EN Official Journal of the European Union C 94/1

Opinion of the European Data Protection Supervisor on the Amended Proposal for a Regulation of the European Parliament and of the Council on mutual administrative assistance for the protection of the financial interests of the European Community against fraud and any other illegal activities

(2007/C 94/01)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1),

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (2), and in particular its Article 41,

Having regard to the request for an opinion in accordance with Article 28 (2) of Regulation (EC) No 45/2001 received on 19 September 2006 from the Commission;

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTION

The Amended Proposal for a Regulation on mutual administrative assistance for the protection of the financial interests of the EC against fraud and any other illegal activities (hereinafter ‘Amended Proposal’) sets forth communication and assistance procedures between the Commission and Member States in order to protect the Community financial interests. Such procedures include mutual administrative assistance as well as exchange of information. In this context, the Amended Proposal establishes the role of the Commission, particularly through the European Antifraud Office (‘OLAF’), as a coordinator and facilitator of the above mentioned procedures.

The Amended Proposal was sent by the Commission to the European Data Protection Supervisor (‘EDPS’) for advice as foreseen in Article 28 (2) of Regulation (EC) No 45/2001 of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (hereinafter ‘Regulation (EC) No 45/2001’). Prior to that, the advice of the EDPS was also sought regarding the same Proposal in its first version, as adopted by the Commission. This request led to the adoption in October 2004 of a first EDPS Opinion on the Proposal for a Regulation as adopted by the Commission (3). The letter received from the Commission on 19 September 2006 is therefore a new request for additional advice on the Amended Proposal, which the EDPS is pleased to meet, in particular taking into account that the initial proposal has been modified during the legislative process towards its adoption. In fact, consultation of the EDPS is necessary ex Article 28.2 each time that the Commission adopts a new proposal.

II. MAIN COMMENTS

II.1. Data Protection Issues Deferred to Implementing Legislation

In setting forth communication and administrative procedures to protect the Community financial interests, the Amended Proposal does not include new rules on data protection nor exceptions to the existing data protection framework, namely Directive 95/46/EC and Regulation (EC) No 45/2001. Instead, the Amended Proposal confirms the application of such legislation and in some areas calls for implementing regulations that will address data protection issues.

The EDPS considers that in this context such an approach is satisfactory insofar as it preserves the data protection standards contained in Directive 95/46/EC and in Regulation (EC) No 45/2001 in the framework of the communication and administrative procedures, including exchanges of information created by the Amended Proposal. The EDPS would have reason for concern should such standards have been lowered.

At the same time, the EDPS is aware that with such an approach the real debate on data protection issues is postponed to a later stage, i.e., to the drafting of implementing regulations. For this reason, the EDPS notes that the protection of personal data in setting forth communication and administrative procedures will have to be carefully considered in the process of drafting implementing legislation. The EDPS therefore welcomes the inclusion in the Amended Proposal of the obligation to consult him on the drafting of such implementing legislation, particularly as regards access to data on value added tax stored in Member States by the Commission ex Article 11 of the Amended Proposal, the provision of information concerning operations or transactions in the case of spontaneous assistance ex Article 12.4 and the exchanges of information and mutual assistance regarding other irregularities ex Article 23 of the Amended proposal. In fact, consultation of the EDPS is necessary not only regarding legislative proposals ex Article 28.2 of Regulation (EC) No 45/2001 but also regarding administrative measures of a similar nature relating to the processing of personal data involving a Community institution or body alone or jointly with others ex Article 28.1 of Regulation (EC) No 45/2001.

II.2. Effect on the Protection of Personal Data: Clarification of Article 17.1

Although the Amended Proposal as described above does not contain new rules on the protection of personal data in the context of the information exchanges that it sets forth, some of its articles indirectly have an effect on data protection, which in the following cases would appear to be positive. For example, the obligation that falls upon Member States to designate the competent authorities for the purposes of the Regulation and communicate these to the Commission may contribute to limit the exchange of information exclusively to competent authorities and not to others. The EDPS also welcomes that requests for assistance and information are to be accompanied by a brief statement of the facts known to the applicant authority as this may contribute to the restriction of the amount of data relevant to satisfy the need for information.

On the contrary, the EDPS notes that at least in one case, the Amended Proposal contains a provision which may have a negative effect as far as the protection of personal data is concerned. This is Article 17 of the Amended Proposal which was formerly Article 18 of the Proposal as adopted by the Commission. Point 4 of the EDPS Opinion of 2004 noted that Article 18 (1) second paragraph should not affect the rights of data subjects to have access to their personal data. The EDPS assumes that this is the intention of the legislator, however, in the current language, this is not entirely clear. For this reason, the EDPS suggests adding the following sentence at the end of Article 17.1., second paragraph: ‘This shall not affect the rights of data subjects to have access to personal data relating to them, in accordance with Directive 95/46 and Regulation 45/2001’.

II.3. Proposal for Alternative Language

The EDPS welcomes the fact that the Amended Proposal takes into account some of the remarks made by the EDPS in his opinion of 2004. For example, in view of the mandatory character of Article 28 (2) of Regulation (EC) No 45/2001, the EDPS welcomes the explicit reference in the Amended Proposal to this consultation exercise. However, the EDPS considers that this reference should be made in the Preamble of the Proposal, at the end of the ‘Having regard to …’. This is the approach followed by the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No. 1073/1999 concerning investigations conducted by OLAF. Furthermore, the EDPS suggests replacing the current language by the following: ‘After consulting the European Data Protection Supervisor’, in line with standard practice.

III. CONCLUSION

The EDPS considers that on the whole the Amended Proposal maintains the level of protection of personal data contained in the EU data protection framework, namely Directive 95/46/EC and Regulation (EC) No 45/2001.

Nevertheless, the EDPS notes that whether such standards of data protection will indeed be maintained will depend on the specific content of implementing legislation for which the Amended Proposal creates a legal basis. Since implementing legislation will be crucial for the protection of personal data in this context, the EDPS particularly welcomes the inclusion in the Amended Proposal of the obligation to consult him on the drafting of such implementing legislation.

In summary, besides the clarification of Article 17.1 suggested under section II.2, and the amendment proposed under section II.3 in accordance with the existing rules on consultation, the EDPS is satisfied with the content of the Amended Proposal and does not see the need for additional changes to it.

Done at Brussels on 13 November 2006 Peter HUSTINX European Data Protection Supervisor

(1) OJ L 281, 23.11.1995, p. 31.

(2) OJ L 8, 12.1.2001, p. 1.

(3) OJ C 301, 7.12.2004, p. 4.