Member State reference number

UEP II a

Name of the Region (NUTS)

Berlin

Article 87(3)(c)

Granting authority

Senatsverwaltung für Gesundheit, Umweltschutz und Verbraucherschutz Berlin

Brückenstraße 6

10179 Berlin

DEUTSCHLAND

http://www.berlin.de/sen/guv

Title of the aid measure

Umweltentlastungsprogramm II (UEP II) (N 774/07), dort: Vorhaben nach Ziffer 2.6.2 der Förderrichtlinie, d. h. Vorhaben zur Reduzierung verkehrsbedingter Emissionen, Verminderung von Lärm und/oder Luftbelastungen

National legal basis (Reference to the relevant national official publication)

Förderrichtlinie vom 22.9.2008 (Veröffentlichung im Amtsblatt von Berlin am 2.10.2008)

Operationelles Programm des Landes Berlin für den Europäischen Fonds für regionale Entwicklung in der Förderperiode 2007—2013 (Abschnitt 5.4); §§ 23, 44 der Landeshaushaltsordnung des Landes Berlin

Web link to the full text of the aid measure

http://www.uep-berlin.de/uepmedia/usermedia/files/foerderrichtlinie_uep_080922.pd

Type of measure

Scheme

Amendment of an existing aid measure

Modification XR 117/08

Duration

2.10.2008-31.12.2013

Economic sector(s) concerned

All economic sectors eligible to receive aid

Type of beneficiary

SME

Annual overall amount of the budget planned under the scheme

EUR 0,31 million

For guarantees

—

Aid Instrument (Article 5)

Grant

Reference to the Commission decision

—

If co-financed by Community funds

—

Objectives

Maximum aid intensity in % or maximum aid amount in national currency

SME-bonuses in %

Regional investment and employment aid (Article 13) Scheme

35 %

—

| Reference number of State Aid | X 131/08 |
| --- | --- |
| Member State | Ireland |
| Member State reference number | — |
| Name of the Region (NUTS) | — |
| Granting authority | Board Bia |
| Clanwilliam Court |
| Lower Mount Street |
| Dublin 2 |
| IRELAND |
| http://www.bordbia.ie |

Reference number of State Aid

X 131/08

Member State

Ireland

Member State reference number

—

Name of the Region (NUTS)

—

Granting authority

Board Bia

Clanwilliam Court

Lower Mount Street

Dublin 2

IRELAND

http://www.bordbia.ie

Title of the aid measure

Consultancy services provided to SME companies engaged in processing and marketing of non-agricultural products (non-Annex 1)

National legal basis (Reference to the relevant national official publication)

An Bord Bia Acts 1994 to 2004

Web link to the full text of the aid measure

http://www.bordbia.ie/industryservices/manufacturers/pages/consultancyservices.aspx

Type of measure

Scheme

Amendment of an existing aid measure

—

Duration

1.9.2008-31.12.2013

Economic sector(s) concerned

Market research and public opinion polling

Type of beneficiary

SME

Annual overall amount of the budget planned under the scheme

EUR 0,80 million

For guarantees

—

Aid Instrument (Article 5)

Grant

Reference to the Commission decision

—

If co-financed by Community funds

—

Objectives

Maximum aid intensity in % or maximum aid amount in national currency

SME-bonuses in %

Aid for consultancy in favour of SMEs (Article 26)

50 %

—

| Reference number of State Aid | X 132/08 |
| --- | --- |
| Member State | Cyprus |
| Member State reference number | 25.06.001.736 |
| Name of the Region (NUTS) | Cyprus
  Article 87(3)(c) |
| Granting authority | Υπουργείο Εσωτερικών, Τμήμα Πολεοδομίας και Οικήσεως |
| Λεωφόρος Δημοσθένη Σεβέρη |
| 1454 Λευκωσία/Nicosia |
| KYΠPOΣ/CYPRUS |
| http://www.moi.gov.cy/tph |

Reference number of State Aid

X 132/08

Member State

Cyprus

Member State reference number

25.06.001.736

Name of the Region (NUTS)

Cyprus

Article 87(3)(c)

Granting authority

Υπουργείο Εσωτερικών, Τμήμα Πολεοδομίας και Οικήσεως

Λεωφόρος Δημοσθένη Σεβέρη

1454 Λευκωσία/Nicosia

KYΠPOΣ/CYPRUS

http://www.moi.gov.cy/tph

Title of the aid measure

Σχέδιο παροχής χορηγιών προς μικρές και μεσαίες επιχειρήσεις για προώθηση του αγροτουρισμού στην ύπαιθρο

National legal basis (Reference to the relevant national official publication)

Απόφαση Υπουργικού Συμβουλίου με αριθμό 67.371 και ημερομηνία 18.6.2008

Web link to the full text of the aid measure

http://www.moi.gov.cy/tph/rural-tourism

Type of measure

Scheme

Amendment of an existing aid measure

—

Duration

3.11.2008-31.12.2013

Economic sector(s) concerned

Hotels and similar accommodation, Holiday and other short-stay accommodation, Restaurants and mobile food service activities, Museums activities, Activities of amusement parks and theme parks

Type of beneficiary

SME

Annual overall amount of the budget planned under the scheme

EUR 2,50 million

For guarantees

—

Aid Instrument (Article 5)

Grant

Reference to the Commission decision

—

If co-financed by Community funds

Αριθμός: ΕΕ(2007)4351 Ημερομηνία: 17.9.2007 — 12,75 EUR (σε εκατ.)

Objectives

Maximum aid intensity in % or maximum aid amount in national currency

SME-bonuses in %

Regional investment and employment aid (Article 13) Scheme

15 %

20 %

| Reference number of State Aid | X 133/08 |
| --- | --- |
| Member State | United Kingdom |
| Member State reference number | — |
| Name of the Region (NUTS) | Scotland
  Mixed |
| Granting authority | Scottish Executive |
| Third Sector Division |
| Highlander House |
| 58 Waterloo Street |
| Glasgow |
| G2 7DA |
| UNITED KINGDOM |
| http://www.scotland.gov.uk/Home |

Reference number of State Aid

X 133/08

Member State

United Kingdom

Member State reference number

—

Name of the Region (NUTS)

Scotland

Mixed

Granting authority

Scottish Executive

Third Sector Division

Highlander House

58 Waterloo Street

Glasgow

G2 7DA

UNITED KINGDOM

http://www.scotland.gov.uk/Home

Title of the aid measure

Scottish Investment Fund

National legal basis (Reference to the relevant national official publication)

The grant is provided under section 10 of the Social Work (Scotland) Act 1968

Web link to the full text of the aid measure

http://www.scotland.gov.uk/Topics/People/15300/funding

Type of measure

Scheme

Amendment of an existing aid measure

—

Duration

1.11.2008-31.3.2011

Economic sector(s) concerned

All economic sectors eligible to receive aid

Type of beneficiary

SME

large enterprise

Annual overall amount of the budget planned under the scheme

GBP 30,00 million

For guarantees

—

Aid Instrument (Article 5)

Grant

Reference to the Commission decision

—

If co-financed by Community funds

—

Objectives

Maximum aid intensity in % or maximum aid amount in national currency

SME-bonuses in %

Regional investment and employment aid (Article 13) Scheme

50 %

20 %

SME investment and employment aid (Article 15)

20 %

—

Aid for consultancy in favour of SMEs (Article 26)

50 %

—

Specific training (Article 38(1))

45 %

—

General training (Article 38(2))

80 %

—

Aid for the recruitment of disadvantaged workers in the form of wage subsidies (Article 40)

50 %

—

Aid for the employment of disabled workers in the form of wage subsidies (Article 41)

75 %

—

Aid for compensating the additional costs of employing disabled workers (Article 42)

100 %

—

---

| 17.11.2009 | EN | Official Journal of the European Union | C 276/35 |
| --- | --- | --- | --- |

17.11.2009

EN

Official Journal of the European Union

C 276/35

---

Information communicated by Member States regarding State aid granted under Commission Regulation (EC) No 800/2008 declaring certain categories of aid compatible with the common market in application of Articles 87 and 88 of the Treaty (General block exemption Regulation)

(Text with EEA relevance)

2009/C 276/07

| Reference number of State Aid | X 134/08 |
| --- | --- |
| Member State | Czech Republic |
| Member State reference number | — |
| Name of the Region (NUTS) | Czech Republic
  Article 87(3)(a), Article 87(3)(c)
  Non-assisted areas |
| Granting authority | Ministerstvo zemědělství |
| Těšnov 17 |
| 117 05 Praha 1 |
| ČESKÁ REPUBLIKA |
| http://www.mze.cz |

Reference number of State Aid

X 134/08

Member State

Czech Republic

Member State reference number

—

Name of the Region (NUTS)

Czech Republic

Article 87(3)(a), Article 87(3)(c)

Non-assisted areas

Granting authority

Ministerstvo zemědělství

Těšnov 17

117 05 Praha 1

ČESKÁ REPUBLIKA

http://www.mze.cz

Title of the aid measure

Vrácení části spotřební daně zaplacené v cenách minerálních olejů uvedených v § 45 odst. 2 písm. c) zákona č. 353/2003 Sb., o spotřebních daních, ve znění p.p.

National legal basis (Reference to the relevant national official publication)

Zákon č. 353/2003 Sb., o spotřebních daních, ve znění p.p.

Vyhláška č. 395/2008 Sb., kterou se mění vyhláška č. 48/2008 Sb., o způsobu výpočtu nároku na vrácení spotřební daně zaplacené v cenách některých minerálních olejů spotřebovaných v zemědělské prvovýrobě

Web link to the full text of the aid measure

http://cds.mfcr.cz/cps/rde/xchg/cds/xsl/182_793.html

http://www.sagit.cz/pages/sbirkatxt.asp?zdroj=sb08395&cd=76&typ=r

Type of measure

Scheme

Amendment of an existing aid measure

—

Duration

1.12.2008-31.12.2013

Economic sector(s) concerned

Growing of non-perennial crops, growing of perennial crops, plant propagation, support activities for crop production, post-harvest crop activities

Type of beneficiary

SME

large enterprise

Annual overall amount of the budget planned under the scheme

CZK 1,50 million

For guarantees

—

Aid Instrument (Article 5)

Fiscal measure

Reference to the Commission Decision

—

If co-financed by Community funds

—

Objectives

Maximum aid intensity in % or maximum aid amount in national currency

SME-bonuses in %

Aid in the form of reductions in environmental taxes (Article 25)

CZK 1 373

—

| Reference number of State Aid | X 135/08 |
| --- | --- |
| Member State | Germany |
| Member State reference number | — |
| Name of the Region (NUTS) | Saarland
  Non-assisted areas |
| Granting authority | Saarland Ministerium für Wirtschaft und Wissenschaft |
| Franz-Josef-Röder-Straße 17 |
| 66119 Saarbrücken |
| DEUTSCHLAND |
| http://www.saarland.de/ministerium_wirtschaft_wissenschaft.htm |

Reference number of State Aid

X 135/08

Member State

Germany

Member State reference number

—

Name of the Region (NUTS)

Saarland

Non-assisted areas

Granting authority

Saarland Ministerium für Wirtschaft und Wissenschaft

Franz-Josef-Röder-Straße 17

66119 Saarbrücken

DEUTSCHLAND

http://www.saarland.de/ministerium_wirtschaft_wissenschaft.htm

Title of the aid measure

Regionales Förderprogramm des Saarlandes für kleine und mittlere Unternehmen der gewerblichen Wirtschaft (einschließlich Tourismus) vom 1.12.2008

National legal basis (Reference to the relevant national official publication)

§ 44 der Landeshaushaltsordnung des Saarlandes (LHO) in der Fassung der Bekanntmachung vom 5.11.1999 (Amtsblatt vom 11.2.2000, S. 194 ff), zuletzt geändert durch das Gesetz vom 15.2.2006 (Amtsblatt vom 6.4.2006, S. 474 ff), Amtsblatt des Saarlandes

Web link to the full text of the aid measure

http://www.saarland.de/8974.htm

http://www.vorschriften.saarland.de/verwaltungsvorschriften.htm

Type of measure

Scheme

Amendment of an existing aid measure

Modification XS 160/06

Duration

1.12.2008-31.12.2013

Economic sector(s) concerned

All economic sectors eligible to receive aid

Type of beneficiary

SME

Annual overall amount of the budget planned under the scheme

EUR 4,00 million

For guarantees

—

Aid Instrument (Article 5)

Grant

Reference to the Commission Decision

—

If co-financed by Community funds

2007DE162PO002 — 0,50 EUR (in Mio.)

Objectives

Maximum aid intensity in % or maximum aid amount in national currency

SME-bonuses in %

SME investment and employment aid (Article 15)

20 %

—

| Reference number of State Aid | X 136/08 |
| --- | --- |
| Member State | Austria |
| Member State reference number | — |
| Name of the Region (NUTS) | Österreich
  Mixed |
| Granting authority | Bundesministerium für Wirtschaft und Arbeit |
| Abteilung V/4 (Tourismusförderung) |
| Stubenring 1 |
| 1011 Wien |
| ÖSTERREICH |
| http://www.bmwa.gv.at |

Reference number of State Aid

X 136/08

Member State

Austria

Member State reference number

—

Name of the Region (NUTS)

Österreich

Mixed

Granting authority

Bundesministerium für Wirtschaft und Arbeit

Abteilung V/4 (Tourismusförderung)

Stubenring 1

1011 Wien

ÖSTERREICH

http://www.bmwa.gv.at

Title of the aid measure

TOP-Tourismus-Förderung 2007—2013 Teil A

National legal basis (Reference to the relevant national official publication)

Richtlinien des Bundesministers für Wirtschaft und Arbeit für die TOP-Tourismus-Förderung 2007—2013

Web link to the full text of the aid measure

http://www.oeht.at/page/media/download/top/RTOP2007n.Notifizierung.pdf

Type of measure

Scheme

Amendment of an existing aid measure

—

Duration

1.11.2008-31.12.2013

Economic sector(s) concerned

Land transport and transport via pipelines, accommodation, food and beverage service activities, motion picture, video and television programme production, sound recording and music publishing activities, real estate activities, architectural and engineering activities; technical testing and analysis, rental and leasing activities, travel agency, tour operator and other reservation service and related activities, education, gambling and betting activities, sports activities and amusement and recreation activities, other personal service activities

Type of beneficiary

SME

large enterprise

Annual overall amount of the budget planned under the scheme

EUR 21,80 million

For guarantees

—

Aid Instrument (Article 5)

Interest rate subsidy, Grant

Reference to the Commission Decision

—

If co-financed by Community funds

—

Objectives

Maximum aid intensity in % or maximum aid amount in national currency

SME-bonuses in %

Regional investment and employment aid (Article 13) Scheme

30 %

—

SME investment and employment aid (Article 15)

20 %

—

| Reference number of State Aid | X 137/08 |
| --- | --- |
| Member State | Germany |
| Member State reference number | — |
| Name of the Region (NUTS) | Thüeringen
  Article 87(3)(a) |
| Granting authority | Staatliches Forstamt Frauenwald |
| Forsthaus Allzunah |
| 98701 Frauenwald |
| DEUTSCHLAND |
| http://www.thueringenforst.de |

Reference number of State Aid

X 137/08

Member State

Germany

Member State reference number

—

Name of the Region (NUTS)

Thüeringen

Article 87(3)(a)

Granting authority

Staatliches Forstamt Frauenwald

Forsthaus Allzunah

98701 Frauenwald

DEUTSCHLAND

http://www.thueringenforst.de

Title of the aid measure

Förderung von Investitionen in Forstbetrieben und der Verarbeitung und Vermarktung von Holz

National legal basis (Reference to the relevant national official publication)

§§ 23 und 44 der Thüringer Landeshaushaltsordnung in der Fassung der Neubekanntmachung vom 19.9.2000 (GVBl. 10/2000, S. 282) i. V. m. der Richtlinie über die Förderung von Investitionen und der Verarbeitung und Vermarktung von Holz

Web link to the full text of the aid measure

http://www.thueringen.de/imperia/md/content/folder/foerderung/vvh.pdf

Type of measure

Scheme

Amendment of an existing aid measure

—

Duration

1.1.2009-31.12.2013

Economic sector(s) concerned

Silviculture and other forestry activities, support services to forestry

Type of beneficiary

SME

Annual overall amount of the budget planned under the scheme

EUR 0,67 million

For guarantees

—

Aid Instrument (Article 5)

Grant

Reference to the Commission Decision

—

If co-financed by Community funds

Entscheidung der Kommission K(2007) 5862 über das Entwicklungsprogramm für den ländlichen Raum des Landes Thüringen

CCI2007DE06RPO023 — 0,50 EUR (in Mio.)

Objectives

Maximum aid intensity in % or maximum aid amount in national currency

SME-bonuses in %

Regional investment and employment aid (Article 13) Scheme

45 %

—

| Reference number of State Aid | X 139/08 |
| --- | --- |
| Member State | Austria |
| Member State reference number | — |
| Name of the Region (NUTS) | Österreich
  Mixed |
| Granting authority | Bundesministerium für Wirtschaft und Arbeit |
| Abteilung V/4 (Tourismusförderungen) |
| Stubenring 1 |
| 1011 Wien |
| ÖSTERREICH |
| http://www.bmwa.gv.at |

Reference number of State Aid

X 139/08

Member State

Austria

Member State reference number

—

Name of the Region (NUTS)

Österreich

Mixed

Granting authority

Bundesministerium für Wirtschaft und Arbeit

Abteilung V/4 (Tourismusförderungen)

Stubenring 1

1011 Wien

ÖSTERREICH

http://www.bmwa.gv.at

Title of the aid measure

Jungunternehmerförderung in der Tourismus- und Freizeitwirtschaft 2007—2013

National legal basis (Reference to the relevant national official publication)

Richtlinie des Bundesministers für Wirtschaft und Arbeit für die Jungunternehmerförderung in der Tourismus- und Freizeitwirtschaft 2007—2013

Web link to the full text of the aid measure

http://www.oeht.at/page/media/download/top/JU-Richtlinie%20Langfassung.pdf

Type of measure

Scheme

Amendment of an existing aid measure

—

Duration

1.11.2008-31.12.2013

Economic sector(s) concerned

Land transport and transport via pipelines, accommodation, food and beverage service activities, motion picture, video and television programme production, sound recording and music publishing activities, real estate activities, architectural and engineering activities; technical testing and analysis, rental and leasing activities, travel agency, tour operator and other reservation service and related activities, education, gambling and betting activities, sports activities and amusement and recreation activities, other personal service activities

Type of beneficiary

SME

Annual overall amount of the budget planned under the scheme

EUR 1,40 million

For guarantees

—

Aid Instrument (Article 5)

Grant

Reference to the Commission Decision

—

If co-financed by Community funds

—

Objectives

Maximum aid intensity in % or maximum aid amount in national currency

SME-bonuses in %

Aid for newly created small enterprises (Article 14)

25 %

—

SME investment and employment aid (Article 15)

5 %

—

---

V Announcements

PROCEDURES RELATING TO THE IMPLEMENTATION OF THE COMPETITION POLICY

Commission

| 17.11.2009 | EN | Official Journal of the European Union | C 276/40 |
| --- | --- | --- | --- |

17.11.2009

EN

Official Journal of the European Union

C 276/40

---

Prior notification of a concentration

(Case COMP/M.5686 — Vitol Holding/Petroplus Refining Antwerp/Petroplus Refining Antwerp Bitumen)

Candidate case for simplified procedure

(Text with EEA relevance)

2009/C 276/08

| 1. | On 9 November 2009, the Commission received a notification of a proposed concentration pursuant to Article 4 of Council Regulation (EC) No 139/2004 (1) by which the undertaking Eurotank Belgium B.V. (‘Eurotank’, Belgium), ultimately controlled by Vitol Holding B.V. (‘Vitol’, Netherlands), acquires within the meaning of Article 3(1)(b) of the Council Regulation control of the whole of the undertakings Petroplus Refining Antwerp N.V. (‘Petroplus’, Belgium) and Petroplus Refining Antwerp Bitumen N.V. (‘Petroplus Bitumen’, Belgium) by way of purchase of shares. |
| --- | --- |

1.

On 9 November 2009, the Commission received a notification of a proposed concentration pursuant to Article 4 of Council Regulation (EC) No 139/2004 (1) by which the undertaking Eurotank Belgium B.V. (‘Eurotank’, Belgium), ultimately controlled by Vitol Holding B.V. (‘Vitol’, Netherlands), acquires within the meaning of Article 3(1)(b) of the Council Regulation control of the whole of the undertakings Petroplus Refining Antwerp N.V. (‘Petroplus’, Belgium) and Petroplus Refining Antwerp Bitumen N.V. (‘Petroplus Bitumen’, Belgium) by way of purchase of shares.

| 2. | The business activities of the undertakings concerned are:






  — | for Petroplus/Petroplus Bitumen: active in the production of bitumen, gasoil desulphurization and the operation of a storage terminal, |
| --- | --- | --- |

2.

The business activities of the undertakings concerned are:

—

for Petroplus/Petroplus Bitumen: active in the production of bitumen, gasoil desulphurization and the operation of a storage terminal,

| — | for Vitol: trade with oil and gas, exploration and production activities in the oil and gas sector, inter alia. |
| --- | --- |

—

for Vitol: trade with oil and gas, exploration and production activities in the oil and gas sector, inter alia.

| 3. | On preliminary examination, the Commission finds that the notified transaction could fall within the scope of Regulation (EC) No 139/2004. However, the final decision on this point is reserved. Pursuant to the Commission Notice on a simplified procedure for treatment of certain concentrations under Council Regulation (EC) No 139/2004 (2) it should be noted that this case is a candidate for treatment under the procedure set out in the Notice. |
| --- | --- |

3.

On preliminary examination, the Commission finds that the notified transaction could fall within the scope of Regulation (EC) No 139/2004. However, the final decision on this point is reserved. Pursuant to the Commission Notice on a simplified procedure for treatment of certain concentrations under Council Regulation (EC) No 139/2004 (2) it should be noted that this case is a candidate for treatment under the procedure set out in the Notice.

| 4. | The Commission invites interested third parties to submit their possible observations on the proposed operation to the Commission.
  Observations must reach the Commission not later than 10 days following the date of this publication. Observations can be sent to the Commission by fax (+32 22964301 or 22967244) or by post, under reference number COMP/M.5686 — Vitol Holding/Petroplus Refining Antwerp/Petroplus Refining Antwerp Bitumen, to the following address:





  European Commission |
| --- | --- |
| Directorate-General for Competition |
| Merger Registry |
| 1049 Bruxelles/Brussel |
| BELGIQUE/BELGIË |

4.

The Commission invites interested third parties to submit their possible observations on the proposed operation to the Commission.

Observations must reach the Commission not later than 10 days following the date of this publication. Observations can be sent to the Commission by fax (+32 22964301 or 22967244) or by post, under reference number COMP/M.5686 — Vitol Holding/Petroplus Refining Antwerp/Petroplus Refining Antwerp Bitumen, to the following address:

European Commission

Directorate-General for Competition

Merger Registry

1049 Bruxelles/Brussel

BELGIQUE/BELGIË

---

(1)  OJ L 24, 29.1.2004, p. 1.

(2)  OJ C 56, 5.3.2005, p. 32.

---

| 17.11.2009 | EN | Official Journal of the European Union | C 276/41 |
| --- | --- | --- | --- |

17.11.2009

EN

Official Journal of the European Union

C 276/41

---

DECISION No 777

of 5 October 2009

on the opening of a procedure for granting authorisation for the prospection and exploration of oil and natural gas — underground natural resources as defined in Article 2(1)(3) of the Underground Natural Resources Act, at Block 1-18 ‘Trakiya’, located in Haskovo Province, and announcing that authorisation will be granted on the basis of a competitive tendering procedure

2009/C 276/09

REPUBLIC OF BULGARIA

THE COUNCIL OF MINISTERS

Pursuant to Article 5, subparagraph 2, Article 42(1)(1) and Article 44(3) of the Underground Natural Resources Act, in conjunction with Article 4(2)(16) and Section 1(24a) of the Additional Provision of the Energy Act,

THE COUNCIL OF MINISTERS HAS DECIDED AS FOLLOWS:

| 1. | A procedure shall be opened for granting authorisation for the prospection and exploration of crude oil and natural gas in Block 1-18 ‘Trakiya’, having a surface area of 940,12 km2 and coordinates 1 to 10 as specified in the Annex. |
| --- | --- |

1.

A procedure shall be opened for granting authorisation for the prospection and exploration of crude oil and natural gas in Block 1-18 ‘Trakiya’, having a surface area of 940,12 km2 and coordinates 1 to 10 as specified in the Annex.

| 2. | The authorisation referred to in point 1 shall be granted on the basis of a competitive tendering procedure. |
| --- | --- |

2.

The authorisation referred to in point 1 shall be granted on the basis of a competitive tendering procedure.

| 3. | The authorisation period for prospection and exploration shall be set at five years from the date on which the prospection and exploration agreement enters into force, with a right to extend this period pursuant to Article 31(3) of the Underground Natural Resources Act. |
| --- | --- |

3.

The authorisation period for prospection and exploration shall be set at five years from the date on which the prospection and exploration agreement enters into force, with a right to extend this period pursuant to Article 31(3) of the Underground Natural Resources Act.

| 4. | The competitive tendering procedure to determine who is granted the authorisation referred to in point 1 shall be conducted, on the 150th day following the publication of this Decision in the Official Journal of the European Union, in the Ministry of the Economy, Energy and Tourism’s building at the following address: ul. Triaditsa 8, Sofia. |
| --- | --- |

4.

The competitive tendering procedure to determine who is granted the authorisation referred to in point 1 shall be conducted, on the 150th day following the publication of this Decision in the Official Journal of the European Union, in the Ministry of the Economy, Energy and Tourism’s building at the following address: ul. Triaditsa 8, Sofia.

| 5. | The time limit for purchasing the tender dossier shall be 17:00 on the 120th day following the publication of this Decision in the Official Journal of the European Union. |
| --- | --- |

5.

The time limit for purchasing the tender dossier shall be 17:00 on the 120th day following the publication of this Decision in the Official Journal of the European Union.

| 6. | The time limit for submitting applications to take part in the competitive tendering procedure shall be 17:00 on the 130th day following the publication of this Decision in the Official Journal of the European Union. |
| --- | --- |

6.

The time limit for submitting applications to take part in the competitive tendering procedure shall be 17:00 on the 130th day following the publication of this Decision in the Official Journal of the European Union.

| 7. | The time limit for submitting bids in accordance with the tender dossier shall be 17:00 on the 144th day following the publication of this Decision in the Official Journal of the European Union. |
| --- | --- |

7.

The time limit for submitting bids in accordance with the tender dossier shall be 17:00 on the 144th day following the publication of this Decision in the Official Journal of the European Union.

| 8. | The competitive tendering procedure shall be non-presential. |
| --- | --- |

8.

The competitive tendering procedure shall be non-presential.

| 9. | The price of the tender dossier shall be set at BGN 500. The tender dossier is to be purchased from Room 802 at the Ministry of the Economy, Energy and Tourism building at the following address: ul. Triaditsa 8, Sofia, within the time limit specified in point 5. |
| --- | --- |

9.

The price of the tender dossier shall be set at BGN 500. The tender dossier is to be purchased from Room 802 at the Ministry of the Economy, Energy and Tourism building at the following address: ul. Triaditsa 8, Sofia, within the time limit specified in point 5.

| 10. | Applicants wishing to take part in the competitive tendering procedure must comply with the requirements of Article 23(1) of the Underground Natural Resources Act. |
| --- | --- |

10.

Applicants wishing to take part in the competitive tendering procedure must comply with the requirements of Article 23(1) of the Underground Natural Resources Act.

| 11. | Tenders shall be evaluated on the basis of the proposed work programmes, resources devoted to environmental protection and training, bonuses and managerial and financial capacities, as provided for in the tender dossier. |
| --- | --- |

11.

Tenders shall be evaluated on the basis of the proposed work programmes, resources devoted to environmental protection and training, bonuses and managerial and financial capacities, as provided for in the tender dossier.

| 12. | The deposit for participation in the competitive tendering procedure shall be set at BGN 10 000, payable within the time limit specified in point 6 into the bank account of the Ministry of the Economy, Energy and Tourism indicated in the tender dossier. |
| --- | --- |

12.

The deposit for participation in the competitive tendering procedure shall be set at BGN 10 000, payable within the time limit specified in point 6 into the bank account of the Ministry of the Economy, Energy and Tourism indicated in the tender dossier.

| 13. | Applicants who are not admitted to the competitive tendering procedure shall have their deposits reimbursed within 14 days after being informed that they have not been admitted. |
| --- | --- |

13.

Applicants who are not admitted to the competitive tendering procedure shall have their deposits reimbursed within 14 days after being informed that they have not been admitted.

| 14. | The successful bidder’s deposit shall be forfeit and the other bidders deposits shall be reimbursed within 14 days following the publication in the State Gazette of the Council of Ministers decision to grant authorisation for prospection and exploration. |
| --- | --- |

14.

The successful bidder’s deposit shall be forfeit and the other bidders deposits shall be reimbursed within 14 days following the publication in the State Gazette of the Council of Ministers decision to grant authorisation for prospection and exploration.

| 15. | Applications to take part in the competitive tendering procedure and bids under the competitive tendering procedure shall be submitted to the Ministry of the Economy, Energy and Tourism at: ul. Triaditsa 8, Sofia, in Bulgarian, in accordance with the requirements of Article 46 of the Underground Natural Resources Act. |
| --- | --- |

15.

Applications to take part in the competitive tendering procedure and bids under the competitive tendering procedure shall be submitted to the Ministry of the Economy, Energy and Tourism at: ul. Triaditsa 8, Sofia, in Bulgarian, in accordance with the requirements of Article 46 of the Underground Natural Resources Act.

| 16. | Bids shall comply with the requirements and conditions specified in the tender dossier. |
| --- | --- |

16.

Bids shall comply with the requirements and conditions specified in the tender dossier.

| 17. | The competitive tendering procedure shall take place even if only one applicant is admitted to take part in it. |
| --- | --- |

17.

The competitive tendering procedure shall take place even if only one applicant is admitted to take part in it.

| 18. | The Minister for the Economy, Energy and Tourism: |
| --- | --- |

18.

The Minister for the Economy, Energy and Tourism:

| 18.1. | shall send this Decision for publication in the Official Journal of the European Union, in the State Gazette and on the website of the Council of Ministers; |
| --- | --- |

18.1.

shall send this Decision for publication in the Official Journal of the European Union, in the State Gazette and on the website of the Council of Ministers;

| 18.2. | shall organise the conduct of the competitive tendering procedure. |
| --- | --- |

18.2.

shall organise the conduct of the competitive tendering procedure.

| 19. | Appeals against this Decision may be lodged with the Supreme Administrative Court within 14 days following its publication in the Official Journal of the European Union. |
| --- | --- |

19.

Appeals against this Decision may be lodged with the Supreme Administrative Court within 14 days following its publication in the Official Journal of the European Union.

Prime Minister

Boyko BORISOV

Secretary-General of the Council of Ministers

Rosen ZHELYAZKOV

Certified true copy,

Director of the Government Office Directorate

Vesselin DAKOV

---

ANNEX

LIST OF COORDINATES

Geographical coordinates (1950 Coordinate System) of Block 1-18 ‘Trakiya’:

| 1. | 41° 50′ 34,275′′ N | 25° 42′ 41,441′′ E |
| --- | --- | --- |
| 2. | 41° 50′ 45,014′′ N | 26° 00′ 44,523′′ E |
| 3. | 41° 52′ 55,884′′ N | 26° 00′ 42,506′′ E |
| 4. | 41° 53′ 06,026′′ N | 26° 22′ 23,117′′ E |
| 5. | 41° 49′ 17,984′′ N | 26° 22′ 24,265′′ E |

1.

41° 50′ 34,275′′ N

25° 42′ 41,441′′ E

2.

41° 50′ 45,014′′ N

26° 00′ 44,523′′ E

3.

41° 52′ 55,884′′ N

26° 00′ 42,506′′ E

4.

41° 53′ 06,026′′ N

26° 22′ 23,117′′ E

5.

41° 49′ 17,984′′ N

26° 22′ 24,265′′ E

border with Turkey and Greece:

| 6. | 41° 39′ 31,125′′ N | 26° 04′ 10,596′′ E |
| --- | --- | --- |
| 7. | 41° 39′ 23,120′′ N | 25° 49′ 25,406′′ E |
| 8. | 41° 46′ 21,391′′ N | 25° 49′ 17,766′′ E |
| 9. | 41° 46′ 18,068′′ N | 25° 42′ 36,679′′ E |
| 10. | 41° 50′ 34,275′′ N | 25° 42′ 41,441′′ E |

6.

41° 39′ 31,125′′ N

26° 04′ 10,596′′ E

7.

41° 39′ 23,120′′ N

25° 49′ 25,406′′ E

8.

41° 46′ 21,391′′ N

25° 49′ 17,766′′ E

9.

41° 46′ 18,068′′ N

25° 42′ 36,679′′ E

10.

41° 50′ 34,275′′ N

25° 42′ 41,441′′ E

---