# Official Journal L 100/2009

| | ISSN 1725-2555
  doi:10.3000/17252555.L_2009.100.eng |
| --- | --- |
| Official Journal
  of the European Union | L 100 |
| | |
| English edition | Legislation | Volume 5218 April 2009 |

ISSN 1725-2555

doi:10.3000/17252555.L_2009.100.eng

Official Journal

of the European Union

L 100

English edition

Legislation

Volume 5218 April 2009

---

| Contents | | I   Acts adopted under the EC Treaty/Euratom Treaty whose publication is obligatory | page |
| --- | --- | --- | --- |
| | | REGULATIONS |
| | | Commission Regulation (EC) No 315/2009 of 17 April 2009 establishing the standard import values for determining the entry price of certain fruit and vegetables | 1 |
| | * | Commission Regulation (EC) No 316/2009 of 17 April 2009 amending Regulation (EC) No 1973/2004 laying down detailed rules for the application of Council Regulation (EC) No 1782/2003 as regards the support schemes provided for in Titles IV and IVa of that Regulation and the use of land set aside for the production of raw materials | 3 |
| | * | Commission Regulation (EC) No 317/2009 of 17 April 2009 replacing Annex I to Council Regulation (EC) No 673/2005 establishing additional customs duties on imports of certain products originating in the United States of America | 6 |
| | * | Commission Regulation (EC) No 318/2009 of 17 April 2009 amending Regulation (EC) No 1914/2006 laying down detailed rules for applying Council Regulation (EC) No 1405/2006 laying down specific measures for agriculture in favour of the smaller Aegean islands | 8 |

Contents

I   Acts adopted under the EC Treaty/Euratom Treaty whose publication is obligatory

page

REGULATIONS

Commission Regulation (EC) No 315/2009 of 17 April 2009 establishing the standard import values for determining the entry price of certain fruit and vegetables

1

*

Commission Regulation (EC) No 316/2009 of 17 April 2009 amending Regulation (EC) No 1973/2004 laying down detailed rules for the application of Council Regulation (EC) No 1782/2003 as regards the support schemes provided for in Titles IV and IVa of that Regulation and the use of land set aside for the production of raw materials

3

*

Commission Regulation (EC) No 317/2009 of 17 April 2009 replacing Annex I to Council Regulation (EC) No 673/2005 establishing additional customs duties on imports of certain products originating in the United States of America

6

*

Commission Regulation (EC) No 318/2009 of 17 April 2009 amending Regulation (EC) No 1914/2006 laying down detailed rules for applying Council Regulation (EC) No 1405/2006 laying down specific measures for agriculture in favour of the smaller Aegean islands

8

| | | II   Acts adopted under the EC Treaty/Euratom Treaty whose publication is not obligatory |
| --- | --- | --- |
| | | DECISIONS |
| | | European Central Bank |
| | | 2009/328/EC |
| | * | Decision of the European Central Bank of 19 March 2009 amending Decision ECB/2004/2 of 19 February 2004 adopting the Rules of Procedure of the European Central Bank (ECB/2009/5) | 10 |
| | | RECOMMENDATIONS |
| | | Commission |
| | | 2009/329/EC |
| | * | Commission Recommendation of 26 March 2009 on data protection guidelines for the Internal Market Information System (IMI)
  (notified under document number C(2009) 2041)

   (
  1
  ) | 12 |

II   Acts adopted under the EC Treaty/Euratom Treaty whose publication is not obligatory

DECISIONS

European Central Bank

2009/328/EC

*

Decision of the European Central Bank of 19 March 2009 amending Decision ECB/2004/2 of 19 February 2004 adopting the Rules of Procedure of the European Central Bank (ECB/2009/5)

(ECB/2009/5)

10

RECOMMENDATIONS

Commission

2009/329/EC

*

Commission Recommendation of 26 March 2009 on data protection guidelines for the Internal Market Information System (IMI)
  (notified under document number C(2009) 2041)

   (
  1
  )

(notified under document number C(2009) 2041)

1

12

| | |
| --- | --- |
| | (1)   Text with EEA relevance |

---

(1)   Text with EEA relevance

1

| EN | Acts whose titles are printed in light type are those relating to day-to-day management of agricultural matters, and are generally valid for a limited period.
  The titles of all other Acts are printed in bold type and preceded by an asterisk. |
| --- | --- |

EN

Acts whose titles are printed in light type are those relating to day-to-day management of agricultural matters, and are generally valid for a limited period.

The titles of all other Acts are printed in bold type and preceded by an asterisk.

---

I Acts adopted under the EC Treaty/Euratom Treaty whose publication is obligatory

REGULATIONS

| 18.4.2009 | EN | Official Journal of the European Union | L 100/1 |
| --- | --- | --- | --- |

18.4.2009

EN

Official Journal of the European Union

L 100/1

---

COMMISSION REGULATION (EC) No 315/2009

of 17 April 2009

establishing the standard import values for determining the entry price of certain fruit and vegetables

THE COMMISSION OF THE EUROPEAN COMMUNITIES,

Having regard to the Treaty establishing the European Community,

Having regard to Council Regulation (EC) No 1234/2007 of 22 October 2007 establishing a common organisation of agricultural markets and on specific provisions for certain agricultural products (Single CMO Regulation) (1),

Having regard to Commission Regulation (EC) No 1580/2007 of 21 December 2007 laying down implementing rules for Council Regulations (EC) No 2200/96, (EC) No 2201/96 and (EC) No 1182/2007 in the fruit and vegetable sector (2), and in particular Article 138(1) thereof,

Whereas:

Regulation (EC) No 1580/2007 lays down, pursuant to the outcome of the Uruguay Round multilateral trade negotiations, the criteria whereby the Commission fixes the standard values for imports from third countries, in respect of the products and periods stipulated in Annex XV, Part A thereto,

HAS ADOPTED THIS REGULATION:

Article 1

The standard import values referred to in Article 138 of Regulation (EC) No 1580/2007 are fixed in the Annex hereto.

Article 2

This Regulation shall enter into force on 18 April 2009.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 17 April 2009.

For the Commission

Jean-Luc DEMARTY

Director-General for Agriculture and Rural Development

---

(1)  
  OJ L 299, 16.11.2007, p. 1.

1

(2)  
  OJ L 350, 31.12.2007, p. 1.

2

---

ANNEX

Standard import values for determining the entry price of certain fruit and vegetables

| (EUR/100 kg) |
| --- |
| CN code | Third country code (1) | Standard import value |
| 0702 00 00 | JO | 93,2 |
| MA | 80,1 |
| TN | 139,0 |
| TR | 108,7 |
| ZZ | 105,3 |
| 0707 00 05 | JO | 155,5 |
| MA | 55,7 |
| TR | 135,4 |
| ZZ | 115,5 |
| 0709 90 70 | JO | 220,7 |
| MA | 28,1 |
| TR | 104,8 |
| ZZ | 117,9 |
| 0805 10 20 | EG | 43,1 |
| IL | 58,1 |
| MA | 49,6 |
| TN | 64,9 |
| TR | 65,2 |
| ZZ | 56,2 |
| 0805 50 10 | TR | 57,2 |
| ZA | 73,4 |
| ZZ | 65,3 |
| 0808 10 80 | AR | 84,2 |
| BR | 75,3 |
| CA | 124,7 |
| CL | 80,2 |
| CN | 77,8 |
| MK | 22,6 |
| NZ | 111,3 |
| US | 129,3 |
| UY | 58,8 |
| ZA | 84,2 |
| ZZ | 84,8 |
| 0808 20 50 | AR | 74,6 |
| CL | 87,8 |
| CN | 64,3 |
| ZA | 96,7 |
| ZZ | 80,9 |

(EUR/100 kg)

CN code

Third country code (1)

Standard import value

0702 00 00

JO

93,2

MA

80,1

TN

139,0

TR

108,7

ZZ

105,3

0707 00 05

JO

155,5

MA

55,7

TR

135,4

ZZ

115,5

0709 90 70

JO

220,7

MA

28,1

TR

104,8

ZZ

117,9

0805 10 20

EG

43,1

IL

58,1

MA

49,6

TN

64,9

TR

65,2

ZZ

56,2

0805 50 10

TR

57,2

ZA

73,4

ZZ

65,3

0808 10 80

AR

84,2

BR

75,3

CA

124,7

CL

80,2

CN

77,8

MK

22,6

NZ

111,3

US

129,3

UY

58,8

ZA

84,2

ZZ

84,8

0808 20 50

AR

74,6

CL

87,8

CN

64,3

ZA

96,7

ZZ

80,9

---

(1)  Nomenclature of countries laid down by Commission Regulation (EC) No 1833/2006 (OJ L 354, 14.12.2006, p. 19). Code ‘
  ZZ
  ’ stands for ‘of other origin’.

---

| 18.4.2009 | EN | Official Journal of the European Union | L 100/3 |
| --- | --- | --- | --- |

18.4.2009

EN

Official Journal of the European Union

L 100/3

---

COMMISSION REGULATION (EC) No 316/2009

of 17 April 2009

amending Regulation (EC) No 1973/2004 laying down detailed rules for the application of Council Regulation (EC) No 1782/2003 as regards the support schemes provided for in Titles IV and IVa of that Regulation and the use of land set aside for the production of raw materials

THE COMMISSION OF THE EUROPEAN COMMUNITIES,

Having regard to the Treaty establishing the European Community,

Having regard to Council Regulation (EC) No 73/2009 of 19 January 2009 establishing common rules for direct support schemes for farmers under the common agricultural policy and establishing certain support schemes for farmers amending Regulations (EC) No 1290/2005, (EC) No 247/2006, (EC) No 378/2007 and repealing Regulation (EC) No 1782/2003 (1), and in particular Article 142(c) and (e) thereof,

Whereas:

| (1) | Regulation (EC) No 73/2009 has repealed Council Regulation (EC) No 1782/2003 (2) to continue the progressive integration of further sectors into the single payment scheme and the extension of decoupling. As a consequence, certain aid schemes ceased to exist and therefore the correspondent implementing rules in Commission Regulation (EC) No 1973/2004 (3) are no longer needed. |
| --- | --- |

(1)

Regulation (EC) No 73/2009 has repealed Council Regulation (EC) No 1782/2003 (2) to continue the progressive integration of further sectors into the single payment scheme and the extension of decoupling. As a consequence, certain aid schemes ceased to exist and therefore the correspondent implementing rules in Commission Regulation (EC) No 1973/2004 (3) are no longer needed.

| (2) | In mainland France and in Italy new techniques of rice cultivation which requires certain delay in sowing have recently been introduced. Therefore it is appropriate to postpone the deadline for sowing in order to be eligible for crop-specific payment for rice in Italy and France. |
| --- | --- |

(2)

In mainland France and in Italy new techniques of rice cultivation which requires certain delay in sowing have recently been introduced. Therefore it is appropriate to postpone the deadline for sowing in order to be eligible for crop-specific payment for rice in Italy and France.

| (3) | Pursuant to former Article 71 of Regulation (EC) No 1782/2003, Member States might decide to apply the single payment scheme after a transitional period which expired on 31 December 2006 at the latest. As a consequence, certain beef and veal payments laid down in Chapter 12 of that Regulation, that the Member States were allowed to implement only during this transitional period, are no longer applicable. The provisions in Regulation (EC) No 1973/2004 referring to those payments should therefore be deleted. |
| --- | --- |

(3)

Pursuant to former Article 71 of Regulation (EC) No 1782/2003, Member States might decide to apply the single payment scheme after a transitional period which expired on 31 December 2006 at the latest. As a consequence, certain beef and veal payments laid down in Chapter 12 of that Regulation, that the Member States were allowed to implement only during this transitional period, are no longer applicable. The provisions in Regulation (EC) No 1973/2004 referring to those payments should therefore be deleted.

| (4) | From 2009, Commission Regulation (EC) No 796/2004 (4), which lays down detailed rules for the implementation of cross-compliance, modulation and the integrated administration and control system, has been amended to directly apply to the single area payment scheme. The provisions relating to the application of Regulation (EC) No 796/2004 to the single area payment scheme should therefore be deleted from Regulation (EC) No 1973/2004. |
| --- | --- |

(4)

From 2009, Commission Regulation (EC) No 796/2004 (4), which lays down detailed rules for the implementation of cross-compliance, modulation and the integrated administration and control system, has been amended to directly apply to the single area payment scheme. The provisions relating to the application of Regulation (EC) No 796/2004 to the single area payment scheme should therefore be deleted from Regulation (EC) No 1973/2004.

| (5) | Co-financing of the complementary national direct payments is only relevant for Bulgaria and Romania in 2009. Therefore the rules on control and sanctions in case of co-finance should be updated. |
| --- | --- |

(5)

Co-financing of the complementary national direct payments is only relevant for Bulgaria and Romania in 2009. Therefore the rules on control and sanctions in case of co-finance should be updated.

| (6) | The set-aside scheme applies only in the form of voluntary set-aside established in former Article 107 of Regulation (EC) No 1782/2003 for the farmers in Member States applying the arable crops area payment in accordance with Article 66 of that Regulation. For the sake of simplification of the administration of the so-called ‘non-food on set-aside’ scheme established in Chapter 16 of Regulation (EC) No 1973/2004, it is appropriate to exclude from this scheme agricultural land used for the cultivation of products eligible to the arable crops area payment. |
| --- | --- |

(6)

The set-aside scheme applies only in the form of voluntary set-aside established in former Article 107 of Regulation (EC) No 1782/2003 for the farmers in Member States applying the arable crops area payment in accordance with Article 66 of that Regulation. For the sake of simplification of the administration of the so-called ‘non-food on set-aside’ scheme established in Chapter 16 of Regulation (EC) No 1973/2004, it is appropriate to exclude from this scheme agricultural land used for the cultivation of products eligible to the arable crops area payment.

| (7) | Article 103 of Regulation (EC) No 1973/2004 provides that the average milk yield to be used for determining the number of eligible suckler cows in application of Article 111(2) of Regulation (EC) No 73/2009 shall be calculated on the basis of the average yields set out in Annex XVI of Regulation (EC) No 1973/2004. That Annex fixes the average milk yield for Spain at 4 650 kilograms. Spain has requested the updating of that average milk yield. In the light of evolution of the milk sector in Spain, which has experienced a continuous increase of the yields of the dairy herd resulting from a restructuring process affecting both the number and the size of the holdings, it is appropriate to update that Annex. |
| --- | --- |

(7)

Article 103 of Regulation (EC) No 1973/2004 provides that the average milk yield to be used for determining the number of eligible suckler cows in application of Article 111(2) of Regulation (EC) No 73/2009 shall be calculated on the basis of the average yields set out in Annex XVI of Regulation (EC) No 1973/2004. That Annex fixes the average milk yield for Spain at 4 650 kilograms. Spain has requested the updating of that average milk yield. In the light of evolution of the milk sector in Spain, which has experienced a continuous increase of the yields of the dairy herd resulting from a restructuring process affecting both the number and the size of the holdings, it is appropriate to update that Annex.

| (8) | Commission Decision C(2004) 1439 of 29 April 2004 has been amended to set the agricultural area under the single area payment scheme in the Slovak Republic from 2009 at 1 880 thousand hectares. That amount needs to be reflected in Annex XXI of Regulation (EC) No 1973/2004. |
| --- | --- |

(8)

Commission Decision C(2004) 1439 of 29 April 2004 has been amended to set the agricultural area under the single area payment scheme in the Slovak Republic from 2009 at 1 880 thousand hectares. That amount needs to be reflected in Annex XXI of Regulation (EC) No 1973/2004.

| (9) | Regulation (EC) No 1973/2004 should therefore be amended accordingly. |
| --- | --- |

(9)

Regulation (EC) No 1973/2004 should therefore be amended accordingly.

| (10) | The measures provided for in this Regulation are in accordance with the opinion of the Management Committee for Direct Payments, |
| --- | --- |

(10)

The measures provided for in this Regulation are in accordance with the opinion of the Management Committee for Direct Payments,

HAS ADOPTED THIS REGULATION:

Article 1

Regulation (EC) No 1973/2004 is amended as follows:

| 1. | in Article 1, point ‘(h)’ is deleted; |
| --- | --- |

1.

in Article 1, point ‘(h)’ is deleted;

| 2. | Article 2 is amended as follows:






  (a) | in the first and in the second subparagraphs of paragraph 1, the references to Article 1(h) are deleted; |
| --- | --- | --- |

2.

Article 2 is amended as follows:

(a)

in the first and in the second subparagraphs of paragraph 1, the references to Article 1(h) are deleted;

| (b) | in the first subparagraph of paragraph 2, the reference to Article 1(h) is deleted; |
| --- | --- |

(b)

in the first subparagraph of paragraph 2, the reference to Article 1(h) is deleted;

| 3. | in Article 4, the reference to Article 98 of Regulation (EC) No 1782/2003 is deleted; |
| --- | --- |

3.

in Article 4, the reference to Article 98 of Regulation (EC) No 1782/2003 is deleted;

| 4. | Article 12 is replaced by the following:

  ‘Article 12
  Dates for sowing
  To be eligible for the crop-specific payment for rice, the declared area shall be sown at the latest:






  (a) | on 30 June preceding the harvest in question, for Spain, France, Italy and Portugal; |
| --- | --- | --- |

4.

Article 12 is replaced by the following:

‘Article 12

Dates for sowing

To be eligible for the crop-specific payment for rice, the declared area shall be sown at the latest:

(a)

on 30 June preceding the harvest in question, for Spain, France, Italy and Portugal;

| (b) | on 31 May for the other producing Member States referred to in Article 80(2) of Regulation (EC) No 1782/2003.’; |
| --- | --- |

(b)

on 31 May for the other producing Member States referred to in Article 80(2) of Regulation (EC) No 1782/2003.’;

| 5. | Chapter 9 ‘Specific regional aid for arable crops’ is deleted; |
| --- | --- |

5.

Chapter 9 ‘Specific regional aid for arable crops’ is deleted;

| 6. | in Chapter 13, the Section 2 ‘Deseasonalisation premium’ (Articles 96, 97 and 98), the Article 117, the Subsection 2 ‘Extensification payment scheme’ of Section 4 (Articles 118 to 119), the Section 6 ‘Additional payments’ (Article 125) and the Article 133 are deleted; |
| --- | --- |

6.

in Chapter 13, the Section 2 ‘Deseasonalisation premium’ (Articles 96, 97 and 98), the Article 117, the Subsection 2 ‘Extensification payment scheme’ of Section 4 (Articles 118 to 119), the Section 6 ‘Additional payments’ (Article 125) and the Article 133 are deleted;

| 7. | Article 126 is amended as follows:






  (a) | paragraph 1 is amended as follows:






  (i) | the third subparagraph is deleted; |
| --- | --- | --- | --- |

7.

Article 126 is amended as follows:

(a)

paragraph 1 is amended as follows:

(i)

the third subparagraph is deleted;

| (ii) | the fourth subparagraph is replaced by the following:
  ‘The advance may not be paid before 16 October of the calendar year in respect of which the premium is applied for.’; |
| --- | --- |

(ii)

the fourth subparagraph is replaced by the following:

‘The advance may not be paid before 16 October of the calendar year in respect of which the premium is applied for.’;

| (b) | paragraph 2 is replaced by the following:

  ‘2.   The definitive payment of the premium shall be an amount equal to the difference between the advance payment and the amount of the premium to which the farmer is entitled.’; |
| --- | --- |

(b)

paragraph 2 is replaced by the following:

‘2.   The definitive payment of the premium shall be an amount equal to the difference between the advance payment and the amount of the premium to which the farmer is entitled.’;

| 8. | in Article 127(1), the first subparagraph is replaced by the following:
  ‘The date of submission of the application shall constitute the operative event for determining the year to which animals covered by the special premium and suckler cow premium schemes are allocated and the number of LUs to be used for calculating the stocking density.’; |
| --- | --- |

8.

in Article 127(1), the first subparagraph is replaced by the following:

‘The date of submission of the application shall constitute the operative event for determining the year to which animals covered by the special premium and suckler cow premium schemes are allocated and the number of LUs to be used for calculating the stocking density.’;

| 9. | Article 130 is replaced by the following:

  ‘Article 130
  Determination of the individual quota for milk
  Up to the end of the seventh period laid down in Article 66 of Council Regulation (EC) No 1234/2007 (*1), by way of derogation from Article 102(1)(a) of this Regulation, a Member State may decide that in the case of milk farmers who release or take over all or part of individual reference quantities with effect on 31 March or 1 April respectively in accordance with Article 65(i) and (k) of Regulation (EC) No 1234/2007 or pursuant to national provisions adopted for the implementation of Articles 73, 74 and 75 of that Regulation, the maximum individual reference quantity of milk available to qualify for the suckler cow premium and the maximum number of suckler cows shall be determined on 1 April.


  (*1)  
  OJ L 299, 16.11.2007, p. 1.’;" |
| --- | --- |

9.

Article 130 is replaced by the following:

‘Article 130

Determination of the individual quota for milk

Up to the end of the seventh period laid down in Article 66 of Council Regulation (EC) No 1234/2007 (*1), by way of derogation from Article 102(1)(a) of this Regulation, a Member State may decide that in the case of milk farmers who release or take over all or part of individual reference quantities with effect on 31 March or 1 April respectively in accordance with Article 65(i) and (k) of Regulation (EC) No 1234/2007 or pursuant to national provisions adopted for the implementation of Articles 73, 74 and 75 of that Regulation, the maximum individual reference quantity of milk available to qualify for the suckler cow premium and the maximum number of suckler cows shall be determined on 1 April.

(*1)  
  OJ L 299, 16.11.2007, p. 1.’;"

*1

| 10. | in Article 131, paragraph 6 is deleted; |
| --- | --- |

10.

in Article 131, paragraph 6 is deleted;

| 11. | in Chapter 14, Articles 136, 137 and 138 are deleted; |
| --- | --- |

11.

in Chapter 14, Articles 136, 137 and 138 are deleted;

| 12. | in Article 140, paragraph 1 is replaced by the following:

  ‘1.   For 2009, Regulation (EC) No 796/2004 shall apply to the complementary national direct payment co-financed in Bulgaria and Romania in accordance with Section I point E of Annex VIII to the Act of Accession of Bulgaria and Romania.’; |
| --- | --- |

12.

in Article 140, paragraph 1 is replaced by the following:

‘1.   For 2009, Regulation (EC) No 796/2004 shall apply to the complementary national direct payment co-financed in Bulgaria and Romania in accordance with Section I point E of Annex VIII to the Act of Accession of Bulgaria and Romania.’;

| 13. | in Article 143, paragraph 1 is replaced by the following:

  ‘1.   Land set aside in the context of Article 107 of Regulation (EC) No 1782/2003 may be used, in accordance with the first indent of Article 107(3) thereof, for producing raw materials for the manufacture within the Community of products not primarily intended for human or animal consumption, under the conditions laid down in this Chapter.’; |
| --- | --- |

13.

in Article 143, paragraph 1 is replaced by the following:

‘1.   Land set aside in the context of Article 107 of Regulation (EC) No 1782/2003 may be used, in accordance with the first indent of Article 107(3) thereof, for producing raw materials for the manufacture within the Community of products not primarily intended for human or animal consumption, under the conditions laid down in this Chapter.’;

| 14. | in Article 145(1), the first subparagraph is replaced by the following:
  ‘Any agricultural raw material, excepted arable crops listed in Annex IX to Regulation (EC) No 1782/2003, may be grown on the areas set aside pursuant to the first indent of Article 107(3) of that Regulation.’; |
| --- | --- |

14.

in Article 145(1), the first subparagraph is replaced by the following:

‘Any agricultural raw material, excepted arable crops listed in Annex IX to Regulation (EC) No 1782/2003, may be grown on the areas set aside pursuant to the first indent of Article 107(3) of that Regulation.’;

| 15. | in Article 146(1)(a), the introductory words are replaced by the following:

  ‘use defined agricultural raw materials, with exception of arable crops listed in Annex IX to Regulation (EC) No 1782/2003, providing that all appropriate control measures are complied with:’; |
| --- | --- |

15.

in Article 146(1)(a), the introductory words are replaced by the following:

‘use defined agricultural raw materials, with exception of arable crops listed in Annex IX to Regulation (EC) No 1782/2003, providing that all appropriate control measures are complied with:’;

| 16. | in Article 147, paragraph 5 is deleted; |
| --- | --- |

16.

in Article 147, paragraph 5 is deleted;

| 17. | Article 149 is deleted; |
| --- | --- |

17.

Article 149 is deleted;

| 18. | in Article 158, paragraph 4 is replaced by the following:

  ‘4.   A percentage of the security shall be released for each raw material on condition that the competent authority of the collector or first processor concerned is in possession of proof that the quantity of raw material in question has been processed in accordance with the uses referred to in Article 147(2)(f), account being taken, where necessary, of any changes pursuant to Article 152.’; |
| --- | --- |

18.

in Article 158, paragraph 4 is replaced by the following:

‘4.   A percentage of the security shall be released for each raw material on condition that the competent authority of the collector or first processor concerned is in possession of proof that the quantity of raw material in question has been processed in accordance with the uses referred to in Article 147(2)(f), account being taken, where necessary, of any changes pursuant to Article 152.’;

| 19. | in Article 159, paragraph 1 is replaced by the following:

  ‘1.   The obligation to process the quantities of raw materials principally into the end products specified in the contract and that the raw materials shall be processed by 31 July of the second year following that of harvest shall constitute primary requirements within the meaning of Article 20 of Regulation (EEC) No 2220/85.’; |
| --- | --- |

19.

in Article 159, paragraph 1 is replaced by the following:

‘1.   The obligation to process the quantities of raw materials principally into the end products specified in the contract and that the raw materials shall be processed by 31 July of the second year following that of harvest shall constitute primary requirements within the meaning of Article 20 of Regulation (EEC) No 2220/85.’;

| 20. | in Annex XVI, the figure for Spain is replaced by ‘6 500’; |
| --- | --- |

20.

in Annex XVI, the figure for Spain is replaced by ‘6 500’;

| 21. | in Annex XVIII, points 2 ‘Deseasonalisation premium’, 4 ‘Extensification payment’ and 5 ‘Premium exempt from the density factor’ are deleted; |
| --- | --- |

21.

in Annex XVIII, points 2 ‘Deseasonalisation premium’, 4 ‘Extensification payment’ and 5 ‘Premium exempt from the density factor’ are deleted;

| 22. | in Annex XXI, the figure referred to agricultural area under single area payment scheme for Slovakia is replaced by ‘1 880’. |
| --- | --- |

22.

in Annex XXI, the figure referred to agricultural area under single area payment scheme for Slovakia is replaced by ‘1 880’.

Article 2

This Regulation shall enter into force on the third day following its publication in the Official Journal of the European Union.

It shall apply to aid applications relating to years starting from 1 January 2009.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 17 April 2009.

For the Commission

Mariann FISCHER BOEL

Member of the Commission

---

(1)  
  OJ L 30, 31.1.2009, p. 16.

1

(2)  
  OJ L 270, 21.10.2003, p. 1.

2

(3)  
  OJ L 345, 20.11.2004, p. 1.

3

(4)  
  OJ L 141, 30.4.2004, p. 18.

4

---

| 18.4.2009 | EN | Official Journal of the European Union | L 100/6 |
| --- | --- | --- | --- |

18.4.2009

EN

Official Journal of the European Union

L 100/6

---

COMMISSION REGULATION (EC) No 317/2009

of 17 April 2009

replacing Annex I to Council Regulation (EC) No 673/2005 establishing additional customs duties on imports of certain products originating in the United States of America

THE COMMISSION OF THE EUROPEAN COMMUNITIES,

Having regard to the Treaty establishing the European Community,

Having regard to Council Regulation (EC) No 673/2005 of 25 April 2005 establishing additional customs duties on imports of certain products originating in the United States of America (1), and in particular Article 3 thereof,

Whereas:

| (1) | As a result of the United States failure to bring the Continued Dumping and Subsidy Offset Act (CDSOA) in compliance with its obligations under the WTO agreements, Regulation (EC) No 673/2005 imposed a 15 % ad valorem additional customs duty on imports of certain products originating in the United States of America as from 1 May 2005. In conformity with the WTO authorisation to suspend the application of concessions to the United States, the Commission shall adjust the level of suspension annually to the level of nullification or impairment caused by the CDSOA to the Community at that time. |
| --- | --- |

(1)

As a result of the United States failure to bring the Continued Dumping and Subsidy Offset Act (CDSOA) in compliance with its obligations under the WTO agreements, Regulation (EC) No 673/2005 imposed a 15 % ad valorem additional customs duty on imports of certain products originating in the United States of America as from 1 May 2005. In conformity with the WTO authorisation to suspend the application of concessions to the United States, the Commission shall adjust the level of suspension annually to the level of nullification or impairment caused by the CDSOA to the Community at that time.

| (2) | The CDSOA disbursements for the most recent year for which data are available relate to the distribution of anti-dumping and countervailing duties collected during the Fiscal Year 2008 (1 October 2007 – 30 September 2008). On the basis of the data published by the United States Customs and Border Protection, the level of nullification or impairment caused to the Community is calculated at USD 16,31 million. |
| --- | --- |

(2)

The CDSOA disbursements for the most recent year for which data are available relate to the distribution of anti-dumping and countervailing duties collected during the Fiscal Year 2008 (1 October 2007 – 30 September 2008). On the basis of the data published by the United States Customs and Border Protection, the level of nullification or impairment caused to the Community is calculated at USD 16,31 million.

| (3) | Since the level of nullification or impairment and consequently of suspension has decreased, the products of Annex II to Regulation (EC) No 673/2005 which were added in 2006 and 2007 to the list in Annex I to Regulation (EC) No 673/2005 should be removed first from the list in Annex I to that Regulation. Four products of Annex I to Regulation (EC) No 673/2005 should then be withdrawn from Annex I to that Regulation following the order of that list. |
| --- | --- |

(3)

Since the level of nullification or impairment and consequently of suspension has decreased, the products of Annex II to Regulation (EC) No 673/2005 which were added in 2006 and 2007 to the list in Annex I to Regulation (EC) No 673/2005 should be removed first from the list in Annex I to that Regulation. Four products of Annex I to Regulation (EC) No 673/2005 should then be withdrawn from Annex I to that Regulation following the order of that list.

| (4) | The effect of a 15 % ad valorem additional import duty on imports from the United States of the products in the amended Annex I represents, over one year, a value of trade that does not exceed USD 16,31 million. |
| --- | --- |

(4)

The effect of a 15 % ad valorem additional import duty on imports from the United States of the products in the amended Annex I represents, over one year, a value of trade that does not exceed USD 16,31 million.

| (5) | To make sure that there are no delays in the customs clearance of goods removed from the scope of the 15 % ad valorem additional import duty, this Regulation should enter into force on the day of its publication. |
| --- | --- |

(5)

To make sure that there are no delays in the customs clearance of goods removed from the scope of the 15 % ad valorem additional import duty, this Regulation should enter into force on the day of its publication.

| (6) | The measures provided for in this Regulation are in accordance with the opinion of the Committee on trade retaliation, |
| --- | --- |

(6)

The measures provided for in this Regulation are in accordance with the opinion of the Committee on trade retaliation,

HAS ADOPTED THIS REGULATION:

Article 1

Annex I to Regulation (EC) No 673/2005 is replaced by the text of the Annex to this Regulation.

Article 2

This Regulation shall enter into force on the day of its publication in the Official Journal of the European Union.

It shall apply from 1 May 2009.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 17 April 2009.

For the Commission

Catherine ASHTON

Member of the Commission

---

(1)  
  OJ L 110, 30.4.2005, p. 1.

1

---

ANNEX

‘ANNEX I

The products on which additional duties are to apply are identified by their eight-digit CN codes. The description of products classified under these codes can be found in Annex I to Council Regulation (EEC) No 2658/87 of 23 July 1987 on the tariff and statistical nomenclature and on the Common Customs Tariff (1) as amended by Regulation (EC) No 493/2005 (2).

4820 10 50

6204 63 11

6204 69 18

6204 63 90

6104 63 00

6203 43 11

6103 43 00

6204 63 18

6203 43 19

6204 69 90

6203 43 90

0710 40 00

9003 19 30

8705 10 00

---

(1)  
  OJ L 256, 7.9.1987, p. 1.

1

(2)  
  OJ L 82, 31.3.2005, p. 1.’

2

---

| 18.4.2009 | EN | Official Journal of the European Union | L 100/8 |
| --- | --- | --- | --- |

18.4.2009

EN

Official Journal of the European Union

L 100/8

---

COMMISSION REGULATION (EC) No 318/2009

of 17 April 2009

amending Regulation (EC) No 1914/2006 laying down detailed rules for applying Council Regulation (EC) No 1405/2006 laying down specific measures for agriculture in favour of the smaller Aegean islands

THE COMMISSION OF THE EUROPEAN COMMUNITIES,

Having regard to the Treaty establishing the European Community,

Having regard to Council Regulation (EC) No 1405/2006 of 18 September 2006 laying down specific measures for agriculture in favour of the smaller Aegean islands and amending Regulation (EC) No 1782/2003 (1), and in particular Article 14 thereof,

Whereas:

| (1) | In the light of the experience gained from the application of Article 34 of Commission Regulation (EC) No 1914/2006 (2), the procedures for amending the programme which are laid down in that Article should be clarified. The final date for submission of annual requests to amend the programme should be brought forward in order to prevent approval decisions from being adopted late. In accordance with budgetary rules, the approved amendments must be implemented as from 1 January of the year following the request for amendment. Moreover, further clarification is required of certain rules for minor amendments to be notified to the Commission for information purposes only. |
| --- | --- |

(1)

In the light of the experience gained from the application of Article 34 of Commission Regulation (EC) No 1914/2006 (2), the procedures for amending the programme which are laid down in that Article should be clarified. The final date for submission of annual requests to amend the programme should be brought forward in order to prevent approval decisions from being adopted late. In accordance with budgetary rules, the approved amendments must be implemented as from 1 January of the year following the request for amendment. Moreover, further clarification is required of certain rules for minor amendments to be notified to the Commission for information purposes only.

| (2) | Regulation (EC) No 1914/2006 should therefore be amended accordingly. |
| --- | --- |

(2)

Regulation (EC) No 1914/2006 should therefore be amended accordingly.

| (3) | The measures provided for in this Regulation are in accordance with the opinion of the Management Committee for Direct Payments, |
| --- | --- |

(3)

The measures provided for in this Regulation are in accordance with the opinion of the Management Committee for Direct Payments,

HAS ADOPTED THIS REGULATION:

Article 1

Article 34 of Regulation (EC) No 1914/2006 shall be replaced by the following:

‘Article 34

Amendments to the programme

1.   Amendments to the programme approved under Article 13(2) of Regulation (EC) No 1405/2006 shall be submitted to the Commission for approval and shall be duly substantiated, in particular giving the following information:

| (a) | the reasons and any implementation problem justifying amendment of the programme; |
| --- | --- |

(a)

the reasons and any implementation problem justifying amendment of the programme;

| (b) | the expected effects of the amendment; |
| --- | --- |

(b)

the expected effects of the amendment;

| (c) | the implications for financing and verification of commitments. |
| --- | --- |

(c)

the implications for financing and verification of commitments.

Except in cases of force majeure or exceptional circumstances, Greece shall submit requests for amendments to the programme not more than once per calendar year and per programme. Such requests for amendment must be received by the Commission no later than 1 August of each year.

If the Commission raises no objections to the amendments requested, Greece shall apply those amendments from 1 January of the year following the request for amendment.

Such amendments may apply earlier if the Commission confirms in writing to Greece before the date referred to in the third subparagraph that the notified amendments comply with Community legislation.

If the notified amendment does not comply with Community legislation, the Commission shall inform Greece thereof and the amendment shall not apply until the Commission receives an amendment that can be declared as compliant.

2.   By way of derogation from paragraph 1, for the following amendments, the Commission shall evaluate the proposals of Greece and decide on their approval within four months of their submission at the latest in accordance with the procedure referred to in Article 13(2) of Regulation (EC) No 1405/2006:

| (a) | the introduction of new measures, actions, products or aid schemes into the programme; and |
| --- | --- |

(a)

the introduction of new measures, actions, products or aid schemes into the programme; and

| (b) | the increase of the unit level of support already approved for each existing measure, action, product or aid scheme by more than 50 % of the amount applicable at the time when the request for amendment is presented. |
| --- | --- |

(b)

the increase of the unit level of support already approved for each existing measure, action, product or aid scheme by more than 50 % of the amount applicable at the time when the request for amendment is presented.

The amendments thus approved shall apply from 1 January of the year following that in which they were notified.

3.   Greece shall be authorised to make the following amendments without recourse to the procedure set out in paragraph 1 provided that they are notified to the Commission:

| (a) | as regards the forecast supply balances, changes in the quantities of the products concerned covered by the supply arrangements and, consequently, the global amount of aid allocated to support each line of products; |
| --- | --- |

(a)

as regards the forecast supply balances, changes in the quantities of the products concerned covered by the supply arrangements and, consequently, the global amount of aid allocated to support each line of products;

| (b) | as regards support for local production, adjustments up to 20 % of the financial allocation for each individual measure; and |
| --- | --- |

(b)

as regards support for local production, adjustments up to 20 % of the financial allocation for each individual measure; and

| (c) | amendments following amendments to codes and descriptions laid down in Council Regulation (EEC) No 2658/87 (*1) used to identify the products benefiting from aid, as long as those amendments do not entail a change of the products themselves. |
| --- | --- |

(c)

amendments following amendments to codes and descriptions laid down in Council Regulation (EEC) No 2658/87 (*1) used to identify the products benefiting from aid, as long as those amendments do not entail a change of the products themselves.

The amendments referred to in subparagraph 1 shall not apply before the date on which they are received by the Commission. They shall be duly explained and justified and can only be implemented once per year except in the following cases:

| (a) | force majeure or exceptional circumstances, |
| --- | --- |

(a)

force majeure or exceptional circumstances,

| (b) | amendment of the quantities of products covered by the supply arrangements, |
| --- | --- |

(b)

amendment of the quantities of products covered by the supply arrangements,

| (c) | amendment of the statistical nomenclature and of the Common Customs Tariff codes as provided for in Regulation (EEC) No 2658/87, |
| --- | --- |

(c)

amendment of the statistical nomenclature and of the Common Customs Tariff codes as provided for in Regulation (EEC) No 2658/87,

| (d) | budget transfers within production support measures. These amendments shall, however, be notified no later than 30 April of the year following the calendar year to which the amended financial allocation refers. |
| --- | --- |

(d)

budget transfers within production support measures. These amendments shall, however, be notified no later than 30 April of the year following the calendar year to which the amended financial allocation refers.

Article 2

This Regulation shall enter into force on the third day following its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 17 April 2009.

For the Commission

Mariann FISCHER BOEL

Member of the Commission

---

(1)  
  OJ L 265, 26.9.2006, p. 1.

1

(2)  
  OJ L 365, 21.12.2006, p. 64.

2

---

II Acts adopted under the EC Treaty/Euratom Treaty whose publication is not obligatory

DECISIONS

European Central Bank

| 18.4.2009 | EN | Official Journal of the European Union | L 100/10 |
| --- | --- | --- | --- |

18.4.2009

EN

Official Journal of the European Union

L 100/10

---

DECISION OF THE EUROPEAN CENTRAL BANK

of 19 March 2009

amending Decision ECB/2004/2 of 19 February 2004 adopting the Rules of Procedure of the European Central Bank

(ECB/2009/5)

(2009/328/EC)

THE GOVERNING COUNCIL OF THE EUROPEAN CENTRAL BANK,

Having regard to the Statute of the European System of Central Banks and of the European Central Bank (hereinafter the Statute of the ESCB), and in particular Article 10.2 and Article 12.3 thereof,

Whereas:

| (1) | Upon adoption of the euro by Slovakia the number of members of the Governing Council of the European Central Bank (ECB) exceeds 21. Article 10.2 of the Statute of the ESCB provides that as from the date on which the number of members of the Governing Council exceeds 21, each member of the Executive Board will have one vote and the number of governors with a voting right will be 15. It also specifies the rules on the rotation of the voting rights. Under the sixth indent of Article 10.2, the Governing Council, acting by a two-thirds majority of all its members, may decide to postpone the start of the rotation system until the date on which the number of governors exceeds 18. In December 2008 the Governing Council decided to postpone the start of the rotation system until such a date (1). |
| --- | --- |

(1)

Upon adoption of the euro by Slovakia the number of members of the Governing Council of the European Central Bank (ECB) exceeds 21. Article 10.2 of the Statute of the ESCB provides that as from the date on which the number of members of the Governing Council exceeds 21, each member of the Executive Board will have one vote and the number of governors with a voting right will be 15. It also specifies the rules on the rotation of the voting rights. Under the sixth indent of Article 10.2, the Governing Council, acting by a two-thirds majority of all its members, may decide to postpone the start of the rotation system until the date on which the number of governors exceeds 18. In December 2008 the Governing Council decided to postpone the start of the rotation system until such a date (1).

| (2) | Under the sixth indent of Article 10.2 of the Statute of the ESCB, the Governing Council, acting by a two-thirds majority of all its members, has to take all measures necessary for the implementation of the rotation system. These measures cover: (i) the rotation rate: the number of governors losing or gaining voting rights at the same time; (ii) the rotation period: the length of the period during which the composition of voting governors does not change; (iii) how governors will be ordered within their groups; and (iv) the transition from a two to a three-group system. The Governing Council has decided to take such measures, which require amendment of Decision ECB/2004/2 of 19 February 2004 adopting the Rules of Procedure of the European Central Bank (2), to be applied as from the date on which the number of governors exceeds 18. |
| --- | --- |

(2)

Under the sixth indent of Article 10.2 of the Statute of the ESCB, the Governing Council, acting by a two-thirds majority of all its members, has to take all measures necessary for the implementation of the rotation system. These measures cover: (i) the rotation rate: the number of governors losing or gaining voting rights at the same time; (ii) the rotation period: the length of the period during which the composition of voting governors does not change; (iii) how governors will be ordered within their groups; and (iv) the transition from a two to a three-group system. The Governing Council has decided to take such measures, which require amendment of Decision ECB/2004/2 of 19 February 2004 adopting the Rules of Procedure of the European Central Bank (2), to be applied as from the date on which the number of governors exceeds 18.

| (3) | The implementation of the rotation system respects the principles of equal treatment of governors, transparency and simplicity, |
| --- | --- |

(3)

The implementation of the rotation system respects the principles of equal treatment of governors, transparency and simplicity,

HAS DECIDED AS FOLLOWS:

Article 1

Amendments to the Rules of Procedure of the European Central Bank

Decision ECB/2004/2 is amended as follows:

| 1. | The following Article 3a is inserted:

  ‘Article 3a
  Rotation system

  1.   Governors shall be allocated to groups as set out in the first and second indents of Article 10.2 of the Statute.


  2.   Governors shall be ordered in each group, following EU convention, in accordance with a list of their national central banks which follows the alphabetical order of the names of the Member States in the national languages. The rotation of voting rights within each group shall follow this order. The rotation shall start at a random point in the list.


  3.   The voting rights within each group shall rotate every month, starting on the first day of the first month of the implementation of the rotation system.


  4.   For the first group, the number of voting rights that rotate in each one month period shall be one; for the second and third groups, the number of voting rights that rotate in each one month period shall be equal to the difference between the number of governors allocated to the group and the number of voting rights assigned to it, minus two.


  5.   Whenever the composition of the groups is adjusted in accordance with the fifth indent of Article 10.2 of the Statute, the rotation of voting rights within each group shall continue to follow the list referred to in paragraph 2. From the date on which the number of governors reaches 22, the rotation within the third group shall start at a random point in the list. The Governing Council may decide to change the order of rotation for the second and third groups to avoid the situation that certain governors are always without a voting right at the same periods of the year.


  6.   The ECB shall publish in advance a list of the members of the Governing Council with a voting right on the ECB’s website.


  7.   The share of each national central bank’s Member State in the total aggregated balance sheet of the monetary financial institutions shall be calculated on the basis of the annual average of monthly average data over the most recent calendar year for which data are available. Whenever the aggregate gross domestic product at market prices is adjusted in accordance with Article 29.3 of the Statute or whenever a country becomes a Member State and its national central bank becomes part of the European System of Central Banks, the total aggregated balance sheet of the monetary financial institutions of the Member States which have adopted the euro shall be recalculated on the basis of the data relating to the most recent calendar year for which data are available.’ |
| --- | --- |

1.

The following Article 3a is inserted:

‘Article 3a

Rotation system

1.   Governors shall be allocated to groups as set out in the first and second indents of Article 10.2 of the Statute.

2.   Governors shall be ordered in each group, following EU convention, in accordance with a list of their national central banks which follows the alphabetical order of the names of the Member States in the national languages. The rotation of voting rights within each group shall follow this order. The rotation shall start at a random point in the list.

3.   The voting rights within each group shall rotate every month, starting on the first day of the first month of the implementation of the rotation system.

4.   For the first group, the number of voting rights that rotate in each one month period shall be one; for the second and third groups, the number of voting rights that rotate in each one month period shall be equal to the difference between the number of governors allocated to the group and the number of voting rights assigned to it, minus two.

5.   Whenever the composition of the groups is adjusted in accordance with the fifth indent of Article 10.2 of the Statute, the rotation of voting rights within each group shall continue to follow the list referred to in paragraph 2. From the date on which the number of governors reaches 22, the rotation within the third group shall start at a random point in the list. The Governing Council may decide to change the order of rotation for the second and third groups to avoid the situation that certain governors are always without a voting right at the same periods of the year.

6.   The ECB shall publish in advance a list of the members of the Governing Council with a voting right on the ECB’s website.

7.   The share of each national central bank’s Member State in the total aggregated balance sheet of the monetary financial institutions shall be calculated on the basis of the annual average of monthly average data over the most recent calendar year for which data are available. Whenever the aggregate gross domestic product at market prices is adjusted in accordance with Article 29.3 of the Statute or whenever a country becomes a Member State and its national central bank becomes part of the European System of Central Banks, the total aggregated balance sheet of the monetary financial institutions of the Member States which have adopted the euro shall be recalculated on the basis of the data relating to the most recent calendar year for which data are available.’

| 2. | The first sentence of Article 4.1 is replaced by the following:

  ‘In order for the Governing Council to vote, there shall be a quorum of two-thirds of the members with a voting right.’ |
| --- | --- |

2.

The first sentence of Article 4.1 is replaced by the following:

‘In order for the Governing Council to vote, there shall be a quorum of two-thirds of the members with a voting right.’

| 3. | The following sentence is added to Article 4.7:

  ‘Decisions to be taken by written procedure shall be approved by the members of the Governing Council with a voting right at the time of approval.’ |
| --- | --- |

3.

The following sentence is added to Article 4.7:

‘Decisions to be taken by written procedure shall be approved by the members of the Governing Council with a voting right at the time of approval.’

| 4. | The fourth sentence of Article 5.1 is replaced by the following:

  ‘An item shall be removed from the agenda at the request of at least three of the members of the Governing Council with a voting right if the related documents were not submitted to the members of the Governing Council in due time.’ |
| --- | --- |

4.

The fourth sentence of Article 5.1 is replaced by the following:

‘An item shall be removed from the agenda at the request of at least three of the members of the Governing Council with a voting right if the related documents were not submitted to the members of the Governing Council in due time.’

| 5. | Article 5.2 is replaced by the following:
  ‘The minutes of the proceedings of the Governing Council shall be approved at the subsequent meeting (or if necessary earlier by written procedure) by the members of the Governing Council who had a voting right at the meeting to which the minutes refer and shall be signed by the President.’ |
| --- | --- |

5.

Article 5.2 is replaced by the following:

‘The minutes of the proceedings of the Governing Council shall be approved at the subsequent meeting (or if necessary earlier by written procedure) by the members of the Governing Council who had a voting right at the meeting to which the minutes refer and shall be signed by the President.’

Article 2

Final provision

This Decision shall enter into force on the day when the number of governors in the Governing Council of the ECB exceeds 18.

Done at Frankfurt am Main, 19 March 2009.

The President of the ECB

Jean-Claude TRICHET

---

(1)  Decision ECB/2008/29 of 18 December 2008 to postpone the start of the rotation system in the Governing Council of the European Central Bank (OJ L 3, 7.1.2009, p. 4).

1

(2)  
  OJ L 80, 18.3.2004, p. 33.

2

---

RECOMMENDATIONS

Commission

| 18.4.2009 | EN | Official Journal of the European Union | L 100/12 |
| --- | --- | --- | --- |

18.4.2009

EN

Official Journal of the European Union

L 100/12

---

COMMISSION RECOMMENDATION

of 26 March 2009

on data protection guidelines for the Internal Market Information System (IMI)

(notified under document number C(2009) 2041)

(Text with EEA relevance)

(2009/329/EC)

THE COMMISSION OF THE EUROPEAN COMMUNITIES,

Having regard to the Treaty establishing the European Community, and in particular Article 211, second indent, thereof,

After consulting the European Data Protection Supervisor,

Whereas:

| (1) | Decision 2004/387/EC of the European Parliament and of the Council of 21 April 2004 on the interoperable delivery of pan-European eGovernment services to public administrations, businesses and citizens (IDABC) (1), and in particular Article 4 thereof, provides for the implementation of projects of common interest, in order to enable the efficient, effective and secure interchange of information between public administrations at all appropriate levels, as well as between such administrations and the Community institutions or other entities as appropriate. |
| --- | --- |

(1)

Decision 2004/387/EC of the European Parliament and of the Council of 21 April 2004 on the interoperable delivery of pan-European eGovernment services to public administrations, businesses and citizens (IDABC) (1), and in particular Article 4 thereof, provides for the implementation of projects of common interest, in order to enable the efficient, effective and secure interchange of information between public administrations at all appropriate levels, as well as between such administrations and the Community institutions or other entities as appropriate.

| (2) | On 17 March 2006, Member States representatives in the Internal Market Advisory Committee (2) approved the Global Implementation Plan for the Internal Market Information System, hereinafter ‘IMI’, and its development aimed at improving communication among Member State administrations. |
| --- | --- |

(2)

On 17 March 2006, Member States representatives in the Internal Market Advisory Committee (2) approved the Global Implementation Plan for the Internal Market Information System, hereinafter ‘IMI’, and its development aimed at improving communication among Member State administrations.

| (3) | Further to this approval, the Commission decided on the financing and setting up of the Internal Market Information System as a project of common interest in Decisions C(2006) 3606 of 14 August 2006, C(2007) 3514 of 25 July 2007 and C(2008) 1881 of 14 May 2008. |
| --- | --- |

(3)

Further to this approval, the Commission decided on the financing and setting up of the Internal Market Information System as a project of common interest in Decisions C(2006) 3606 of 14 August 2006, C(2007) 3514 of 25 July 2007 and C(2008) 1881 of 14 May 2008.

| (4) | The aim of IMI is to give support to relevant Community acts that require the exchange of information between Member States administrations, including Directive 2005/36/EC of the European Parliament and of the Council of 7 September 2005 on the recognition of professional qualifications (3) and Directive 2006/123/EC of the European Parliament and of the Council of 12 December 2006 on services in the internal market (4). |
| --- | --- |

(4)

The aim of IMI is to give support to relevant Community acts that require the exchange of information between Member States administrations, including Directive 2005/36/EC of the European Parliament and of the Council of 7 September 2005 on the recognition of professional qualifications (3) and Directive 2006/123/EC of the European Parliament and of the Council of 12 December 2006 on services in the internal market (4).

| (5) | The exchange of information by electronic means between Member States and between Member States and the Commission should comply with the rules on the protection of personal data laid down in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (5) and in Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (6). |
| --- | --- |

(5)

The exchange of information by electronic means between Member States and between Member States and the Commission should comply with the rules on the protection of personal data laid down in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (5) and in Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (6).

| (6) | The right to data protection is recognised by the Charter of Fundamental Rights of the European Union, in particular in Article 8 thereof; information systems such as IMI should ensure that the different responsibilities and obligations shared between the Commission and the Member States as regards data protection rules are clear and that data subjects are provided with simple and easily available mechanisms to assert their rights. |
| --- | --- |

(6)

The right to data protection is recognised by the Charter of Fundamental Rights of the European Union, in particular in Article 8 thereof; information systems such as IMI should ensure that the different responsibilities and obligations shared between the Commission and the Member States as regards data protection rules are clear and that data subjects are provided with simple and easily available mechanisms to assert their rights.

| (7) | Commission Decision COM 2008/49/EC of 12 December 2007 concerning the implementation of the Internal Market Information System (IMI) as regards the protection of personal data (7) laid down the functions, rights and obligations of the IMI actors and IMI users. This Commission Decision took into account the opinion of the Article 29 Working Party (8). |
| --- | --- |

(7)

Commission Decision COM 2008/49/EC of 12 December 2007 concerning the implementation of the Internal Market Information System (IMI) as regards the protection of personal data (7) laid down the functions, rights and obligations of the IMI actors and IMI users. This Commission Decision took into account the opinion of the Article 29 Working Party (8).

| (8) | Further to the adoption of this Decision, the European Data Protection Supervisor (EDPS) adopted an opinion (9) where it called for the adoption of a legal instrument, preferably in the form of a Council and Parliament Regulation in view of the fact that IMI is expected to gradually broaden its scope to additional areas of internal market legislation with increased complexity and an increasing number of participating authorities and data exchanges. In several meetings and in an exchange of letters between the EDPS and the Commission services (10) it was agreed to follow a step by step approach which would start with the adoption of data protection guidelines, to be drawn up in close consultation with the EDPS. |
| --- | --- |

(8)

Further to the adoption of this Decision, the European Data Protection Supervisor (EDPS) adopted an opinion (9) where it called for the adoption of a legal instrument, preferably in the form of a Council and Parliament Regulation in view of the fact that IMI is expected to gradually broaden its scope to additional areas of internal market legislation with increased complexity and an increasing number of participating authorities and data exchanges. In several meetings and in an exchange of letters between the EDPS and the Commission services (10) it was agreed to follow a step by step approach which would start with the adoption of data protection guidelines, to be drawn up in close consultation with the EDPS.

| (9) | These guidelines complement Decision 2008/49/EC and take into account both the recommendations of the Article 29 Working Party and the EDPS, |
| --- | --- |

(9)

These guidelines complement Decision 2008/49/EC and take into account both the recommendations of the Article 29 Working Party and the EDPS,

HEREBY RECOMMENDS THAT MEMBER STATES SHOULD:

| 1. | Take steps to ensure the implementation of the guidelines in the Annex among actors and users of IMI. |
| --- | --- |

1.

| 2. | Encourage national IMI coordinators to make contacts with their national Data Protection Authorities for guidance and assistance on the best way to implement these guidelines under national law. |
| --- | --- |

2.

| 3. | Provide feedback to the European Commission on the implementation of the guidelines in the Annex, not later than nine months after the adoption of this Recommendation and with the assistance of the national IMI coordinators. This feedback will be taken into account by the European Commission in a report it will draw up not later than one year after the adoption of this Recommendation in which it will assess the data protection situation in IMI as well as the content and timeliness of any future measures including the possible adoption of a legal instrument. |
| --- | --- |

3.

Done at Brussels, 26 March 2009.

For the Commission

Charlie McCREEVY

Member of the Commission

---

(1)  
  OJ L 144, 30.4.2004, p. 62; corrected by OJ L 181, 18.5.2004, p. 25.

1

(2)  Set up by Commission Decision 93/72/EEC (OJ L 26, 3.2.1993, p. 18).

2

(3)  
  OJ L 255, 30.9.2005, p. 22.

3

(4)  
  OJ L 376, 27.12.2006, p. 36.

4

(5)  
  OJ L 281, 23.11.1995, p. 31.

5

(6)  
  OJ L 8, 12.1.2001, p. 1.

6

(7)  
  OJ L 13, 16.1.2008, p. 18.

7

(8)  Opinion 01911/07/EN, WP 140.

8

(9)  Opinion of the European Data Protection Supervisor on Commission Decision 2008/49/EC of 12 December 2007 concerning the implementation of the Internal Market Information System (IMI) as regards the protection of personal data (OJ C 270, 25.10.2008, p. 1).

9

(10)  http://www.edps.europa.eu/EDPSWEB/edps/site/mySite/pid/87

10

---

ANNEX

GUIDELINES FOR THE IMPLEMENTATION OF DATA PROTECTION RULES IN IMI

1.   IMI - A TOOL FOR ADMINISTRATIVE COOPERATION

IMI is a software application accessible via the Internet designed by the European Commission in cooperation with the Member States. Its main goal is to assist Member States with the practical implementation of EU legislation that provides for mutual assistance and administrative cooperation. IMI is not a database aimed at storing information for long periods of time but rather a centralised mechanism to allow national administrations of the EEA Member States to exchange information, with limited data retention periods.

IMI login page

IMI currently supports exchanges of information under the Professional Qualifications Directive and it will also support exchanges of information under the Services Directive from the end of 2009. In the future it may support exchanges of information for additional legislative areas of the Internal Market. At all times you will be able to find an updated list of these legislative areas in the annex to Decision 2008/49/EC. This annex will be amended from time to time. IMI cannot be used for information exchanges in legislative areas not specifically listed in this annex.

Example of the view of the application concerning competent authorities dealing with professional qualifications

Cooperation between national administrations is vital for the Internal Market to function well. European citizens cannot benefit from basic internal market rights such as the freedom of establishment in another Member State or the freedom to provide services cross border without practical arrangements for administrative cooperation in place.

| A couple of examples

  A German doctor resident in Berlin marries a French man and decides to start a new life in Paris. The German doctor wants to practice her profession in France and therefore submits titles and diplomas to the Order of Doctors in France. The person dealing with the file has doubts about the authenticity of one of the diplomas and uses IMI to check with the competent authority in Berlin.
  A French industrial cleaning company operating in France also provides cleaning services across the border in the Catalan region (Spain). A Spanish NGO lodges a complaint with the Catalan environmental department stating that the French company does not have the specialised work force required to handle certain cleaning substances. The Catalan competent authority uses IMI to find out whether the cleaning company is operating legally in France. |
| --- |

A couple of examples

A German doctor resident in Berlin marries a French man and decides to start a new life in Paris. The German doctor wants to practice her profession in France and therefore submits titles and diplomas to the Order of Doctors in France. The person dealing with the file has doubts about the authenticity of one of the diplomas and uses IMI to check with the competent authority in Berlin.

A French industrial cleaning company operating in France also provides cleaning services across the border in the Catalan region (Spain). A Spanish NGO lodges a complaint with the Catalan environmental department stating that the French company does not have the specialised work force required to handle certain cleaning substances. The Catalan competent authority uses IMI to find out whether the cleaning company is operating legally in France.

Administrative cooperation in the EU is not an easy task. There are language barriers (the EU has 23 official languages), lack of administrative procedures for cross-border cooperation, different administrative structures and cultures and lack of clearly identified partners in other Member States.

Although it is up to Member States to ensure that Internal Market laws work effectively on their territories, the Commission believes that Member States need the tools to work together. IMI has been designed with this idea in mind: to identify the appropriate competent authority in another Member State (search function), to manage the exchanges of information on the basis of simple and unified procedures and to remove the linguistic barriers on the basis of pre-defined and pre-translated question sets.

Screenshots showing questions in the languages of two competent authorities involved in an information exchange

2.   SCOPE AND OBJECTIVE OF THESE GUIDELINES

IMI users are experts in their respective fields of competence, whether it is the rules governing a profession or the regulations in place for the provision of services. However, they are not data protection experts and they may not always be sufficiently aware of the data protection requirements imposed by their own national data protection legislation.

Therefore it is advisable to provide IMI users with guidelines in which the functioning of IMI is explained from the data protection perspective as well as the safeguards built into the system and the possible risks associated with its use (1).

These guidelines are not intended to be a comprehensive review of all data protection issues in connection with IMI but a user-friendly explanation, a compliance framework that all IMI users can understand. In case of need, IMI users can always obtain further guidance and assistance from the data protection authorities in the Member States. A list of these authorities with contact details and websites can be found here:

http://ec.europa.eu/justice_home/fsj/privacy/nationalcomm/index_en.htm

3.   A DATA PROTECTION FRIENDLY ENVIRONMENT

IMI has been developed with the requirements of data protection legislation in mind and is data protection friendly from its conception.

IMI users can be reassured that IMI is a reliable software application from the data protection point of view and some simple examples may easily illustrate this point:

| a) | IMI is only used by competent authorities inside the European Economic Area (EU Member States plus Norway, Iceland and Lichtenstein) and there are no transfers of personal data outside the EEA; |
| --- | --- |

a)

IMI is only used by competent authorities inside the European Economic Area (EU Member States plus Norway, Iceland and Lichtenstein) and there are no transfers of personal data outside the EEA;

| b) | The European Commission and the IMI coordinators (2) have no access to the personal data of professionals or service providers exchanged in the system; |
| --- | --- |

b)

The European Commission and the IMI coordinators (2) have no access to the personal data of professionals or service providers exchanged in the system;

| c) | Only the competent authorities involved in a request for information are allowed to see the personal data of the service provider (3). In fact, the protection goes so far as to prevent the addressee of a request from seeing the personal information on the service provider until the addressee has formally accepted it;

  Example of the view of a request before acceptance by the recipient |
| --- | --- |

c)

Only the competent authorities involved in a request for information are allowed to see the personal data of the service provider (3). In fact, the protection goes so far as to prevent the addressee of a request from seeing the personal information on the service provider until the addressee has formally accepted it;

Example of the view of a request before acceptance by the recipient

| d) | All personal data relating to requests are automatically deleted from the system six months after the closure of a request or even before if requested by the competent authorities involved (for more details, see chapter 12 on retention period). |
| --- | --- |

d)

All personal data relating to requests are automatically deleted from the system six months after the closure of a request or even before if requested by the competent authorities involved (for more details, see chapter 12 on retention period).

4.   WHO IS WHO IN IMI? THE ISSUE OF JOINT CONTROLLERSHIP

IMI is a clear example of joint processing operations and joint controllership. For example, whilst only the competent authorities in the Member States exchange personal data, the storage of these data on its servers is the responsibility of the European Commission. Whilst the European Commission is not allowed to see this personal data it is the operator of the system who physically processes the deletion and rectification of the data.

In other words and as a result of the allocation of different responsibilities between the Commission and the Member States:

| a) | Each competent authority and each IMI coordinator is a controller with respect to its own data processing activities; |
| --- | --- |

a)

Each competent authority and each IMI coordinator is a controller with respect to its own data processing activities;

| b) | The Commission is not a user, but the operator of the system, responsible, primarily, for maintenance and security of the system (4); |
| --- | --- |

b)

The Commission is not a user, but the operator of the system, responsible, primarily, for maintenance and security of the system (4);

| c) | The IMI actors share responsibility with respect to notice provisions and rights of access, objection and rectification. |
| --- | --- |

c)

The IMI actors share responsibility with respect to notice provisions and rights of access, objection and rectification.

In complex scenarios of joint controllership like IMI, it seems most efficient from the perspective of compliance to embed data protection in the system from the beginning (see section: ‘Work in Progress’ under chapter 13: ‘Cooperation with data protection authorities and the EDPS’) and to define a compliance framework as provided in these guidelines. Compliance with the framework is the responsibility of all IMI actors and users.

5.   ACTORS AND USERS IN IMI

All actors which use IMI are validated by IMI coordinators. Actors and users as well as their functions, rights and obligations are described in detail in Articles 6 to 12 of Decision 2008/49/EC. There is therefore no need for these guidelines to repeat these.

It is important to understand that IMI is a very flexible system whereby Member States may allocate responsibilities and functions to competent authorities and coordinators in many different ways in order to fit their particular administrative structure and the legislative areas to be covered by administrative cooperation.

It is also important to bear in mind that IMI users in the Member States are responsible for many other processing operations. Data protection compliance in IMI does not need to be unduly complicated or pose an excessive administrative burden. Neither does it have to be a one-size fits all system.

In most cases competent authorities simply need to carry out the processing operations inside IMI under the same rules and good practices that they normally have in place as data controllers according to their own particular needs and the data protection laws of their Member States.

They should also take advantage of the data protection-friendly environment offered within IMI. For example, they are encouraged to request that the personal data exchanged will be deleted from IMI even before the six months retention period lapses, if they no longer need to keep the information exchange in IMI.

6.   LEGAL GROUNDS FOR THE EXCHANGES OF PERSONAL INFORMATION IN IMI

The Commission has adopted Decision 2008/49/EC which sets out the functions, rights and obligations of IMI actors and users concerning the implementation of IMI as regards the protection of personal data.

Not all information exchanged in IMI is personal data. For example, the information exchanged may concern legal persons (5) or the question and answer may not relate to any given individual (e.g. a general question as to whether a profession is regulated in a given Member State).

In many cases, however, the exchanges of information do concern individuals and therefore there must be legal grounds for the processing of personal data. The use of IMI is often in the interest of the data subject. Nevertheless, even if the exchange of information is not necessarily in the interest of the data subject, it may be exchanged using IMI by competent authorities, provided that such exchange is required by a specific legal basis.

Article 7 of Directive 95/46/EC lists the legal grounds for the processing of personal data. Of these, Article 7 (c) and Article 7 (e) are the most relevant for exchanges of data within IMI.

I)   Compliance with a legal obligation (Article 7 (c))

As a general principle, EU Member States have the duty to cooperate with each other and with the Community Institutions. The duty of administrative cooperation is explicit and specific in Directive 2005/36/EC (Recognition of Professional Qualifications) and Directive 2006/123/EC (Services Directive).

Article 56 (1) and (2) of the Professional Qualifications Directive provides as follows:

‘1.   The competent authorities of the host Member State and of the home Member State shall work in close collaboration and shall provide mutual assistance in order to facilitate application of this Directive. They shall ensure the confidentiality of the information which they exchange.

2.   The competent authorities of the host and home Member States shall exchange information regarding disciplinary action or criminal sanctions taken or any other serious, specific circumstances which are likely to have consequences for the pursuit of activities under this Directive, respecting personal data protection legislation provided for in Directives 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (...) and 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) [OJ L 201, 31.7.2002, p. 37].’

Article 28 (1) and (6) of the Services Directive provides as follows:

‘1.   Member States shall give each other mutual assistance, and shall put in place measures for effective cooperation with one another, in order to ensure the supervision of providers and the services they provide (...)

6.   Member States shall supply the information requested by other Member States or the Commission by electronic means and within the shortest possible period of time.’

Article 34 (1) of the Services Directive provides as follows:

‘1.   The Commission, in cooperation with Member States, shall establish an electronic system for the exchange of information between Member States, taking into account existing information systems’.

II)   The performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 7 (e)).

IMI actors and users carry out tasks in the public interest or in the exercise of official authority vested in them. All registrations in IMI are validated by the IMI Coordinator after making sure that the competent authority in question does carry out tasks either in the public interest (for example doctors or veterinary bodies ensuring that their members conform to ethical or sanitary rules) or in the exercise of official authority vested in them (e.g. Ministries of Education ensuring that secondary education teachers have the correct qualifications).

Based on the foregoing, you may use IMI to exchange personal data under the Professional Qualifications and Services Directives for the purposes set out in their provisions. Information in relation to other internal market legislation cannot be exchanged in IMI. If the scope of IMI is at any stage widened to include additional legislation, appropriate reference to the relevant Community acts will be added to the annex of Decision 2008/49/EC.

7.   THE ISSUE OF THE APPLICABLE LAW AND THE APPROPRIATE SUPERVISION

The applicable data protection law depends on who the IMI actor or user is. For the European Commission, for example, the Data Protection Regulation (EC) No 45/2001 applies. For a national user (e.g. a competent authority) the applicable law is its national data protection law which must be in conformity with Directive 95/46/EC (Data Protection Directive).

The European Union has a solid data protection legal framework provided by this Directive and by Regulation (EC) No 45/2001 (6). The Data Protection Directive leaves some flexibility for Member States. IMI national coordinators are therefore advised to discuss these guidelines with their data protection authorities, for example as regards the details of information to be provided to individuals (see chapter 9 on this matter) or the duty to notify certain data processing operations to data protection authorities.

6

Directive 95/46/EC is an Internal Market Directive which has a dual purpose. The harmonisation of national data protection legislation is intended both to ensure a high level of data protection and to safeguard the fundamental rights of individuals and thus to allow the free flow of personal data between Member States. Therefore, national specificities should not have any practical or significant impact on the use of IMI and the exchange of information required by other Community acts.

One of the most significant features of the EU data protection legal framework is its supervision by public independent data protection authorities. As a result, citizens may lodge complaints before these authorities to get their data protection problems dealt with promptly and outside the courts. The processing of personal data at national level is supervised by the national data protection authorities and the processing of personal data by the European Institutions is supervised by the European Data Protection Supervisor (EDPS). Consequently, the European Commission is subject to the supervision of the EDPS and other users of IMI, to the supervision of the national data protection authorities involved. For more details on how to deal with complaints or data subjects’ requests, see chapter 10 on the rights of access and rectification and chapter 13 on the issue of cooperation with data protection authorities and the EDPS.

8.   DATA PROTECTION PRINCIPLES APPLICABLE TO EXCHANGES OF INFORMATION

The processing of personal data under EC Law may only take place under certain conditions (see chapter 6: ‘Legal grounds for the exchanges of personal information in IMI’) and in accordance with some principles that the Data Protection Directive calls ‘principles relating to data quality’ (see Article 6 thereof).

Data controllers should only collect personal data for legitimate and specific purposes and not process it for other purposes incompatible with those stated at the time of the collection. A classical example of incompatible purposes would be a competent authority selling on to private companies for marketing purposes the address data that it collected for purposes of handling the case of migrant professionals under the Services Directive.

Furthermore, processing of personal data needs to be proportionate (adequate, relevant and not excessive) to the purposes of the collection and the controller must also take reasonable steps to ensure that the data is kept up to date and that it is destroyed or rendered anonymous once the identification of the data subject is no longer necessary. Data quality principles are good information management principles because a good information system is not one that keeps gigabytes of data for no particular reason and that soon becomes out of date and unreliable. A good electronic information system should collect only the data that is necessary for the purposes set out in advance and these data should be kept up to date so that they can be relied on fully.

Applying these data quality principles to the functioning of IMI, leads to the following recommendations:

| (1) | The use of IMI should be strictly limited to the purposes set out in the applicable legislation (e.g. in case of justified doubt or for any other reasons set out in the applicable legislation). Therefore, while it is expected that IMI will become the routine way to exchange information between competent authorities, it must be absolutely clear that IMI should not be used systematically to carry out background checks on migrant professionals or service providers. |
| --- | --- |

(1)

The use of IMI should be strictly limited to the purposes set out in the applicable legislation (e.g. in case of justified doubt or for any other reasons set out in the applicable legislation). Therefore, while it is expected that IMI will become the routine way to exchange information between competent authorities, it must be absolutely clear that IMI should not be used systematically to carry out background checks on migrant professionals or service providers.

| (2) | The requesting competent authority should provide only the personal data that the responding competent authority needs to be able to unambiguously identify the person in question or to answer the questions. For example, if a migrant professional can be identified by his name and registration number in a professional registry, there should be no need to also provide his personal identification number. |
| --- | --- |

(2)

The requesting competent authority should provide only the personal data that the responding competent authority needs to be able to unambiguously identify the person in question or to answer the questions. For example, if a migrant professional can be identified by his name and registration number in a professional registry, there should be no need to also provide his personal identification number.

| (3) | IMI users should carefully select the questions and not ask more than is absolutely necessary. This is not only a matter of respecting data quality principles, but also a matter of reducing administrative burden. For transparency purposes, the pre-defined question sets are published on the IMI website (7).






  What is sensitive data
   (8)
  ?

  It is data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health, sex life, offences, criminal convictions or security measures. Some Member States may also consider as sensitive data information concerning administrative sanctions or judgements. |
| --- | --- |

(3)

IMI users should carefully select the questions and not ask more than is absolutely necessary. This is not only a matter of respecting data quality principles, but also a matter of reducing administrative burden. For transparency purposes, the pre-defined question sets are published on the IMI website (7).

7

What is sensitive data
   (8)
  ?

What is sensitive data

8

?

It is data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health, sex life, offences, criminal convictions or security measures. Some Member States may also consider as sensitive data information concerning administrative sanctions or judgements.

| (4) | Competent authorities must be particularly vigilant when the exchanges of information concern sensitive data. Exchange of sensitive data is only possible in very limited circumstances. The most relevant requirements for the processing of sensitive data in IMI are the following:






  (a) | The processing of sensitive data is necessary for the establishment, exercise or defence of legal claims (see Article 8(2)(e) of the Data Protection Directive and corresponding provisions in national law).
  This may apply to those data exchanges in IMI where a migrant professional or a service provider is claiming his right to exercise his profession or to be established in another Member State. Competent authorities, in each case, must carefully assess whether use of the sensitive data is indeed absolutely necessary to establish the right.
  With regard to certain specific sensitive data exchanged within IMI, Member States adopted specific provisions in the Professional Qualifications Directive and the Services Directive:






  1) | Article 56(2) of the Professional Qualifications Directive states that ‘The competent authorities of the host and home Member States shall exchange information regarding disciplinary action or criminal sanctions taken or any other serious, specific circumstances which are likely to have consequences for the pursuit of activities under this Directive, respecting personal data protection legislation ...’ |
| --- | --- | --- | --- |

(4)

Competent authorities must be particularly vigilant when the exchanges of information concern sensitive data. Exchange of sensitive data is only possible in very limited circumstances. The most relevant requirements for the processing of sensitive data in IMI are the following:

sensitive data

(a)

The processing of sensitive data is necessary for the establishment, exercise or defence of legal claims (see Article 8(2)(e) of the Data Protection Directive and corresponding provisions in national law).

This may apply to those data exchanges in IMI where a migrant professional or a service provider is claiming his right to exercise his profession or to be established in another Member State. Competent authorities, in each case, must carefully assess whether use of the sensitive data is indeed absolutely necessary to establish the right.

With regard to certain specific sensitive data exchanged within IMI, Member States adopted specific provisions in the Professional Qualifications Directive and the Services Directive:

1)

Article 56(2) of the Professional Qualifications Directive states that ‘The competent authorities of the host and home Member States shall exchange information regarding disciplinary action or criminal sanctions taken or any other serious, specific circumstances which are likely to have consequences for the pursuit of activities under this Directive, respecting personal data protection legislation ...’

| 2) | Article 33 of the Services Directive foresees specific rules for the exchange of information regarding the good repute of the migrant service provider: ‘Member States shall, at the request of a competent authority in another Member State, supply information, in conformity with their national law, on disciplinary or administrative actions or criminal sanctions and decisions concerning insolvency or bankruptcy (...)’ |
| --- | --- |

2)

Article 33 of the Services Directive foresees specific rules for the exchange of information regarding the good repute of the migrant service provider: ‘Member States shall, at the request of a competent authority in another Member State, supply information, in conformity with their national law, on disciplinary or administrative actions or criminal sanctions and decisions concerning insolvency or bankruptcy (...)’

| (b) | The data subject gives his explicit consent. If the administrative cooperation is in the data subject’s interest, it may not be difficult to obtain the data subject’s explicit consent for the processing of personal data. |
| --- | --- |

(b)

The data subject gives his explicit consent. If the administrative cooperation is in the data subject’s interest, it may not be difficult to obtain the data subject’s explicit consent for the processing of personal data.

| (5) | Precaution must be extreme as regards information on criminal records whose accuracy and up-to-date status are paramount. Therefore, besides compliance with other principles of the Data Protection Directive and Regulation referred to in this Recommendation (9) this category of information should only be requested when it is authorised under the relevant Community acts and is absolutely necessary to allow a decision in the particular case which is directly linked to the request. In other words, the processing must be directly related to the exercise of the professional activity or the provision of a service and necessary for the purpose of verifying compliance with the provisions of the relevant Directive. IMI users should always bear in mind that in many cases, the information necessary to take a decision does not need to refer specifically to the criminal record of the migrant professional or service provider.
  In fact, there are only a few questions in the IMI question set that concern criminal records or other sensitive data (10). Beyond these limited cases, the exchange of sensitive data should only occur in those exceptional cases where the concrete circumstances of the case are such that the sensitive data are directly related to the pursuit of the activity in question and are absolutely necessary for the establishment of the legal claims.
  Competent authorities must not use IMI for routine checks of the criminal history of migrant professionals as this would not be compliant with the purpose for which IMI has been established. Any enquires about offences or disciplinary measures must also relate to the profession or the service concerned and not to any other offences or disciplinary measures that the migrant professional may have committed in the country of origin. For example, in order to determine if a doctor is legally registered and in good standing with the order of doctors, the requesting competent authority does not need to know whether the doctor has a road traffic offence on his criminal record, because such an offence would not prevent him from working as a doctor in his home country. |
| --- | --- |

(5)

Precaution must be extreme as regards information on criminal records whose accuracy and up-to-date status are paramount. Therefore, besides compliance with other principles of the Data Protection Directive and Regulation referred to in this Recommendation (9) this category of information should only be requested when it is authorised under the relevant Community acts and is absolutely necessary to allow a decision in the particular case which is directly linked to the request. In other words, the processing must be directly related to the exercise of the professional activity or the provision of a service and necessary for the purpose of verifying compliance with the provisions of the relevant Directive. IMI users should always bear in mind that in many cases, the information necessary to take a decision does not need to refer specifically to the criminal record of the migrant professional or service provider.

9

and

In fact, there are only a few questions in the IMI question set that concern criminal records or other sensitive data (10). Beyond these limited cases, the exchange of sensitive data should only occur in those exceptional cases where the concrete circumstances of the case are such that the sensitive data are directly related to the pursuit of the activity in question and are absolutely necessary for the establishment of the legal claims.

10

Competent authorities must not use IMI for routine checks of the criminal history of migrant professionals as this would not be compliant with the purpose for which IMI has been established. Any enquires about offences or disciplinary measures must also relate to the profession or the service concerned and not to any other offences or disciplinary measures that the migrant professional may have committed in the country of origin. For example, in order to determine if a doctor is legally registered and in good standing with the order of doctors, the requesting competent authority does not need to know whether the doctor has a road traffic offence on his criminal record, because such an offence would not prevent him from working as a doctor in his home country.

| The issue of further processing and storage outside IMI

  The use of IMI will often be associated with providing input to another processing operation that takes place in the Member State (for example to deal with an application to perform a service or to license a given activity). It is therefore normal that competent authorities will further process the data obtained for these purposes. When data is obtained through IMI and is further processed beyond the system, national data protection legislation still applies. You would therefore need to make sure that:






  — | This further processing is not incompatible with the purposes of collection and exchange that took place in IMI, |
| --- | --- |

The issue of further processing and storage outside IMI

The issue of further processing and storage outside IMI

The use of IMI will often be associated with providing input to another processing operation that takes place in the Member State (for example to deal with an application to perform a service or to license a given activity). It is therefore normal that competent authorities will further process the data obtained for these purposes. When data is obtained through IMI and is further processed beyond the system, national data protection legislation still applies. You would therefore need to make sure that:

—

This further processing is not incompatible with the purposes of collection and exchange that took place in IMI,

| — | This further processing is necessary and proportionate (adequate, relevant and not excessive) with the original purposes of collection in IMI, |
| --- | --- |

—

This further processing is necessary and proportionate (adequate, relevant and not excessive) with the original purposes of collection in IMI,

| — | Take reasonable steps to keep the data up to date and to delete once no longer required, |
| --- | --- |

—

Take reasonable steps to keep the data up to date and to delete once no longer required,

| — | When data are extracted from IMI for disclosure to a third party, the data subject needs to be informed of this circumstance to guarantee fair processing, unless it would be impossible or involve disproportionate effort or if disclosure is expressly laid down by law (see Article 11(2) of the Data Protection Directive 95/46/EC). Considering that the disclosure may be required by the laws of only one of the Member States involved, and therefore, may not be widely known elsewhere, the Commission suggests that efforts be made to provide information even when the disclosure is expressly laid down by law. |
| --- | --- |

—

When data are extracted from IMI for disclosure to a third party, the data subject needs to be informed of this circumstance to guarantee fair processing, unless it would be impossible or involve disproportionate effort or if disclosure is expressly laid down by law (see Article 11(2) of the Data Protection Directive 95/46/EC). Considering that the disclosure may be required by the laws of only one of the Member States involved, and therefore, may not be widely known elsewhere, the Commission suggests that efforts be made to provide information even when the disclosure is expressly laid down by law.

9.   THE PROVISION OF INFORMATION TO DATA SUBJECTS

One of the pillars of any data protection scheme is that data controllers provide information to data subjects about the processing operations that they intend to carry out on their personal data.

Article 10 of the Data Protection Directive provides that at the time of the collection at least information concerning the identity of the controller, the purposes of the processing, the recipients or categories of recipients of the data, whether the replies to the questions are obligatory and the possible consequences of failure to reply, as well as the right of access and rectification must be provided to the data subject.

Therefore, when collecting personal data from an individual, the competent authority must inform the data subject that the data may be introduced in IMI in order to correspond with other public administrations in other Member States for the purposes of his or her request and that, in case of need, he or she could request access to or rectification of the data being exchanged from any of the competent authorities involved in the request (for more details in this regard, see chapter 10 on rights of access and rectification).

It is for each competent authority to decide how to convey this information to data subjects. As most (if not all) competent authorities will carry out processing operations other than exchanges of information in IMI, the way they inform individuals may, if appropriate, be the same way chosen for conveying similar information for other processing operations under national law (e.g. with signs, in the correspondence with data subjects and/or on websites).

| The provision of information in the Data Protection Directive

  Article 10 of the Data Protection Directive contains a list with a minimum set of information that needs to be provided to individuals, except when they already have it:






  a) | Identity of the controller or controllers (competent authority collecting the data and similar authorities in other Member States); |
| --- | --- |

The provision of information in the Data Protection Directive

The provision of information in the Data Protection Directive

Article 10 of the Data Protection Directive contains a list with a minimum set of information that needs to be provided to individuals, except when they already have it:

a)

Identity of the controller or controllers (competent authority collecting the data and similar authorities in other Member States);

| b) | The purpose of the processing (corresponding with other authorities in connection with the request of the migrant professional or service provider); |
| --- | --- |

b)

The purpose of the processing (corresponding with other authorities in connection with the request of the migrant professional or service provider);

| c) | Any further information in so far as such information is necessary to guarantee fair processing or if the provision of further information is required by national law such as:






  1) | recipients or categories of recipients; |
| --- | --- | --- |

c)

Any further information in so far as such information is necessary to guarantee fair processing or if the provision of further information is required by national law such as:

1)

recipients or categories of recipients;

| 2) | the existence of the right of access to and the right to rectify the data concerning them, how these rights can be exercised in practice and any exceptions to these rights under national law; |
| --- | --- |

2)

the existence of the right of access to and the right to rectify the data concerning them, how these rights can be exercised in practice and any exceptions to these rights under national law;

| 3) | right of redress (e.g. access to Courts and right to claim damages); |
| --- | --- |

3)

right of redress (e.g. access to Courts and right to claim damages);

| 4) | storage and retention period; |
| --- | --- |

4)

storage and retention period;

| 5) | security measures; |
| --- | --- |

5)

security measures;

| 6) | links to relevant documents and websites, including the Commission IMI website. |
| --- | --- |

6)

links to relevant documents and websites, including the Commission IMI website.

The Data Protection Directive foresees two cases in which information must be provided to data subjects: when the data is collected directly from them and when the data has been obtained from someone else. In this latter case, however, Article 11 of the Directive contains a rule of reason by which the provision of such information would not be necessary if it would involve a disproportionate effort or if the recording or disclosure was expressly laid down by law (as is the case for exchanges of information in IMI) although the Directive goes on to say that in these cases, ‘Member States shall provide for appropriate safeguards’.

Therefore, competent authorities may need to fine-tune the provision of information to data subjects on the basis of their respective national data protection laws, possibly in consultation with the national IMI coordinators and the national data protection authorities. It is recommended to follow a layered approach, with the provision of basic information upon collection (e.g. in application forms to competent authorities) along with indication as to where data subjects may get more comprehensive information if they are interested.

For this second, more detailed layer of information, one efficient way to provide information to data subjects is by means of privacy policies or privacy statements on websites.

If competent authorities already have these privacy statements, they should update or complement them to refer specifically to exchanges of personal data in IMI. If that is not the case, competent authorities should decide whether the use of IMI and the amount of collection of personal data justifies the drafting of an on-line privacy statement.

In those cases where the use of IMI is very sporadic, it may suffice to inform individuals about IMI only briefly upon collection and also later when the need arises. In these cases, where no specific privacy statement about IMI is provided to the data subject by the competent authority, the competent authority should clearly indicate where data subjects may get more comprehensive information, for example, on the website of the national IMI coordinator and on the Commission’s IMI website.

The data protection section of the Commission IMI website (11) contains the Commission’s IMI privacy statement. It also contains additional information for data subjects on how to exercise their rights and to get assistance from national competent authorities or data protection authorities if necessary:

11

It is strongly recommended that important actors in IMI dealing with a high volume of requests should publish their privacy policies on their websites. These privacy policies should contain a link to the data protection site of the Commission IMI website. Other competent authorities dealing with a low volume of requests may primarily rely on a link to the Commission IMI website.

National IMI Coordinators should provide assistance to competent authorities. This may include assistance in drafting sample privacy notices that may be used as a template by the national competent authorities. Alternatively, a common, national privacy notice could be drafted and published on the internet by the national coordinator, and each competent authority could simply provide the link to this notice when dealing with data subjects (e.g. in application forms or any other documents provided to the data subjects).

| EUROPEAN COMMISSION PRIVACY STATEMENT


  Internal Market Information System - IMI

  1.   Aim and actors of IMI

  The objective of IMI is to facilitate administrative cooperation and mutual assistance between Member States in order to ensure the proper functioning of the Internal Market and the free movement of persons and services. It does so by providing a tool for the exchange of information (including certain personal data) between national administrations of the EEA Member States.
  This privacy statement covers the part of IMI for which the Commission is responsible, i.e. the collection, registration, storage and deletion of personal data of the first users in National IMI Coordinators and the storage and deletion, but not the collection, retrieval or viewing, of personal data of other IMI users and of persons who are the subject of an information exchange. Thus it does not concern those data processing acts which fall under the responsibility of Member States.
  2.   What is the applicable law?

  All processing acts within the responsibility of the European Commission are governed by Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data.
  Commission Decision 2008/49/EC of 12 December 2007 concerning the implementation of the Internal Market Information System (IMI) as regards the protection of personal data also applies.
  3.   Which data are processed by the Commission in IMI?

  The Commission collects the necessary contact details of the first users in the National IMI Coordinators such as name, professional telephone, fax numbers and e-mail addresses. These personal data as well as those of users in Delegated IMI Coordinators and in Competent Authorities are stored on a Commission server.
  The personal data of persons who are the subject of an information exchange will for technical reasons be stored on a Commission server.
  4.   What is the purpose of processing data in IMI?

  The contact details of the National IMI Coordinators are essential in order to set up und run IMI. The Commission needs to have access to these data in order to cooperate effectively with the Member States on the management of IMI.
  With regard to the temporary storage of personal data of persons who are the subject of an information exchange between national authorities, the purpose of data processing in IMI is to improve and facilitate cooperation amongst Member State competent authorities on the basis of Community legislation adopted to achieve the Internal Market in cases when there is a need for additional information from another Member State in relation to temporary cross-border provision of services or establishment of a service provider in another Member State.
  5.   Who has access to the data?

  Within the limits of Article 12 paragraph 7 of Decision 2008/49/EC the local data administrators of the Commission have access to the personal data of the local data administrators of the National IMI Coordinators. In no case are Commission staff able to access personal data of the person who is the subject of an information exchange.
  6.   How long will your data be stored?

  Personal data of users in Competent Authorities and Coordinators will be stored as long as they are IMI users.
  All personal data exchanged between Competent Authorities and processed in IMI will be deleted automatically by the Commission six months after the formal closure of an information exchange. For statistical reasons the information exchange will continue to be kept in IMI, but all personal data will be rendered anonymous. A Competent Authority involved in a specific information exchange may at any time after the closure of that information exchange instruct the Commission to delete specific personal data. The Commission will honour any such request within 10 working days subject to the agreement of the other Competent Authority involved.
  7.   Which security measures are in place against unauthorised access?

  IMI is protected by a number of technical measures. Different levels of access to the database are secured by a normal password system and an additional digital code similar to that used in some personal computer banking systems. Access to the personal data in IMI is only allowed to a restricted group as described above under point 5 ‘Who has access to the data?’ The system is also protected by https, a special, secure internet protocol.
  8.   Access to your personal data

  Access to your personal data as National IMI Coordinator is possible via the contact address below in point 10.
  9.   Additional information

  In addition to these Privacy Statements the ‘important legal notice’ (http://europa.eu/geninfo/legal_notices_en.htm) applies.
  If you think that your personal data is in IMI and you would like to have access to it or have it deleted or rectified, you may do so by contacting the administration or the professional body with which you had contacts or any other IMI user that was involved in the request. If you were not satisfied with the answer received, you may either contact another IMI user involved or lodge a complaint with the data protection authority of one of the IMI users involved in the request which will assist you at no charge. A list of data protection authorities is available at the following address:
  http://ec.europa.eu/justice_home/fsj/privacy/nationalcomm/index_en.htm
  Please be aware that in some cases, national law may contain exceptions to your right to have access to your personal data.
  10.   Contact

  IMI is managed by the European Commission’s Directorate General for Internal Market and Services, unit E.3. The responsible person (controller) is Mr Nicholas Leapman, Head of Unit. The contact address for IMI is:





  European Commission |
| --- |
| Internal Market and Services Directorate General |
| Unit E.3 |
| B-1049 Brussels |
| markt-imi-dataprotection@ec.europa.eu |

EUROPEAN COMMISSION PRIVACY STATEMENT

EUROPEAN COMMISSION PRIVACY STATEMENT

Internal Market Information System - IMI

Internal Market Information System - IMI

1.   Aim and actors of IMI

Aim and actors of IMI

The objective of IMI is to facilitate administrative cooperation and mutual assistance between Member States in order to ensure the proper functioning of the Internal Market and the free movement of persons and services. It does so by providing a tool for the exchange of information (including certain personal data) between national administrations of the EEA Member States.

This privacy statement covers the part of IMI for which the Commission is responsible, i.e. the collection, registration, storage and deletion of personal data of the first users in National IMI Coordinators and the storage and deletion, but not the collection, retrieval or viewing, of personal data of other IMI users and of persons who are the subject of an information exchange. Thus it does not concern those data processing acts which fall under the responsibility of Member States.

2.   What is the applicable law?

What is the applicable law?

All processing acts within the responsibility of the European Commission are governed by Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data.

Commission Decision 2008/49/EC of 12 December 2007 concerning the implementation of the Internal Market Information System (IMI) as regards the protection of personal data also applies.

3.   Which data are processed by the Commission in IMI?

Which data are processed by the Commission in IMI?

The Commission collects the necessary contact details of the first users in the National IMI Coordinators such as name, professional telephone, fax numbers and e-mail addresses. These personal data as well as those of users in Delegated IMI Coordinators and in Competent Authorities are stored on a Commission server.

The personal data of persons who are the subject of an information exchange will for technical reasons be stored on a Commission server.

4.   What is the purpose of processing data in IMI?

What is the purpose of processing data in IMI?

The contact details of the National IMI Coordinators are essential in order to set up und run IMI. The Commission needs to have access to these data in order to cooperate effectively with the Member States on the management of IMI.

With regard to the temporary storage of personal data of persons who are the subject of an information exchange between national authorities, the purpose of data processing in IMI is to improve and facilitate cooperation amongst Member State competent authorities on the basis of Community legislation adopted to achieve the Internal Market in cases when there is a need for additional information from another Member State in relation to temporary cross-border provision of services or establishment of a service provider in another Member State.

5.   Who has access to the data?

Who has access to the data?

Within the limits of Article 12 paragraph 7 of Decision 2008/49/EC the local data administrators of the Commission have access to the personal data of the local data administrators of the National IMI Coordinators. In no case are Commission staff able to access personal data of the person who is the subject of an information exchange.

6.   How long will your data be stored?

How long will your data be stored?

Personal data of users in Competent Authorities and Coordinators will be stored as long as they are IMI users.

All personal data exchanged between Competent Authorities and processed in IMI will be deleted automatically by the Commission six months after the formal closure of an information exchange. For statistical reasons the information exchange will continue to be kept in IMI, but all personal data will be rendered anonymous. A Competent Authority involved in a specific information exchange may at any time after the closure of that information exchange instruct the Commission to delete specific personal data. The Commission will honour any such request within 10 working days subject to the agreement of the other Competent Authority involved.

7.   Which security measures are in place against unauthorised access?

Which security measures are in place against unauthorised access?

IMI is protected by a number of technical measures. Different levels of access to the database are secured by a normal password system and an additional digital code similar to that used in some personal computer banking systems. Access to the personal data in IMI is only allowed to a restricted group as described above under point 5 ‘Who has access to the data?’ The system is also protected by https, a special, secure internet protocol.

8.   Access to your personal data

Access to your personal data

Access to your personal data as National IMI Coordinator is possible via the contact address below in point 10.

9.   Additional information

Additional information

In addition to these Privacy Statements the ‘important legal notice’ (http://europa.eu/geninfo/legal_notices_en.htm) applies.

If you think that your personal data is in IMI and you would like to have access to it or have it deleted or rectified, you may do so by contacting the administration or the professional body with which you had contacts or any other IMI user that was involved in the request. If you were not satisfied with the answer received, you may either contact another IMI user involved or lodge a complaint with the data protection authority of one of the IMI users involved in the request which will assist you at no charge. A list of data protection authorities is available at the following address:

http://ec.europa.eu/justice_home/fsj/privacy/nationalcomm/index_en.htm

Please be aware that in some cases, national law may contain exceptions to your right to have access to your personal data.

10.   Contact

Contact

IMI is managed by the European Commission’s Directorate General for Internal Market and Services, unit E.3. The responsible person (controller) is Mr Nicholas Leapman, Head of Unit. The contact address for IMI is:

European Commission

Internal Market and Services Directorate General

Unit E.3

B-1049 Brussels

markt-imi-dataprotection@ec.europa.eu

If you want to file a complaint against any data processing act executed under the Commission’s responsibility you may contact the European Data Protection Supervisor:

| European Data Protection Supervisor (EDPS) |
| --- |
| Rue Wiertz 60 (MO 63) |
| B-1047 Brussels |
| Tel. +32 2 283 19 00 |
| Fax: +32 2 283 19 50 |
| edps@edps.europa.eu |

European Data Protection Supervisor (EDPS)

Rue Wiertz 60 (MO 63)

B-1047 Brussels

Tel. +32 2 283 19 00

Fax: +32 2 283 19 50

edps@edps.europa.eu

10.   RIGHT OF ACCESS AND RECTIFICATION

Transparency with the data subject is paramount. This is achieved both by first providing him or her with the information discussed in the previous chapter and second by granting him or her the right to access his or her personal data and, where appropriate, the right to have it deleted or rectified or blocked if they are inaccurate or have been unlawfully processed.

and

The complexity of the IMI system with many actors and users involved in joint-processing and joint-controller operations require a straight-forward approach towards the data subject. Data subjects are not familiar with the technicalities of joint processing operations or the functioning of IMI and they do not need to be.

A clear and simple approach therefore needs to be in place: as a general rule subject only to justified exceptions agreed between the data subject and all other parties concerned, data subjects will be able to exercise their rights of access, rectification and deletion by addressing any competent authority involved in a request. No competent authority should refuse access, rectification or deletion on the ground that it did not introduce the data in the system or that the data subject should contact another competent authority. The competent authority receiving the request will examine it and grant or refuse it in accordance with the merits of the request and the provisions of its own national data protection law. If necessary and appropriate, the competent authority may contact other competent authorities before taking a decision. In case of disagreement between competent authorities, they should involve their respective data protection authorities to reach an agreement in a timely and efficient way.

If the data subject is not happy with the decision taken, it may contact another competent authority involved in the information exchange or contact the national data protection authority of one of these competent authorities that suits him or her best: for example, the authority of the country where he or she is established, or his or her own national data protection authority, or the authority of the country where he or she is working. If necessary and appropriate, data protection authorities should cooperate with each other to deal with the complaint (see Article 28 of the Data Protection Directive).

It must be highlighted that data subjects always have the right to commence at any moment legal proceedings and to obtain redress where appropriate (see Articles 22 and 23 of the Data Protection Directive and corresponding provisions in national laws).

Article 12(c) of the Data Protection Directive provides that the controller will notify any rectification, erasure or blocking to third parties to whom the data have been disclosed, unless this proves impossible or involves a disproportionate effort. This also applies to information further processed outside IMI.

Further to the recommendations of the Article 29 Working Party and the EDPS, the Commission is currently working on a feature within the IMI system (along the lines of the procedure already in place for early deletion of data at the request of competent authorities, see chapter 12) that would allow online data rectifications and with automatic notifications to those competent authorities involved. This has some technical complexity, so it is proposed that until the functionality can be implemented, if there was a need to rectify personal data, the competent authority should address such request for rectification directly to the IMI data controller at the European Commission (see the previous section ‘European Commission Privacy Statement’).

The Data Protection Directive and the national laws implementing it also give data subjects the right to object to the processing of data relating to them and to have processing stopped when there is a justified objection. If you are contacted by a data subject who objects to the processing of data relating to him or her, please contact your national data protection authority to get more information about how this right to object works in your Member State.

11.   DATA SECURITY

A number of organisational and technical measures, similar to those used in some personal computer banking systems, are used to ensure the security of IMI. Communication with IMI across the Internet is protected by https, a special, secure, Internet protocol. The technical measures to protect IMI have to be interoperable across the European Union. The technical protection of the system will be further developed with regard to the state of the art and the cost of implementation (see Article 17 of Directive 95/46/EC and Article 22 of Regulation (EC) No 45/2001)

To obtain more information about the rules concerning the security of information systems used by the European Commission, please consult Commission Decision C(2006) 3602 available on the data protection section of the IMI website:

http://ec.europa.eu/internal_market/imi-net/data_protection_en.html

12.   RETENTION PERIOD

The rules as regards the retention period are laid down in Articles 4 and 5 of Decision 2008/49/EC.

As a general rule, all personal data contained in information exchanges will be automatically erased six months after the formal closure of an information exchange. The Commission is currently implementing some modifications in the system (reminders and urgency lists) aimed at achieving the formal closure of requests as soon as possible.

There is also the possibility that a competent authority requests the deletion of personal data before the end of the six month period. Provided that the other competent authority agrees, the Commission shall act upon such requests within ten working days.

Competent authorities should be aware that requests for deletion of personal data can be made online simply by accessing the appropriate closed request and clicking on the ‘Request removal of personal data’ button.

Screenshot of a competent authority requesting an early removal of personal data

Screenshot of a competent authority requesting an early removal of personal data

Screenshot of a competent authority being consulted on early removal of personal data

Screenshot of a competent authority being consulted on early removal of personal data

The Commission will also implement some improvements to the system, such as automatic reminders to accept replies or to formally close requests in cases where there has been a satisfactory answer.

It is also important to recall that the national data protection rules apply to the storage of any personal data outside IMI by competent authorities.

13.   COOPERATION WITH NATIONAL DATA PROTECTION AUTHORITIES AND THE EDPS

The network of national data protection authorities and the EDPS is one of the most robust guarantees of the good functioning of our data protection system. Competent authorities can rely on them to seek advice any time they are confronted with a difficult issue that is not covered by these guidelines. National IMI coordinators are called upon to play a significant role in this respect. A list of contacts in the data protection authorities is available on the data protection section of the IMI website.

Competent authorities must also be aware that it might be necessary for them to notify their respective national data protection authorities before participating in IMI. In some Member States a prior authorisation might be necessary. IMI coordinators should play an active coordinating role in contacting data protection authorities, when necessary.

| Work in progress

  The following data protection-friendly improvements will be included in a future version of IMI during 2009:






  a) | Where the exchanges of information concern sensitive data (e.g. health data or criminal records or disciplinary measures), there will be a reminder that the information exchanged is sensitive and that the case handler should only request this information if absolutely necessary and directly related to the exercise of the professional activity or the performance of a given service. |
| --- | --- |

Work in progress

Work in progress

The following data protection-friendly improvements will be included in a future version of IMI during 2009:

a)

Where the exchanges of information concern sensitive data (e.g. health data or criminal records or disciplinary measures), there will be a reminder that the information exchanged is sensitive and that the case handler should only request this information if absolutely necessary and directly related to the exercise of the professional activity or the performance of a given service.

| b) | An online procedure will be set up (along the lines of the one already in place for early deletion of data at the request of the competent authorities) for the rectification erasure or blocking of data which have been unlawfully processed or are inaccurate. |
| --- | --- |

b)

An online procedure will be set up (along the lines of the one already in place for early deletion of data at the request of the competent authorities) for the rectification erasure or blocking of data which have been unlawfully processed or are inaccurate.

| c) | There will be automated reminders and urgency lists to accept a response so that requests do not remain open longer than necessary. |
| --- | --- |

c)

There will be automated reminders and urgency lists to accept a response so that requests do not remain open longer than necessary.

| d) | Appropriate measures to deal with new flows of information under the Services Directive - that is the alert mechanism and the case by case derogations. As a general rule, these measures will follow the same approach designed for general exchanges of information, for example: reminders about the sensitive nature of these information flows, reminders to close alerts as soon as feasible and possible ways of informing individuals about the exchange of information and their rights to have access to the data and, if appropriate, to have it blocked, deleted or rectified. It is possible that additional data protection safeguards may be necessary. These will be drawn up in consultation with the EDPS. |
| --- | --- |

d)

Appropriate measures to deal with new flows of information under the Services Directive - that is the alert mechanism and the case by case derogations. As a general rule, these measures will follow the same approach designed for general exchanges of information, for example: reminders about the sensitive nature of these information flows, reminders to close alerts as soon as feasible and possible ways of informing individuals about the exchange of information and their rights to have access to the data and, if appropriate, to have it blocked, deleted or rectified. It is possible that additional data protection safeguards may be necessary. These will be drawn up in consultation with the EDPS.

14.   REVIEW CLAUSE

IMI is a pioneer information system and is still being developed. The Commission is continuously gathering input from coordinators and competent authorities to improve the system and it is therefore likely that changes will be implemented in the coming months. Some of them may have no data protection consequences - others may do so.

These guidelines, therefore, are not set in stone and will need to be updated on the basis of the experience with the daily work of IMI. Not later than one year after the adoption of this Recommendation, the Commission will draw up a report in which it will assess the situation, including the possibility of adopting another legal measure.

---

(1)  Members States should consider including information on data protection in their training actions on IMI.

1

(2)  See Article 12 of Decision 2008/49/EC.

2

(3)  Competent authorities may have other authorities ‘linked’ for supervision (e.g. a regional authority links a federal authority). These ‘linked authorities’ can in this way be made aware of the number and the nature of the requests but they have no access to the personal data of the service providers or the migrant professionals.

3

(4)  As provided for in Article 10(3) of Decision 2008/49/EC, the Commission may participate in information exchanges only in specific cases where the relevant Community act provides for information to be exchanged between Member States and the Commission. In these cases the Commission has similar obligations as if it were a competent authority. For example, it needs to provide appropriate notice to the data subjects as well as access to their data if they so request.

4

(5)  Although in some Member States such as Italy, Luxembourg, Austria and Denmark the scope of data protection legislation also covers legal persons to a certain extent.

5

(6)  Directive 95/46/EC applies to the Member States whilst Regulation (EC) No 45/2001 applies to the European Institutions.

6

(7)  http://ec.europa.eu/internal_market/imi-net/docs/questions_and_data_fields_en.pdf

7

(8)  For a legal definition see Article 8 of Directive 95/46/EC and Article 10 of Regulation (EC) No 45/2001.

8

(9)  i.e. appropriate information should be provided to the data subjects, processing should be proportionate, and data should not be further processed for purposes incompatible with its collection.

9

(10)  A specific list of these questions is available on the IMI website:

10

http://ec.europa.eu/internal_market/imi-net/docs/questions_and_data_fields_en.pdf

(11)  The data protection section of the IMI website contains all the IMI specific data protection documents as well as a link to a list of all legislative documents on data protection at EU level:

11

http://ec.europa.eu/internal_market/imi-net/data_protection_en.html

---