49.

The EDPS makes the following recommendations: — include references to this Opinion in the preamble of the proposal, — rephrase provisions emphasising the full applicability of existing data protection legislation in one general provision referring to Directive 95/46/EC as well as Regulation (EC) No 45/2001 and clarify the reference to Directive 95/46/EC by specifying that the provisions will apply in accordance with the national rules which implement Directive 95/46/EC. The EDPS furthermore recommends including this type of overarching provision in a substantive provision of the proposal, — limit competent authorities’ access to documents and information to specifically identified and serious violations of the proposal and in cases where a reasonable suspicion (which should be supported by concrete initial evidence) exists that a breach has been committed, — introduce a requirement for competent authorities to request documents and information by formal decision, specifying the legal basis and the purpose of the request and what information is required, the time limit within which the information is to be provided as well as the right of the addressee to have the decision reviewed by a court of law, — specify the kind of personal information that can be processed and transferred under the proposal, define the purposes for which personal data can be processed and transferred by competent authorities and fix a proportionate data retention period for the above processing or at least introduce precise criteria for its establishment, — in view of the risks concerned regarding transfers of data to third countries, add in Article 23.7 specific safeguards such as for example a case-by-case assessment and the existence of an adequate level of protection of personal data in the third country receiving the personal data, — replace the minimum retention period of five years in Article 27 of the proposal with a maximum retention period when records contain personal data. The chosen period should be necessary and proportionate for the purpose for which data are processed, — rephrase Article 28.1(i) as follows: ‘The CSD ensures that the service provider provides its services in full compliance with the national rules, applicable to the CSD, implementing Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data. The CSD is responsible (…)’, — add in Article 62.2(b) a provision saying that: ‘the identity of these persons should be guaranteed at all stages of the procedure, unless its disclosure is required by national law in the context of further investigation or subsequent judicial proceedings’ and remove in Article 62.2(c) ‘the principles laid down in’, — in light of the doubts expressed in the present Opinion, assess the necessity and proportionality of the proposed system of mandatory publication of sanctions. Subject to the outcome of the necessity and proportionality test, in any event provide for adequate safeguards to ensure respect of the presumption of innocence, the right of the persons concerned to object, the security/accuracy of the data and their deletion after an adequate period of time.