EN Official Journal of the European Union C 91/1

Opinion of the European Data Protection Supervisor on the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 1073/1999 concerning investigations conducted by the European Anti-Fraud Office (OLAF)

(2007/C 91/01)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1),

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (2), and in particular its Article 41,

Having regard to the request for an opinion in accordance with Article 28 (2) of Regulation (EC) No 45/2001 received on 15 September 2006 from the Commission;

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTION

1. The Proposal for a Regulation amending Regulation (EC) No 1073/1999 of the European Parliament and the Council of 25 May 1999 concerning investigations conducted by OLAF (3) (hereinafter ‘the Proposal’) contains revisions to most of the articles of Regulation (EC) No 1073/1999 (4). This Regulation sets forth the operational rules to be followed by those involved in OLAF investigations and, as such, it constitutes the legal basis for OLAF's operational activities.

Consultation with the EDPS

2. The Proposal was sent by the Commission to the EDPS on 15 September 2006. The EDPS understands this communication as a request to advise Community institutions and bodies, as foreseen in Article 28(2) of Regulation (EC) No 45/2001 of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (hereinafter Regulation (EC) No 45/2001). In view of the mandatory character of Article 28(2) of Regulation (EC) No 45/2001, the EDPS welcomes the explicit reference to this consultation in the preamble of the Proposal.

3. The comments made in this Opinion apply mutatis mutandis to the Proposal for a Council Regulation amending Council Regulation (Euratom) No 1074/1999 of 25 May 1999 concerning investigations conducted by the European Anti-Fraud Office (OLAF) (5).

The Importance of the Proposal and the EDPS Advice

4. The EDPS deems it important to deliver an opinion on this Proposal in the light of its impact on individuals' rights to data protection and privacy. Taking into account that the Proposal sets forth new rules to be followed by OLAF to conduct investigations of alleged illegal activities, it is essential to ensure that in doing so, the data protection and privacy rights of the persons implicated in such investigations, suspected infringers and also staff members and other individuals who provide information to OLAF, are properly guaranteed. This is even more important given the particularly sensitive type of information that OLAF may potentially collect, which includes data relating to suspected offences, offences, criminal convictions, health data as well as information that would serve to exclude individuals from a right, benefit or contract insofar as such information represents a particular risk to the rights and freedoms of the data subjects.

Main Elements of the Proposal and Initial Comments

5. The proposed amendments to Regulation (EC) No 1073/1999 respond to different goals and objectives (6). For example, some amendments aim at improving the effectiveness and efficiency of OLAF investigations, for example, to ensure that OLAF's powers of investigation cover economic operators in Member States receiving Community funds. Others intend to facilitate the exchange of information about suspected wrongdoings between OLAF and the various institutions concerned, at both EU and national level. (7) Finally, some of the proposed amendments seek to guarantee the rights of the persons implicated in an investigation, including their right to data protection and privacy and make procedural guarantees stronger.

6. The EDPS agrees with the significance of the goals and objectives pursued by the proposed amendments and, to this extent, he welcomes the Proposal. The EDPS particularly values the procedural guarantees afforded to individuals under the Proposal. This is particularly true regarding the possibility of suspected individuals to request an opinion from the Review Adviser as to whether the procedural guarantees were respected during the investigation. The EDPS is also pleased with the amendments that aim to provide more information to whistleblowers and informers. From the perspective of the protection of individuals' rights to the protection of their personal data and privacy, the EDPS considers that on the whole the Proposal contains improvements vis-à-vis the current situation. For example, the EDPS welcomes the recognition of the application of several data protection rights during the investigations such as the right of the suspected person to be informed of the investigation and have his/her views known.

7. However, despite the overall positive impression, the EDPS considers that from the point of view of the protection of personal data, the Proposal could be further improved, without jeopardising the objectives that it pursues. In particular, the EDPS is concerned that the Proposal may be deemed as a lex specialis regulating the processing of personal data collected in the scope of OLAF investigations, which would take precedent over the application of the general data protection framework contained in Regulation (EC) No 45/2001. This is particularly worrisome considering that the data protection standards contained in the Proposal are lower than those contained in Regulation (EC) No 45/2001, and this without any apparent justification.

8. In order to avoid this outcome, the following section provides an analysis of the Proposal which, on the one hand, describes its shortcomings and, on the other hand, suggests specific ways to address them. Obviously, the scope of this analysis is limited to the provisions having an impact on personal data protection, particularly Article 1, section (5), (6) and (7) pursuant to which Articles 7a, 8 and 8a are added or amended.

II. ANALYSIS OF THE PROPOSAL

II.1. Article by Article Examination of the Proposal

II.1.a. Data Quality Principle

9. The data quality principle, which is recognised in Article 4 of Regulation (EC) No 45/2001, encompasses various specific aspects. In particular, pursuant to this principle, personal data must be accurate, it must conform to the objective reality and it must also be complete and updated. Second, data must not be excessive and it must be adequate so that there is a link between the information and the purpose for which it is intended to be used. The Proposal incorporates the data quality principle through Article 1, section (1) pursuant to which Article 7a1 is added which requires OLAF to seek evidence for and against the person concerned.

10. The EDPS welcomes the inclusion of the obligation to seek evidence for and against the person concerned because it affects the accuracy and the completeness of the data being processed, thus contributing to the compliance with the principle of data quality, and hence increasing the overall data protection safeguards in the context of OLAF investigations.

II.1.b. Right of Information

11. Pursuant to this right, those who collect personal data are required to inform individuals to whom the data refers of the fact that their data are being collected and processed. Individuals are further entitled to be informed of, inter alia, the purposes of the processing, the recipients of the data and the specific rights that individuals, as data subjects, are entitled to. The obligation to give information about the processing of one's data is to ensure the fairness of the processing of individual's personal information and is, at the same time, an indispensable safeguard for the rights of individuals. The Proposal recognises this right in Article 1, section (1) pursuant to which Article 7a2, first paragraph is added and Article 1, section (7) pursuant to which Article 8a is added.

12. The EDPS welcomes the inclusion of Articles 7a.2 first paragraph and 8a, insofar as they contribute to the respect for the data protection right of information set forth in Article 11 and 12 of Regulation (EC) No 45/2001, in the specific context of investigations performed by OLAF.

13. In addition to setting forth the right to be informed of the processing of one's personal information, Articles 11 and 12, which apply respectively to the situations where information on an individual is collected directly from that individual or from third parties, lay down the information that must necessarily be given to individuals so that they are in a position to have accurate and full information about the existence of a processing operation that concerns them. This information includes among others the purposes for which the data will be used, potential recipients of the data and the existence of the right of access to the data.

14. Unfortunately neither Article 7a2 first paragraph nor Article 8a contain similar information requirements as Article 11 and 12 of Regulation (EC) No 45/2001, thus failing to specify what information is to be given to individuals in order to ensure the fairness of the processing. The EDPS considers that Articles 7a2 first paragraph and 8a should be consistent with Articles 11 and 12 of Regulation (EC) No 45/2001. To this end, the EDPS suggests including in Articles 7a2 first paragraph and 8a an express reference to the application of Articles 11 and 12 of Regulation (EC) No 45/2001.

15. The EDPS considers that failure to include a reference to Articles 11 and 12 will create an unclear legal situation. Indeed, the Proposal would create a legal framework regulating the right of information in the context of OLAF investigations that would differ from the general framework set forth by Articles 11 and 12 of Regulation (EC) No 45/2001. Unfortunately, such a framework would provide less data protection safeguards than the general one. The EDPS fails to see any reason to justify this unfortunate outcome.

16. Articles 7a2 and 8a second paragraph of the Proposal foresee an exception to their application if giving the information would prejudice the performance of the investigation. Pursuant to the exception, the Director General of OLAF is entitled to defer the fulfilment of the obligation to ask the person implicated to make his views known.

17. The EDPS notes that the possibility of limiting the provision of information in certain specific cases is in line with Article 20 of Regulation (EC) No 45/2001 which provides for certain restrictions to this right, including when doing so is necessary to safeguard (i) the prevention and investigation of criminal offences, (ii) economic or financial interest of a Member State or of the European Communities, as well as (iii) the protection of the data subject or of the right and freedoms of others.

18. The EDPS notes that under Article 20 of Regulation (EC) No 45/2001, the limitation to the right of information is accompanied by various data protection safeguards. In particular, Article 20.3 establishes that if a restriction is imposed, the data subject shall be informed of the principal reasons and on his or her right to have recourse to the European Data Protection Supervisor. Providing such information may be deferred if providing the information would harm the investigation.

19. However, in the Proposal the provisions that set forth restrictions to the right of information are not accompanied by the data protection safeguards foreseen in Article 20 of Regulation (EC) No 45/2001. Thus, in the context of OLAF investigations, limitations to the right of information are provided without the safeguards that would apply under the general data protection framework, which the EDPS finds inappropriate. To resolve this situation the EDPS suggests that the limitation to the right of information of Articles 7a2 second paragraph and 8a be linked to the guarantees of Article 20 Regulation (EC) No 45/2001.

II.1.c. Right of Access

20. The right of access gives individuals the possibility to learn whether and what type of information relating to them is being processed. The Proposal recognises this right in Article 1, section (1) pursuant to which Articles 7a2, second paragraph and 7a3 are added.

21. The above amendments, i.e. Articles 7a2, second paragraph and 7a3 set up the right of the individual suspected of wrongdoing to be informed on all matters concerning him. More specifically, they establish how this right will be exercised in the context of OLAF investigations. Firstly, it will be provided on completion of an investigation, i.e. at the end of the investigation. Secondly, it will be provided through a summary of the matters regarding the individual. In addition, access will also be provided through a record of the interview with the suspected individual.

22. The EDPS welcomes the inclusion of Articles 7a2 second paragraph and 7a3 insofar as they specify in the context of OLAF investigations the data protection right of access set forth by Article 13 of Regulation (EC) No 45/2001. However, the EDPS considers that there is room for improvement in the way this right is recognised in the Proposal. The EDPS is concerned that the right of access, as drafted in the Proposal, is inferior to the same right under Regulation (EC) No 45/2001.

23. Under Regulation (EC) No 45/2001 as a matter of general principle, individuals are entitled to exercise the right of access to their personal data, unless one of the specific situations of Article 20 of Regulation (EC) No 45/2001, referred above, justifying a restriction to such right, arise. In such a case, access can be restricted until the circumstances change.

24. The EDPS observes that the Proposal does not recognise the application of the right of access as a matter of general principle. Instead, the Proposal foresees the application of the right of access in certain procedural stages and in respect to certain documents. To some extent, it can be said that under the Proposal, the right of access has both temporal and material limitations.

25. Indeed under Article 7a2 second paragraph access can be obtained only on completion of an investigation, when the individual is given a summary of the matters that concern him/her and when an interview with the individual and OLAF has taken place and a record of an interview has been drafted. Outside these two stages of the procedure, as a general rule, there is no access to personal information. Regarding the material to which access is granted, the EDPS sees that under the Proposal, access is only possible regarding the summary of the matters concerning the individual and the record of the interview ex Article 7a2 second paragraph and Article 7a.3 respectively. Access does not apply to any other information that may be held about the individual, such as copies of documents, e-mails, telephone records, etc.

26. The EDPS agrees with the Proposal that access to personal information is relevant in the two procedural steps and regarding the two documents specified by the Proposal and welcomes the Proposal's recognition of such right in these circumstances. However, the EDPS considers that as a matter of general principle, the Proposal should also recognise the existence of a right of access beyond the two cases explicitly mentioned by the Proposal.

27. The EDPS is aware that there may be some opposition to the idea of recognising the right of access, as a general rule, in the course of an investigation. However, the EDPS recalls that if in certain investigation cases there is a need to safeguard the confidentiality of the investigation, pursuant to Article 20 of Regulation (EC) No 45/2001, OLAF will be able to defer access. Indeed, OLAF can rely on Article 20 to defer access for example in order to safeguard the prevention and investigation of criminal and other offences. Thus, granting the right of access as a matter of general principle does not prevent ad hoc limitations to such rights, when the reasons outlined above occur.

28. In light of the above, and in order to ensure that an effective right of access in the course of an investigation exists which also recognises potential limitations to it, the EDPS suggests adding in the Proposal a clear reference to the individual's right of access to their personal data contained in OLAF's investigation file. In particular, the EDPS considers that a paragraph along the following lines should be inserted between the first and second paragraph of Article 7a.2: ‘Any person implicated in an investigation has the right to access personal data related to him/her which are gathered in the course of the investigation. Such right(s) may be subject to the limitations foreseen in Article 20 of Regulation (EC) No 45/2001’.

29. This paragraph would set forth, as a general principle, the application of the right of access. As a result, not only consistency would be achieved but also individuals concerned by OLAF investigations would not be subject to a less benevolent regime as far as access to personal data is concerned.

II.1.d. Right of Rectification

30. The right of access is a prius to the right of rectification. Once individuals have had the opportunity to access their data and verify the accuracy and the lawfulness of the processing, the right of rectification enables them to require rectification of any incomplete or inaccurate information.

31. Under the Proposal, the right of rectification is regulated together with the right of access. Both Article 1, section (1) pursuant to which Articles 7a2 second paragraph and 7a3 are added refer to the possibility of the suspected infringer to have his views known.

32. The EDPS notes that, stricto sensu, the Proposal does not provide for a right to rectify as such. Instead, the Proposal provides for a right to ‘have the views known’and ‘approve or add observations’(in both instances regarding personal information). The EDPS considers that such privileges are equivalent to the right of rectification and that they are in line with Article 14 of Regulation (EC) No 45/2001 which sets forth the legal framework for the right to rectify inaccurate information. The EDPS considers that in the context of OLAF investigations it is not possible to provide individuals with the possibility to simply ‘rectify ’the information that they deem as incomplete or inaccurate, obviously because in many cases, ascertaining whether the information is inaccurate will be the subject of the investigation. This is why in this context the right of rectification can be provided, as the Proposal does, by allowing the individual to have his views known and by allowing him to provide comments regarding the personal information at stake.

33. In addition to the above, the EDPS considers that the same comments made above regarding the way the Proposal regulates the right of access, apply mutatis mutandis to the right of rectification. Indeed, under the Proposal, the right of rectification has the same shortcomings that were described above regarding the right of access: the Proposal does not recognise the right to rectify as a matter of general principle. Instead, the right of rectification is unduly confined to the summary of the allegations and the report that follows an interview.

34. The EDPS considers that the Proposal should recognise the right of rectification as a general right, not like a partial one. To this end, the EDPS suggests inserting a provision in the proposal recognising the application of the right of rectification. In particular, after the sentence ‘Any person implicated in an investigation has at any time the right to access personal data related to him/her gathered in the course of the investigation ’the following should be added: ‘and to make his views known on whether the personal data are inaccurate or incomplete’. The EDPS recalls that by applying Article 20 of Regulation (EC) No 45/2001, OLAF may still be able to limit the right of rectification in order to safeguard the prevention, investigation, detection and prosecution of criminal offences.

35. Article 7a2, 3rd paragraph foresees the possibility of excluding the application of the right of access and rectification. As it was mentioned regarding the limitation to the right of information, such limitations should be accompanied by the safeguards that apply in the context of Article 20 of Regulation (EC) No 45/2001. To this end, the EDPS suggests that the limitation of the application of such rights under the Proposal is linked to an express reference to Article 20.

II.1.e. Exchanges of Personal Information

36. The Proposal provides for exchanges of personal data within the European Institutions and with Member States authorities. In fact, one of the goals of the Proposal is to enhance the exchange of information among OLAF and authorities at both EU and Member State levels.

37. In this regard, the EDPS would like to stress that these exchanges should be allowed only to the extent that is necessary to the specific case in order to meet the goals pursued by the investigation. Furthermore, in accordance with Article 7 of Regulation (EC) No 45/2001, the EDPS reminds that the recipient of the data shall process them only for the purposes for which they were transmitted.

38. The Proposal does not provide for exchanges of personal data with third countries, or for international cooperation. However, in this context, one may assume that such cooperation may take place. In this regard, the EDPS would like to stress that these exchanges should be allowed only if the third country ensures an adequate level of protection of personal data or if the transfer falls within the scope of one of the derogations laid down by Article 9.6 of Regulation (EC) No 45/2001. Furthermore, the EDPS recalls that the same rules apply regarding the exchanges of information between OLAF and EU institutions and bodies that are not Community bodies such as EUROPOL or EUROJUST. In such cases, the EDPS hopes that appropriate legislation will be passed recognising the adequacy of the data protection framework that governs such institutions, which would facilitate the transfers of information to them ex Article 9.2 of Regulation (EC) No 45/2001. Alternatively, new legislation could be passed deeming their data protection regime as equivalent to that of Community bodies and institutions, ex Article 7 of Regulation (EC) No 45/2001, which would also have the effect of removing the restriction to transfer data to such institutions.

II.1.f. Compliance with Regulation (EC) No 45/2001

39. The Proposal has amended Article 8.3 to include an express reference to the application of Regulation (EC) No 45/2001. The EDPS welcomes the amendment of Article 8(3), insofar as it confirms that whenever the Proposal does not specify how the data protection requirements apply in the context of OLAF investigations, the Regulation (EC) No 45/2001 will apply as default.

40. However, the EDPS considers that Article 8.3 on its own, i.e. without the amendments suggested in this Opinion, is not sufficient to ensure a level of protection of personal data at least equal to that provided under Regulation (EC) No 45/2001. Article 8.3 by itself is not enough because it could be understood that it is only relevant whenever the Proposal does not specify how the data protection requirements apply in the context of OLAF investigations. However, when the Proposal does specify how the data protection requirements apply and in doing so lays down a less protective data protection regime, then such unsatisfactory regime could be considered to take precedent over the general data protection embodied in Regulation (EC) No 45/2001. The specific amendments suggested above for concrete references to Regulation 45/2001 aim to avoid such risks of interpretation

III. ADDITIONAL CONSIDERATIONS

III.1. Protection of Whistleblowers

41. The EDPS fully agrees with the Proposal that for the sake of greater transparency it is necessary to ensure an adequate degree of information for whistleblowers, and welcomes the obligation in the Proposal to provide informers with information as to whether or not to open an investigation.

42. The EDPS recommends the respect for the confidentiality of the identity of whistleblowers during OLAF investigations and in the later stages. To this end, the EDPS is of the view that it would be appropriate for this Proposal to include a new paragraph guaranteeing the confidentiality of whistleblowers. The present guarantees (Commission Communication SEC/2004/151/2) do not seem enough from a legal point of view. The EDPS notes that such provision would be in line with the Opinion of the Article 29 Data Protection Working Party that deals with the application of EU data protection rules to internal whistleblowing schemes (8).

IV. CONCLUSIONS AND RECOMMENDATIONS

43. The EDPS welcomes this Proposal insofar as it makes more explicit the procedural guarantees of individuals concerned by OLAF investigations, including the protection of personal data of such individuals.

44. From the perspective of the protection of individuals' rights to the protection of their personal data and privacy, the EDPS considers that for the most part the Proposal contains improvements vis-à-vis the current legal framework. Examples of improvements include Articles 7a2 first paragraph and 8a as they contribute to the respect of the right of information and Articles 7a2 second paragraph and 7a.3 which confirm the application of the partial right of access and rectification in the context of OLAF investigations.

45. In addition, the EDPS welcomes the Proposal's recognition that Regulation (EC) No 45/2001 applies to all data processing activities carried out in the context of OLAF investigations, as it will contribute to ensuring a consistent and homogeneous application of the rules regarding the protection of individuals' fundamental rights and freedoms with regard to the processing of personal information.

46. Although the EDPS is appreciative of the amendments aimed at boosting procedural and data protection rights outlined above, he is concerned by the fact that most of the proposed amendments do not reach the minimum data protection standards contained in Regulation (EC) No 45/2001. The EDPS is concerned that if the Proposal could be deemed to take precedent over the application of the general data protection framework contained in Regulation (EC) No 45/2001, this would entail an unacceptable watering down of the data protection standards in the context of OLAF investigations. In the EDPS's opinion this is particularly worrisome in the light of the sensitive nature of the type of data that may be collected in the framework of OLAF investigations. In order to avoid this outcome, the EDPS requests the Community legislator to take into account the following issues and make the related amendments in the Proposal in order to address them:

47. Shortcomings regarding the right of information in the context of OLAF investigations: Providing information to individuals to ensure fair processing constitutes an indispensable safeguard which should not be unduly compromised, as the Proposal does. To avoid it, the Proposal should be amended as follows: (i) Articles 7a2 first paragraph and 8a should include an explicit reference to Articles 11 and 12 of Regulation (EC) No 45/2001 in order to ensure fair processing. (ii) The limitation to the right of information of Articles 7a2 first paragraph and 8a second paragraph should be linked to the safeguards of Article 20 Regulation (EC) No 45/2001.

48. Shortcomings regarding the right of access in the context of OLAF investigations: Providing access to personal information so that individuals can learn whether data concerning them is being processed constitutes a basic pillar for the respect of the personal data. To ensure effective access rights, the Proposal should be amended as follows: (i) A new provision should be added recognising as a general principle the right of access to personal information gathered in the context of OLAF investigations which could be inserted between the first and second paragraph of Article 7a.2. Such a provision could read as follows. Such a provision could read as follows ‘Any person implicated in an investigation has the right to access personal data related to him/her which are gathered in the course of the investigation. Such right(s) may be subject to the limitations foreseen in Article 20 of Regulation (EC) No 45/2001’.

49. Shortcomings regarding the right of rectification in the context of OLAF investigations: The right to rectify inaccurate or incomplete information is a natural consequence of the right of access to personal information, and as such, it constitutes a cornerstone of the protection of the right to personal data. Restrictions to the right of rectification should only be provided to the extent that they are permitted under Regulation (EC) No 45/2001. The Proposal contains additional restrictions that should be avoided as follows: (i) A provision should be added stating that suspected individuals have a general right to have their views known regarding any piece of information that referred to them, except if an exception ex Article 20 of Regulation (EC) No 45/2001 applies. In particular, after having stated that any person implicated in an investigation has ‘at any time the right to access personal data related to him/her gathered in the course of the investigation’, it should be added that an individual has the subsequent right ‘to make his views known on whether the personal data is inaccurate or incomplete’. (ii) The EDPS suggests that the limitation to the right of access and rectification foreseen in Article 7a2, 3rd paragraph be linked to the guarantees of Article 20 Regulation (EC) No 45/2001.

50. In addition to the above, the EDPS is of the view that it would be appropriate for this Proposal to include a new paragraph guaranteeing the confidentiality of whistleblowers.

Done at Brussels on 27 October 2006 Peter HUSTINX European Data Protection Supervisor

(1) OJ L 281, 23.11.1995, p. 31.

(2) OJ L 8, 12.1.2001, p. 1.

(3) OJ L 136, 31.5.1999, p. 1.

(4) The Proposal amends articles 3,4,5,6,7,8,9,10,11,12,13,14, and 15.

(5) OJ L 136, 31.5.1999, p. 8.

(6) Some of the problems that the Proposal seeks to solve were raised in the past by the Court of Auditors the European Parliament and OLAF's own evaluation of the Office's activities.

(7) The Proposal lays down a set of measures to ensure that the information flows in all directions: from OLAF to institutions and Member States and vice-versa.

(8) Opinion 1/2006 on the application of EU data protection rules to internal whistleblowing schemes in the fields of accounting, internal accounting controls, auditing matters, fight against bribery, banking and financial crime (00195/06/EN WP 117).