EN Official Journal of the European Union C 37/1

Opinion of the European Data Protection Supervisor on the Commission Implementing Regulation (EU) No 404/2011 laying down detailed rules for the implementation of Council Regulation (EC) No 1224/2009 establishing a Community control system for ensuring compliance with the rules of the common fisheries policy

2012/C 37/01

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1),

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (2), and in particular Article 41(2) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION

1.1. Background

1. On 8 April 2011, the Commission adopted Implementing Regulation (EU) No 404/2011 laying down detailed rules for the implementation of Council Regulation (EC) No 1224/2009 establishing a Community control system for ensuring compliance with the rules of the common fisheries policy (the Implementing Regulation) (3).

2. The EDPS was not consulted under Article 28(2) of Regulation (EC) No 45/2001, despite the fact that the legislative initiative was included in the EDPS Inventory of priorities for legislative consultation (4). The present Opinion is therefore based on Article 41(2) of the same Regulation.

1.2. Objectives of the Implementing Regulation

3. The objective of Council Regulation (EC) No 1224/2009 of 20 November 2009 establishing a Community control system for ensuring compliance with the rules of the common fisheries policy (the Control Regulation) (5), is to put in place a European system for control, inspection, and enforcement so as to ensure compliance with all the rules of the common fisheries policy.

4. The Control Regulation obliged the Commission to adopt detailed rules and measures necessary to implement certain of its provisions. The Implementing Regulation establishes such detailed rules with regard to the following areas: general conditions for access to waters and resources (Title II), control of fisheries (Title III), control of marketing (Title IV), surveillance (Title V), inspection (Title VI), enforcement (Title VII), measures to ensure compliance by Member States (Title VIII), data and information (Title IX) and implementation (Title X).

1.3. Aim of the present Opinion

5. In March 2009, the EDPS issued an Opinion on the Control Regulation (6). The Opinion highlighted that the proposal involved the processing of various categories of data, which in some cases could be considered personal data. Personal data would normally be processed in all cases where the master or the owner of the vessel or any fisherman or member of the crew is identified or identifiable. On this ground, the EDPS made some recommendations on a few provisions of the proposal.

6. The EDPS further stressed that several articles of the proposed Regulation referred to a comitology procedure for the adoption of implementing rules and that some of these rules also involved data protection aspects (7). Given the impact that these rules may have on data protection, the EDPS thus recommended the Commission to consult him before these detailed rules were adopted. The Implementing Regulation was adopted last 8 April 2011, but the EDPS was not consulted before the adoption.

7. The EDPS regrets that the Implementing Regulation was not submitted to him for prior consultation as recommended in the 2009 Opinion. He would like to nonetheless draw the attention of the Commission to a few aspects of the Implementing Regulation liable to raise concerns from a data protection point of view. For this reason, the EDPS has decided to submit this brief Opinion. The EDPS’ comments will focus mainly on the following aspects: (i) monitoring of the activities of the fishing vessels and data protection; (ii) vessels remote monitoring systems; (iii) retention of personal data by the Commission and the competent authorities; and (iv) applicability of Regulation (EC) No 45/2001.

2. ANALYSIS OF THE IMPLEMENTING REGULATION

2.1. Monitoring of the activities of the fishing vessels and data protection

8. Recital 31 provides that the processing of personal data under the Implementing Regulation is governed by Directive 95/46/EC and Regulation (EC) No 45/2001, ‘in particular as regards the requirements of confidentiality and security of processing, the transfer of personal data from the national systems of Member States to the Commission, the lawfulness of processing, and the rights of data subjects to information, access and rectification of their personal data’. The EDPS welcomes this reference to the applicable data protection legislation.

9. The activities of the fishing vessels are subject to systematic and detailed monitoring through advanced technological means, including satellite tracking devices and computerised databases (8). The geographical position, course and speed of fishing vessels is regularly monitored by the Vessel Monitoring System (VMS) (9) and, where applicable, the Automatic Identification System (AIS) (10) or the Vessel Detection System (VDS) (11). All these data are systematically cross-checked, analysed and verified through computerised algorithms and automated mechanisms in order to spot inconsistencies or suspected infringements. As Article 145(3) of the Implementing Regulation shows, this processing may resort, as appropriate, in data mining and profiling activities (12).

10. As long as these data can be linked to identified or identifiable individuals (e.g. the master of the vessel, the owner of the vessel, or the members of the crew), such monitoring involves the processing of personal data. It is therefore important that the control system is well-balanced and that adequate safeguards are put in place and implemented in order to avoid that the rights of the persons involved are unduly restricted. This implies for instance a clear delimitation of the purposes for which the relevant data can be processed, the minimisation of the (personal) data being processed and the establishment of maximum retention periods for the same data. This is especially important in the present case where the processing operations potentially involve data concerning offences or suspected offences, which are likely to be linked to the personal data of the owner and/or the master of the vessel.

11. Having regard to the scope and scale of the monitoring activities, it appears that the Implementing Regulation does not always successfully strike a balance between the objective of ensuring compliance and the respect for privacy and data protection of the individuals concerned. As the Implementing Regulation has already been adopted, the EDPS considers it important for the Commission to clarify ex post, where possible, the scope and limits of the processing activities and provide for specific safeguards where necessary. This could be achieved, for instance, by adopting general or specific guidance or internal rules aimed at clarifying certain aspects of the processing activities with regard to the protection of personal data or in the framework of prior checks with the EDPS under Article 27 of Regulation (EC) No 45/2001.

12. The main aspects which in the EDPS’ view require further specification are discussed below.

2.2. Use of VMS, AIS and VDS data and purpose limitation principle

13. One of the basic principles of the fundamental right to data protection is that personal data shall be processed only for specified, explicit and legitimate purposes (13). The purpose limitation principle establishes a special responsibility for data controllers but also sets out a requirement for the legislator, by demanding that legislative provisions must not be framed in such a general way as to justify the use of personal data for purposes which are not sufficiently defined. Derogations of the purpose limitation principle are possible, provided that they are necessary and proportionate and that the other requirements set out in Article 52 of the Charter of the Fundamental Rights of the European Union are complied with.

14. As mentioned, the Control Regulation and the Implementing Regulation provide for the systematic and detailed monitoring of fishing activities by means of VMS, AIS and VDS. Pursuant to Article 12 of the Control Regulation, data from the VMS, AIS and VDS may be transmitted to EU agencies and competent authorities of the Member State engaged in surveillance operations for the purpose of ‘maritime safety and security, border control, protection of the maritime environment and general law enforcement’. Article 27 of the Implementing Regulation further specifies that Member States shall use VMS data ‘for the effective monitoring of the activities of fishing vessels’ and that Member States shall ‘take all necessary measures to ensure that they are used only for official purposes’.

15. Having regard to the purpose limitation principle, the EDPS considers that Article 12 of the Control Regulation and Article 27 of the Implementing Regulation are too broadly formulated. If not interpreted restrictively, the expressions ‘general law enforcement’, ‘monitoring of the activities of the fishing vessels’ and ‘official purposes’ are likely to cover an overly broad range of processing activities, not even remotely connected with the purposes of the Control Regulation. This open-ended approach raises concerns in connection with the purpose limitation principle.

16. In light of the above considerations, the EDPS advises the Commission to provide concrete guidance on the interpretation of Article 27 of the Implementing Regulation. The Commission should in particular clarify the meaning, and limit the scope, of VMS, AIS and VDS data processing for ‘general law enforcement’ or other purposes unconnected with the common fisheries policy.

2.3. Retention periods

17. Another fundamental principle of the data protection legislation is that personal data should be kept in a form which permits the identification of data subjects for no longer than necessary for the purposes for which the data were collected (14). This principle is also directly connected with purpose limitation. If personal data are no longer necessary for the initial purpose, the retention of those data is no longer admissible as it would constitute a processing incompatible with the original purpose.

18. The Implementing Regulation sets a minimum retention period of three years in relation to a number of data. With regard to VMS data, for example, Article 27(2)(a) provides that Member States shall ensure that the relevant data are recorded in a computer readable form and safely stored in computerised databases ‘for at least three years’. Similarly, Article 92(3) provides that data related to the surveillance reports shall be kept available in the database for ‘at least three years’. Moreover, Article 118 establishes that the data from the inspection reports shall be kept available in the database ‘for at least three years’.

19. In general, the EDPS considers that the storage period should have been established more precisely by setting a maximum period of retention (instead of only a minimum retention period). In any event, he takes the view that the above provisions should be interpreted consistently with Article 6(1)(e) of Directive 95/46/EC and Article 4(1)(e) of Regulation (EC) No 45/2001. This implies that the period of retention of three years should be interpreted in principle as a maximum retention period, unless the necessity to retain the data for a longer period can be adequately demonstrated on the basis of convincing evidence.

2.4. Administrative cooperation and transfers of data to third countries

20. Article 164 of the Implementing Regulation governs information exchanges with third countries. Article 164, paragraph 2, in particular deals with information exchanges from a Member State to a third country or a Regional Fisheries Management Organisation under a bilateral agreement with that country or in accordance with the rules of a that Organisation. Article 164, paragraph 3, deals with exchanges of information concerning non-compliance with the rules of the Common Fisheries Policy, from the Commission, or the body designated by it, in the framework of fisheries agreements concluded between the Union and third countries or in the framework of Regional Fisheries Management Organisation or similar arrangements.

21. While Article 164, paragraph 2, specifies that the information exchange from Member States to third countries shall take place ‘in accordance with EU and national legislation regarding the protection of individuals with regard to the processing of personal data’, paragraph 3 does not contain a similar reference with regard to information exchanges originating from the Commission. Under paragraph 3, the information exchange is made subject only to the consent of the Member State that supplied the information.

22. In this respect, the EDPS highlights that the communication of personal data from the Commission or other European Institutions or bodies to third countries under Article 164 may take place only if the requirements of Regulation (EC) No 45/2001 and in particular Articles 9 thereof, are complied with.

2.5. The Commission should consider the need for prior-checking

23. The Control Regulation and the Implementing Regulation may involve the processing of personal data by the Commission or other EU bodies, thereby triggering the applicability in these cases of Regulation (EC) No 45/2001 to such processing operations. To the extent that these processing operations are likely to present specific risks to the rights and freedoms of data subjects, they shall be subject to prior checking of the EDPS under Article 27 of Regulation (EC) No 45/2001.

24. In particular, it appears that the processing operations carried out under the Control Regulation and the Implementing Regulation may involve the processing of data related to offences or suspected offences committed by a vessel. These data are likely to be linked with the personal data of the owner or the master of the vessel (or a member of the crew) in connection with the breaches of the applicable rules.

25. Consequently, the EDPS invites the Commission (and other European bodies concerned) to consider the need for prior checking of the processing operations carried out under the Control Regulation and the Implementing Regulation and submit the necessary notifications further to this assessment (15).

CONCLUSIONS

26. The EDPS regrets that the text of the Implementing Regulation was not notified to him for legislative consultation under Article 28(2) of Regulation (EC) No 45/2001, as recommended in the 2009 Opinion. Although the EDPS welcomes the reference to the applicable data protection legislation in recital 31 of the Implementing Regulation, he finds that certain provisions of this Regulation are liable to raise data protection concerns.

27. Given that the Implementing Regulation has already been adopted, the EDPS advises the Commission to clarify ex post, where possible, the scope and the limits of the processing activities and provide specific safeguards where necessary. This could be done by adopting general or specific guidance or internal rules or in the framework of prior checks with the EDPS under Article 27 of Regulation (EC) No 45/2001.

28. In particular, the EDPS advises the Commission and other EU bodies concerned to: — provide concrete guidance on the interpretation of Article 27 of the Implementing Regulation; the Commission should in particular clarify the meaning, and limit the scope, of VMS, AIS and VDS data processing for ‘general law enforcement’ or for other purposes unconnected with the common fisheries policy, — whenever the Implementing Regulation sets a minimum retention period in relation to specific categories of data (see the examples provided in paragraph 19), only retain personal data for longer periods if the necessity to do so can be adequately demonstrated, — ensure that the transfer of personal data from the Commission or other European Institutions or bodies to third countries under Article 164 of the Implementing Regulation complies with the requirements of Regulation (EC) No 45/2001 and in particular Article 9 thereof, — consider the need for prior checking with the EDPS of the processing operations carried out under the Control Regulation and the Implementing Regulation and submit the necessary notifications further to this assessment.

Done at Brussels, 28 October 2011. Giovanni BUTTARELLI Assistant European Data Protection Supervisor

(1) OJ L 281, 23.11.1995, p. 31.

(2) OJ L 8, 12.1.2001, p. 1.

(3) OJ L 112, 30.4.2011, p. 1.

(4) Available on the EDPS website (http://www.edps.europa.eu) in the section: Consultation/Priorities.

(5) OJ L 343, 22.12.2009, p. 1.

(6) Opinion of the European Data Protection Supervisor on the Proposal for a Council Regulation establishing a Community control system for ensuring compliance with the rules of the common fisheries policy (OJ C 151, 3.7.2009, p. 11).

(7) See EDPS Opinion on the Proposal for a Council Regulation establishing a Community control system for ensuring compliance with the rules of the common fisheries policy, cited above, paragraphs 29-30.

(8) See, in this regard, Commission memorandum of 12.4.2011, MEMO/11/234.

(9) VMS consists in a satellite tracking device installed on board fishing vessels which collects data on the fishing vessel identification, geographical position, date, time, course and speed and transmits these data to the fisheries monitoring centre of the flag Member State (see Article 4, point 12 of the Control Regulation).

(10) AIS means an autonomous and continuous vessel identification and monitoring system which provides means for ships to electronically exchange with other nearby ships and authorities ashore ship data including identification, position, course and speed (see Article 4, point 11 of the Control Regulation).

(11) VDS means a satellite based remote sensing technology which can identify vessels and detect their positions at sea (see Article 4, point 13 of the Control Regulation).

(12) Pursuant to Article 145(3) ‘All results of the computerised validation system, both positive and negative, shall be stored in a database. It shall be possible to identify immediately any inconsistency and non-compliance issue detected by the validation procedures, as well as the follow-up of these inconsistencies. It shall also be possible to retrieve the identification of fishing vessels, vessel masters or operators for which inconsistencies and possible non-compliance issues were detected repeatedly in the course of the past three years’.

(13) Article 8 of the Charter of the Fundamental Rights of the European Union and Article 6(1)(b) of Directive 95/46/EC and Article 4(1)(b) of Regulation (EC) No 45/2001.

(14) Article 6(1)(e) of Directive 95/46/EC and Article 4(1)(e) of Regulation (EC) No 45/2001.

(15) As already recommended in the 2009 Opinion, see paragraph 22.