EN Official Journal of the European Union C 94/12

Opinion of the European Data Protection Supervisor on: the Modified Proposal for a Council Regulation amending Regulation (EC, Euratom) No 1605/2002 on the Financial Regulation applicable to the general budget of the European Communities (COM(2006) 213 final) and on the Proposal for a Commission Regulation (EC, Euratom) amending Regulation (EC, Euratom) No 2342/2002 laying down detailed rules for the implementation of Council Regulation (EC, Euratom) No 1605/2002 on the Financial Regulation applicable to the general budget of the European Communities (SEC(2006) 866 final)

(2007/C 94/03)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1),

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (2), and in particular its Article 41,

Having regard to the requests for an opinion in accordance with Article 28 of Regulation (EC) No 45/2001 sent on 18 May 2006 (for the Modified Proposal of the Financial Regulation) and 4 July 2006 (for the Proposal of the Implementing Rules) by the Commission;

HAS ADOPTED THE FOLLOWING OPINION

I. INTRODUCTION

1. Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities (3) (hereinafter ‘FR’) lays down the legal foundations of the financial management reform. In December 2002, after extensive consultation of the institutions, the Commission adopted the Implementing Rules of the FR (hereinafter ‘IR’). Both regulations, which apply to all institutions, entered into force on 1 January 2003.

2. The Modified Proposal for a Council Regulation amending Regulation (EC, Euratom) No 1605/2002 on the Financial Regulation applicable to the general budget of the European Communities (4) (hereinafter ‘FR Proposal’) adopted in 2006 is presented in order to fulfil Article 184 of the FR, which subjects the Financial Regulation to review every three years, or whenever it proves necessary to do so. The main objective of the FR Proposal is to improve the efficiency and transparency of the rules by striking a better balance between the cost of control and the financial risks at stake whilst maintaining a high level of protection of the Community funds. The Modified Proposal of the FR was agreed via conciliation between the European Parliament and the Council at the end of November 2006. This Opinion takes this text into account (5).

3. In order to speed-up the legislative process, the Commission took the initiative to present a Proposal for a Commission Regulation (EC, Euratom) amending Regulation (EC, Euratom) No 2342/2002 laying down detailed rules for the implementation of Council Regulation (EC, Euratom) No 1605/2002 on the Financial Regulation applicable to the general budget of the European Communities (6) (hereinafter ‘IR Proposal’). The EDPS is consulted in the framework of these two proposals.

4. The EDPS considers that an analysis of the proposals is important because they will affect the way in which some personal data of individuals, relating to financial activities are dealt with. One of the main points of the proposals is that they foresee the set up and operation by the Commission of a central database, common to all institutions and bodies, of candidates and tenderers under specific situations of exclusions in case of fraud and allow the exchange of the information contained in the database with authorities at different levels. The EDPS underlines that the central database foreseen, which would include candidates and tenderers who have found themselves in one of the situations referred to in Articles 93, 94 and 96 (1)(b) and (2)(a) of the Financial Regulation, already existed prior to the modification of the Financial Regulation (7). The existing database relies on the use of warnings of different levels (1, 2, 3, 4, 5a and 5b) according to their impacts on the candidates and tenderers. However, the existing database, developed at institutional level by the Commission, has a broader scope than the one which is foreseen in the Financial Regulation proposal (covering only warnings of level 5). This central database and other aspects of the proposals require careful analysis from a data protection point of view.

Consultation with the EDPS

5. The FR and IR Proposals were sent by the Commission to the EDPS for advice as foreseen in Article 28(2) of Regulation (EC) No 45/2001 of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (hereinafter ‘Regulation 45/2001’). In view of the mandatory character of Article 28(2) of Regulation 45/2001, the EDPS welcomes the explicit reference to this consultation in the preamble of the proposals.

II. ANALYSIS OF THE PROPOSALS

6. The Commission, responsible for executing the general budget of the European Union and any other funds managed by the Communities, is under an obligation to counter fraud and any other illegal activities affecting the financial interests of the Communities. The FR and IR proposals set out new obligations on the Commission concerning the award of contracts and grants to third parties in the context of management of Community funds. Taking into account that the proposals set forth rules to be followed in order to ensure the protection of the Communities' financial interests, it is essential that in doing so, the data protection and privacy rights of the persons concerned are properly guaranteed when personal data are processed.

II.1. Transparency

7. The EDPS recognises that important principles relating to sound financial management are fostered in the proposals and that new ones are introduced or reinforced. For instance, the EDPS notes that Recital 1 of the FR Proposal foresees that ‘transparency, in particular, has to be reinforced by providing for information on beneficiaries of Community funds’. This principle is developed in Articles 30(3) and 53 of the FR.

8. These provisions, dealing with the transparency principle, introduce the publication of beneficiaries of funds deriving from the budget. The EDPS supports the inclusion of this principle, with due respect to Directive 95/46/EC and Regulation 45/2001, but wants to underline that a proactive approach to the rights of the data subjects (8) should be respected, as personal data will be disclosed. This proactive approach could consist of informing the data subjects beforehand, at the time the personal data are collected, that these data might be made public, and of ensuring that the data subject's right of access and right to object are respected. This principle should also apply to the ex post publication of beneficiaries (Article 169 of the Implementing Rules).

II.2. Early Warning System (EWS) central database

9. Article 95 of the FR Proposal stipulates that a central database containing the relevant details of candidates and tenderers which are in a situation of exclusion referred to in Articles 93, 94 (9), 96 (1)(b) and (2)(a) shall be set up and operated by the Commission in compliance with Community rules on the processing of personal data. As mentioned in the introduction, this new version of Article 95, stressing the leading role of the Commission, does not substantially modify the existing practice which has been used so far (i.e. Article 95 of the FR states that each institution has its own central database). Indeed, currently the institutions (10) do not have a separate database but use the computerised database of the European Commission and exchange information with the latter (11). This database is handled according to the procedure foreseen in the Commission Decision on the Early Warning System (EWS) (12). The Commission centralises all relevant information and plays the role of a central gateway between all institutions participating in the scheme.

10. Article 95 of the FR Proposal also states that the database is common to the institutions, executive agencies and bodies referred to in Article 185 of the FR. In the agreed version of the Financial Regulation, Article 95 further states that the authorities of the Member States and third countries as well as the bodies participating in the implementation of the budget shall communicate to the competent authorising officer information on candidates and tenderers which are in one of the situations referred to in Article 93(1) (e) (i.e. judgment which has the force of res judicata). This information is communicated where the conduct of the operator concerned was detrimental to the Communities' financial interests (Article 95(2)). The consequences attached to the involvements of those actors will be analysed below.

11. The EDPS agrees to the principle of a central database of candidates and tenderers who have found themselves in one of the situations referred to in Article 93, 94 and 96 (1)(b) and (2)(a) in the light of the purposes of data processing foreseen by the FR. These purposes are to enhance the effectiveness, improve the protection of the financial interests of the Communities and ensure circulation of restricted information concerning third parties.

12. However, although central databases and large scale systems are becoming more widely used nowadays, the EDPS considers that, in each case, the need for such a database must be properly and carefully assessed and that when such database is established, specific safeguards have to be implemented in the light of data protection principles. The reason behind is to avoid any developments which would unduly affect the protection of personal data. In the view of the EDPS, any proposal which foresees the creation of a central repository of personal data has to respect the European data protection regulatory framework and implement it concretely. For instance, Articles 4 (data quality), 5 (lawfulness of processing) and 10 (processing of special categories of data) of Regulation 45/2001 are most relevant for the processing of personal data by European institutions.

13. Moreover, the EDPS underlines that personal data should be collected for legitimate purposes (Article 4(1) (b) of Regulation 45/2001). In this context, the EDPS considers that if it is in the legitimate interests of the institutions and bodies to set up the system in order to preserve the financial interests and reputation of the Communities, the introduction of a warning against a person can have serious adverse effects for a data subject and for this reason specific safeguards must be in place to uphold the data subject's legitimate interests. These safeguards are developed in the following paragraphs.

II.2.a. Data subjects concerned

14. The EWS database is based on the centrally validated ‘Legal Entity File ’(hereinafter LEF) and uses the data it contains. The LEF is a general database, which covers legal persons or individuals who at any time have (had) contractual and/or financial dealings with one of the Commission's services: service providers, staff, experts, beneficiaries of grants. Article 95 of the FR Proposal only refers to candidates and tenderers and does not apply to members of staff as they can not be as well candidates and tenderers. In this respect, the EDPS suggests clarifying the definition of the candidates and tenderers in the IR Proposal, so as to avoid confusions between the entities covered.

15. Moreover, the EDPS suggests that the IR proposal, in Article 134a, should clarify the categories of entities which are affected by the database. Article 134a covers third parties, also called legal entities in the LEF, which are either natural persons or legal persons. Besides, the Proposal anticipates a third category in the sense that the information may also include natural persons with powers of representation, decision making or control over given legal persons. Therefore, in the latter case, natural persons are in the system as far as they have power of representation. In the present practice, they are included as a new autonomous entry in the database. The links and differences between the legal persons and the natural persons with powers of representation, decision making or control over given legal persons should benefit from clarification.

II.2.b. Update of information registered in the database

16. The data quality principle (Article 4 of Regulation 45/2001) requires data to be adequate, relevant and not excessive in relation to the purposes for which they are collected (13). It is clear that the quality of the personal data can only be ensured if its accuracy is regularly and properly checked. The procedure currently foreseen in Article 134a(2) of the IR Proposal is that the Commission shall, via a secured protocol on a regular basis, provide validated data contained in the database to persons designated in the first paragraph of the same article. This proposed timetable is unclear. The EDPS is aware that alternatives are being considered, involving permanent provision of data. However, this would not be sufficient. Indeed, in the view of the EDPS, the update of the central database has to be frequent, and the frequency must be structured and respect a precise timetable (monthly or weekly transfers would help to ensure accuracy and timely update of the data).

II.2.c. Management and security

17. The central database must be adequately protected. The management of and respect for an optimal security level for the central database constitutes a fundamental requirement for ensuring the adequate protection of personal data stored in the database and its update. In order to obtain this satisfactory level of protection, proper safeguards have to be implemented for handling the potential risks related to the infrastructure of the system and to the persons involved.

18. In this respect, the EDPS is of the opinion that a consistent system for the selection of authorising officers must be put in place, as to allow adequate protection of the information stored in the central database and to protect its integrity. Although Article 134a foresees the selection and definition of tasks of the authorising officer responsible for requesting entry in the database and for receiving validated data contained in the database, this procedure is only foreseen for the institutions, executive agencies or bodies referred to in Article 185 of the FR and implemented for the Commission in the Commission Decision on the Early Warning System. There is no specific rule anticipated regarding the situation of Member States, third countries or international organisations. This situation may create inconsistency in the protection of the data which are accessed.

19. The EDPS advises to include provisions in complementary administrative rules on the way access to data is granted to the authorities and bodies of the Member States, third countries and international organisation as well as the amount of data which can be accessed. Indeed, the EDPS considers important not only to ensure the security of the information stored in the database but also that the information is sent to the relevant and authorized authorities, and within the authorities, exclusively to the relevant officers.

II.2.d. Exchange of data

20. The EDPS acknowledges the set up of a unique central access point to the database, which is coordinated by the Commission. Moreover, the FR Proposal extends the current scope of the EWS as it envisages access for more authorities and bodies than in the previous version. Therefore, the FR Proposal foresees different situations as far as access to information is concerned. The situations concern different authorities and bodies and must be analysed separately. From a data protection perspective, the EDPS notes that this right of access to the database, granted to different bodies, leads to a transfer of data to each one of the bodies concerned, despite the fact that the data are stored by the Commission. Therefore, the analysis must be carried out in the light of Articles 7, 8 and 9 of Regulation 45/2001 which deal with transfers of data.

21. The FR Proposal makes a distinction between two cases of transfer of data. The first relates to the transfer of data within or between Community institutions and bodies. The second refers to the right of access of the Member States and third countries or international bodies. For the purpose of this Opinion, the EDPS makes a separate analysis for the situation of Member States and the situation of third countries or international bodies, as these are separately covered by Regulation 45/2001.

22. The first situation is covered by Article 95, paragraph 1 of the FR Proposal, which states that the database set up and operated by the Commission is common to the institutions, executive agencies and the bodies referred to in Article 185 FR. The EDPS stresses that, when a transfer of personal data within or between Community institutions or bodies is foreseen, Article 7 of Regulation 45/2001 is applicable. Therefore, the EDPS reminds that the recipient of the data shall process them only for the purposes for which they were transmitted.

23. The access by Member States, third countries and international organisations is covered by the second indent of Article 95(2) of the FR Proposal. They shall have access to the information contained in the database and may take it into account, as appropriate and on their own responsibility, for the award of contracts associated with the implementation of the budget. Therefore, the Proposal foresees the automatic access to the database within the framework of award of contracts associated with the implementation of the budget.

24. The EDPS underlines that when Member States are recipients of the concerned data, Article 8 of Regulation 45/2001 is applicable. This article deals with the transfer of personal data to recipients, other than Community institutions and bodies, subject to Directive 95/46/EC. In this case, it is likely that Article 8 (a) is respected, considering that the ‘necessity ’of the data for the performance of the tasks carried out by the recipients is related to the way chosen by the Commission to implement the budget. Furthermore, all those bodies are acting under the national law implementing Directive 95/46 and are acting for the purpose of the implementation of European budget.

25. As far as third countries and international organisations are concerned, Article 9 of Regulation 45/2001 is applicable (14). Article 9(1) prohibits the transfer of personal data to recipients, other than Community institutions and bodies, which are not subject to national law adopted pursuant to Directive 95/46/EC, unless an adequate level of protection is ensured in the country of the recipient or within the recipient international organisation and the data are transferred solely to allow tasks covered by the competence of the controller to be carried out. Regulation 45/2001 allows for derogations, which cover the situation of the award of contracts associated with the implementation of the budget. However, the EDPS underlines that these exceptions have to be interpreted restrictively. It is preferable to provide for adequate safeguards in the case of structural transfers. In the context of the transfer from the central database, transfers are structural and therefore the need for safeguards, such as contractual clauses in the granting agreement of EU funds, should be laid down in the Implementing Rules.

26. Besides, third countries are not only provided with data from the central database, according to Article 95 of the FR. Article 134a of the IR also foresees the receiving of data from third countries and international organisations, and to this extent they shall certify to the Commission that information was established and transmitted in accordance with the rules on the protection of personal data. In this context, the EDPS underlines the importance of the data quality principle when international transfers of data take place. It must be ensured that the provisions of Regulation 45/2001 regarding the accuracy and updating of data, which are provided to the Commission and recorded in the database, are respected. Therefore, when agreements for funding are concluded, it will be important to define the data which are covered and the warranties attached to their quality. The need for these safeguards should also be included in the Implementing Rules.

II.2.e. Rights of candidates and tenderers

27. Candidates and tenderers which are registered in the central database shall benefit from safeguards regarding the management of their personal data in the central database. These safeguards should notably be found in the data subject's rights to be informed and to have access to data relating to them.

28. The right of information is covered by Article 134a(1) (3) of the IR Proposal. However, the EDPS considers that the wording of this paragraph should be reviewed and interpreted as follows: ‘The institutions, executive agencies, authorities and bodies referred to in Articles 95(1) and (2) of the Financial Regulation shall certify to the Commission that the information was established and transmitted in accordance with the rules on the protection of personal data and that the third party concerned was informed about the transmission of information’. The EDPS underlines that Regulation 45/2001 is applicable to the institutions, executive agencies and bodies but that the national legislations implementing Directive 95/46/EC will be applicable in Member States. However, problems may arise at national level when a third country does not provide its citizens with the right to be informed. The EDPS thinks that the Commission should ensure a mechanism allowing any candidates or tenderers to be aware of their inclusion in the central database.

29. Furthermore, the EDPS agrees with a proactive approach of the right to information (15). In the prior-check case regarding the implementation of the EWS of the Court of Justice (16), the EDPS welcomes that all third parties are informed beforehand that their personal data may be used by the Court not only for internal purposes related to the procurement process but also communicated to other institutions in the context of Articles 93 and 94 of the FR with the purpose of being included in the database of the Commission foreseen by Article 95 of the FR. In such cases a third party has already been informed of the possibility of being excluded from the participation in the procurement process or excluded from the award of a contract, if it is included in the database of the Commission. In the same perspective, the EDPS also recognises the efforts made to provide additional rights of information. For instance, recital 36 of the FR Proposal deals with the right of information to be provided to unsuccessful tenderers after a contract has been awarded. As already underlined in this Opinion, the EDPS proposes that this procedure is followed in all the concerned institutions, authorities and bodies and that it is prescribed in the IR Proposal.

30. Article 13 of Regulation 45/2001 establishes a right of access of a data subject to information which is processed by data controllers. Therefore, in order to implement this right, it should be stated in the Implementing Rules that any third party entered in the database has a right of access to the data regarding him or her and that this right should not be restricted for reasons other than those mentioned in Article 20 of Regulation 45/2001. Moreover, the right of access is closely related to the proactive approach mentioned above in the sense that not being aware of the inclusion in the database notably entails that persons will not be able to exercise their right of access.

II.2.f. Need for prior checking

31. According to Article 27(2) (b) of Regulation 45/2001, processing operations intended to evaluate personal aspects relating to data subjects, including their ability, efficiency and conduct, are likely to present specific risks to the rights of data subjects. Moreover, the same applies when they contain data relating to processing operations for the purpose of excluding individuals from a right, benefit or contract (Article 27(2) (d)).

32. At the date of adoption of this opinion, both the European Commission and the European Court of Justice have made a notification to the EDPS for prior checking of the Early Warning System based on the existing version of the FR. As the new version of the FR introduces modifications in the management of the database with regard to the setting up and operation of a common database to which Member States, third countries and international organisations will have access and to which they will send data, the EDPS considers it as a substantial change falling under Article 27 of Regulation 45/2001. Therefore, when the Commission will take the steps to implement the new legal framework, the EDPS will prior check the system.

III. TIME LIMITS FOR STORAGE AND BUDGETARY CONTROL

33. Although not covered by the current modifications which are part of the proposals, the EDPS would like to use this opportunity to highlight a provision which he dealt with in previous prior checking cases related to budgetary questions.

Existing framework

34. Article 49 of the present IR on the keeping of supporting documents by authorising officers provides that ‘The management systems and procedures concerning the keeping of original supporting documents shall provide for: (…) d) such documents to be kept for at least five years from the date on which the European Parliament grants discharge for the budgetary year to which the documents relate. Documents relating to operations not definitively closed shall be kept for longer than provided for in point (d) of the first subparagraph, that is to say, until the end of the year following that in which the operations are closed’.

35. The principle as concerns the conservation of supporting documents as established by the IR therefore allows for a possible conservation period of up to 7 years, for the purpose of budgetary discharge of the accounts of the European institutions and bodies.

36. Supporting documents kept by authorising officers may contain personal data and to this extent the principles on conservation of personal data as laid down by Regulation 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data also apply.

37. As a general principle, Article 4.1.c of Regulation 45/2001 provides that personal data must be adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed. Article 4.1.e of the Regulation further provides that personal data may be kept in a form which permits identification of the data subjects for no longer than is necessary for the purpose for which the data were collected or further processed.

38. Article 37 of the Regulation provides for specific rules as concerns the conservation of traffic and billing data in the context of internal communication networks. Such networks are defined in Article 34 as being ‘telecommunications network or terminal equipment operated under the control of a Community institution or body’. The article therefore applies to traffic and billing data collected by internal networks of the Community institutions or bodies.

39. According to Article 37.1, traffic data which are processed and stored to establish calls and other connections over the telecommunications network shall be erased or made anonymous upon termination of the call or other connection. The principle is therefore to erase data as soon as no longer necessary for the establishment of the call or connection.

40. Article 37.2 however provides that traffic data (17), as indicated in a list agreed by the EDPS, may be processed for the purpose of budget and traffic management, including the verification of authorised use of the telecommunications systems. They must be erased or made anonymous as soon as possible and in any case no longer than six months after collection, unless they need to be kept for a longer period to establish, exercise or defend a right in a legal claim pending before a court. If the period of six months lapses without the institution of proceedings, the traffic data must be erased or rendered anonymous. If proceedings have been commenced within that period, such proceedings will interrupt the prescriptive period until the end of the proceedings and further until the end of the prescriptive period allowed for any appeal or the conclusion of the appeal proceedings as the case may be. Any conservation of traffic and billing data beyond these six months can only be justified on the basis of Article 20.

41. Article 20 of Regulation 45/2001 provides that exemptions and restrictions may be brought to the immediate erasure of traffic data as provided for in Article 37.1 in certain limited cases enumerated in the article. Notably traffic data may be kept if this constitutes a necessary measure to safeguard the prevention, investigation, detection and prosecution of criminal offences; an important economic or financial interest of a Member State or of the European Communities, including monetary, budgetary and taxation matters; or the protection of the data subject or of the rights and freedoms of others. Article 20, as an exception to principles of data protection provided in the Regulation must be interpreted restrictively and only applies on a case by case basis. Furthermore, Article 20 only provides for exceptions to the immediate erasure of traffic data as laid down in Article 37.1 and not to the limitation of six months as provided for in Article 37.2. Article 20 cannot therefore serve to justify the conservation of traffic data beyond six months for general auditing purposes as foreseen in Article 49 IR.

Need for review

42. The EDPS therefore recommends that the provisions of the IR on the conservation of supporting documents are reviewed so as to ensure the respect of the principles governing the protection of personal data.

43. In order to ensure the respect of these principles, information contained in supporting documents must be scrutinized. Indeed supporting documents contain different levels of information: general information relevant for budgetary discharge, including possible auditing, and detailed information which is not as such necessary for budgetary control.

44. The general principle should be that if the supporting documents contain personal data, only that personal data necessary for the purpose of budgetary discharge may be processed. As far as possible, those documents which contain personal data which are not necessary for this purpose should be deleted. The conservation of relevant data may only be kept for as long as necessary for the purpose of budgetary discharge. The period of 5-7 years as established by Article 49 IR must, in any event, be seen as a maximum time limit for the conservation of supporting documents.

45. As concerns the conservation of supporting documents which contain details such as traffic data, the principle should be that such traffic data should be deleted as they are not necessary for the purpose of budgetary discharge. Whenever supporting documents are set in a layered form, the lowest level of greatest detail, which may contain traffic data, is not necessary and should not be kept for the purpose of budgetary discharge. If the supporting documents are not set in a layered manner, then partial processing of the information contained in the documents should be envisaged, providing this does not involve a disproportionate effort.

46. To illustrate this point, the EDPS would like to take the example of budgeting of fixed telephony in the institutions. As concerns fixed telephony the principle established in Article 37 implies that traffic data such as number calling, the number called and the duration of call may be kept for the purpose of traffic and budget management including the verification of the authorised use of the communications system for up to 6 months. Once the authorised use of the communications tools has been duly verified, any traffic data should be erased or made anonymous. Should the data need to be kept for auditing of costs of communications in accordance with the IR, no detailed traffic data need be kept. The only relevant data which may be kept for budget purposes relate to the costs of communications revealing no underlying traffic data (18).

Suggestions for a modified Article 49

47. In order to address this issue of compatibility, the EDPS suggests adding a paragraph to Article 49 IR which provides: ‘Personal data contained in supporting documents should be deleted where possible when those data are not necessary for the purpose of budgetary discharge. In any event Article 37§2 of Regulation (EC) 45/2001 as concerns the conservation of traffic data should be respected’.

IV. CONCLUSION

The EDPS welcomes to have been consulted on these proposals, which foresee a sound and more transparent financial management of the Community funds. He also welcomes this occasion to highlight a number of specific aspects of data protection relating to their implementation, especially in the context of the Early Warning System.

On the substance, the EDPS recommends the following:

— The insertion in the Implementing Rules of references to a proactive approach (prior information and feedback information) which should be widely applied by all the concerned institutions, authorities and bodies in the light of the transparency principle;

— Specific safeguards in the light of data protection principles must be implemented when a central database is established;

— The Implementing Rules should clarify, in Article 134a, the notions of candidates and tenderers as well as the categories of entities which are affected by the database;

— A precise timeframe regarding the updating of information contained in the database should be put in place in the Implementing Rules;

— To avoid inconsistency, a system of selection of authorizing officers must be put in place among Member States, authorities and bodies; their access to information, as well as the amount of data which can be accessed according to Article 95(2) should be defined in complementary administrative rules.

— In the context of transfers of personal data from the central database, those transfers are structural and therefore the need for safeguards such as contractual clauses should be laid down in the Implementing Rules.

— When data are received from third countries and international organisations, it will be important to define the data which are covered and the warranties attached to their quality, and the need for these safeguards should thus be included in the Implementing Rules

— The wording of Article 134a(1) (3) of the Implementing Rules should be reviewed so as to refer to the institutions, executive agencies, authorities and bodies referred to in Articles 95(1) and (2) of the Financial Regulation;

— Regarding the right of access of candidates and tenderers, a reference to Article 13 of Regulation 45/2001 should be included;

— In order to address the issue of compatibility with Article 37 of Regulation 45/2001, the EDPS suggests adding a paragraph to Article 49 IR;

As to procedure, the EDPS:

— recommends that an explicit reference to this Opinion is made in the preamble of the Proposal.

— reminds that, as the processing operations foreseen will introduce substantial changes in the management of the database and thus will fall under Article 27 of Regulation 45/2001, the EDPS must prior check the system before it is implemented.

Done at Brussels on 12 December 2006 Peter HUSTINX European Data Protection Supervisor

(1) OJ L 281, 23.11.1995, p. 31.

(2) OJ L 8, 12.1.2001, p. 1.

(3) OJ L 248, 16.9.2002, p. 1.

(4) Doc. COM(2006) 213 Final — 2005/0090 (CNS)

(5) Article 95(3)(2) has been deleted from the modified proposal, which means an improvement of the text from a data protection point of view.

(6) Doc. SEC(2006) 866 Final

(7) For an analysis of the existing situation, see EDPS prior-check opinion on the EWS of the Commission. 6 December 2006, available at: www.edps.europa.eu

(8) See Articles 11-13 and 18 of Regulation 45/2001. On the notion of a proactive approach, see: EDPS Background paper: public access to documents and data protection, 12 July 2005 available at: http://www.edps.europa.eu/EDPSWEB/edps/lang/en/pid/21

(9) Articles 93 and 94 (read together with Article 114(2)) set out an obligation to exclude third parties from participation in a procurement or award procedure where they are in one of the situations listed in Article 93 FR or forbid the award of a contract or grant to third parties in a situation of conflict of interest or misrepresentation in supplying the information required by the contracting authority as a condition of participation in a procurement or award procedure.

(10) Article 1 of the FR: for the purposes of the FR, the Economic and Social Committee, the Committee of the Regions, the Ombudsman and the European Data Protection Supervisor are to be treated as Community institutions.

(11) See EDPS Opinion on the prior-check of the EWS of the European Court of Justice, to be published on our website.

(12) C(2004) 193/3 as modified by corrigendum C(2004)517 and last modified by the 2006 internal rules, See: http://ec.europa.eu/budget/library/sound_fin_mgt/ews_decision_en.pdf .

(13) The following information is included in the EWS system: Name and address of the individual — Type of EWS-warning — Start date — end date of active warning — Commission service that has requested the EWS flag to be set.

(14) Article 9 is comparable to Articles 25 and 26 of Directive 95/46/EC

(15) See above on the transparency principle.

(16) To be published soon on our website: www.europa.edps.eu

(17) Billing data are not expressly mentioned in Article 37.2 but can be implicitly included.

(18) A clear illustration of this can be found in the Opinion of the EDPS on the TOP 50 procedure of the European Parliament (case 2004-0126)