# EUR-Lex - 52012DC0009 - EN

*|*

# 52012DC0009

**COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE AND THE COMMITTEE OF THE REGIONS Safeguarding Privacy in a Connected World A European Data Protection Framework for the 21st Century /* COM/2012/09 final */**

			*

			*

COMMUNICATION FROM THE COMMISSION TO
THE EUROPEAN PARLIAMENT, THE COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL
COMMITTEE AND THE COMMITTEE OF THE REGIONS

Safeguarding Privacy in a Connected World
A European Data Protection Framework for the 21st Century

(Text with EEA relevance)

1.
TODAY'S CHALLENGES TO DATA PROTECTION

The rapid pace of technological change and
globalisation have profoundly transformed the way in which an ever-increasing
volume of personal data is collected, accessed, used and transferred. New ways
of sharing information through social networks and storing large amounts of
data remotely have become part of life for many of Europe's 250 million
internet users. At the same time, personal data has become an asset for many
businesses. Collecting, aggregating and analysing the data of potential
customers is often an important part of their economic activities[1].

In this new digital environment, individuals
have the right to enjoy effective control over their personal information.
Data protection is a fundamental right in Europe, enshrined in Article 8 of the
Charter of Fundamental Rights of the European Union, as well as in Article
16(1) of the Treaty on the Functioning of the European Union (TFEU), and needs to
be protected accordingly.

Lack of confidence makes consumers hesitant to
buy online and accept new services. Therefore, a high level of data protection
is also crucial to enhance trust in online services and to fulfil the potential
of the digital economy, thereby encouraging economic growth and the competitiveness
of EU industries.

Modern, coherent rules across the EU are needed
for data to flow freely from one Member State to another. Businesses need clear
and uniform rules that provide legal certainty and minimise the administrative
burden. This is essential if the Single Market is to function and to stimulate
economic growth, create new jobs and foster innovation[2]. A modernisation of the
EU's data protection rules, which strengthens their internal market
dimension, ensures a high level of data protection for individuals, and
promotes legal certainty, clarity and consistency, therefore plays a central
role in the European Commission's Stockholm Action Plan[3], in the Digital Agenda for
Europe[4]
and, more broadly, for the EU's growth strategy Europe 2020[5].

The EU's 1995 Directive[6], the central legislative
instrument for the protection of personal data in Europe, was a milestone in
the history of data protection. Its objectives, to ensure a functioning Single Market
and effective protection of the fundamental rights and freedoms of individuals,
remain valid. However, it was adopted 17 years ago when the internet was in its
infancy. In today's new, challenging digital environment, existing rules
provide neither the degree of harmonisation required, nor the necessary
efficiency to ensure the right to personal data protection. That is why the
European Commission is proposing a fundamental reform of the EU's data
protection framework.

In addition, the Lisbon Treaty has created,
with Article 16 TFEU, a new legal basis for a modernised and comprehensive
approach to data protection and the free movement of personal data, also
covering police and judicial cooperation in criminal matters[7]. This approach is reflected in
the European Commission's Communications on the Stockholm Programme and the
Stockholm Action Plan[8],
which stress the need for the Union to "establish a comprehensive personal
data protection scheme covering all areas of EU competence" and "ensure that the fundamental right to data protection is consistently
applied".

To prepare the reform of the EU's data
protection framework in a transparent manner, the Commission has, since 2009, launched
public consultations on data protection[9]
and engaged in intensive dialogue with stakeholders.[10] On 4 November 2010, the
Commission published a Communication on a comprehensive approach on personal
data protection in the European Union[11]
which set out the main themes of the reform. Between September and December
2011, the Commission was involved in an enhanced dialogue with Europe's
national data protection authorities and with the European Data Protection
Supervisor to explore options for more consistent application of EU data
protection rules across all EU Member States[12].

These discussions made clear that both citizens
and businesses wanted the European Commission to reform EU data protection
rules in a comprehensive manner. After assessing the impacts of different
policy options[13],
the European Commission is now proposing a strong and consistent legislative
framework across Union policies, enhancing individuals' rights, the Single Market
dimension of data protection and cutting red tape for businesses[14]. The Commission proposes that
the new framework should consist of:

–
A Regulation (replacing Directive
95/46/EC) setting out a general EU framework for data protection[15];

–
and a Directive (replacing Framework
Decision 2008/977/JHA[16])
setting out rules on the protection of personal data processed for the purposes
of prevention, detection, investigation or prosecution of criminal offences
and related judicial activities.

This Communication sets out the main elements
of the reform of the EU framework for data protection.

2.
Putting individuals in control of their personal data

Under Directive 95/46/EC – the EU's main legislative
act in the field of data protection today – the ways in which individuals are
able to exercise their right to data protection are not sufficiently harmonised
across Member States. Nor are the powers of the national authorities
responsible for data protection harmonised enough to ensure consistent and
effective application of the rules. This means that actually exercising such rights
is more difficult in some Member States than in others, particularly online.

These difficulties are also due to the sheer
volume of data collected everyday, and the fact that users are often not fully
aware that their data is being collected. Although many Europeans consider that
disclosure of personal data is increasingly a part of modern life[17], 72% of internet users in
Europe still worry that they are being asked for too much personal data online[18]. They feel they are not in
control of their data. They are not properly informed of what happens to their
personal information, to whom it is transmitted and for what purposes. Often, they
do not know how to exercise their rights online.

'Right to be
forgotten'

A European student who is a member of an
online social networking service decides to request access to all the personal
data the network holds about him. In doing so, he realises that it collects
much more data than he was aware of and that some personal data that he thought
had been deleted were still being stored.

The reform of the EU's data protection
rules will ensure that this will no longer happen by introducing:

- an explicit requirement that obliges
online social networking services (and all other data controllers) to minimise
the volume of users' personal data that they collect and process;

- a requirement that the default settings ensure
that data is not made public;

- an explicit obligation for data
controllers to delete an individual's personal data if that person explicitly requests
deletion and where there is no other legitimate reason to retain it.
In this specific case, this would oblige the social network provider to delete
the student's data immediately and completely.

As highlighted in the Digital Agenda for
Europe, concerns about privacy are among the most frequent reasons for people
not buying goods and services online. Given the contribution of the Information
and Communication Technology (ICT) sector to overall productivity growth in
Europe – 20% directly from the ICT sector and 30% from ICT investments[19] – trust in such services is
vital to stimulate growth in the EU economy and the competitiveness of European
industry.

Data breach
notifications

Hackers attacked a gaming service which
targets users in the EU. The breach affected databases containing personal data
(including names,
addresses and possibly credit card data) of tens of millions of users worldwide. The company waited for a week before
notifying the users concerned.

The reform of the EU's data protection
rules will ensure this could no longer happen. The new rules will oblige
companies:

- to strengthen their security measures to
prevent and avoid breaches;

- to notify data breaches to both the
national data protection authority – within 24 hour of the breach being
discovered, where feasible – and the individuals concerned without undue delay.

The aim of the new legislative acts proposed by
the Commission is to strengthen rights, to give people efficient and
operational means to make sure they are fully informed about what happens to
their personal data and to enable them to exercise their rights more
effectively.

To strengthen the right of individuals to data
protection, the Commission is proposing new rules which will:

Improve individuals' ability to control
their data, by:

-        ensuring that, when their consent
is required, it is given explicitly, meaning that it is based either on a
statement or on a clear affirmative action by the person concerned and is
freely given;

-        equipping internet users with an
effective right to be forgotten in the online environment: the right to
have their data deleted if they withdraw their consent and if there are no other
legitimate grounds for retaining the data;

-        guaranteeing easy access to one's own
data and a right to data portability: a right to obtain a copy of
the stored data from the controller and the freedom to move it from one service
provider to another, without hindrance;

-         reinforcing
the right to information so that individuals fully understand how
their personal data is handled, particularly when the processing activities
concern children.
Improve the means for individuals to exercise their rights, by:

-        strengthening national data protection
authorities' independence and powers, so that they are properly equipped to
deal effectively with complaints, with powers to carry out effective investigations,
take binding decisions and impose effective and dissuasive sanctions;

-        enhancing administrative and judicial
remedies when data protection rights are violated. In particular, qualified
associations will be able to bring actions to court on behalf of the individual.

Reinforce data security, by:

-        encouraging the use of privacy-enhancing
technologies (technologies which protect the privacy of
information by minimizing the storage of personal data),
privacy-friendly default settings and privacy certification schemes;

-        introducing a general obligation[20] for data controllers to
notify data breaches without undue delay to both data protection
authorities (which, where feasible, should be within 24 hours) and the
individuals concerned.

Enhance the accountability of those processing data, in particular by:

-         requiring
data controllers to designate a Data Protection Officer in companies with
more than 250 employees and in firms which are involved in processing operations
which, by virtue of their nature, their scope or their purposes, present
specific risks to the rights and freedoms of individuals ("risky
processing");

-        introducing the "Privacy by
Design" principle to make sure that data protection safeguards are
taken into account at the planning stage of procedures and systems;

-        introducing the obligation to carry out Data
Protection Impact Assessments for organisations involved in risky
processing.

3.
data protection rules fit for the digital single
market

Despite the current Directive's objective to
ensure an equivalent level of data protection within the EU, there is still
considerable divergence in the rules across Member States. As a consequence, data
controllers may have to deal with 27 different national laws and requirements.
The result is a fragmented legal environment which has created legal
uncertainty and uneven protection for individuals. This has caused unnecessary
costs and administrative burdens for businesses and is a disincentive for
enterprises operating in the Single Market that may want to expand their
operations across borders.

The resources and the powers of the national authorities
responsible for data protection vary considerably among Member States[21]. In some cases, they are
unable to perform their enforcement tasks satisfactorily. Cooperation among these
authorities at European level – via the existing Advisory Group (the so-called
Article 29 Working Party)[22]
– does not always lead to consistent enforcement and also needs to be improved.

Consistent enforcement of data protection
rules across Europe

A multinational company with several
establishments in the EU has deployed an online mapping system across Europe
which collects images of all private and public buildings, and may also take
pictures of people on the street. In one Member State, the inclusion of
un-blurred pictures of persons unaware that they were being photographed was
considered to be unlawful, while in other Member States there was no such infringement
of data protection laws. As a result, there was no consistent response among
national data protection authorities to remedy this situation.

The reform of the EU's data protection
rules will ensure that this could not happen in future, as:

- data protection requirements and
safeguards will be set out in an EU Regulation with direct application throughout
the Union;

- only the data protection authority where
the company has its main establishment will be responsible for deciding whether
the company is acting within the law;

- prompt, and effective coordination
between national data protection authorities – given that the service is directed
at individuals in several Member States – will help ensure that the new EU data
protection rules will be applied and enforced consistently across all Member
States.

National authorities need to be reinforced and
their cooperation strengthened to guarantee the consistent enforcement and,
ultimately, uniform application of rules across the EU.

A strong, clear and uniform legislative
framework at EU level will help to unleash the potential of the Digital Single Market
and foster economic growth, innovation and job creation. A Regulation will do
away with the fragmentation of legal regimes across 27 Member States and remove
barriers to market entry, a factor of particular importance to micro, small and
medium-sized enterprises.

The new rules will also give EU companies an
advantage in global competition. Under the reformed regulatory framework, they
will be able to assure their customers that valuable personal information will
be treated with the necessary care and diligence. Trust in a coherent EU regulatory
regime will be a key asset for service providers and an incentive for investors
looking for optimal conditions when locating services.

To enhance the Single Market dimension of data
protection, the Commission proposes to:

-        lay down data protection rules at EU
level through a Regulation directly applicable in all Member States[23] which will put an end to the
cumulative and simultaneous application of different national data protection
laws. This will lead to a net saving for companies of about € 2.3 billion a
year in terms of administrative burdens alone;

-        simplify the regulatory environment by
drastically cutting red tape and doing away with formalities such as
general notification requirements (leading to net savings of € 130 million a
year in terms of administrative burdens alone). Given their importance for the
competitiveness of the European economy, special attention is given to the specific
needs of micro, small and medium sized enterprises;

-        further enhance the independence
and powers of national data protection authorities (DPAs) to enable them to
carry out investigations, take binding decisions and impose effective and
dissuasive sanctions, and oblige Member States to provide them with sufficient
resources to do so;

-        set up a 'one-stop-shop' system for
data protection in the EU: data controllers in the EU will only have to
deal with a single DPA, namely the DPA of the Member State where the company's
main establishment is located;

-        create the conditions for swift and
efficient cooperation between DPAs, including the obligation for one DPA to
carry out investigations and inspections upon request from another, and to
mutually recognise each other's decisions;

-        set up a consistency mechanism at
EU level, to ensure that DPA decisions that have a wider European impact take
full account of the views of other DPAs concerned, and are fully in compliance
with EU law;

-        upgrade the Article 29 Working Party to
an independent European Data Protection Board to improve its contribution
to consistent application of data protection law and to provide a strong basis for
cooperation among data protection authorities, including the European Data
Protection Supervisor; and to enhance synergies and effectiveness by foreseeing
that the secretariat of the European Data Protection Board will be provided by
the European Data Protection Supervisor.

The new EU Regulation will ensure a robust
protection of the fundamental right to data protection throughout the European
Union and strengthen the functioning of the Single Market. At the same time –
in view of the fact that, as underlined by the Court of Justice of the EU[24], the right to the protection
of personal data is not an absolute right, but must be considered in relation
to its function in society[25]
and be balanced with other fundamental rights, in accordance with the principle
of proportionality[26]
– the Regulation will include explicit provisions that ensure the respect of
other fundamental rights, such as freedom of expression and information, the
right to defence, as well as of professional secrecy (such as for the legal
profession), without prejudicing the status of churches under the laws of the
Member States.

4.
THE use of data in police and criminal justice
cooperation

The entry into force of the Lisbon Treaty and
in particular the introduction of a new legal basis (Article 16 TFEU) allow the
establishment of a comprehensive data protection framework ensuring a high
level of protection for individuals' data, whilst respecting the specific
nature of the field of police and judicial cooperation in criminal matters. In
particular, it allows the revised EU data protection framework to cover both
cross-border and domestic processing of personal data. This would reduce
differences between the legislation in Member States, to the likely benefit of
the protection of personal data overall. It could also lead to a smoother
exchange of information between Member States' police and judicial authorities
and thereby improve cooperation in the fight against serious crime in Europe. The
processing of data by police and judicial authorities in criminal matters is
currently principally covered by Framework Decision 2008/977/JHA, which
pre-dates the entry into force of the Lisbon Treaty. The Commission has no
powers to enforce its rules, as it is a Framework Decision, and this has
contributed to uneven implementation. In addition, the scope of the Framework
Decision is limited to cross-border processing activities.[27] This means that the processing
of personal data that has not been made the subject of exchanges is currently
not covered by EU rules governing such processing and protecting the
fundamental right to data protection. This also creates, in some cases,
practical difficulties for police and other authorities for whom it may not be
obvious whether data processing is to be purely domestic or cross-border; or to
foresee whether 'domestic' data might become the object of a subsequent cross-border
exchange.[28]

The EU's new reformed data protection framework
therefore aims to ensure a consistent, high level of data protection to enhance
mutual trust between police and judicial authorities of different Member States,
thus contributing further to a free flow of data, and effective cooperation
between police and judicial authorities.

To ensure a high level of protection of personal
data in the field of police and judicial cooperation in criminal matters and to
facilitate exchanges of personal data between Member States' police and
judicial authorities, the Commission is proposing, as part of the data
protection reform package, a Directive which will:

-         apply general data protection principles to police cooperation and judicial cooperation in criminal matters,
while respecting the specific nature of these fields;[29]

-        provide for minimum harmonised
criteria and conditions on possible limitations to the general rules. This concerns,
in particular, the rights of individuals to be informed when police and
judicial authorities handle or access their data. Such limitations are
necessary for the effective prevention, investigation, detection or prosecution
of criminal offences;

-        establish specific rules to cover the
specific nature of law enforcement activities, including a distinction between
different categories of data subjects whose rights may vary (such as witnesses
and suspects).

5.
DATA PROTECTION IN A GLOBALISED WORLD

Individuals' rights must continue to be ensured
when personal data is transferred from the EU to third countries, and whenever
individuals in Member States are targeted and their data is used or analysed by
third country service providers. This means that EU data protection standards have
to apply regardless of the geographical location of a company or its processing
facility.

In today's globalised world, personal data is
being transferred across an increasing number of virtual and geographical
borders and stored on servers in multiple countries. More companies are
offering cloud computing services, which allow customers to access and store
data on remote servers. These factors call for an improvement in current
mechanisms for transferring data to third countries. This includes adequacy
decisions – i.e. decisions certifying 'adequate' data protection standards in
third countries – and appropriate safeguards such as standard contractual
clauses or Binding Corporate Rules[30],
so as to secure a high level of data protection in international processing
operations and facilitate data flows across borders.

Binding Corporate Rules

A corporate group regularly needs to transfer
personal data from its affiliates based in the EU to its affiliates located in
third countries. The group would like to introduce a set of Binding Corporate
Rules (BCRs) to comply with EU law while limiting the administrative
requirements for each individual transfer. In practice, BCRs ensure that a
single set of rules would apply throughout the group instead of various
internal contracts.

Based on current practices agreed at the
level of the Article 29 Working Party, the recognition that a company's BCRs
provide adequate safeguards implies a thorough review by three DPAs (one 'lead'
and two 'reviewers') but may also be commented on by several others.
Furthermore, many Member States' laws require additional national
authorisations for transfers covered by BCRs and this makes their adoption
process very burdensome, costly, long and complex.

Following the data protection reform:

- this process will be simpler and more
streamlined;

- BCRs will be validated only by one DPA,
with mechanisms to ensure the swift involvement of other relevant DPAs;

- Once one authority has approved a BCR, it
will be valid for the entire EU without needing any additional authorisation at
national level.

To address the challenges of globalisation,
flexible tools and mechanisms are needed – particularly for businesses
operating worldwide – while guaranteeing protection of individuals' data
without any loopholes. The Commission is proposing the following measures:

-         clear rules defining when EU law is applicable to data controllers
established in third countries, in particular by specifying that whenever goods
and services are offered to individuals in the EU, or whenever their behaviour
is monitored, European rules shall apply;

-        any adequacy decisions will be
taken by the European Commission on the basis of explicit and clear criteria, including
in the area of police cooperation and criminal justice;

-        legitimate flows of data to third
countries will be made easier by reinforcing and simplifying rules on
international transfers to countries not covered by an adequacy decision,
in particular by streamlining and extending the use of tools such as Binding
Corporate Rules, so that they can be used to cover data processors and
within groups of companies, thus better reflecting the increasing number
of companies involved in data processing activities, especially in cloud
computing;

-        engaging in dialogue and, where
appropriate, negotiations, with third countries – particularly EU
strategic partners and European Neighbourhood Policy countries – and relevant
international organisations (such as the Council of Europe, the Organisation
for Economic Cooperation and Development, the United Nations) to promote
high and interoperable data protection standards worldwide.

6.
CONCLUSION

The EU data protection reform aims to build a
modern, strong, consistent and comprehensive data protection framework for the
European Union. Individuals' fundamental right to data protection
will be reinforced. Other rights, such as freedom of expression and information,
the right of the child, the right to conduct a business, the right to a fair
trial and professional secrecy (such as for the legal profession), as well as
the status of churches under Member States' laws will be respected.

The reform will first of all benefit
individuals by strengthening their data protection rights and their trust in
the digital environment. The reform will furthermore simplify the legal
environment for businesses and the public sector substantially. This is
expected to stimulate the development of the digital economy across the EU's Single
Market and beyond, in line with the objectives of the Europe 2020 strategy and
the Digital Agenda for Europe. Finally, the reform will enhance trust among law
enforcement authorities in order to facilitate exchanges of data between them
and cooperation in the fight against serious crime, while ensuring a high level
of protection for individuals.

The European Commission will work closely with
the European Parliament and the Council to ensure an agreement on the EU's new
data protection framework by the end of 2012. Throughout this adoption process
and beyond, especially in the context of the implementation of the new legal
instruments, the Commission will maintain a close and transparent dialogue with all interested parties involving representatives from the private and public sector.
This will include representatives from the police and the judiciary, electronic
communications regulators, civil society organisations, data protection
authorities and academics, as well as from specialised EU agencies such as
Eurojust, Europol, the Fundamental Rights Agency, and the European Network and
Information Society Agency.

In a context of constant development of
information technologies and evolving social behaviour, such a dialogue is of
the utmost importance to benefit from the input necessary to ensure a high level
of data protection of individuals, the growth and competitiveness of EU
industries, the operational effectiveness of the public sector (including the police
and the judiciary) and a low level of administrative burden.

[1]               The market for the analysis of very large sets of
data is growing by 40% per year worldwide: http://www.mckinsey.com/mgi/publications/big_data/.

[2]               See also the conclusions of the European Council of
23 October 2011, which stressed the "key role" of the Single Market
"in delivering growth and employment", as well as the need to
complete the Digital Single Market by 2015.

[3]               COM(2010)171 final.

[4]               COM(2010)245 final.

[5]               COM(2010)2020 final.

[6]               Directive 95/46/EC on the protection of individuals
with regard to the protection of personal data and on the free movement on such
data, OJ L 281, 23.11.1995, p. 31.

[7]               Specific rules for processing by Member States in the
area of Common Foreign and Security Policy shall be laid down by a Council
Decision based on Article 39 TEU.

[8]               COM(2009)262 and COM(2010)171 respectively.

[9]               Two public consultations have been launched on the
data protection reform: one from July to December 2009 (http://ec.europa.eu/justice/news/consulting_public/news_consulting_0003_en.htm)
and a second one from November 2010 till January 2011 (http://ec.europa.eu/justice/news/consulting_public/news_consulting_0006_en.htm).

[10]             Targeted consultations were organised in 2010 with
Member State authorities and private stakeholders. In November 2010, EU Justice
Commissioner Viviane Reding organised a roundtable on the data protection
reform. Additional dedicated workshops
and seminars on specific issues (e.g. data breach notifications) were also held
throughout 2011.

[11]             COM(2010)609.

[12]             See the letter of EU Justice Commissioner Viviane
Reding of 19 September 2011 to the members of the Article 29 Working Party,
published at http://ec.europa.eu/justice/data-protection/article-29/documentation/other-document/index_en.htm.

[13]             See the Impact Assessment SEC(2012)72.

[14]             This will include, at a later stage, amendments to
align specific and sectoral instruments, for example Regulation (EC) No
45/2001, OJ L 8, 12.1.2001, p.1.

[15]             The Regulation also makes a limited number of technical
adjustments to the e-Privacy Directive (Directive 2002/58/EC as last amended by
Directive 2009/136/EC - OJ L 337, 18.12.2009, p. 11) to take account of the
transformation of Directive 95/46/EC into a Regulation. The substantive legal
consequences of the new Regulation and of the new Directive for the e-Privacy
Directive will be the object, in due course, of a review by the Commission,
taking into account the result of the negotiations on the current proposals
with the European Parliament and the Council.

[16]             Framework Decision 2008/977/JHA of 27 November 2008 on
the protection of personal data processed in the framework of police and
judicial cooperation in criminal matters, OJ L 350, 30.12.2008, p.60. A report
on the implementation by Member States of the Framework Decision (COM(2012)12) is
adopted as part of the data protection reform package.

[17]             See Special Eurobarometer 359 – Attitudes on Data
Protection and Electronic Identity in the European Union, June 2011, p. 23.

[18]             Ibidem, p. 54.

[19]             See Digital Agenda for Europe, cit., p.4.

[20]             This is currently compulsory only in the
telecommunications sector, based on the e-Privacy Directive.

[21]             For more details on this aspect, see the Impact
Assessment accompanying the legal proposals, SEC(2012)72.

[22]             The Article 29 Working Party was set up in 1996 (by
Article 29 of Directive 95/46/EC) with advisory status and composed of
representatives of national Data Protection Supervisory Authorities (DPAs), the
European Data Protection Supervisor (EDPS) and the Commission. For more
information on its activities see http://ec.europa.eu/justice/policies/privacy/workinggroup/index_en.htm.

[23]             A Directive is proposed to define the rules applicable
to the area of police cooperation and judicial cooperation in criminal matters
(see § 4 below), which will allow for more flexibility for Member States in
this specific area.

[24]             Court of Justice of the EU, judgment of 9.11.2010, Joined
Cases C-92/09 and C-93/09 Volker und Markus Schecke and Eifert [2010], not yet
officially reported.

[25]             In line with Article 52(1) of the Charter, limitations
may be imposed on the exercise of the right to data protection as long as the
limitations are provided for by law, respect the essence of the right and
freedoms and, subject to the principle of proportionality, are necessary and
genuinely meet objectives of general interest recognised by the European Union
or the need to protect the rights and freedoms of others.

[26]             Court of Justice of the EU, judgment of 6.11.2003,
C-101/01, Lindqvist [2003] ECR I-12971, para 82-90; judgement of 16.12.2008, C-73/07, Satamedia [2008],
ECR I-9831, para 50-62.

[27]             More precisely, the Framework Decision applies to personal
data that are or have been transmitted or made available between Member States
or exchanged between Member States and EU institutions or bodies (see Article
1(2)).

[28]             This was confirmed by some Member States when replying
to the Commission's questionnaire in relation to the Implementation Report on
the Framework Decision (COM(2012)12).

[29]             Cf. Declaration No 21 on the protection of personal
data in the fields of judicial cooperation in criminal matters and police
cooperation, as annexed to the Final Act of the Intergovernmental Conference
which adopted the Lisbon Treaty.

[30]             Binding Corporate Rules (BCRs) are codes of practices
based on European data protection standards, approved by at least one DPA,
which organisations draw up voluntarily and follow to ensure adequate
safeguards for categories of transfers of personal data between companies that
are part of the same corporate group and that are bound by those rules. They
are not explicitly covered in Directive 95/46/EC but have developed as a matter
of practice between DPAs, with the support of the Article 29 Working Party.