EN Official Journal of the European Union C 192/1

Opinion of the European Data Protection Supervisor on the Recommendation for a Council Regulation amending Regulation (EC) No 2533/98 of 23 November 1998 concerning the collection of statistical information by the European Central Bank

2009/C 192/01

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular its Article 41,

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTION

Recommendation to amend the Regulation concerning the collection of statistical information by the European Central Bank

1. On 23 November 1998, the Council of the European Union adopted Regulation (EC) No 2533/98 concerning the collection of statistical information by the European Central Bank (hereinafter ‘Regulation (EC) No 2533/98’) (1). In order to maintain this Regulation as an effective instrument to carry out the statistical information collection tasks of the European System of Central Banks (hereinafter the ‘ESCB’) a number of amendments are being considered. On 15 September 2008, the Governing Council of the European Central Bank (hereinafter the ‘ECB’) unanimously adopted a Recommendation (2) (hereinafter the ‘Recommendation’) for a Council Regulation amending Regulation (EC) No 2533/98 (3).

2. On 4 February 2009, the Council decided to consult the European Data Protection Supervisor (hereinafter the ‘EDPS’) and invited him to submit his opinion (4). It must be underlined that such consultation at the Coreper's stage, although unusual, is covered by Articles 41 and 46(d) of Regulation (EC) No 45/2001.

3. The main articles of Regulation (EC) No 2533/98 which are submitted for amendments are Articles 1, 2, 3 (partly) and 8. Although Article 8 specifically deals with the confidentiality regime, the EDPS considers that the other articles may also have an impact on the protection of personal data and are therefore part of the current analysis.

4. Last, the general context in which this Recommendation is analysed must also take into account the proposal for a Regulation of the European Parliament and of the Council on European Statistics (5), a proposal for which the EDPS also provided his opinion (6). Both texts are interlinked. This connection between the two regulations implies, as was underlined in the latter opinion, that close cooperation and appropriate coordination should be ensured between the European Statistical System and the ESCB, while preserving the respective governance structures. The EDPS also explained his interpretation of the notions of confidentiality and anonymity in the context of statistics. This analysis remains valid.

II. ANALYSIS OF THE PROPOSAL

Statistical Information

5. The EDPS welcomes that the proposed amendments contain a specific reference to the data protection legal framework. Indeed, where Regulation (EC) No 2533/98 presently only refers to Directive 95/46/EC, it is now proposed that Article 8(8) also refers to Regulation (EC) No 45/2001, the latter covering more specifically the activities of the ECB as a European institution.

6. Moreover, this provision confirms recital 34 of Regulation (EC) No 45/2001 which states that: ‘Under Article 8(8) of Council Regulation (EC) No 2533/98 of 23 November 1998 concerning the collection of statistical information by the European Central Bank, that Regulation is to apply without prejudice to Directive 95/46/EC’. In this context, it is also without prejudice to Regulation (EC) No 45/2001.

7. As explained in the preamble of the Recommendation, its main objective is to review the scope of Regulation (EC) No 2533/98 in order to maintain it as an effective instrument for the ECB to carry out the statistical information collection tasks of the ESCB. It should also guarantee the continued availability to the ECB of statistical information of the necessary quality (and) covering the entire range of tasks of the ESCB.

8. Although the expression ‘statistical information’ is used extensively both in Regulation (EC) No 2533/98 and in the Recommendation adopted by the ECB, the EDPS notes that the expression ‘statistical information’ is not defined in any of these texts, except by some reference to the definition of reporting requirements (Article 1(1) of Regulation (EC) No 2533/98). The EDPS considers that the scope of this expression should be clarified in the context of Regulation (EC) No 2533/98, especially as statistical information may cover data coming not only from legal, but also from natural persons (also described as reference reporting population). Therefore personal data in the sense of Regulation (EC) No 45/2001 may be collected and although these data would be processed in a statistical form, they could still be data on identifiable individuals (i.e. indirectly, through code or because a very small proportion of people with specific characteristics is mentioned). Moreover, it is equally important to define this expression as the Recommendation deals with the possibility to grant to scientific research bodies access to confidential statistical information which ‘does not allow direct identification’ (Article 8(4)) or expressed in a positive way: which still allows indirect identification.

9. According to the EDPS, the expression could be understood in a similar fashion as in the proposal for a Regulation on European Statistics (where it is defined as: ‘all different forms of statistics including basic data, indicators, accounts and metadata’). Nonetheless, in the case of the ECB, the notion of statistical information should be limited to statistics on natural and legal persons which are processed within the sphere of competence of the ECB. The EDPS suggests that further clarification about this expression be given in the recitals.

Purpose

10. According to the Explanatory Memorandum of the Recommendation, the existing architecture of the collection of statistical information is based on a one-to-one link between the reference reporting population (the natural and legal persons subject to reporting requirements) and specific types of statistics (as described in Article 2(2) of Regulation (EC) No 2533/98). In the view of the ECB, this architecture has become ineffective because data are increasingly collected only once and serve multiple statistical purposes, in order to minimise the reporting burden. Therefore the ECB proposes to extend the scope of the purposes by providing an indicative list of all statistical purposes for which statistical information may be collected from the reference reporting population.

11. The EDPS takes note of the reasons why the widening of scope is requested, but underlines that one of the principles contained in Regulation (EC) No 45/2001 relates to the purpose limitation. This principle states that personal data must be processed for specific, explicit and legitimate purposes and must not be further processed in a way incompatible with those purposes. This principle contained in Article 4(1)(b) is further clarified as it is stated ‘that further processing of personal data for historical, statistical or scientific purposes shall not be considered incompatible provided that the controller provides appropriate safeguards, in particular to ensure that the data are not processed for any other purposes or used in support of measures or decisions regarding any particular individual’.

12. The EDPS acknowledges, in view of the facts described in the Explanatory Memorandum of the Recommendation that the existing practice has not been compliant with Regulation (EC) No 45/2001 as data have been further processed for purposes not established in Regulation (EC) No 2533/98. By creating an ‘indicative’ list of purposes going beyond the framework of Regulation (EC) No 2533/98, the purpose limitation principle of Regulation (EC) No 45/2001 would still not be fully met.

13. However, it was stressed in comments received from the ECB on this point that Regulation (EC) No 2533/98 remains an ‘umbrella Regulation’ which establishes the reference reporting population (the scope of entities from which the ECB may potentially collect data for performing its tasks). To be able to impose actual reporting obligations to the reporting agents, the ECB has to issue a specific ECB legal act that defines both the actual reporting population and the specific reporting requirements.

14. The EDPS considers that any modification introduced in the Regulation on this aspect should clarify the extent to which data will be processed in the future or at least more precisely specify the expected purposes within the remit of the ECB's competences. Therefore, the EDPS does not oppose the widening of the purposes for which statistical information is collected, but suggests deleting any reference to the establishment of an indicative list of purposes. Moreover, the text could confirm that any ECB legal act that defines the actual reporting population and the specific reporting requirements will not go beyond the limitation of purposes within the specific competences of the ECB.

15. Furthermore, as a matter of clarification, the EDPS can not agree with the explanation given by the ECB in the Explanatory Memorandum of the Recommendation, according to which ‘information becomes statistical information if it is used for the compilation of statistics, irrespective of the purpose for which it was originally collected’. The purpose limitation principle does not allow such an interpretation. Indeed, personal data shall be collected in the first place for one or more specific purposes and may be further used for (other) statistical purposes subject to appropriate safeguards (see Article 4(1)(b) of Regulation (EC) No 45/2001 referred to in point 11).

16. Last, the EDPS notes that the purpose limitation is already underlined in the proposed Article 8(4)(a) which states that ‘(…) the ESCB shall use confidential statistical information transmitted to it exclusively for the exercise of the tasks of the ESCB except in any of the following circumstances: (a) if the reporting agent or the other legal person, natural person, entity or branch which can be identified, has explicitly given its consent to the use of the said statistical information for other purposes’. By requesting the explicit consent to extend the initial purpose, the ECB acknowledges that purposes should be limited as a principle.

Payment statistics

17. Moreover, in the proposed indicative list of purposes for which statistics may be collected from the reference reporting population, the EDPS has noted that the recommendation (Article 2(1)) adds the notion of ‘payment statistics’ to the already existing purpose of ‘payment system statistics’. This means that the statistics to be collected will cover data on individual payments as part of payment systems statistics (i.e. infrastructure of payments). This addition of payment statistics makes it all relevant to ensure that the rules on data protection are respected.

18. Although the EDPS understands that Article 105(2) of the EC Treaty gives the ESCB a mandate to promote the smooth operation of payment systems and that, in this context, comprehensive information on both the payments infrastructures and the payments carried out via these infrastructures may be necessary for ECB policy-making, this mandate should be limited to what is necessary in order to achieve the ECB's policy making and should not allow the collection of financial information relating to natural persons who are identifiable (either directly or indirectly). Even if the EDPS can understand that it is important to collect information on the payments themselves — for example data on credit card payments for conjectural analysis or for balance of payment purposes, he wants to underline that whether data on credit cards are collected directly from the natural person or from the card companies and/or payment system runners on an aggregated basis, they still may contain personal information about natural persons.

19. However, if in specific cases, there might be some reasons to process such payment statistics, the ECB stated that they will comply with the applicable data protection legal framework. This covers the need to ascertain the necessity of the processing and to ensure that security measures are taken.

Reporting population

20. Similar to the Commission in its opinion on the Recommendation (7), the EDPS recognises the need expressed by the ECB in the Recommendation to adjust the scope of the reference reporting population. The reason given by the ECB is that financial markets are becoming increasingly complex, with steadily growing interlinkages between the financial transactions and balance sheet positions of different types of financial intermediaries (such as monetary financial institutions, insurance corporations and financial vehicle corporations).

21. In turn, this may imply that the ECB requires comparable, frequent and timely statistics for these subsectors, so that it can continue to carry out its tasks. However, the consequence will be that such modification of the reference reporting population will increase the collection of information by the different actors involved in the ESCB. In order to avoid unnecessary collection of data, the EDPS notes that the ECB intends to ensure that it will only collect the necessary statistical information if the merits of doing so outweigh the costs and if this information is not already collected by other bodies.

22. However, in order to ensure the respect of the data quality principle as well as the data minimization principle, the EDPS considers that a specific procedure to ensure that the information is not already collected by other bodies should be put in place. The ECB confirmed that discussions are ongoing between the ESS (Eurostat) and the ECB in order to develop procedures for further fostering cooperation and minimisation of reporting burden. The EDPS considers that such cooperation should be further developed.

Exchange of confidential information

23. The Recommendation amends Article 3 of Regulation (EC) No 2533/98 by mentioning several statistical principles, among which the principle of statistical confidentiality. Furthermore, it modifies Article 8 as regards the confidentiality regime established. The idea is to mirror the content of the proposal for a Regulation on European Statistics. As was already underlined in this text, there is a need to introduce more flexibility in the existing rules on statistical confidentiality between the European Statistical System (ESS) and the ESCB. The proposed new regime introduced by the Recommendation reiterates this need by stating that in order to ensure an efficient and effective exchange of the necessary statistical information, the legal framework should foresee that such a transmission can take place provided that it is necessary for the efficient development, production or dissemination of European statistics.

24. The EDPS already had the occasion to clarify his position regarding the transmission of confidential data between the ESS and the ESCB (8). The EDPS considered that such transfers taking place between Eurostat and the ECB comply with the conditions of necessity provided for in Article 7 of Regulation (EC) No 45/2001. In the light of the proposed amendments, the EDPS confirms that such transfer could take place but for statistical purposes only and by guaranteeing protection from unlawful disclosure. This aspect could be further underlined in the modification of Regulation (EC) No 2533/98. Paragraph 3 of Article 8 already contains some measures but the EDPS suggests adding for instance that reporting agents shall be informed that the further transmission will take place for statistical purposes only and that persons receiving this statistical information are reminded of the confidential aspect of this statistical information.

Access to non-directly identifiable confidential statistical information for research purposes

25. The EDPS notes that the approach adopted by the ECB towards access to non-directly identifiable confidential statistical information for research purposes is to allow such access while maintaining strict confidentiality safeguards. Paragraph 4 of Article 8 foresees the prior explicit consent of the authority which provided the information.

26. In the context of processing of non-directly identifiable confidential statistical information, the EDPS wants to underline that the definition of personal data contained in Article 2(a) of Directive 95/46/EC reads as follows: ‘Personal data shall mean any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity’.

27. Furthermore, as was analysed by the EDPS in his Opinion on the proposal for a Regulation of the European Parliament and of the Council on Community statistics on public health and health and safety at work (9), ‘non-direct identifiability’ relates to the notion of anonymity from a statistical point of view. Although, from a data protection view, the notion of anonymity would cover data that are no longer identifiable (see recital 26 of the Directive 95/46/EC), from a statistical point of view, anonymous data are data for which no direct identification is possible.

28. Therefore, this definition implies that the indirect identification of statistical information would remain possible and the processing would still be subject to compliance with Regulation (EC) No 45/2001. In this respect, Article 4(1)(e) specifies that personal data ‘must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. The Community institution or body shall lay down that personal data which are to be stored for longer periods for historical, statistical or scientific use should be kept either in anonymous form only or, if that is not possible, only with the identity of the data subjects encrypted. In any event, the data shall not be used for any purpose other than for historical, statistical or scientific purposes’.

29. As a result, in the case of such access for research purposes, the EDPS considers that the statistical information should be provided in such a way that the reporting agent cannot be identified, either directly or indirectly, when account is taken of all relevant means that might reasonably be used by a third party.

III. CONCLUSION

30. The EDPS notes the willingness to improve the exchange of statistical information between the ESS and the ESCB and the access for research purposes. Although it is welcome that such exchange and access may take place while ensuring strict confidentiality of the data, some clarifications are needed as regards the terminology used and the concepts covered by such exchange and access.

31. The EDPS has the following comments regarding the submitted Recommendation and future change of Regulation (EC) No 2533/98: — further clarification about the expression of ‘statistical information’ should be made in the recitals of the Regulation, as the notion of statistical information in the context of Regulation (EC) No 2533/98 should be limited to statistics on natural and legal persons which are processed within the sphere of competence of the ECB, — the EDPS does not oppose the widening of purposes but objects to a list of purposes which would be indicative and not sufficiently specified, — it should be ensured that the data protection framework is fully applied in the case of collection of payment statistics. The collection of financial information relating to natural persons who are identifiable (either directly or indirectly) should normally not be allowed, unless the necessity of the processing is clearly demonstrated and security measures are implemented, — further collaboration between the ESS and the ECB should be developed in view of ensuring the respect of the data quality principle as well as the data minimization principle, — it should be ensured that access to statistical information for research purposes should be provided in such a way that the reporting agent cannot be identified, either directly or indirectly, when account is taken of all relevant means that might reasonably be used by a third party.

Done in Brussels, 8 April 2009. Peter HUSTINX European Data Protection Supervisor

(1) OJ L 318, 27.11.1998, p. 8.

(2) OJ C 251, 3.10.2008, p. 1.

(3) The procedure to adopt such amendments is based on Article 107(6) of the Treaty establishing the European Community and subsequently on Articles 5(4) and 41 of the Statute of the European System of Central Banks and the European Central Bank.

(4) The Council also consulted the European Commission on 13 October 2008, which submitted a Commission Opinion on 13 January 2009, COM(2008) 898 final.

(5) COM(2007) 625 final of 16.10.2007.

(6) OJ C 308, 3.12.2008, p. 1.

(7) Commission Opinion of 13 January 2009, COM(2008) 898 final.

(8) See point 27 of Opinion of the European Data Protection Supervisor on the proposal for a Regulation of the European Parliament and of the Council on European Statistics (COM(2007) 625 final).

(9) OJ C 295/1, 7.12.2007, see points 14 to 18.