EN Official Journal of the European Union L 164/65

COMMISSION RECOMMENDATION (EU) 2017/1140

of 23 June 2017

on personal data that may be exchanged through the Early Warning and Response System (EWRS) established pursuant to Decision No 1082/2013/EU of the European Parliament and of the Council for the purposes of the coordination of contact tracing measures in relation to serious cross-border threats to health

(notified under document C(2017) 4197)

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 292,

Whereas:

(1) Decision No 2119/98/EC of the European Parliament and of the Council (1) established an early warning and response system (‘EWRS’) as a permanent communication network between the Commission and the competent public health authorities of the Member States for the prevention and control of certain categories of communicable diseases. The procedures governing the functioning of the EWRS were laid down in Commission Decision 2000/57/EC (2).

(2) Decision No 2119/98/EC was repealed and replaced by Decision No 1082/2013/EU of the European Parliament and of the Council (3). The new Decision re-enacted the EWRS. It also extended the scope of the permanent communication network to cover other types of biological threats, and other categories of serious cross-border threats to health including threats of chemical, environmental or unknown origin. In addition, it laid down rules on epidemiological surveillance, monitoring, early warning of, and combating serious cross-border threats to health.

(3) Decision 2000/57/EC was repealed and replaced by Commission Implementing Decision (EU) 2017/253 (4).

(4) Pursuant to Article 9(3)(i) of Decision No 1082/2013/EU, notification of serious cross-border threats to health through the EWRS should include data necessary to permit the identification of infected persons as well as of individuals potentially in danger (‘contact tracing data’). In line with Article 16(9)(b) of that Decision, and the objective to ensure the effectiveness and uniform application of such notifications, it is appropriate to recommend an indicative list of personal data that may be communicated by the EWRS competent authorities.

(5) The exchange of personal data through the EWRS should be carried out in accordance with the requirements of Directive 95/46/EC of the European Parliament and of the Council (5) and Regulation (EC) No 45/2001 of the European Parliament and of the Council (6). While, as a rule, Directive 95/46/EC and Regulation (EC) No 45/2001 preclude the processing of special categories of personal data, including data relating to an individual's health, such processing is nevertheless authorised insofar as it is necessary to protect the vital interests of the data subject, in accordance with Article 8(2)(c) of Directive 95/46/EC and with Article 10(2)(c) of Regulation (EC) No 45/2001, and also for reasons of substantial public interest, subject to the provision of suitable safeguards, as laid down in Union or Member State law, in accordance with, respectively, Articles 8(4) and 10(4) of those acts.

(6) Only the personal data necessary for the above purposes as determined in the individual cases should be exchanged through the EWRS, and this Recommendation should not constitute an authorisation to exchange all the types of personal data it concerns.

(7) The European Data Protection Supervisor was consulted in accordance with Article 28(2) of Regulation (EC) No 45/2001 and delivered an opinion on 24 August 2015 (C 2015-0629),

HAS ADOPTED THIS RECOMMENDATION:

1. An indicative list of personal data that may be exchanged for the purpose of coordination of contact tracing measures is set out in the Annex to this Recommendation.

2. This Recommendation is addressed to the Member States.

Done at Brussels, 23 June 2017. For the Commission Vytenis ANDRIUKAITIS Member of the Commission

(1) Decision No 2119/98/EC of the European Parliament and of the Council of 24 September 1998 setting up a network for the epidemiological surveillance and control of communicable diseases in the Community (OJ L 268, 3.10.1998, p. 1).

(2) Commission Decision 2000/57/EC of 22 December 1999 on the early warning and response system for the prevention and control of communicable diseases under Decision No 2119/98/EC of the European Parliament and of the Council (OJ L 21, 26.1.2000, p. 32).

(3) Decision No 1082/2013/EU of the European Parliament and of the Council of 22 October 2013 on serious cross-border threats to health and repealing Decision No 2119/98/EC (OJ L 293, 5.11.2013, p. 1).

(4) Commission Implementing Decision (EU) 2017/253 of 13 February 2017 laying down procedures for the notification of alerts as part of the early warning and response system established in relation to serious cross-border threats to health and for the information exchange, consultation and coordination of responses to such threats pursuant to Decision No 1082/2013/EU of the European Parliament and of the Council (OJ L 37, 14.2.2017, p. 23).

(5) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).

(6) Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).