EN Official Journal of the European Union C 20/1

Opinion of the European Data Protection Supervisor on the Commission Green Paper on the Effective Enforcement of Judgements in the European Union: the Transparency of Debtors' Assets — COM(2008) 128 final

(2009/C 20/01)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular its Article 41,

Having regard to the request for an opinion in accordance with Article 28(2) of Regulation (EC) No 45/2001 received on 10 March 2008 from the European Commission,

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTION

Consultation of the EDPS

1. Prior to the adoption of the Green Paper, the Commission informally consulted the EDPS on its draft version, which the EDPS welcomed as it gave him an opportunity to make some suggestions on the draft prior to its adoption by the Commission.

2. As already made clear in his Policy paper on ‘The EDPS as an advisor to the Community institutions’, the EDPS does not only give advice on formal proposals, but may also react on preceding documents, such as communications or consultations, which serve as the basis for the policy choices made in the proposals for legislation (1). Accordingly, in this case the EDPS was consulted by the Commission by letter of 6 March 2008.

3. On the same date, the Commission launched a public consultation, inviting interested parties to submit comments by 30 September 2008. This opinion should be also considered as complementing this public consultation. The EDPS is available to provide informal comments on draft proposals arising from this Green Paper and expects to be consulted on any adopted legislative proposals pursuant to Article 28(2) of Regulation (EC) No 45/2001.

The Green Paper in its context and focus of the opinion

4. The Green Paper focuses on possible measures at EU level that can be adopted with a view to ‘improve the transparency of the debtor's assets and the right of creditors to obtain information whilst respecting the principles for the protection of debtor's privacy’ pursuant to the provisions of Directive 95/46/EC. The Green Paper analyzes in detail the current situation as well as a broad range of possible options to reach these objectives.

5. Against this background, this opinion is mainly aimed at providing guidance with regard to data protection issues that may arise in possible legislative initiatives stemming from this Green Paper.

6. First of all, it should be noted that the EDPS has already issued some opinions about proposals having many similarities with this draft Green Paper, in particular in the field of maintenance obligations (2) as well as in the co-ordination of social security systems (3).

7. All these initiatives share many elements: fostering and managing the circulation of personal information with a view to better ensure citizens' rights within an Area of Freedom Security and Justice; coping with different legal systems and national competent authorities; ensuring that the circulation of personal data is done in compliance with relevant data protection legislation, thus guaranteeing not only citizens' fundamental right to data protection but also the quality of the data used in the envisaged systems.

8. Against this background, the EDPS notes that some of the points made in the abovementioned opinions, as those mentioned in the following paragraphs, might be relevant and useful also in this case.

II. SUBSTANTIVE COMMENTS

Differences in Member States legal systems and legal grounds for processing personal data

9. First of all, it should be highlighted that in the area of transparency of debtors' assets, as the Green Paper recognizes, the systems currently in place in the Member States are very heterogeneous, both with regard to the authorities in charge of the enforcement (which may include both public authorities and private qualified professionals), and with regard to substantive rules. Since the Green Paper does not envisage harmonizing these aspects, these differences should be taken into account because enforcement authorities, acting as data controllers, may broadly differ.

10. According to Directive 95/46/EC, data controllers may process personal data only on the basis of the consent of the person concerned or some other legitimate legal basis, such as compliance with a legal obligation or performance of a task carried out in the public interest or in the exercise of official authority (Article 7(a), 7(c) and 7(e) of the Directive).

11. In this context, the EDPS notes that the use of consent as a legal ground seems to have a very limited scope, since the debtor is not likely to provide his consent freely for the processing of his personal data for the purpose of ensuring transparency of his assets in an enforcement perspective. On the contrary, laying down a specific legal — EU or national — obligation for enforcement authorities to process debtors' personal data would not only provide a suitable legal ground pursuant to Article 7(c), but may also foster the efficient and uniform availability of debtors' data, subject to clear data protection guarantees. Alternatively, a specific provision could be developed aiming at the performance of a public interest task pursuant to Article 7(e) of the Directive.

12. Therefore, the EDPS recommends that possible legislative actions stemming from the Green Paper should ensure that the processing of personal data carried out by the whole range of enforcement authorities is clearly based on at least one of the legal grounds laid down by Article 7 of Directive 95/46/EC (4).

Proportionality

13. Proportionality is a key concept to be taken into account in this context, in particular by ensuring that personal information about debtors is not excessive with regard to the debt and that it is kept only for as long as it is necessary for the purpose for which it is collected or further processed (5).

14. Therefore, the EDPS welcomes the last sentence of Chapter 4.b which, referring to the need to respect the principle of proportionality in the debtor's declaration, states that ‘the declaration should avoid information which is not necessary for the purpose for which it is required. A solution that obliges the debtor to disclose all his assets in advance is less privacy friendly than a solution where the debtor is required to declare only the necessary information when specific conditions are met’. Against this background, it is also important to ensure that access to debtors' personal data is proportionate to the purposes pursued and subject to specific limits. This issue is already referred to in the last sentence of Chapter 4.c, where the Green Paper states that in order to avoid undue coercion on the debtor, a possible future European Assets Declaration could prohibit the publication of the debtor's declaration in an open register. The EDPS notes that this general statement will require special attention and further specifications when putting forward proposals concerning a possible European debtors' list.

15. In this perspective, the EDPS recommends that the proportionality principle is duly taken into account not only with regard to the data elements to be disclosed by the debtors, but also with regard to other aspects such as the period of time during which the data are stored and disclosed, the entities having access to data, and the modalities of disclosure.

Limitation of purposes

16. Another relevant issue is the purpose limitation principle, according to which data should be collected for specified, explicit and legitimate purposes and not further processed for purposes incompatible with those purposes (Article 6(1)(b) of Directive 95/46/EC). Therefore, a complete and precise definition of the purposes for which debtor's personal data are processed would be an essential element of any proposal on transparency of debtors' assets.

17. This means that for example, as already briefly mentioned in footnote 25 of the draft Green Paper, the information on the debtor obtained for debt recovery should not be used for purposes other than the enforcement of the title held by the creditor.

18. However, exceptions to the principle of purpose limitation may be needed. This may happen, for example, in case a legislative initiative would establish that enforcement authorities collect from third parties (such as, for example, tax or social security authorities) personal data which have been originally collected for purposes other than debt recovery, like in the case of population registers as well as social security or tax registers (mentioned at paragraph II.2 of the Green Paper). Furthermore, it may also happen in case data processed for debt recovery are necessary to pursue other purposes, like for example in the case of a taxation investigation or the prosecution of a criminal offence.

19. These cases should be addressed in the light of Article 13 of Directive 95/46/EC, which lays down some possible exemptions to the principle of purpose limitation. In particular, Article 13(1), letter (a) — prosecution of criminal offences —, letter (e) — taxation matters —, letter (f) — exercise of official authority — or letter (g) — the protection of the rights and freedoms of others — could justify an exception in this context. These possibilities have been already used in a similar context at national or EU level, as mentioned by the Green Paper with regard to access to social security and tax registers and to cooperation between national tax authorities (6). In some cases, additional guarantees have been provided, such as judicial control or public oversight.

20. Nonetheless, Article 13 of Directive 95/46/EC requires that these exceptions shall be necessary and based on legislative measures, which can be taken both at EU or national level. In this context, it would be desirable that any proposals stemming from the Green Paper ensure that processing of personal data originally collected for purposes other than debt recovery are explicitly and clearly based on legislative measures. Furthermore, the legislator may consider whether to specifically refer in legislative measures stemming from the Green Paper to the conditions under which data collected to ensure transparency of debtors' assets may be processed for a different purpose.

21. Against this background, the EDPS recommends that any measures on transparency of debtors' assets respect the purpose limitation principle and that any necessary exception would comply with the conditions laid down by Article 13 of Directive 95/46/EC (7).

Information to debtors, data subject' rights and security measures

22. Besides the issues mentioned above, possible initiatives stemming from the Green Paper should also duly consider the following aspects: — pursuant to Section IV of Directive 95/46/EC, it is essential to adequately inform data subjects about the processing of their personal data and about their rights. In particular, this means that adequate information to debtors should be provided disregarding whether personal data have been collected directly from them or indirectly from third parties, — the data subjects' rights of access and rectification of personal data, pursuant to Article 12 of Directive 95/46/EC, as well as the right to object to the processing on the basis of compelling legitimate grounds, pursuant to Article 14, should be ensured. In this perspective, measures facilitating the use of these rights in a trans-border context might be envisaged (8), — appropriate technical and organizational measures pursuant to Article 17 of Directive 95/46/EC should be envisaged with a view to ensure an appropriate level of security in the transmission of the information between enforcement authorities and access to this information. Security of the system should be taken into account already at the moment of defining the architecture of the system of information exchange.

III. CONCLUSION

23. The EDPS welcomes the Green Paper and the broad consultation to which it has been submitted and recommends that: — possible legislative actions stemming from the Green Paper should ensure that the processing of personal data carried out by the whole range of enforcement authorities is clearly based on at least one of the legal grounds laid down by Article 7 of Directive 95/46/EC, and in particular its letter (c) and/or (e), — the proportionality principle is duly taken into account not only with regard to the data elements to be disclosed by the debtors, but also with regard to other aspects such as the period of time during which the data are stored and disclosed, the entities having access to data, and the modalities of disclosure, — any measures on transparency of debtors' assets respect the purpose limitation principle and that any necessary exception would comply with the conditions laid down by Article 13 of Directive 95/46/EC, — aspects concerning the provision of information to the debtors, the rights of data subjects, and the security of processing are duly taken into account.

24. The EDPS is available to provide informal comments on draft proposals arising from this Green Paper and expects to be consulted on any adopted legislative proposals pursuant to Article 28(2) of Regulation (EC) No 45/2001.

Done at Brussels, 22 September 2008. Peter HUSTINX European Data Protection Supervisor

(1) Policy paper ‘The EDPS as an advisor to the Community Institutions on proposals for legislation and related documents’, 18 March 2005, available at the EDPS website: www.edps.europa.eu

(2) Opinion of 16 May 2006 of the European Data Protection Supervisor on the Proposal for a Council Regulation on jurisdiction, applicable law, recognition and enforcement of decisions and cooperation in matters relating to maintenance obligations (OJ C 242, 7.10.2006, p. 20).

(3) Opinion of 6 March 2007 of the European data protection Supervisor on the Proposal for a Regulation of the European Parliament and of the Council laying down the procedure for implementing Regulation (EC) No 883/2004 on the coordination of social security systems (COM(2006) 16 final) (OJ C 91, 26.4.2007, p. 15).

(4) See also EDPS Opinion on maintenance obligations, § 14-18, and EDPS Opinion on coordination of social security systems, § 27-33.

(5) See also EDPS Opinion on maintenance obligations, § 45-49, and EDPS Opinion on coordination of social security systems, § 21-26.

(6) See pages 7-8 of the Green Paper.

(7) See EDPS Opinion on maintenance obligations § 14-16, and EDPS Opinion on coordination of social security systems § 18-20.

(8) See, for example EDPS Opinion on coordination of social security systems § 36-38, as well as Article 6 of the Commission proposal for a Council Framework Decision on the exchange of information extracted from criminal records between Member States (COM(2005) 690 final).