COMMISSION OF THE EUROPEAN COMMUNITIES 
Brussels, 18.07.1995 
COM(95) 375 final-COD287 
OPINION OF THE COMMISSION 
pursuant to Article 189 b (2) (d) of the EC Treaty, 
on the European Parliament's amendments 
to the Council's common position regarding the 
>slra§slIP proposal for a 
EUROPEAN PARLIAMENT AND COUNCIL DIRECTIVE 
on the protection of individuals with regard to the processing of 
personal data and on the free movement of such data 
mm 
•£83» 
/••.••£5$fe AMENDING THE PROPOSAL OF THE COMMISSION 
pursuant to Article 189 a (2) of the EC Treaty 

1. BACKGROUND 
(a) On 27 July 1990 the Commission presented to the Council a proposal for a 
Directive (COM(90) 314 final - SYN 287).l 
(b) On 24 April 1991 the Economic and Social Committee delivered its opinion ^ 
(c) On 11 March 1992 Parliament delivered its opinion (first reading) and adopted a 
resolution endorsing the Commission proposal, subject to a large number of 
amendments. 
(d) On 15 October 1992 the Commission adopted an amended proposal for a 
Directive pursuant to Article 149(3) of the EEC Treaty (COM(92)422 final -
SYN 287) 4 
(e) On 20 February 1995 the Council adopted a common position. 
(f) On 24 February 1995 the Commission transmitted to Parliament its opinion on 
this common position (SEC(95) 303 final - COD 287). 
(g) On 15 June 1995 Parliament approved (second reading) seven amendments to 
the common position. 
2. PURPOSE OF THE COMMISSION PROPOSAL 
The proposal for a Directive seeks to facilitate the free movement of data within the 
Community by affording individuals a high level of protection with regard to the 
processing of personal data. Harmonization of the relevant national laws has proved 
necessary because of the wide divergences between them and of data-exchange 
requirements imposed by completion of the internal market. 
The White Paper "Growth, competitiveness, employment" and the Bangemann 
group's report "Europe and the global information society" underscored the need for 
the Directive as a regulatory measure within the clear, stable legal framework that is 
essential if the information society is to develop along lines acceptable to the citizens 
of Europe. 
The proposal for a Directive lays down common ground rules for the protection of 
individual rights with regard to the processing of personal data. 
The high-level protection is afforded through the obligations imposed on data 
controllers (for example, public authorities, enterprises and associations) and through 
the rights conferred on the individuals whose data are processed. 
The obligations on controllers relate, for example, to the quality of the data - the 
processing of which must meet a specific and legitimate purpose - to security 
requirements and to the notification of such processing to an independent supervisory 
authority to be set up by the Member States. 
OJNoC277, 5.11.1990, p. 3. 
OJNoC159, 17.6.1991, p. 38. 
OJ No C 94, 13.4.1992, p. 76; OJ Annex, Debates of the European Parliament, No 3/416, p. 133. 
OJ No C 311, 27.11.1992, p. 30. 
OJNoC93, 13.4.1995, p. 1. 
2 
The right to be informed under certain circumstances about the processing of data 
relating to them, the right of access to such data and the right to ask for them to be 
corrected if they are inaccurate and even to object to their processing are the main 
rights conferred on individuals by the proposal. 
3. COMMISSION OPINION ON PARLIAMENT'S AMENDMENTS 
1. The seven amendments put forward by Parliament are acceptable to the 
Commission. 
2. Five of them, which relate to the substance of the proposal, make useful 
clarifications to the text. 
Amendment No 1 incorporates into the 41st recital a specific reference to 
business confidentiality as grounds for possibly limiting an individual's right to 
know the logic involved in the automatic processing of data concerning him. 
Amendment No 3 provides in Article 2(d) for the possibility that for a single 
processing operation a number of parties may jointly determine the purpose and 
means of the processing to be carried out. 
It follows from this that, in such a case, each of the co-controllers must be 
considered as being constrained by the obligations imposed by the directive so as 
to protect the natural persons about whom the data are processed. 
Amendment No 4 is intended to make it clear in Article 3(2) that the processing 
of personal data carried out for the "economic well-being of the State" is 
excluded from the scope of the Directive where that operation relates to 
questions of State security. 
In order to do this, amendment No 4 adopts the wording used in the 13th recital 
of the common position. 
Amendment No 5 incorporates into Article 9 a clarification to the effect that 
Member States will have to provide for exemptions or derogations "only" if they 
are necessary to reconcile the right to privacy with the rules governing freedom 
of expression. 
Amendment No 6 is designed to clarify the point that transfers which are "legally 
required" on important public interest grounds escape application of the normal 
rule that the third country of destination must ensure an adequate level of 
protection to enable such transfers to take place. 
Although it is not specified in certain language versions of the text, it seems 
evident that such a transfer could only be considered as legally required where a 
legal act of a public authority applies, notably a law passed by the national 
parliament. On the contrary a simple contractual agreement could not serve as a 
basis for such a transfer. 
3. The remaining two amendments concern the Commission's implementing powers. 
Amendment No 2 introduces a reference to the "modus vivendi" agreed between 
Parliament, the Council and the Commission on 20 December 1994. 
Amendment No 7 is designed to replace the Ilia regulatory committee with a lib 
management committee. 
A management committee is fully consistent with the nature of the powers 
conferred on the committee by the Council common position. Those powers are 
limited to transfers to third countries: they cover the appraisal, based on the 
criteria set out in Article 25(2), of whether or not there is an adequate level of 
protection in third countries (Article 25(3) and (6)) and the adoption of 
appropriate measures to authorize transfers to third countries not having an 
adequate level of protection (Article 26(3) and (4)). 
It should also be pointed out that there is no major difference between the Ilia 
committee and the lib committee in terms of powers available to the 
Commission. The difference between the two procedures is essentially formal: in 
one case (Ilia), the Council decides on the basis of a Commission proposal, while 
in the other (lib) it amends a decision which has already been taken by the 
Commission but whose effects are suspended. However, the lib procedure is 
quicker since it obviates the need for a new procedure within the Commission: 
the Commission's decision simply takes effect once the period allowed the 
Council has expired. 
The Commission very much hopes that the Council will also be convinced by this 
procedural efficiency aspect of the matter, which is important for the decisions to 
be taken. 
Amended proposal for a 
t. 
EUROPEAN PARLIAMENT AND COUNCIL DIRECTIVE 
on the protection of individuals with regard to the 
processing of personal data and on 
the free movement of such data 
(presented by the Commission pursuant to 
Article 189a(2) of the EC Treaty) 
Common position of the Council Amended Commission proposal 
Recital 41 
Whereas any person must be able to 
exercise the right of access to data relating 
to him which are being processed, in order 
to verify in particular the accuracy of the 
data and the lawfulness of the processing; 
whereas, for the same reasons, every data 
subject must also have the right to know 
the logic involved in the automatic 
processing of data concerning him, at least 
in the case of automated decisions referred 
to in Article 15(1); whereas this right must 
not adversely affect intellectual property 
and in particular the copyright protecting 
the software; whereas these considerations 
must not, however, result in the data 
subject being refused all information; Whereas any person must be able to 
exercise the right of access to data relating 
to him which are being processed, in order 
to verify in particular the accuracy of the 
data and the lawfulness of the processing; 
whereas, for the same reasons, every data 
subject must also have the right to know 
the logic involved in the automatic 
processing of data concerning him, at least 
in the case of automated decisions referred 
to in Article 15(1); whereas this right must 
not adversely affect business 
confidentiality or intellectual property and 
in particular the copyright protecting the 
software; whereas these considerations 
must not, however, result in the data 
subject being refused all information; 
Common position of the Council Amended Commission proposal 
Recital 66a (new) 
Whereas an agreement on a "modus 
vivendi" between the European 
Parliament, the Council and the 
Commission concerning the implementing 
measures for acts adopted in accordance 
with the procedure laid down in Article 
189B of the EC Treaty was reached on 20 
December 1994. 
Common position of the Council Amended Commission proposal 
Article 2(d) 
d) "controller" shall mean the natural or 
legal person, public authority, agency 
or any other body which determines 
the purposes and means of the 
processing of personal data. Where 
the purposes and means of processing 
are determined by national or 
Community laws or regulations, the 
controller or the specific criteria for 
his nomination may be designated by a 
national or Community law; d) "controller" shall mean the natural or 
legal person, public authority, agency 
or any other body which alone or 
jointly with others determines the 
purposes and means of the processing 
of personal data. Where the purposes 
and means of processing are 
determined by national or Community 
laws or regulations, the controller or 
the specific criteria for his nomination 
may be designated by a national or 
Community law; 
Common position of the Council Amended Commission proposal 
Article 3(2), first indent 
in the course of an activity which falls -
outside the scope of Community law, 
such as those provided for by Titles V 
and VI of the Treaty on European 
Union and in any case to processing 
operations concerning public security, 
defence, State security (including the 
economic well-being of the State) and 
the activities of the State in areas of 
criminal law; in the course of an activity which falls 
outside the scope of Community law, 
such as those provided for by Titles V 
and VI of the Treaty on European 
Union and in any case to processing 
operations concerning public security, 
defence, State security (including the 
economic well-being of the State 
when the processing operation is 
bound up with questions of State 
security) and the activities of the State 
in areas of criminal law; 
Common position of the Council Amended Commission proposal 
Article 9 
Member States shall provide for Member States shall provide for 
exemptions or derogations from the exemptions or derogations from the 
provisions of this Chapter, Chapter IV and provisions of this Chapter, Chapter IV and 
Chapter VI for the processing of personal Chapter VI for the processing of personal 
data carried out solely for journalistic data carried out solely for journalistic 
purposes or the purpose of artistic or purposes or the purpose of artistic or 
literary expression which prove necessary literary expression only if they are 
to reconcile the right to privacy with the necessary to reconcile the right to privacy 
rules governing freedom of expression. with the rules governing freedom of 
expression. 
10 
Common position of the Council Amended Commission proposal 
Article 26(1) (4) 
4) the transfer is necessary on important 4) the transfer is necessary or legally 
public interest grounds, or for the required on important public interest 
establishment, exercise or defence of grounds, or for the establishment, 
legal claims, or exercise or defence of legal claims, or 
tt 
Common position of the Council Amended Commission proposal 
Article 31(2), third, fourth and fifth subparagraphs 
The Commission shall adopt the measures 
envisaged if they are in accordance with 
the opinion of the committee. 
If the measures envisaged are not in 
accordance with the opinion of the 
committee or if no opinion is delivered the 
Commission shall, without delay, submit 
to the Council a proposal relating to the 
measures to be taken. The Council shall 
act by a qualified majority. 
If within three months of the referral to it 
the Council has not acted, the proposed 
measures shall be adopted by the 
Commission The Commission shall adopt measures 
which shall apply immediately. However, 
if these measures are not in accordance 
with the opinion of the committee, they 
shall be communicated by the Commission 
to the Council forthwith. In that event: 
The Commission shall defer application of 
the measures which it has decided for a 
period of three months from the date of 
such communication. 
The Council, acting by a qualified 
majority, may take a different decision 
within the time limit referred to in the 
previous subparagraph. 
12 
ISSN 0254-1475 
COM(95) 375 final 
DOCUMENTS 
EN 08 16 
Catalogue number : CB-C0-95-397-EN-C 
ISBN 92-77-92142-0 
Office for Official Publications of the European Communities 
L-2985 Luxembourg