Opinion of the Economic and Social Committee on the "Proposal for a Regulation of the European Parliament and of the Councilon the protection of individuals with regard to the processing of personal data by the institutions and bodies of the Community and on the free movement of such data"

(2000/C 51/13)

On 29 September 1999 the Council decided to consult the Economic and Social Committee, under Article 262 of the Treaty establishing the European Community, on the above-mentioned proposal.

The Section for Employment, Social Affairs and Citizenship, which was responsible for preparing the Committee's work on the subject, adopted its opinion on 12 November 1999 (rapporteur working alone: Mr Retureau).

At its 368th plenary session (meeting of 8 December 1999), the Economic and Social Committee adopted the following opinion with 117 votes in favour and two abstentions.

1. Legal basis, content and scope of the proposal

1.1. The legal basis and reasons for the proposal for a regulation are clearly explained. The purpose is to apply Directive 95/46/EC(1) of 24/10/1995 to the processing and transmission of personal data by European Community bodies and institutions.

1.2. Community institutions and bodies, and the Commission in particular, handle personal data as part of their everyday work. The Commission exchanges personal data with Member States in implementing the common agricultural policy and the Structural Funds, in administering the customs union and in pursuing other Community policies.

1.3. When Directive 95/46/EC was adopted, the Commission and the Council undertook to comply with it and called upon the other Community institutions and bodies to do likewise (public declaration issued on 24 October 1995). In practice, the Directive has already been applied in the Community institutions since that date.

1.4. Since the Amsterdam Treaty came into effect, the Treaty establishing the European Community contains a specific provision, Article 286, providing that from 1 January 1999 Community institutions and bodies set up by the EC Treaty must apply the Community rules on the protection of personal data set out essentially in Directive 95/46/EC and Directive 97/66/EC(2). It also provides for the application of these rules to be monitored by an independent supervisory body, set up in accordance with the procedure referred to in Article 251. This is the most important innovation in the proposal for a regulation.

1.5. The present proposal for a regulation is designed to attain this twin objective (rather later than the application date provided for in the EU Treaty).

1.6. However, some key questions are difficult to assess in the proposal as it now stands.

1.7. For example, with regard to defining the Community institutions and bodies concerned by the regulation: looking at the list provided in an annex to the proposal, Europol is evidently excluded from the proposed provisions. What is the situation, for example, with the IT network of Schengen and its own supervisory authority: should they remain separated, or could they not be merged? The same considerations apply to the other third-pillar bodies.

1.8. Another important point is that although officials and other people employed by Community bodies and institutions are covered by the proposal, the link between the proposed provisions and the Staff Regulations of the European Union officials is not very apparent (although involvement of the Staff Committees is provided for in an annex). Have staff representatives been consulted? Processing of personal data relating to staff should surely be subject to separate special provisions to protect the privacy and rights of people employed by the Communities as effectively as possible, starting at the moment when the application form is completed and continuing throughout the person's career or for the length of the contract and whenever it is renewed.

1.9. Finally, the proposal covers only individuals, reflecting the limitations of the 1995 directive, which excludes de facto or de jure legal persons, who are however affected by collection and processing of data. Nevertheless, we would point out that legal persons are affected by the 1995 directive in so far as they handle or hold personal data relating to natural persons. The present proposal concerns only the handling and transmission by the Community institutions of data that may relate to natural or legal persons, whereas the safeguards envisaged apply only to natural persons.

2. General comments

2.1. The Council, which naturally has every right to set a deadline for the submission of opinions, has set a very early deadline for the ESC to present this opinion on a proposal for a regulation that is complex and important because it concerns the protection of human rights in relation to the processing and transmission of personal data.

2.1.1. The Committee would have liked more time so that it could participate more closely in a legislative process based on co-decision that affects many of the members of economic and social organisations which it represents.

2.2. The Committee has already issued an opinion(3) on:

a) two Council proposals for a Directive concerning:

- protection of individuals in relation to the processing of personal data

- protection of personal data and privacy in the context of public digital telecommunications networks;

b) and a proposal for a Council Decision in the field of information security.

2.3. The general principles regarding the processing of personal data and essential guarantees to protect individual rights and the right to privacy that were set out by the Committee in the above opinion are still valid and relevant to the present proposal for a regulation. They comply with Council of Europe Convention No. 108(4), which should be used to help evaluate the proposal for a regulation in conjunction with legislation and practice in the Member States and with the 1995 Directive.

2.3.1. The Committee urges the Council to refer to the principles and proposals set out in its 1991 opinion and the present opinion, and to take them fully into consideration in order to improve on the 1995 Directive as far as possible, with due regard to the constraints imposed by the legal basis, and at least to bear them in mind when re-examining the Directive for possible revision by 2001.

2.3.2. The Committee believes that the Community institutions and bodies must offer maximum protection and guarantees when processing personal data, on the basis of the most advanced international standards and national legislation and the best practices in the Member States. The aim should be to set an example and to promote harmonised progress, especially since the proposal concerns not only the processing but also the free movement of data and of the information obtained from processing it both within and outside the EU.

2.4. The rapid growth in information and communication technologies, the improved facilities for long-term storage of data on different media, the growing sophistication of processing and interconnection techniques, and the development of information transmission and access systems make it all the more necessary to improve protection and guarantees for the people concerned, while respecting the principle of free data movement.

2.4.1. However, these technological developments also provide new ways of protecting against unauthorised access, ensuring secure transmission and safeguarding privacy and the exercise of individual rights, including people's right to access, correct and oppose the use or transmission of data relating to them. First and foremost, it is the state-of-the-art that should be taken into consideration rather then the cost, unless the cost of introducing new techniques is disproportionately high in relation to the level of security to be provided.

2.4.2. Protecting people's rights and providing them with guarantees must be an integral part of the process of designing instruments and methods for collecting, processing, using and transmitting data; any person involved at these various levels, from data collection to final use, must meet strict competence and confidentiality requirements, and if any of these are breached, sufficiently deterrent penalties must be imposed. The proposal essentially makes provisions along these lines, and the Committee considers it to offer considerable protection overall, providing guarantees and possibilities for administrative and legal access and appeal that are generally satisfactory.

2.4.3. Progress has been made since the 1995 Directive, e.g. regarding the right of access to data, and the transposition provisions are precise and clear, e.g. the definition of sensitive data and data that may not be handled, the exact definition of what constitutes an "adequate" level of protection for the transmission of data to countries or bodies not covered by the 1995 Directive, the inclusion of all possible forms of data processing, or the establishment of independent supervisory bodies in each of the Community institutions and bodies (permitting a priori monitoring of rights and freedoms and of privacy, which provides better protection than a posteriori monitoring).

2.4.4. Certain provisions should nevertheless be improved, although the Committee is aware that the Commission's proposal may not overstep the framework of the 1995 Directive, of which the Committee has already highlighted certain shortcomings. For instance, there should be specific protective provisions for legal persons, or even entities without legal personality, e.g. with regard to confidentiality and respect for corporate image in the case of companies. Such protection should be provided at all events, and measures should be taken to find the right ways of achieving it. The proposed provisions on the independent supervisory bodies, over which the Council and European Parliament have complete legislative power should also be improved.

2.5. The Committee thinks that all the measures envisaged, from data collection to data processing and transmission, should relate to purposes strictly defined and checked beforehand that must meet the lawfulness criteria correctly set out in the proposal, and should be essential to the activities of the institutions and bodies responsible.

2.6. The Committee thinks there should be a separate chapter devoted to protection of the personal data and privacy of staff employed by Community institutions and organs. This chapter should at least give the future European Supervisor the power, after consultation with staff organisations, to stipulate questions that should not be asked at the time of recruitment (e.g. on health), to prevent women being asked whether they are pregnant, and to specify what each individual dossier may contain. It would be a good idea here to refer to the ILO's code of practice on protection of workers' personal data and ILO Recommendation No. 171 on Occupational Health Services (1985).

2.7. With regard to the Community institutions and bodies concerned, the Committee notes that the proposal effectively covers the whole Community sphere, and it therefore agrees with the interpretation of Treaty Article 286, i.e. that the proposal applies to all the institutions. A restrictive interpretation, which for instance excluded Euratom or the ECSC from the scope of the proposal, would have been absurd and contrary to the objectives pursued.

2.8. However, given the gradual incorporation of the third pillar (which is not covered by the 1995 Directive) into the Community system and the need for a horizontal instrument for data collected, processed and transmitted in the framework of judicial and police cooperation, the Committee suggests that the remit of the European Data Protection Supervisor be broadened to immediately include the Schengen information system and to gradually include all the third-pillar agreements in which data protection is currently seen as an issue to be tackled separately, with separate monitoring standards and bodies, albeit on the basis of common principles. Such protection must also be introduced in the sphere of judicial cooperation, where it is not yet envisaged. This would also mean attaching additional protocols to the above agreements.

2.9. Thus on the basis of these general comments and bearing in mind all the new factors and developments that have taken place since its previous opinion, the Committee, while noting that there have been many positive and interesting initiatives, would like to make some more precise and detailed suggestions and recommendations, given in the order of the proposal's chapters and annexes.

3. Specific comments and recommendations

3.1. Article 2 (c), Definitions. The filing system is defined as a "structured set of personal data". Data does not have to be structured in order to be processed and used; it would thus be enough to refer to "a set of personal or individual data".

3.2. Article 4 (d), Data quality. Every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected ...This should read "every possible step".

3.2.1. Article 5 (d), Lawfulness of processing. The Committee agrees with the lawfulness criteria, but thinks that the proposal should refer to "informed consent" here.

3.3. Article 6, Further processing. When processing is carried out for other than the original purpose, those concerned should be informed in advance of this possibility when the data is collected or when the new decision is taken.

3.4. Article 9, Transfer of personal data.

3.4.1. Paragraphs 1 to 4: when data is to be transmitted to people or bodies that are not subject to Directive 95/46/EC or to a country that has not ratified Council of Europe Convention No. 108, measures should be taken in advance to ensure that the level of protection is equivalent, not just "adequate" (although this is the wording of the Directive). The Committee notes, however, that the practical provisions for ensuring matching levels are highly protective.

3.4.2. Paragraphs 5 and 6: the European Data Protection Supervisor (EDPS) should be informed in advance of cases where there has been a derogation, so that objections can be raised if necessary.

3.5. Article 10(1), Prohibited processing. The wording goes further than that of Article 6 of Council of Europe Convention No. 108, except with respect to data on criminal convictions, which is treated more restrictively in Article 10(5) (though processing of such data is not absolutely prohibited). The Committee would prefer a more detailed wording, as follows: "The processing of personal data revealing racial or ethnic origin, political opinion, religious or philosophical beliefs, and more generally any belief or opinion not defined as criminal under international law, trade-union membership, and the processing of data concerning health, genetic heritage, or sex life, shall be prohibited." Although genetic heritage can be understood as an aspect of health, the wording on prohibited processing should no doubt be reviewed if the Directive is amended.

3.6. Article 17, Notification to third parties. The possibility of exemption from the requirement to notify changes or blocking is too vague and too broad in scope.

3.7. Article 23(1), Security of processing. The person responsible for processing must ensure the highest possible level of security during data processing and transmission, in accordance with the state of the art and provided the cost is not disproportionate to the level of security which must be provided.

3.8. Article 25, Data Protection Officer and Annexes I and II:

3.8.1. The main question concerns the independence and qualifications of the people appointed by the Community institutions and bodies to actually collect, process and transmit personal data.

3.8.2. The provisions of the proposal protect these people from any undue pressure exerted by the appointing bodies, which are also the bodies to which they are answerable and subordinate.

3.8.3. These people must be explicitly released from this subordinate relationship as far as their data protection tasks are concerned, and must be answerable only to the European Data Protection Supervisor(5). Their data protection tasks should not be evaluated or assessed by their hierarchical superiors, nor should they have a negative effect on their career in the event of conflict with those superiors on data protection issues. Their term in office should be longer to provide a better guarantee of their independence and provide them with security and a long-term perspective.

3.8.4. The estimated proportion of working time the people appointed will spend on data protection tasks (5 % in general, 10 % in more exceptional cases), and the means placed at their disposal, seem limited. These officers must be given sufficient freedom and flexibility to carry out their tasks properly, and they must be provided with appropriate staff and equipment as required.

3.9. Article 28, Prior checking by the European Data Protection Supervisor (EDPS).

3.9.1. The principle that should be laid down is that any data processing likely to jeopardise in a specific way the rights and freedoms of those concerned must be subject to prior checking by the Supervisor. The existence or application of "sensitive" processing operations must be carefully considered in advance by an independent authority. Provision is made for this in the proposal, for it is a fundamental safeguard.

3.9.2. However, some types of data processing should be added to the proposed list, and at all events the EDPS should check in advance situations such as:

- data-processing involving innovative application of existing technologies;

- the additional points proposed by the ESC in Article 10;

- data-processing affecting the police, security, criminal law, immigration and the residence of people from outside the Community (e.g. provision of visas, length of stay);

- processing that uses identifiers of general application;

- interlinking of files with distinct purposes;

- processing of data collected for other purposes;

- data-processing conditions that violate the principles of personal protection;

- processing that uses or requires data to be transmitted beyond EU frontiers;

- mandatory statistical surveys and surveys relating to whole sectors of the population and professions.

3.10. Article 32, Security of internal telecommunications networks, end of paragraph 1. The Committee recommends that the sentence be changed as follows: "Having regard to the state of the art, technological development and, possibly, the related cost, if this is disproportionate to the objectives pursued, these measures shall ensure, and continue to ensure, a level of security appropriate to the risk presented."

3.11. Supervisory authority

3.11.1. Article 38, The EDPS. Paragraph 1 should specify that an independent supervisory authority is to be established.

3.11.2. Article 39, Appointment. The proposal provides for the EPDS to be appointed "by common accord" by the Commission, Council and European Parliament for a term of four years. The EPDS may also be reappointed, but the proposal does not stipulate how many times this may be done.

3.11.3. The Committee again points to the need for an independent EPDS, who should therefore not be appointed by bodies such as the Council and Commission that regularly process personal data or ask for personal data to be processed, and circulate or transmit such data. As with the Ombudsman, it would seem more appropriate and more practical from a technical point of view for the EDPS to be appointed by the European Parliament in consultation with the Commission and the Council. A considerably longer (possibly double the length provided for in the proposal), but non-renewable, term-of-office could provide an additional guarantee of independence.

3.11.4. The tasks of the EDPS are particularly demanding and diverse, and the budgetary provisions in the annexes to the proposal seem somewhat modest considering the requirements of the post.

3.11.5. The Committee considers it absolutely necessary for the future supervisor to have adequate means and a sufficient number of highly qualified staff.

4. Conclusions

4.1. The Committee would have liked to examine in more detail all the provisions submitted to it in this proposal for a regulation that is so critical to the protection of personal rights and freedoms within the Community administration.

4.2. This project represents an enormous task that must be acclaimed for the important safeguards it provides. Its limitations largely reflect those of the 1995 Directive. Although it recognises the progress in the proposal as it stands, the ESC nevertheless presents general and specific comments in this opinion to the Council, the European Parliament and the Commission in the hope that its contribution will make it possible to strengthen the guarantees of freedoms and rights enjoyed by people within and outside the Community.

4.3. On the basis of the planned review in 2001 of how the Directive is being implemented and in accordance with the specific revision proposals that will then be presented to it for consideration, the Committee will make detailed and exhaustive proposals on the nature and scope of the changes that it would like to see made to the current text.

Brussels, 8 December 1999.

The President

of the Economic and Social Committee

Beatrice RANGONI MACHIAVELLI

(1) OJ L 281, 23.11.1995, p. 31.

(2) OJ L 24, 30.1.1998, p. 1.

(3) Rapporteur: Mr Salmon, opinion published in OJ C 159, 17.6.1991, p. 38

(4) Council of Europe (ETS No. 108) Conventionfor the protection of individuals with regard to the automatic processing of personal data. All the current Member States have now ratified this convention; most of the applicant countries have not.

(5) As stipulated, for example, in ILO Convention No. 81 on Labour Inspection.