EN Official Journal of the European Union C 160/1

Opinion of the European Data Protection Supervisor on the proposal for a Council decision on a Union position within the EU-US Joint Customs Cooperation Committee regarding mutual recognition of the Authorised Economic Operator Programme of the European Union and the Customs-Trade Partnership Against Terrorism Program of the United States

2012/C 160/01

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1),

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular Article 41 thereof (2),

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTION

I.1. Consultation of the EDPS and aim of the Opinion

1. On 5 January 2011, the Commission adopted a Proposal for a Council decision on a Union position within the EU-US Joint Customs Cooperation Committee regarding mutual recognition of the Authorised Economic Operator Programme of the European Union and the Customs-Trade Partnership Against Terrorism Program of the United States (3) (hereinafter: ‘the Proposal’). The Proposal was sent to the EDPS on the same day.

2. The EDPS had been previously informally consulted and has sent a number of informal comments to the Commission. The aim of this Opinion is to complement these comments in light of the present Proposal and to make his views publicly available.

3. The EDPS acknowledges that the processing of personal data is not at the core of the proposal. Most information processed will not contain personal data, as defined in data protection law (4). However, data protection law should be respected also in those circumstances where this is the case, as will be explained below.

I.2. Context of the Proposal

4. The aim of the Proposal is to establish mutual recognition of the EU and the US trade partnership programmes — namely the EU Authorised Economic Operator (AEO) and the US Customs-Trade Partnership against Terrorism (C-TPAT) — in order to facilitate trade of operators who have invested in supply chain security and are members of one of these programmes.

5. EU-US relations in the area of customs are based on the Agreement on Customs Cooperation and Mutual Assistance in Customs Matters (CMAA) (5). This agreement sets up the Joint Customs Cooperation Committee (JCCC), which consists of representatives of the customs authorities of the EU and the US. Mutual recognition is to be established by a decision of this Committee. Therefore, the Proposal consists of: — an Explanatory Memorandum; — a proposal for a Council decision stating that the EU will take position within the JCCC as set out in the draft decision on mutual recognition; — the JCCC draft decision establishing mutual recognition of the EU AEO and the US C-TPAT (hereinafter: ‘the draft decision’) (6).

6. The draft decision is to be implemented by the customs authorities, who have set out a process of joint validations (application process for granting membership to operators, assessment of applications, granting of membership and monitoring of membership status).

7. The good functioning of the mutual recognition is thus based on the exchange of information between EU and US customs authorities on trade operators who are already members of a partnership programme.

II. ANALYSIS OF THE DRAFT DECISION

II.1. Processing of data relating to natural persons

8. Although the purpose of the draft decision is not the processing of personal data, some of the information exchanged will relate to natural persons, especially if the operator is a natural person (7) or if the official title of the legal person acting as operator identifies a natural person (8).

9. The relevance of data protection in this context has been underlined by the European Court of Justice in its Schecke ruling. According to the Court, legal persons can claim the protection of the rights to privacy and data protection, as recognised in the Charter of Fundamental Rights of the EU, if the official title of the legal person identifies one or more natural persons (9). The present Opinion will thus analyse how the exchange of personal data relating to operators is regulated in the draft decision.

II.2. Applicability of the EU data protection framework

10. The processing will be carried out by the customs authorities defined in Article 1(b) of the CMAA (10). This definition refers, in the EU, to ‘the competent services’ of the European Commission and to the customs authorities of the EU Member States. According to the EU data protection legislation, processing by EU Member States is subject to Directive 95/46/EC (hereinafter: ‘the Data Protection Directive’) and to the national data protection laws implementing the Data Protection Directive, while the processing of personal data by EU institutions and bodies is subject to Regulation (EC) No 45/2001 (hereinafter: ‘the Regulation’). Therefore, in this case both the Data Protection Directive and the Regulation are applicable.

II.3. Level of protection

11. Exchanges of information are to be conducted in electronic format and in accordance with the CMAA. Article 17(2) of the CMAA states that personal data can only be transferred between the parties of the agreement if the party that will receive the data guarantees a level of protection which is at least equivalent to the one applicable to that particular case in the country that supplies the data.

12. The EDPS welcomes this provision, which should be understood as aiming at complying with EU data protection law. According to Article 25 of the Data Protection Directive and Article 9 of the Regulation, as a main rule data can only be transferred from the EU to third countries if the receiving country ensures an ‘adequate’ level of protection (11). Article 17(2) of the CMAA thus seems stricter than the Data Protection Directive.

13. Therefore, it should be analysed on the basis of all relevant circumstances whether the receiving authorities in the United States indeed guarantee an equivalent level of protection (or at least an ‘adequate’ level). The analysis of the adequacy must be conducted in light of all the circumstances surrounding the transfer or set of transfers (12).

14. The European Commission has not found that the US as a whole ensures an adequate level of protection. In the absence of a general adequacy decision, controllers (13), under the supervision of data protection authorities (14), may decide that the protection provided in that specific case is adequate. EU Member States (or the EDPS, if the transfers are carried out by EU institutions or bodies) can also authorize a specific transfer or a set of transfers of personal data to a third country where the controller adduces adequate safeguards (15).

15. These ad hoc adequacy decisions could be applied in this case if the national customs authorities and the services of the European Commission responsible for customs matters present sufficient evidence supporting the allegations of the adoption of adequate safeguards by the US customs authorities as regards the transfers foreseen in the draft decision (16).

16. However, the EDPS does not have sufficient evidence that US customs authorities ensure a level of data protection which is ‘adequate’ or ‘at least equivalent to the one applicable to that particular case in the country that supplies the data’ as required by Article 17(2) of the CMAA.

17. The EDPS urges therefore to ensure that evidence demonstrating that US customs authorities ensure a level of data protection which is ‘adequate’ or ‘at least equivalent to the one applicable to that particular case in the country that supplies the data’ as required by Article 17(2) of the CMAA will be available for the EDPS and to national data protection authorities. This should be required by a provision in the draft decision.

18. Finally, transfers of personal data from the EU to countries which do not guarantee an ‘adequate’ level of protection can also be allowed if any of the exceptions of Article 26(1) of the Data Protection Directive or Article 9(6) of the Regulation apply. In this particular case, it could be argued that the transfer is ‘necessary or legally required on important public interest grounds’ (17). However, these exceptions should be interpreted restrictively and cannot be the basis for massive or systematic transfers of personal data (18). In the view of the EDPS, these exceptions would not be helpful in the present case.

II.4. Purpose limitation

19. Section V(1) of the draft decision states that the data exchanged may only be processed by the receiving customs authorities for the purposes of implementing the draft decision, in conformity with Article 17 of the CMAA.

20. However, processing for other purposes is also allowed by Section V(3), 4th indent and Article 17(3) of the CMAA. Considering that the purposes of the draft decision go beyond customs cooperation and include the fight against terrorism, the EDPS advises that all possible purposes of the transfers of personal data be specified in the text of the decision. Besides, any data transferred should be necessary and proportionate to fulfil these purposes. It should also be specified that data subjects should be informed in a comprehensive way about all purposes and conditions of processing of their personal data.

II.5. Categories of data to be exchanged

21. Data on the members of the Trade Partnership Programmes that may be exchanged among customs authorities are the following: name; address; status of membership; validation or authorisation date; suspensions and revocations; the unique authorization or identification number; and ‘details that may be mutually determined between the Customs Authorities, subject, where applicable, to any necessary safeguards’ (19). As this last field is too open, the EDPS recommends specifying which categories of data it may include.

22. The EDPS also notes that data exchanged may include data on offences or suspected offences, for example, data related to the suspension and revocation of membership. The EDPS underlines that EU data protection law, restricts the processing of personal data relating to offences, criminal convictions or security measures (20). The processing of these categories of data may be subject to prior checking by the EDPS and EU national data protection authorities (21).

II.6. Onward transfers

23. Section V(3), third indent allows the transfer of data to third countries or international bodies if the supplying authority has provided prior consent and in accordance with the conditions specified by this authority. Further transfers should not be allowed unless a justification is provided.

24. Therefore, it appears that Section V(3) should include a provision similar to the one contained in Article 17(2) of the CMAA, stating that personal data can only be transferred to a third country if the receiving country guarantees a level of protection which is at least equivalent to the one required in the draft decision. The protection granted to personal data under this draft decision could otherwise be circumvented by onward transfers.

25. This provision should in any case specify the purposes of such transfers and the specific situations in which they are allowed. It should also explicitly state that the necessity and the proportionality of international onward transfers are to be assessed on a case by case basis and that massive or systematic transfers are not allowed. The obligation to inform data subjects about the possibility of international onward transfers should also be included in the text.

II.7. Data retention

26. The EDPS welcomes Section V(2), which prohibits to process or keep the information longer than necessary for the purpose for which it is transferred. However, a maximum retention period should also be established.

II.8. Security and accountability

27. Section IV states that the exchanges of information will be conducted in an electronic format. According to the EDPS, more details on the information exchange system to be established should be provided in this section. In any case, the chosen system should integrate privacy and data protection from the design stage (Privacy by Design).

28. In this respect, the EDPS welcomes the security safeguards foreseen in Section V(3), first and second indents, which include access controls, ‘protection from unauthorized access, dissemination, and alteration, deletion or destruction’ and controlling that data is only for the purposes of the draft decision. He also welcomes the access logs foreseen in Section V(3), 5th indent.

29. The EDPS recommends also including in these provisions the obligation to conduct a data protection impact assessment (including a risk assessment) before the start of the exchanges of data. The assessment should include a risk assessment and the measures envisaged to address the risks (22). The text should also specify that compliance with these measures and their implementation should be periodically audited and reported. This is all the more relevant taking into account the possibility that sensitive data will be processed.

II.9. Data quality and rights of data subjects

30. The EDPS welcomes the obligation for customs authorities to ensure that the information exchanged is accurate and regularly updated (see Sections V(2) and V(5)). He also welcomes Section V(4), which guarantees to operators who are members of the partnership programmes the right of access and rectification of their personal data.

31. However, the EDPS notes that the exercise of these rights is subject to the custom's authority domestic legislation. As regards data supplied by EU customs authorities, and in order to guarantee an ‘adequate’ level of protection (see section II.3 of this Opinion), these rights should only be limited if such restriction is necessary to safeguard an important economic or financial interest.

32. The EDPS also welcomes the fact that customs authorities are obliged to delete the data they have received if its collection or further processing contravenes the draft decision or the CMAA (23). The EDPS would like to remind that in accordance with Article 17(2) of the CMAA, this provision would apply to any processing which is against EU data protection law.

33. The EDPS welcomes the obligation for customs authorities to provide information to programme members on their options for seeking redress (24). However, it should be clarified which are the options of redress in case of a breach of the data protections safeguards guaranteed by the draft decision. This provision should also specify that other data subjects (namely, operators who are applying for membership) should also be informed of the options of seeking redress.

II.10. Oversight

34. The EDPS welcomes Section V(6) which subjects the whole Section V to ‘independent oversight and review’ by the US Department of Homeland Security's Chief Privacy Officer, the EDPS and national data protection authorities.

35. It should also be specified that the EDPS and national data protection authorities should supervise that the level of protection granted to personal data by the receiving customs authority is ‘adequate’ (see section III.1.). Section IV should also be subject to oversight and review.

III. CONCLUSION

36. The EDPS welcomes the safeguards foreseen in the draft decision, especially as regards data security. However, evidence demonstrating that US customs authorities ensure a level of data protection which is ‘adequate’ or ‘at least equivalent to the one applicable to that particular case in the country that supplies the data’ as required by Article 17(2) of the CMAA should be available for the EDPS and to national data protection authorities. This should be required by a provision in the draft decision.

37. In addition, he recommends the following: — specifying the purpose(s) of the exchanges of data foreseen in the draft decision, which should be necessary and proportional; — specifying the categories of data included under Section IV(3)(g); — specifying that in case that the necessity of onward international transfers is justified, these should only be allowed, on a case-by-case basis, for compatible purposes and if the receiving country guarantees a level of protection which is at least equivalent to the one granted by the draft decision; — including an obligation to inform all data subjects on the above; — complementing the provisions on security; — specifying maximum data retention periods; — not limiting rights of EU data subjects unless such restriction is necessary to safeguard an important economic or financial interest; — guaranteeing the right to redress; — subjecting Section IV to oversight and review; — specifying that the EDPS, EU national data protection authorities and the US Department of Homeland Security's Chief Privacy Officer should supervise that safeguards implemented by the receiving customs authority to ensure an adequate level of protection of personal data are effective and in line with EU requirements.

38. The EDPS also notes that the Proposal may imply the processing of personal data relating to offences or suspected offences. These data are subject to stricter safeguards under EU law and may be subject to prior checking by the EDPS and by EU national data protection authorities.

Done at Brussels, 9 February 2012. Giovanni BUTTARELLI Assistant European Data Protection Supervisor

(1) OJ L 281, 23.11.1995, p. 31.

(2) OJ L 8, 12.1.2001, p. 1.

(3) COM(2011) 937 final.

(4) As set out in points 8-9 of this Opinion.

(5) Agreement between the European Community and the United States of America on customs cooperation and mutual assistance in customs matters (OJ L 222, 12.8.1997, p. 17), available on http://ec.europa.eu/world/agreements/prepareCreateTreatiesWorkspace/treatiesGeneralData.do?step=0&redirect=true&treatyId=308 (summary and full text).

(6) Proposal for a Decision of the US-EU Joint Customs Cooperation Committee regarding mutual recognition of the Customs-Trade Partnership against Terrorism Program in the United States and the Authorised Economic Operators Programme of the European Union.

(7) Personal data are defined in Article 2(a) of Directive 95/46/EC and Article 2(a) of Regulation (EC) No 45/2001 as ‘any information relating to an identified or identifiable natural person’.

(8) See also EDPS Opinion on the proposal for a Council Decision on a Union position within the EU-Japan Joint Customs Cooperation Committee concerning the mutual recognition of Authorised Economic Operator programmes in the European Union and in Japan, available on http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:2010:190:0002:0006:EN:PDF

(9) European Court of Justice, 9 November 2010, Volker und Markus Schecke, C-92/09 and C-93/09, paragraph 53 (available on http://curia.europa.eu/jurisp/cgi-bin/gettext.pl?where=&lang=en&num=79898890C19090092&doc=T&ouvert=T&seance=ARRET).

(10) See Section I(2) of the draft decision.

(11) The Regulation adds that these transfers can only take place if the data are transferred ‘solely to allow tasks covered by the competence of the controller to be carried out’.

(12) See Articles 9(1) and 9(2) of the Regulation, Articles 25(1) and 25(2) of the Data Protection Directive and EU national data protection laws implementing them. See also EDPS Opinion on EU-Japan Joint Customs Cooperation, cited above.

(13) In this cases, the customs authorities of the EU and its Member States.

(14) In some Member Sates, only data protection authorities can authorize the transfer.

(15) Article 26(2) of the Data Protection Directive and Article 9(7) of the Regulation.

(16) See also EDPS letter on ‘Transfers of personal data to third countries: “adequacy” of signatories to Council of Europe Convention 108 (Case 2009-0333)’, available on http://www.edps.europa.eu/EDPSWEB/webdav/shared/Documents/Supervision/Adminmeasures/2009/09-07-02_OLAF_transfer_third_countries_EN.pdf

(17) See Article 9(6)(d) of the Regulation or Article 26(1)(d) of the Data Protection Directive, which according to Recital 58 of the Data Protection Directive, includes transfers between tax or customs authorities.

(18) See Article 29 Working Party Working Document of 25 November 2005 on a common interpretation of Article 26(1) of Directive 95/46/EC of 24 October 1995 (WP114), pages 7-9, available on http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2005/wp114_en.pdf

(19) See Section IV(3)(a) to (g) of the draft decision.

(20) See Article 8(5) of Directive 95/46/EC and Article 10(5) of Regulation (EC) No 45/2001.

(21) See Article 27(a) of Regulation (EC) No 45/2001 and EU national data protection laws implementing Article 20 of Directive 95/46/EC.

(22) As already foreseen in Article 33 of the new Proposal for a Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (COM(2012) 11/4 draft).

(23) See Section V(5) of the draft decision.

(24) See Section V(4), last sentence.