CCll\MISSION OF THE EUROPEAN CQ1\I\4UNITIES 
COM(90) 314 final ~.sYN 287 and 288 
Brussels, 13 September 1990 
COMMISSION COMMUNICATION 
on the protection of Individuals In relation to the processing of 
personal data In the Community and Information security 
ProP.os.a 1 for a 
COUNCIL DIRECTIVE 
concerning the protection of individuals SYN 287 
In relation to the processing of personal data 
Draft 
RESOLUTION OF THE REPRESENTATIVES OF THE GOVERNMENTS OF THE MEMBER 
STATES OF THE EUROPEAN COMMUNITIES MEETING WITHIN THE COUNCIL 
COMMISSION DECLARATION 
on the application to the Institutions and other bodies of the European 
Communities of the principles contained In the Council 
Directive 
concerning the protection ~f 
Individuals In relation to the processing of personal data 
Pr·oposa I for a 
COUNCIL DIRECTIVE SYN 288 
concerning the protection of personal data and privacy In the context 
of publ le digital telecommunications networks, In particular the Integrated 
services digital network (ISDN) and pub·llc digital mobile networks 
Recommendation for a 
COUNCIL DECISION . 
on the opening of negotiations with a view to the accession of the 
European Commun lties to the Counc I I of Europe Convent Ion for the protect Ion 
of fndlvlduals with regard to the automatlc.processlng of personal data 
Proposal for a 
COUNCIL DECISION 
In the field of Information security 
- 2 -
COINIIssl on COINM.In I eat 1 on 
on the protection of Individuals In relation 
to the processing of personal data In the COmmunity 
and Information security 
I. INTRODUCTION 
1. The Increasingly frequent recourse to the processi.ng 
of personal data In every sphere of economic and social activity and the 
new data-exchange requirements linked to the strengthening of European 
Integration necessitate the Introduction In the Community of measures to 
ensure the protection of Individuals In relation to the processing of 
personal data and to enhance the security of Information processing In the 
context, notably, of the development of open telecommunications networks. 
2. At a time when progress In the field of Information technology Is 
making lt much easier to process and exchange all sorts of data, the 
current position with regard to the protection of Individuals In relation 
to such processing In the Community Is characterized by the diversity of 
national approaches. In the 1970s, the concern felt about the protection 
of IndiVIduals In relation to the processing of personal data led to the 
leg.lslatlve process being set In motion In several Member States wJth a 
·view to limiting and providing a framework for the use of this kind of 
data. At the last count, however, only seven Member States had specific 
1 aws In thIs fIe Id. Moreover, a I th'ough theIr obJect·l ves are the same, 
- 3 -
those laws sometimes adopt divergent approaches, for example on the 
question of scope (Inclusion or not of manual data fl les, protection or not 
of legal persons> or on the question of the preconditions for processing 
(extent of the obl lgatlon to notify, provision of Information at the time 
of col lectlon, processing of sensitive data). 
3. Over and above national provisions and In addition to the 
recommendation of the Councl I of the OECD concerning guldel lnes on the 
protection of privacy and the cross-border flow o.f personal data of 
23 September 1980, the Council of Europe Convention of 28 January 1981 for 
the Protection of Individuals with regard to Automatic Processing of 
Personal Data Is the only International legal Instrument In this field. How­
ever, it Leaves open a large number of options for the Implementation of 
the basic principles lt contains, and lt has been ratified by only seven 
Member States, of which one still has no domestic legislation. 
4. This state of affairs has given cause for concern for some time In the 
Community. In a number of resolutions dating back to 1976~ the European 
Parliament has voiced Its disquiet and called upon the Commission to 
prepare a proposal for a directive harmonizing laws on the protection of 
personal data. 
5. The Commission, In a recommendation of 29 July 1981, stated that such 
protection Is quite fundamental and that lt Is desirable that there should 
be an approximated level of protection In all the Member States. lt 
recommended the Member States to ratify, before the end of 1982, the 
Councl 1 of Europe Convention of 28 January 1981 for the Protection of 
Individuals with regard to Automatic Processing of Personal Data. lt 
added, however. that "If all the Member States do not within a reasonable 
time sign and ratify the Convention, the Commission reserves the right to 
propose that the Council adopt an Instrument on the basis of the 
EEC Treaty ... 
1 OJ No C 100. 3.5.1976, p. 27; OJ No C 140, 5.6.1979, p. 34; OJ No C 87, 
5. 4 . 1982. p • 39. 
- 4 -
6. The diversity of national approaches and the lack of a system of 
protection at Community level are an obstacle to completion of the Internal 
market. If the fundamental rights of data subjects, In particular their 
right to privacy, are not safeguarded at Community level, the cross-border 
flow of data might be Impeded just when lt Is becoming essential to the 
activities of business enterprises and research bodies and to collaboration 
between Member States' authorities In the frontier-free area provided for 
In Article Sa of the Treaty. With this In mind, the Strasbourg European 
Council of 8 and 9 December 1989 stressed, In the context of measures to 
promote the free movement of persons and People's Europe, the need "to 
ensure that the procedures for cooperation between administrations first 
ensure the protection of Individuals with regard to the use of personal lzed 
data banks". 
7. A Community approach towards the protection of Individuals In relation 
to the processing of personal data Is also essential to the development of 
the data processing Industry and of value-added data communication 
services. The speedy Introduction of harmonized provisions concerning the 
protection of data and privacy In the context of digital telecommunications 
networks Is a key element In the completion of the Internal market In 
telecommunications equipment and services. 
8. The penetration of data processing Into every sphere of economic and 
social activity and the appearance of global communication systems making 
lt easier to Integrate various activities also represent a new challenge 
which calls for the affording of "protection" commensurate with the risks 
Involved In any technical or human fa I lure, whether lt be accidental or 
deliberate. Effective Information security Is lndlspenslble If one Is to 
ensure effective protection of privacy and preserve the Integrity of the 
present wearth of data recorded and transmitted electronically. The 
Community pol lcles and programmes for the development of the data 
processing and telecommunications Industries and t~e completion of the 
Internal market might be seriously undermined If an active polIcy for the 
creation, development and promotion of Information security standards Is 
not adopted. Since telecommunications nowadays make lt possible to 
exchange data worldwide, such a policy must take that dimension Into 
account. lt Is, moreover, essential that national Information security 
policies do not become an obstacle to the promotion of the harmonious 
development of the Community and to relations with third countries. 
-5-
11. THE PROPOSED APPROACH 
9. The proposed approach Is designed to ensure a high level of protection 
via a Community system of protection based on a set of complementary 
measures. 
A. A high level of protection 
10. Since the object of national laws In this field Is to protect the 
fundamental rights of Individuals, and In particular the right to privacy, 
and since the Community has Itself stressed the Importance lt attaches to 
fundamental rights, In particular In the third paragraph of the Preamble to 
the Single European Act, the action taken by the Community must not have 
the effect of reducing the level of protection but, on the contrary, of 
ensuring a high level of protection throughout the Community. Through 
Community action lt Is possible to guarantee a high level of equivalent 
protection In all the Member States of the Community, and In so doing 
remove obstacles to the establishment of the Internal market In accordance 
with Article 100a. 
11. In addition to the approximation, at a high level, of the rights of 
Individuals, the launching of an active policy on Information security Is 
essential. Information security Is vital not only to Individuals butalso to 
trade, Industry and public authorities. The Important thing Is to ensure 
effective and practical security of Information held In electronic form 
while avoiding the formation of new technical obstacles between 
Member st~tes.or vls-i-vls third countries. This requirement calls for the 
examination at Community level of the possible needs and options In close 
col laboratlon with Industry and the Member States. 
B. A global approach 
12. In order to establish In the Community a system of protection of 
Individuals In relation to the processing of personal data, several 
measures covering the various aspects of the matter must be adopted. 
-6-
13. At the Internal level, besides a framework directive approximating 
certain laws, regulations and administrative provisions of the 
Member States concerning the protection of Individuals In relation to 
the processing of personal data (general directive), which Is the 
centrepiece of the protection system, a set of other, complementary 
measures Is proposed In order to ensure the fullest possible protection. 
Each of the measures proposed Is tailored to a specific situation, but al 1 
take as point of departure the same protection principles to be found In 
the general directive. A resolution of the representatives of the 
Governments of the Member States meeting within the Council and a 
Commission declaration are thus designed to make the principles contained 
In the directive applicable to data flies which are not covered by lt. 
Similarly, a sectoral directive Is necessary In the context of publ le 
digital telecommunications networks. Lastly, Information security calls 
for a Community action plan. 
14. At the external level, the European COmmunity must promote among Its 
partners the Introduction of adequate protection measures and support the 
efforts of the Council of Europe In this field. lt Is desirable In this 
connection that the community should enter Into negotiations with a view to 
Its accession to council of Europe convention No 108. 
This set of proposals cannot be split up without detracting from the 
homogeneity and cohesion of the protection system proposed. 
c~ Outline of the proposals 
15. The proposal for a general directive la aimed at establ lshlng an 
equivalent, high level of protection In all the·uember States of the 
Community In order to remove the obstacles to the exchange of data which is 
necessary If the Internal market Is to function. To that end, the 
principles set forth In the draft proposal for a directive must be 
underwritten by the Member States. Those principles relate to the 
conditions under which the processing of personal data Is lawful, the 
-7 -
rights of the data subject (right to Information, right of access, right to 
rectification, right of opposition, etc.), the reQuisite data Quality (data 
must be accurate, collected fairly, stored for specified and lawful 
purposes, etc.) and the setting-up of a Working Party on the Protection of 
Personal Data to advise the Commission on data protection Issues. The 
draft proposal for a directive covers both the private sector and those 
activities of the public sector which fall within the scope of Community 
law. Since every Individual will enjoy In each Member State an equivalent, 
high level of protection In respect of the processing of personal data, the 
Member States will no longer be able to restrict the flow of such data In 
the Community on grounds of the protection of the data subject. 
16. The draft resolution of the representatives of the Member States of 
the European Communities meeting within the COuncil Is designed to extend 
the coverage of the principles contained In the general directive to 
Include flies held by those parte of the public sector to which lt does not 
apply, that Is to say those authorities whose activities are not governed 
by Community law. For the sake of consistency. all flies held by public 
authorities, even th~se which are not covered by the general directive, 
should be subject to the same protection principles. To that end, the 
Member States should commit themselves to aettlng In motion the necessary 
domestic legislative procedures. 
17. The Commission declaration on the aepllcatlon to the Institutions and 
other bodies of the Community of the provisions of the general directive Is 
an expression of the Commission's wish that the principles contained In the 
directive should apply to the Institutions and other bodies of the 
Community. lt provides In this respect that the commission will take and 
propose the necessary measures. and Indicates that, In the mean time, lt 
will apply the directive's provisions to Its own data fl lea. 
- 8 -
18. The proposal for a Council Directive concerning the protection of 
personal data and privacy In the context of public digital 
telecommunications networks, In particular the Integrated services digital 
network (ISDN) and public digital mobile networks supplements the general 
directive by applying the general principles of data protection to the 
specific requirements of the new telecommunications networks. The 
directive seeks to guarantee telecommunications users In all the 
Uember States a baste level of protection via measures which must be 
Integrated Into the services provided by the new networks. The Council and 
the European Parliament have stressed on a number of occasions the 
Importance of appropriate measures to ensure the protection of data and 
privacy In the light of future developments In telecommunications, and In 
particular the ISDN.1 This concern was expressed strongly by the 
Uember States' officials In charge of data protection at their annual 
meeting In Berlin In August 1989. 
19. The recommendation for a Council Decision on the accession of the 
European Community to the Council of Europe Convention for the Protection 
of Individuals with regard to Automatic Processing of Personal Data le one 
of the external aspects of the Community's approach to the protection of 
personal data. Accession to the Convention will ensure, In relations 
between the Community and the third countries which will be parties 
thereto, the protection of data subjects and the cross-border flow of 
personal data. 
20. The proposal for a Council Decision on the adoption of a two-year 
action plan on Information security completes the set of measures for 
strengthening the rights of Individuals In relation to the processing of 
personal data. Information security, that Is to say the protection of data 
stored, processed and transmitted electronically against every kind of 
threat (both accidental and deliberate) la esa~ntlal If the rights of 
Individuals In relation to the processing of personal data are to be 
effectively exercised. Uore generally, lt la a primary requirement from 
1 OJ No C 257. 4.10.1988, p. 1; OJ No C 196, 1.8.1989, p. 4; OJ No C 7, 
12.1.1987, p. 334; OJ No C 12, 16.1.1989, p. 66; OJ No C 12. 16.1.1989, 
p. 69. 
-9-
the point of view of the protection of property and persons which, In the 
context of the deployment of open telecommunications networks, necessitates 
the development of a global strategy, concerted action at COmmunity level 
on technologies, standards and approval and testing p_rocedures .. and 
technological developments -Involving cooperation at the pre-competltlve 
research and development stage. 
21. The proposed action plan provides for the development of a strategic 
framework for Information security, the analysis of security requirements, 
the devising of ways of satisfying certain priority needs, the drawing-up 
of specifications, standards and validation testa, the Integration of 
technological and operational developments In the field of Information 
security Into a general strategic framework and the Integration of certain 
security functions Into Information systems. 
-10-
PROPOSAL FOR A 
COUNCIL DIRECTIVE 
CONCERNING THE PROTECTION OF INDIVI6UALS 
IN RELAY I ON TO THE PROCESSING OF PERSONAL DATA SYN 287 
-11_ 
I. :tnt;ra!not;tm 
II. The ree1 tor ;groteqt1m in +:be 0Jmnm1 if! 
The c11vars1 ty ot nat;1Qnal 1aws am tbe 1ao1t ot an 
equivalent level of proteot1cm 
COl1sequenoes for tbe Ccmmm1 ty 
III. The ~ Moptat 
An equivalent level of proteotiaD in tbe Qmmm1 ty 
A high level of proteotiaD 
!Y. D' B'!'ee1 cm at the pray;1 s1 QD8 
PrQpre\1 for & Coupci l Directive 
-1.2-
SlMMRY 
This proposal for a directive la aimed at establishing an equivalent, high 
level of protection In all the Member States of the COmmunity In order to 
remove the obstacles to the data exchanges that are necessary If the 
Internal Market la to function. To that end, the principles set forth In 
the draft proposal for a directive must be underwritten by the 
Member States. Those principles relate to the conditione under which the 
processing of personal data la lawful, the rlghta of the data subject 
(right to InforMation, right of acceaa, right to rectification, right of 
opposition, etc.), the requlalte data quality (data must be accurate, 
collected fairly, stored for specified and lawful purposes, etc.) and the 
setting-up of a Working Party on the Protection of Personal Data to advise 
the Commlaalon on data protection laauea. The draft proposal for a 
directive covers both the private sector and those activities of the public 
sector which fall within the scope of COmmunity law. Since every 
Individual will enjoy In each Member State an equivalent, high level of 
protection In respect of the processing of personal data, the Member States 
will no longer be able to restrict the flow of such data In the community 
on grounds of the protection of the data subject. 
-13-
Explanatory memoran~ 
I. INTRODUCTION 
The concern that has been felt for the past fifteen years or so about the 
protection of Individuals In relation to the processing of personal data 
has arisen as a result both of the opportunlttea afforded by technical 
progress In the Information processing field and of the Increasingly 
frequent recourse that la being had to personal data processing In a 
multitude of spheres. This concern has manifested Itself In a variety of 
ways and has led to the legislative process being aet In motion In several 
Member States. On the wider International canvas, the COUncil of Europe 
Convention of 28 January 1981 for the Protection of Individuals with regard 
to Automatic Processing of Personal Data la as yet the only International 
legal Instrument In this field. The OECD has laid down guidelines on the 
protection of privacy and transborder flows of personal data In a 
Recommendation of 23 September 1980, and the UN la In the process of 
drawing up Ita own guidelines. 
Similar expressions of concern have been voiced In the Community context. 
The European Parliament has since 1978 adopted a number of resolutions In 
which lt makes clear Ita disQuiet on th.ls Issue and calls upon the 
Commission to prepare a proposal for a directive harmonizing personal data 
protection lawa.C1) 
The Commission,. In a recommendation of 29 July 1981, stated that such 
·protection Is QUite fundamental and that lt la desirable that there should 
be an approximated level of protection In all the Member States. lt 
(1) OJ No C 100, 3.5.1976, p. 27; OJ No C 140, 5.8.1979," p. 34; 
OJ No C 87, 5.4.1982, p.39. 
-14-
recommended the Member States to ratify the Council of Europe Convention 
before the end of 1982, adding, however, that "If all the Member States do 
not within a reasonable time sign and ratify the Convention, the Commission 
reserves the right to propose that the Council adopt an Instrument on the 
basis of the EEC Treaty". 
The Strasbourg European Council of 8 and 9 December 1989 emphasized, In the 
context of measures to promote the free movement of persons and People's 
Europe, the need "to ensure that the procedures for cooperation between 
administrations first ensure the protection of Individuals with regard to 
the use of personalized data banks". 
In addition to these pronouncements on the need for general protection, the 
feelings of concern have also been translated Into specific or sectoral 
Community measures, especially In the field of the new Information 
technologies. 
In view of the current situation with regard to the processing of personal 
data and the requirements of European Integration, a directive aimed at 
protecting Individuals In connection with this type of processing Is now 
essential. 
11. THE NEED FOR PROTECTION IN THE COMMUNITY 
The diversity of national laws and the lack of an equivalent level of 
protection In the Community 
A wide variety of approaches are taken In the Member States towards the 
protection of Individuals In relation to personal data: some Member States 
have no specific laws In this field, and where they do, the content 
differs. 
Currently, seven Member States have specific laws ·(Denmark, France, 
Germany, Ireland, Luxembourg, the Netherlands and the United Kingdom). Work 
Is In progress In certain other Member States. 
-15-
While the object of these national laws la the same, namely to protect the 
data subject, they adopt different approaches owing to the multiplicity of 
possible ways of affording such protection. The covering of manual data 
flies, the protection of legal persons, the procedures prior to the 
creation of flies, the extent of the obligation to notify, the provision of 
Information at the time of collection of data, the processing of sensitive 
data and transfer to other countries are just some of the questions which 
can be approached In different ways. Moreover, technical developments may 
Induce countries to react differently and, In so doing, Increase the 
diversity. 
The abovementloned Council of Europe COnvention has not led to a reduction 
In this diversity because, firstly, lt leaves open a large number of 
options as far as Implementation of Its basic principles la concerned, and 
secondly, lt has been ratified by only seven Member States (Denmark, 
France, Germany, Ireland, Luxembourg, Spain and the United Kingdom), of 
which one (Spain) still has no domestic legislation. The Commission 
recommendation of 29 July 1981 calling on the Member States of the 
community to ratify the Convention has not altered matters. 
Owing to the diversity of national approaches, the protection of 
Individuals In relation to the processing of personal data la not 
equivalent In all the Member States, the level of protection varying from 
one Member State to another. 
Consequences for the Community 
In the COmmunity, this state of affairs gives rise to three types of 
dlfflcul~y: 
-The lack of specific national laws or their deficiencies do not reflect 
the Community's commitment to the protection of fundamental rights, as 
stressed In the Joint declaration of the European Parliament, the 
Council and the Commission on fundamental rights of 5 April 1977 and In 
the third paragraph of the preamble to the Single European Act. What la 
more, In Community law, the protection of fundamental rights forms an 
Integral part of the general principles of law which the court of 
Justice of the European Communities la charged to uphold. 
-16 -
-Where lt respects the rights of the data subject, the flow of personal 
data Is a necessity as far as the establishment and functioning of the 
Internal market are concerned. In view of technical developments In 
Information processing, notably the Introduction of digital 
telecommunications networks In the Community, the cross-border dimension 
of data flows Is apparent at three levels: 
. Personal data are used at numerous stages of economic activity. The 
free movement of goods, persons, services and capital requires that 
personal data be transferable between business people Involved In 
cross-border activities • 
. In the Community Integration process, and In particular In the context 
of the abolition of frontiers, cooperation between national 
authorities will necessarily Increase, the authorities In one Member 
State being called upon to perform tasks which are normally the 
responsibility of an authority In another Member State. The flow of 
data Is essential to such cooperation. The duty to collaborate or 
provide Information, which will be Imposed on authorities by Community 
law, requires at the same time that data subjects be fully protected . 
. Data exchanges are also necessary for scientific cooperation purposes. 
This need to permit data flows between Member States currently comes up 
against the differences In national approaches to the question of 
protecting Individuals In relation to the processing of personal data. 
These differences may Induce a Member State to place barriers In the way 
of the free flow of data on grounds of the lack or Inadequacy of 
protection In the country of origin or destination. 
-These differences could also, In certain circumstances, distort 
competition between private operators depending on the constraints to 
which they are subject In their country. 
Ill. THE APPROACH ADOPTED 
An equivalent level of protection In the Community 
In order to afford any Individual residing In the Community protection In 
connection with the processing of personal data and permit the flow of this 
-17-
type of data between Member States, an equivalent level of protection must 
be established throughout the Community. To that end an approximation of 
laws Is necessary. The Commission's programme for 1990 mentions the 
protection of data as a priority area In the context of completing the 
Internal market.C1) 
In this connection, Article 100a of the Treaty provides the appropriate 
legal basis Inasmuch as a high level of equivalent protection Is essential 
to the creation of the Internal market. The completion and functioning of 
the Internal market, which Is described In Article Sa as ••an area without 
Internal frontiers In which the free movement of goods, persons, services 
and capital Is ensured In accordance with the provisions of this Treaty", 
necessitate, for the reasons already given, an approximation of laws In 
this field. 
In the preparation of this proposal the Commission has taken Into account 
the requirements of Article Se of the EEC Treaty and has concluded that no 
special provisions or derogatlons seem warranted or Justified at this 
stage. Likewise the Commission has studied the question of the high level 
of health/safety/environmental and consumer protection required by the 
terms of Article 100a(3) of the EEC Treaty. 
A high level of protection 
The object of national laws In this field being to protect fundamental 
rights, and In particular the right to privacy, an approximation of those 
laws must seek to guarantee a high level of protection. Apart from the 
adjustments Inherent In any approximation of laws, the exercise must not 
have the effect of reducing the level of protection already afforded In the 
Member States. 
The general principles set out In the Council of Europe Convention are a 
suitable benchmark as they already constitute a common.basls for the 
countries which have ratified the Convention. Thus, while adopting 
solutions compatible with those of the Convention, the Directive adds to 
those general principles In order to provide a high level of equivalent 
protection. 
(1) Bull. EC Supplement 1/90, pp. 18, 25 and 27. 
-18-
A high level of protection requires that the protection guaranteed by the 
Directive should have a very wide scope and that every situation In which 
the processing of personal data Involves a risk to the data subject should 
be covered. The Directive therefore applies to manual as well as automated 
flies and to both public-sector and private-sector flies. 
The principles contained In the Directive, notably those relating to the 
lawfulness of processing, the communication of data to third parties, 
notification procedures, the rights of the data subject and data quality, 
are designed to ensure a high level of protection by taking as a basis the 
various solutions adopted In national laws. Similarly, particular attention 
has been paid to the means of ensuring, beyond the usual arrangements for 
monitoring the application of Community law, the effective application of 
the Directive's provisions. Hence the Inclusion of provisions on 
liability and on the setting-up of a Working Party on the Protection of 
Personal Data. 
The principles contained In the Directive may, If necessary, be 
supplemented. The Directive provides In a number of Its articles that 
Member States may lay down more specific rules In respect of data flies 
that are subject to their law. Additional measures may also be necessary 
for the purpose of applying certain general principles to sectors having 
special features. 
IV. DISCUSSION OF THE PROVISIONS 
CHAPTER I 
General provisions 
Article 1 
Object of the Directive 
This article provides that the Member States are obliged to ensure the 
protection of Individuals In relation to the processing of personal data by 
-19 -
applying the Directive's provisions. Since, under the Directive, protection 
Is ensured In accordance with the same principles In all the Member States 
and Is therefore equivalent, the Member States can no longer restrict, In 
the fields covered by the Directive, the flow of data on grounds of the 
protection of the data subject. The protection of Individuals and the flow 
of data are, however, guaranteed under the Directive only In the fields 
covered by lt. Flies held for private purposes or by non-profit-making 
bodies cannot, therefore, give rise to the application of this article 
Inasmuch as Article 3(2) excludes them from the scope of the Directive. 
Article 2 
Definitions 
This article defines the main concepts used In the Directive. The 
definitions are taken from Council of Europe COnvention N• 108 with such 
adjustments and clarifications as are necessary to guarantee a high level 
of equivalent protection In the Community. 
a) .. Personal data ... As In COnvention 108, a broad definition Is adopted In 
order to cover all Information which may be linked to an Individual. 
Depending on the use to which lt Is put, any Item of data relating to an 
Individual, harmless though lt may seem, may be sensitive (e.g. a mere 
postal address). In order to avoid a situation In which means of 
Indirect Identification make lt possible to circumvent this definition, 
lt la stated that an Identifiable Individual Is an Individual who can be 
Identified by reference to a number or a similar Identifying particular. 
b) .. Depersonalize ... This concept Is designed to permit the exclusion from 
the a·cope of certain provisions of the Directive of data which are no 
longer Identifiable. An Item of data can be regarded as depersonalized 
even If lt could theoretically be reperaonallzed with the help of 
disproportionate technical and financial resources.· 
c) •Personal data file•. The definition Is based on the criterion of 
possibility of access to personal data, either by means of manual 
processing where the file consists of a collection of structured data, 
or by means of automatic processing which permits the grouping together 
of disseminated data or the extraction of data from a complete text 
-20 -
using a method of consultation which corresponds to that of a file. 
The definition therefore covers structured automated and manual flies. 
Individual flies, and In particular administrative fl lea, which do not 
contain a structured collection of personal data are not covered owing 
to the specific and divergent laws governing them In the Member States. 
d) "Processing". In listing the principal processing operations, the 
definition adapts that given In the Convention to suit the wider scope 
of the concept of file. Data combination operations are covered as they 
make lt possible to produce new data (e.g. electronic profiles). The 
reference to blocking relates to data to which access Is blocked using 
more stringent security measures than Is normally the case, but stopping 
short of erasure. 
e) "Controller of the file". The concept of "controller of the file" as 
used In the Convention Is adapted In two respects: firstly, by referring 
to Community law In order to cover the case where specific directives 
contain substantive provisions on the protection of personal data; and 
secondly, by specifying that the person who authorizes consultation, 
notably In the event of direct Interrogation, Is the controller of the 
f lie. 
f) "Supervisory authority". The definition stresses that the authority must 
be Independent and refers to Article 28, which specifies the functions 
of the supervisory authority. 
g) and h)0Publlc sectorn and "private sector•. The definitions of public 
sector and private sector are justified In the Directive as some of Its 
provisions are specific to one or other sector (Chapters 11 and Ill 
relating to the lawfulness of personal data processing In the public and 
private sectors). These definitions are based on the nature of the 
service provided by the body concerned, regardless of Its private or 
public status. The body will have to apply the rules specific to the 
private· sector or to the public sector according as to whether lt 
carries on commercial activities or performs public-service duties. 
-21 -
Article 3 
Scope 
The Directive applies to all flies whose controllers are In the private 
sector or the public sector. In the latter case, the performance of 
numerous administrative tasks necessitates, by virtue of Community law, 
cooperation between authorities In the Member States. The Directive does 
not apply, however, to flies In the public sector where the activities of 
that sector fall outside the scope of Community law (e.g. the Intelligence 
services). 
Paragraph 2 provides for two exceptions where Invasions of privacy are 
unlikely to occur either because the data are used for private purposes 
only, as Is the case with a personal electronic diary, or because the flies 
are registers of members of an association whose consent to appear therein 
can be presumed from their very membership and the Information contained In 
the register Is not transmitted to third parties. 
Article 4 
Law applicable 
This article specifies the connecting factors which determine the 
application In each Member State of the Dlrectlve•s provisions. The choice 
of factors In paragraph 1 Is motivated by the desire to avoid a situation 
In which the data subject Is completely unprotected owing, mainly, to the 
law being circumvented. The factual criterion of the place In which the 
file Is located has therefore been adopted. In this connection, each part 
of a file which Is geographically dispersed or dlvtded among several Member 
States must be treated as a separate file. 
The desire to protect the data subJect In the event of relocation Is at the 
root of a provision which requires a user consulting a file located In a 
third country from a terminal located In a Member State to comply with the 
-22 -
Directive's provisions on the lawfulness of processing, the Informing of 
the data subject In the event of the communication of data, sensitive data, 
data security and liability. Thla requirement la Imposed where such use Is 
not simply sporadic. 
In view of the ease with which flies can be moved, the temporary removal of 
a file from one location to another does not constitute a change of 
location. The removal of data storage media must not give rise to the 
completion of formalities over and above those which have been gone through 
In the country In which the file la normally located. 
This article la also designed to avoid any overlapping of applicable laws. 
CHAPTER 11 
Lawfulness of processing In the public sector 
Personal data may be processed only If their processing Is lawful. This 
chapter, like Chapter Ill, specifies the circumstances In which processing 
Is lawful. The lawfulness may stem from the consent of the data subject, 
from a provision of the Directive or of Community law, or from a national 
legal Instrument. 
Article 5 
Principles 
This article provides that the creation of a public-sector file and any 
other processing of data shall be lawful only If lt Is necessary for the 
per(ormance of ~he tasks of the public authority In control of the file. 
There are four cases In which data may be processed for a purpose other 
than that for which the file was created: If the dat• subject consents; .If 
the processing has a legal basis; If, after weighing the Interests 
Involved,. lt Is clear that the legitimate Interests of the data subject do 
not preclude such change of purpose; and, lastly, In the event of an 
Imminent threat to public order or a serious Infringement of the rights of 
others. 
-23 -
These principles do not concern the specific case of the communication of 
data to third parties, which Is dealt with In Article 6. 
Article 6 
Processing In the public sector having as Its obJect the communication of 
personal data. 
A specific provision on the communication of data to third parties Is 
necessary Inasmuch as this type of processing Involves the greatest risk to 
the data subject. The paragraph provides for two cases In which data may be 
communicated to third parties, according to whether the recipient Is In the 
public sector or the private sector. In the former Instance, communication 
must be necessary for the performance of the tasks of the authority 
requesting or communicating the data; In the latter, a balancing of 
Interests must be carried out In order to determine whether the requester 
has a legitimate Interest and whether the Interests of the data subject do 
not preva I I. 
The Member States are given the opportunity to specify In their law, within 
the limits of the two principles set out above, the conditions under which 
the communication of data Is lawful. This may consist, for example, In 
defining, In respect of certain fields, In what circumstances the Interests 
of the data subject prevail. 
In order to ensure that the Interests of the data subject are not harmed by 
the communication of data to the private sector, a procedure for Informing 
the data subject Is laid down. A derogation from this obligation Is 
possible, however, .where communication Is authorized by the supervisory 
authority. The latter may attach conditions to the derogation or decide to 
Inform the data subject Itself. 
Article 7 
Obligation to notify the supervisory authority 
The obligation provided for In this article to notify the supervisory 
authority and to have such notification recorded In a register kept by that 
,. -24-
authority Is restricted to public-sector flies the data In which might be 
communicated. The aim Is to ensure the minimum transparency necessary for 
the exercise of the rights of the data subject while reducing the number of 
formalities, as these might place a very heavy burden on the supervisory 
authority owing to the widely drawn concept of data file. The Uember States 
may, however, extend the obligation to notify so as to cover other public­
sector flies. 
CHAPTER Ill 
Lawfulness of processing In the private sector 
Article 8 
Principles 
The lawfulness of the processing of personal data In the private sector may 
be based on the consent of the data subject. Such consent must satisfy the 
conditions of Articles 12 (Informed consent) and 13 (provision of 
Information at the time of collection of data). 
In the absence of the consent of the data subject. the lawfulness of the 
processing may be based on the existence of a contractual or quasi­
contractual relationship between the controller of the file and the data 
subject In so far as the processing Is necessary for the performance of the 
contract (e.g. processing of orders or Invoicing). 
The lawfulness of the processing may also be based on the fact that the 
data come from sources generally accessible to the publ le (public telephone 
directories) In $0 far as the processing Is Intended solely for 
correspondence purposes. 
Lastly. the iawfulness of the processing may be based on a balancing of 
Interests which reveals that the controller of the fl le has a legitimate 
Interest and that the data subject does not have an overriding Interest. 
The communication of data Is lawful only If lt Is compatible with the 
purpose of the file as notified (Article 11(2)), which has to be adhered to 
-25 -
when data are stored (Article 18(1) (b)). When data are communicated, the 
controller of the fl le Is obliged, moreover, to Inform the data subject In 
the manner prescribed In Articles 9 and 10. Within the limits of the 
principles set out above, the Member States may specify In their law the 
conditions under which the processing of data Is lawful. This may consist, 
for example, In defining, In respeet of certain fields, In what 
circumstances the Interests of the data subject prevail. 
Article 9 
Obligation to Inform the data subject 
In order that the data subject might exercise his rights, paragraph 1 
requires the controller of the file to Inform the data subject of the 
communication of data concerning him. The data subject can thus exercise 
his right of access and object to continuation of the processing In 
question. There Is no obligation to Inform the data subject where the data 
come from sources generally accessible to the public and their processing 
Is Intended solely for correspondence purposes. 
Article 10 
Special exceptions to the obligation to Inform the data subject 
This article authorizes Member states to provide In their law that, where 
major practical difficulties, overriding legitimate Interests of the 
controller of the fl le or a similar Interest of a third party stand In the 
way of Informing the data subject, the supervisory authority may, within 
·the llm~ts of the law authorizing lt to do so, at the request of the 
controller of the file authorize a derogation from the obligation to Inform 
the data subject. The supervisory authority may, specify the terms of the 
derogation and decide to Inform the data subject Itself. 
The case of major practical difficulties covers, for example, data relating 
to persons whose home address Is not known. 
-26"-
Article 11 
Obligation to notify the supervisory authority 
For the same reasons as those underlying the obligation to notify In the 
public sector (Article 7), the obligation to notify In the private sector 
does not apply to flies In which the data are not Intended to be 
communicated or which come from sources generally accessible to the public. 
The notification must be updated If there Is any change In the purpose of 
the f lie. 
The Information notified must Include that which Is necessary for the 
purpose of monitoring compliance with the Directive (at least the name and 
address of the controller of the file, the purpose of the file, a 
description of the types of data lt contains, the third parties to whom the 
data might be communicated and a description of the security measures 
taken). The Member States may extend the scope of the obligation to notify. 
CHAPTER IV 
Rights of data subjects 
Article 12 
Informed consent 
This provision determines under what conditions the data subject's consent 
to the processing of data relating to him, both In the public and In the 
private sector, Is legally valid. 
The data subject's consent to the processing of data relating to him Is an 
Important justification for the processing of personal data by the 
controller of the file. The concept of Nconsent" as used In Article 12 
means "Informed consent". In order to enable the data subject to weigh the 
risks and advantages of the Intended processing of data relating to him and 
-27 -
to exercise his rights under Article 14 of the Directive (rectlflcalon, 
erasure, blocking), the controller of the file has to provide the data 
subject with such Information as la relevant to the data subject's 
decision, e.g. name and address of the controller of the file, purpose of 
the file, data stored In the file, etc. 
As to the form of the consent, the Directive does not, for practical 
reasons, require that the data subject should give his consent In writing. 
The agreement, however, has to be expressly given. The consent of the data 
subject has to be specific In that lt has to refer to the processing of 
data relating to him by a particular controller of a file and for a certain 
purpose or purposes. The agreement must also Indicate the kinds of data 
which may be processed, the forms of processing and the potential 
recipients In case of transfer to third parties. 
Under Article 12(c) the data subject la entitled to withdraw hla consent at 
any time. The revocation, however, bears no retroactive effect as 
otherwise a previously lawful processing of personal data would be made 
Illegal ex post facto. 
Article 13 
Provision of Information to the data subject at the time of collection of 
data 
Effective data protection requires that the data subject be kept fully 
Informed about the processing of personal data relating to him, not only 
once they are stored and processed In a data file but at the stage 
preceding their processing, I.e. at the stage of their collection. 
lt Is laid down In Article 18(1)(a) that data must be collected fairly and 
lawfully. For the purposes of Article 13 this reQulr~ent cover• the 
situation where data are obtained from the data subject himself. 
The fair and lawful collection of personal data presuppose• that the data 
subject makes his decision whether or not to disclose data relating to him 
-28 -
to the collectors on a reliable factual basis as regards the purpose of the 
processing, the Identity of the controller of the file and the question 
whether he Is under a legal obligation to disclose the data or whether 
disclosure la voluntary. So that he can assert hla rights under Article 14 
of the Directive and control effectively the use of data relating to him, 
he should also be Informed about his rights of access and rectification 
and about recipients of the data. 
Article 13(1) of the Directive obliges the Member States to provide In 
their domestic data protection laws that the data subject must be.glven 
this Information. 
The person who collects data will often not be the same as the controller 
of the file In which the data will eventually be stored and processed. In 
order that he may assert his rights against the latter, lt Is Important 
that the data subject should be Informed of his name and address when the 
data are collected. 
Article 13(2) empowers the Member States to restrict the duty to Inform the 
data subject at the time of collection of data on grounds of the existence 
of predominant general Interests. Under thla provision, there Is no duty to 
supply the Information mentioned In Article 13(1) to the data subject If 
the Information prevents the proper discharge of the functions of public 
authorities entrusted with monitoring and supervisory duties or the 
maintenance of public order. 
Article 14 
Additional rights of data subjects 
Article 14 of the Directive encompasses the rights ~f the data subject vls­
•-vla the controller of the file. The purpose of data protection Is to 
-29· -
safeguard the data subject's right to privacy. The rights of that party 
vls-l-vls the controller of the file therefore form a fundamental part of 
data protection. 
Article 1~(1) entitles the data subject to oppose the processing of data 
relating to him for legitimate reasons. Legitimate reasons, for the 
purposes of this provision, means the lack of a legal justification for 
processing personal data, e.g. because the requirement of Chapters 11 and 
111 of the Directive as to the permissibility of such processing Is not 
fulfilled with regard to a particular processing of data. 
Article 14(2) safeguards the data subject against being made the subject of 
decisions by public- and private-sector Institutions Involving the 
assessment of human conduct on the sole basis of an automatic processing of 
personal data forming a data or personality profile of the data subject. 
This provision Is designed to protect the Interest of the data subject In 
participating In the making of decisions which are of Importance to him. 
The use of extensive data profiles of Individuals by powerful public and 
private Institutions deprives the Individual of the capacity to Influence 
decision-making processes within those Institutions, should decisions be 
taken on the sole basis of his •data shadow•. 
If he Is to assert effectively his rights to rectification, erasure or 
blocking of data vls-l-vls the controller of the file, lt Is essential that 
the data subject have access to the data In the file. This Is granted to 
him by Article 14(3) and (4). Article 1~(3) grants the data subject the 
right to be Informed about the relevant facts relating to the processing of 
his personal data by the controller of the file so that he may assert his 
rights. to rectification, erasure and blocking and exercise effective 
control over the.processlng of data relating to him. Article 1~(~) confers 
on the data subject the right to obtain, at reasonable. Intervals and 
without excessive delay or expense, confirmation as to whether data on him 
are stored In the file and, If so, communication to him of those data In an 
Intelligible form. 
The provisions of Article 14(3) and (4) leave lt to the Member States to 
-30 -
decide how such Information Is forwarded to the data subject. 
lt Is also left to the domestic law of the Member States to determine the 
meaning of the term •reasonable Interval•. Taking Into consideration the 
Interests of the data subject and of the controller of the file, the 
domestic law of the Member States may provide that the controller of the 
file may charge a data subject who exercises his right of access no more 
than the actual cost Incurred. The charge must not be excessive. 
Article 14(4) allows the Member States to lay down a special rule on the 
exercise of the data subject's right of access where medical data are 
concerned. To protect the data subject from psychological shock, which In 
extreme caaea may lead to suicide, such Information might be provided to 
him by a medical expert. 
Article 14(5) of the Directive grants the data subject the right to 
rectification, erasure or blocking of data If their processing la 
.Incompatible with the Directive. 
The data subject may exercise the right to rectification If data relating 
to him are Incorrect, Incomplete, Inaccurate, misleading or out of date. 
The right of the data subject to have data erased or blocked presupposes 
that they have been processed In violation of the Directive. Article 14(5) 
refers to all provisions of the Directive which regulate the collection, 
storage, processing and use of personal data. 
The concept of blocking has Its origins In the German Federal Data 
Protection Act (paras. 4, 27 and 35: Sperrung). If data are blocked 
because they have been collected, stored, processed or used In violation of 
the Directive's rules, the controller of the file may still keep them 
stored In his file, but he Is prohibited from processing or using them, and 
In par·t lcular from connunlcat lng them to third par.t lea. The blocked data 
have to be marked In the file to Inform users of the file of the blocking. 
The wording of the Directive ("as the case may be•> leaves the precise 
shaping of the data subject's rights of erasure, blocking or rectification 
with regard to the different situations In which personal data are 
processed and used In violation of the Directive to t~e data protection 
legislation of the Member States. 
-31 -
Frequently, data are not only processed by a controller of a file, but 
communicated to third parties. If the controller of the file has to 
rectify, erase or block data because they are Incorrect or unlawfully 
processed or used, lt la In the data subJect's Interest that third parties 
to whom such data have been transmitted should be notified of the 
rectification, erasure or blocking so that they, too, can rectify, erase or 
block the data. This Interest of the data subJect la taken care of by 
Article 14(7). 
Article 14(8) grants the data subJect the right to have data concerning him 
erased from flies which serve marketing and direct-mall advertising 
purposes. The data subJect can thus protect himself against unsolicited 
direct-mall advertising. 
Finally, Article 14(8) obliges the Member States to grant the data subJect 
an effective judicial remedy should the controller of the file or another 
person Infringe hla rights as set out In Article 14. 
Article 15 
Exceptions to the data subJect's right of access to public-sector flies 
Article 15 authorizes the Member States to restrict the data subJect's 
right of access to data flies In order to protect an overriding public 
Interest or an Interest of a private Individual eQuivalent to the data 
subject's right to privacy where the fllea are held by the public sector. 
lt la left to the Member States to decide to what extent they Include In 
their domestic data protection legislation exceptions based on Article 15. 
However, the excep.tlona set out In thla·provlalon are_ limited to those 
necessary for the safeguarding of substantial values In a democratic 
society and have to be adopted by a formal statute. The list of lntereata 
which justify a restriction of the right of access under Article 15 of the 
Directive la exhaustive. 
-32 -
T.he term "national security" Is to be Interpreted as meaning the protection 
of national sovereignty against Internal and external threats. 
;'Criminal proceedings" covers the prosecution of crimes which have already 
been committed, whereas the concept of .. publ le safety" encompasses al I the 
polIcing functions of state organs Including crime prevention. The phrase 
"substantial economic and financial Interests of a Member State or of the 
European Communities" refers tJ al I economic polIcy measures and means of 
financing the pol lcles of a Member State or of the Community, e.g. exchange 
controls, foreign trade controls and tax col lectlon. However, only a 
substantial Interest of this kind justifies a restriction of the right of 
access. 
Finally, an Interest of a third party equivalent to the data subject's 
r lght of access or the rights and freedoms of others are considered valId 
grounds for restricting the right of access. Such Interests Include the 
trade secrets of others or the freedom of the press. 
If the dat~ subject Is denied access to data relating to him contained in a 
fl le because an Interest covered by Article 15(1) Is Involved. the data 
protectloP authority, at his reQuest. must carry out the necessary 
inspection and checks on the fl te In which the data are stored. 
Article 15(3) empowers the Merr•ber States to place limits on tt-te rl~ht of 
access to dat~ compl led only temporarl ly for the purpose of extracting 
stat 1st I eel ir,format Ion. as su~h operatIons pose only a l"''inl)r •.hreat to tht; 
data subj(•ct. 
-33 -
Chapter V 
Data qual lty 
The data protection principles set forth In this Chapter are more far 
reaching than Its title suggests: they cover not only the qual lty of data 
(Article 18), but alao the procesalng of certain categories of data which 
are considered to be particularly sensitive from the point of view of the 
Interests of the data subject (Article 17) and the appropriate data 
security measures (Article 18). 
Article 16 
Principles 
A·tlcle 16 of the Directive requires the Member States to Incorporate the 
basic principles relating to the quality of personal data In their domestic 
data protection legislation. These principles are designed to safeguard 
the data subJect's right to privacy by placing certain restrictions on the 
col lectlon and processing of personal data and on the permissible contents 
of personal data fl lea. 
Article 16(1)(a) requires that the col lectlon and processing of personal 
data should be carried out fairly and lawfully. 
This provision covers the processing of personal data as defined In 
Article 2(d) as wel I as Its gathering. 
Article 16(1)(a)·rules out, say, the use of technical devices hidden from 
the data subJect-which serve to obtain data secretly and without his 
~nowledge, _for example by wire-tapping, eavesdropping and slml lar methods. 
lt also prevents controllers of flies from creating and using clandestine 
fl les containing personal data. 
-34 -
Article 16(1)(b) sets out the principle of •purpose specification•. 
According to this principle, personal data may be stored only for 
specified, explicit and lawful purposes. 
The purpose for which personal data are stored must be specific In that the 
aim which the storage and use of the data Is Intended to serve must be 
defined and specified In as narrow terms as possible. A general or vague 
definition or description of the purpose of a file (e.g., the fl le la 
Intended to serve •business purposes•> will not be consonant with the 
purpose specification principle as laid down In Article 18(1)(b) .. 
The purpose has to be specified before the storage Is effected. Where the 
data are collected from the data subject, the purpose should be specified 
at the time of collection (cf. Article 13). 
Subsequent changes In the purpose of processing are permissible only In 80 
far as they are not Incompatible with Its former purpose. 
Article 18(1)(b) also requires that the controller of the file should make 
the purpose of storage and use of the data explicit. The requirement of 
explicitness seeks to prevent personal data from being stored and used for 
hidden purposes. 
The reQuirement of lawfulness of the purpose of storage and use of personal 
data limits the potential purposes which a data file may serve; a fl le may 
be created and used only for purposes which are compatible with this 
Directive and the domestic law of the Member States. Furthermore, only 
such purposes as are relevant to the administrative functions of 
controllers of flies In the public sector and the business activities of 
controllers of flies In the private sector are lawful. Article 18(1)(b) 
states clearly that the purpose specification principle applies not only to 
the processing of personal data: the use of such data also has to be 
compatible with the purpose of the file. 
Article 18(1)(c) provides that the data In a fl le must be adequate, 
relevant and not excessive In relation to the purposes for which they are 
stored. This principle seeks to ensure that the contents of a file are In 
keeping with Its purpose. 
-35 -
Standing In close relationship with the reaulrements of ~rtlcle 16(1)(b) 
and (c) are th~ orovlslons of Article 16(1)(d). Personal data stored In a 
file hav~ to he accurate and, If necessary, ~act uo to date. If data are 
lnaccuratA or lncomolete In relation to the purpose of the file, 
Article 16(1)(d) reaulres that they be erased or rectified. 
Article 18(1)(e) deals with time limits for the retention of personal data. 
According to this provision, the keeping of data In a form which permits 
Identification of the data subject Is allowed only for as long as Is 
necessary for the ourposes for which the data are stored. 
There may be circumstances however, In which lt Is necessary, e.g. for 
statistical purposes, to keep data beyond that time limit. lt Is 
essential, In such circumstances, for the protection of the data subject 
that th~ link between his name and the data be removed. 
Article 16(2) makes lt the duty of the controller of the file to ensure 
that the data quality provisions of Article 16(1) are complied with. 
Article 17 
Special categories of data 
lt Is generally accepted that the right to privacy Is endangered, not by 
the contents of personal data, but by the context In which the processing 
of personal data takes place. However, there la a broad consensus among 
the Member States that there are certain categories of data which, by 
virtue of their contents- quite Irrespective of the context In which they 
are processed- carry the risk of Infringing the data s~bject's right to 
pr~vacy. Article 17 of the Directive therefore places strict limits on the 
electronic processing and use of sensitive Information. In personal data 
flies. 
-36 -
Article 17 classes as sensitive the fol lowlng categories of data: racial 
origin (Including Information on skin colour); pol ltlcal oclnlons, 
religious beliefs and philosophical convictions, Including the fact that a 
cerson holds no religious belief (these categories encompass Information on 
activities of the data subject relating to pol ltlcal, rei lglous or 
philosophical convictions); Information on trade-union membershiP; 
Information on the data subject's health (Including Information on his 
past, present and future state of physical and mental health and 
Information on drug and alcohol abuse); Information concerning sexual 1 lfe. 
As a general rule, Article 17(1) prohibits the automatic processing of 
sensitive data. Exceptions to this rule are processing with the consent of 
the data subject, which has to be freely given, express and declared In 
writing, and the exception set out In Article 17(2). 
According to the latter provision, the Member States may allow the 
electronic processing of sensitive data If lt Is reQuired on Important 
public Interest grounds. However, such an exception presupposes as a legal 
basis the adoption of a formal statute specifying the kinds of sensitive 
data which may be processed electronically and the persons who may have 
access to the data, and providing appropriate safeguards against abuse and 
unauthorized access. 
Article 17(3) covers the special case of the storage of Information on 
criminal convictions. The storage of such Information Is permitted only In 
public-sector data flies. 
The scope of Article 17 Is limited to data processed by automated means. 
The article does not cover the electronic storage •nd processing of data on 
political opinions, religious and philosophical convictions and trade-union 
membership where such data are processed by non-profit-making organizations 
In accordance with Article 3(2)(b). 
-37 -
Article 18 
Data security 
Threats to the data subject's right to privacy do not emanate only from 
the controller of the file, who collects, stores, processes and 
communicates the Individual's data for his own purposes. 
His right to privacy Is also jeopardized If his data are misused by third 
parties through unauthorized access to and use of the data. 
The first sentence of Article 18(1) requires the Member States to obl lge 
the controller of the file to take appropriate organizational and technical 
measures to protect the data In a file against the danger of unauthorized 
Intrusion by third parties Into a file or accidental loss of data, 
Including accidental or unauthorized destruction, unauthorized modification 
of or access to data and any other unauthorized processing. 
Technical measures of data security Include: safety measures for access to 
data processing and storage locations, Identification codes for persons 
entitled to enter such locations, Informational safeguards such as the use 
of passwords for access to electronically processed fl lea, the enciphering 
of data and monitoring of hacking and other unusual activities. Through 
organizational measures, the controller of the file adopts certain 
procedural steps within the hierarchy of his public authority or business 
enterprise, e.g. by establishing authority levels with regard to access to 
the data. 
The second sentence of Article 18(1) lays down the standard of approprate 
data security measures with regard to automated data flies. The measures 
have to ensure an appropriate level of security having regard to the state 
-38-
of the art In the field of data security, the cost of taking those 
measures, the nature of the data stored In the file and the assessment of 
the potential risks. In order to determine the appropriateness of data 
security measures, the controller of the fl le has to take Into 
consideration any recommendations on data security and network 
lnteroperabl I lty formulated by the Community In accordance with Article 29 
of the Directive. 
The obligation to take appropriate security measures Is not I lmlted to the 
location of the data processing or of the hardware and software used for 
the processing. If data transmissions take place between one computer and 
another or between a computer and terminals via a telecommunications 
network, according to Article 18(2) security measures also have to be taken 
with regard to the network In order to guarantee the safe and uninterrupted 
transfer of data. 
Article 18(3) covers the case of direct access by a remote user to a fl le 
via on-line retrieval. The authority of the user to obtain data from the 
fl le Is specified In and limited by the contract with the controller of the 
fl le. The Directive requires the controller of the fl le to design hardware 
and software used for on-line retrieval In such a way that the user's 
access remains within the I lmlts of the authorization granted to him by the 
controller of the file. 
Article 18(4) assigns responslbl llty for compliance with the obl lgatlons 
laid down by Article 18(1) to (3). The persons who-de facto or by 
contract -control the operations relating to a data fl le are also 
responsible for ensuring compl lance with the data security requirements. 
Those to whom this rule appl les are, as the case may be, the controller of 
the flle,,the user having access via on·-llne data retrieval and data 
processing service bureaux performing data processing operations on behalf 
of the controller of the fl le. 
-39 -
Finally, Article 18(5) places a duty of professional secrecy on employees 
of the controller of a fl le and other persons who In the course of their 
professional activities have access to the personal Information In a file. 
These persons are prohibited from communicating the Information to which 
they have access to third parties without the authorization of the 
controller of the file. 
CHAPTER VI 
Provisions speclflcal ly relating to certain sectors 
Article 19 
The Member States may provide for derogatlons from the Directive's 
provisions In respect of the press, and the audiovisual media In so far as 
they are necessary In order to reconcl le the fundamental rights of 
Individuals, notably the right to privacy, with the freedom of Information 
and of the press, there being a danger of conflict between the two 
categories of fundamental right. The approach adopted lays emphasis on the 
obl lgatlon to balance the Interests Involved In the event of a derogation. 
This balance may take Into account, among other things. the avallabl 1 lty to 
the data subJect of remedies or of a right of reply, the existence of a 
code of professional ethics, the limits laid down by the European 
Convention on Human Rights and the general principles of law. 
Article 20 
This article provides that the Member States must encourage the business 
circles concerned to draw up codes of conduct or professional ethics so as 
to facl 1 ltate the appl lcatlon of the principles of the Directive In certain 
sectors. 
The Commission wl I I also support such Initiatives and wll I take them Into 
account, If necessary, when lt exercises Its rule-making powers or puts 
forward new proposals. 
CHAPTER VI I 
Llabl I lty and sanctions 
Article 21 
Llabl I lty -40 -
Where damage Is suffered as a result of fa I lure to comply with the 
Directive, 1 labl llty rests under this article with the controller of the 
fl le, who may be sued by the data subJect for compensation. The concept of 
damage covers both physical and non-physical damage. The I lablllty of the 
controller of the file for loss, destruction or unauthorized access Is 
I lmlted If he can prove that the security reQuirements were complied with. 
Artlcle 22 
Processing on behalf of the controller of the fl le 
The object of this article Is to avoid a situation whereby processing by a 
third party on behalf of the controller of the file has the effect of 
j 
reducing the level of protection enjoyed by the data subject. To that end, 
obligations are placed both on the controller of the file and on the third 
party carrying out the processing. 
Article 23 
Sanc~lons 
In order to·ensure compl lance with the measures taken pursuant to the 
Directive, the Member States are required to lay down· truly dissuasive 
sanctions, such as criminal sanctions, bearing In mind, In particular, 
that non-compl lance with the data protection prlnclp.les constitutes an 
infringement of a fundamental right. 
-4r _ 
CHAPTER V I I I 
Transfer of personal data to third countries 
Article 24 
Principles . ' '· 
· .. 
This article establ lshes the principle that the transfer of personal data 
from a Member State to a third country may take place only If that country 
ensures an adequate level of protection. lt Is for the Member States, and, 
If necessary, for the Commission, to determine whether a country ensures an 
adequate level of protection. The Member States must Inform the Commission 
of cases In which an Importing third country does not ensure such a level 
of protection. In that event, negotiations may be entered Into between the 
Commission and the third country concerned. 
The Commission may decide, In the exercise of the Implementing powers 
conferred on lt by Article 29, that a country ensures an adequate level of 
protection In the I lght of Its domestic law and/or of the International 
commitments lt has entered Into. The Councl I of Europe Convention of 
28 January 1981 for the Protection of Individuals with regard to Automatic 
Processing of Personal Data forms part of the commitments which the 
Commission wl I I take Into account. lt may also draw on the expertise of 
the Working Party on the Protection of Personal Data In this field. 
Article 25 
Derogation 
If a country does not ensure an adequate level of protection, a derogation 
permitting the transfer of data Is possible In respeet of a given export. 
The Member State In which the fl le Is located may authorize such a transfer 
If the controller of the fl le can guarantee an adequate level of protection 
In respect of that export and If neither the other Member States nor the 
Commission object. To that end an Information procedure Is provided for, 
with a ten-day period In which notice of opposition may be given. 
-42 -
Where notice of opposition Is given, the Commission may take the 
appropriate measures, Including prohibition of the transfer. 
CHAPTER IX 
Supervisory authorities and the Working Party on the Protection of Personal 
Data 
Article 26 
Supervisory authority 
This article provides for the setting-up of a supervisory authority 
characterized by Its Independence and by powers of Investigation and 
Intervention suited to the performance of the supervisory duties entrusted 
to lt. National law must guarantee these two characteristics. The term 
"supervisory authority" does not prejudice the adoption of a multiple 
Internal structure based on the constitutional system of the Member States. 
Article 27 
Working Party on the Protection of Personal Data 
Owing to the special features of the protection of Individuals In relation 
to personal data, this article sets up a working party of an advisory 
nature, the Working Party on the Protection of Personal Data. The Working 
Party on the Protection of Personal Data Is characterized by Its 
Independence and Is composed of representatives of the national supervisory 
authorities. The Working Party Is chaired by a representative of the 
Commission. 
Article 28 
Tasks of the Working Party on the Protection of Personal Data 
This article sets out the tasks of the Working Party on the Protection of 
Personal Data. The Working Party gives the Commission the benefit of Its 
-43-
knowledge and expertise In the field of the protection of Individuals In 
relation to the processing of personal data, thereby contributing to the 
uniform appl lcatlon of the national rules adopted pursuant to the 
Directive; lt assesses the level of protection In the Community and In 
third countries and Informs the Commission thereof; and lt may advise the 
Commission on any additional measures that need to be taken. 
The Working Party on the Protection of Personal Data may formulate 
recommendations which may, If lt so wishes, be transmitted to the 
Advisory Committee that Is consulted by the Commission In the exercise of 
Its Implementing powers. 
An annual report on the situation regarding the protection of personal data 
In the Community and In third countries Is drawn up by the Working Party on 
the Protection of Personal Data. The report Is transmitted to the 
Commission. 
CHAPTER X 
Rule-making powers of the Commission 
Articles 29 and 30 
Exercise of rule-making powers 
Advisory Committee 
Article 29 confers on the Commission powers of execution In respect of the 
technical Implementing measures that are necessary as a result of the 
extent and technical nature of the personal data processing field. 
Since the Directive Is designed to contribute to the completion of the 
Internal market, Article 30 provides for the setting-up of an 
Advisory Committee to assist the Commission In the exercise of Its 
Implementing powers and applies the procedures laid down In the 
Councl I Decision of 13 July 1987 laying down the procedures for the 
exercise of Implementing powers conferred on the Commission. 
-44 -
Proposal for a 
COUNCIL DIRECTIVE 
concerning the protection of individuals 
In relation to the processing of personal data 
THE COUNCIL OF THE EUROPEAN COMMUNITIES, SYN 287 
Having regard to the Treaty establishing the European Economic Community, 
and In particular Articles 100a and 113 thereof, 
Having regard to the proposal from the Commlsslon,1 
In cooperation with the European Parllament,2 
Having regard t~ the opinion of the Economic and Social Commlttee,3 
(1) Whereas the obJectives of the Community, as laid down In the Treat~ as 
amended by the Single European Act, Include establishing an ever closer 
union among the peoples of Europe, fostering closer relations between the 
States belonging to the Community, ensuring economic and social progress by 
common action to eliminate the barriers which divide Europe, encouraging 
the constant Improvement of the I lvlng conditions of Its peoples, 
preserving and strengthening peace and liberty and promoting democracy on 
the basis of the fundamental rights recognized In the constitutions and 
laws of the Member States and In the European Convention for the Protection 
of Human Rights and Fundamental Freedoms; 
-45 -
(2) Whereas the establ lshment and the functioning of an Internal market In 
which, In accordance with Article Sa of the Treaty, the free movement of 
goods, persons~ services and capital Is ensured reQuire not only that 
personal data should be able to flow freely, regardless of the Member States 
.;n which they are processed or requested, but also that fundamental 
rights should be safeguarded In view of the Increasingly frequent recourse 
In the Community to the processing of personal data In the various spheres 
of economic and social activity; 
(3) Whereas the Internal market comprises an area without frontiers; 
whereas, for that reason, the national authorities In the various 
Member States are Increasingly being called upon, by virtue of the 
operation of Community law, to collaborate and exchange personal data so as 
to be able to perform their duties or carry out tasks on behalf of an 
authority In another Member State; 
(4) Whereas the Increase In scientific and technical cooperation and the 
coordinated Introduction of new telecommunications networks In the 
Community necessitate and facl I ltate cross-border flows of personal data; 
(5) Whereas the difference In levels of protection of privacy In relation 
to the processing of personal data afforded In the Member States may 
prevent the transmission of such data from the territory of one Member 
State to that of another Member State; whereas this difference may 
therefore constitute an obstacle to the pursuit of a number of economic 
activities at Community level, distort competition and Impede authorities 
In the discharge of their responslbl I ltles under Community law~ whereas 
this difference In levels of protection Is due to the existence of a wide 
variety of national laws, regulations and administrative provisions; 
(6) Whereas In order to remove the obstacles to flows of personal data, 
the level of protection of privacy In relation to the processing of such 
data must be eQuivalent In al I the Member States; whereas to that end lt Is 
necessary to approximate the relevant laws; 
-46 -
(7) Whereas the object of the national laws on the processing of personal 
data la to protect fundamental rights, notably the right to privacy which is 
recognized both In Article 8 of the Convention for the Protection of Human 
Rights and Fundamental Freedoms and In the general principles of Community 
taw; whereas, for that reason, the approximation of those laws must not 
result In any lessening of the protection they afford but must. on the 
contrary, seek to ensure a high level of protection In the Community; 
(8) Whereas the principles underlying the protection of privacy In relation 
to the processing of personal data set forth In this Directive may be 
supplemented or clarified, In particular as far as certain sectors are 
concerned, by specific rules based on those principles; 
(9) Whereas the protection principles must apply to all data flies where 
the activities of the controller of the file are governed by Community law; 
whereas public-sector flies which are not governed by COmmunity law should, 
as Is provided for In the resolution of the representatives of the 
Governments of the Member States of the European Communities meeting within 
the council of ... ,be subject to the same protection principles set forth 
In national laws; whereas, however, data flies falling exclusively within 
the confines of the exercise of a natural person's right to privacy, such 
as personal address flies, must be excluded; 
(10) Whereas any processing of personal data In the COmmunity should be 
carried out In accordance with the law of the Member State In which the 
data file la located so that Individuals are not deprived of the protection 
to which they are entitled under this Directive; whereas, In this 
connection, each part of a data file divided among several Member States 
must-be. considered a separate data file and transfer to a non-member 
country must not be a bar to such protection; 
(11) Whereas any processing of personal data must .be lawful; whereas such 
lawfulness must be based on the consent of the data subject or on Community 
or nat Iona I I aw; 
-47 -
(12) Whereas national laws may. under the conditions laid down In this 
Directive, specify rules on the lawfulness of processing; whereas, 
however, such a possibility cannot serve as a basis for supervision by a 
Uember State other than the State In which the data file Is located, the 
obligation on the part of the latter to ensure. In accordance with this 
Directive, the protection of privacy In relation to the processing of 
personal data being sufficient. under Community law, to permit the free 
flow of data; 
(13) Whereas the procedures of notification, In respect of public-or 
private-sector data flies, and provision of Information at the time of 
first communication, In respect of private-sector data flies, are designed 
to ensure the transparency essential to the exercise by the data subject of 
the right of access to data relating to him; 
(14) Whereas the data subject must, If his consent Is to be valid and when 
data relating to him are collected from him, be given accurate and full 
Information; 
(15) Whereas the data subject must be able to exercise the right of access 
In order to verify the lawfulness of the processing of data relating to him 
and their quality; 
(16) Whereas, If data are to be processed, they must fulfil certain 
requirements; whereas the processing of data which are capable by their 
very nature of Infringing the right to privacy must be prohibited unless 
the data subject gives hl·s explicit consent; whereas, however. on 
Important publl~ Interest grounds, notably In relation to the medical 
profession, derogatlons may be granted on the basis of a law laying down 
precisely and strictly the conditions governing and limits to the 
processing of this type of data; 
(17) Whereas the protection of privacy In relation to personal data 
requires that appropriate security measures be taken~ both at the level of 
design and at that of the techniques of processing, to prevent any 
unauthorized processing; 
-48 -
(18) Whereas as regards the media the Member States may grant derogatlons 
from the provisions of this Directive In so far as they are designed to 
reconcl le the right to privacy with the freedom of Information and the 
right to receive and Impart Information, as guaranteed, in particular, in Article 
10 of the Convention for the Protection of Human Rights and Fundamental 
Freedoms; 
(19) Whereas the Member States must encourage the drawing-up, by the 
business circles concerned, of European codes of conduct or professional 
ethics relating to certain specific sectors; whereas the Commission wl 11 
support such Initiatives and wi I I take them Into account when lt considers 
the appropriateness of new, specific measures In respect of certain 
sectors; 
(20) Whereas, In the event of non-compl lance with this Directive, I labl llty 
In any action for damages must rest with the controller of the fl le; 
whereas dissuasive sanctions must be appl led In order to ensure effective 
protection; 
(21) Whereas lt Is also necessary that the transfer of personal data should 
be able to take place with third countries having an adequate level of 
protection; whereas, In the absence of such protection In third countries, 
this Directive provides, In particular, for negotiation procedures with 
those countries; 
(22) Whereas the principles contained In this Directive sive sLbstance to and 
ampl lfy those contained In the Councl I of Europe Convention of 28 January 
1981 for the Protection of Individuals with regard to Automatic Processing 
of Personal Data; 
(23) Whereas the existence In each Member State of an Independent 
supervisory authority Is an essential component of the protection of 
Individuals In relation to the processing of personal data; wherea~ at 
Community level, a Working Party on the Protection of Personal Data, 
-49-
rust be set LP and re completely Independent In the performance of Its 
functions; whereas having regard to Its specific nature lt must advise the 
Commission and contribute to the uniform application of the national rules 
adopted pursuant to this Directive; 
(24) Whereas the adoption of additional measures for applying the 
principles set forth In this Directive cal Is for the conferment of 
rule-making powers on the Commission and the establ lshment of an Advisory 
Committee In accordance with the procedures laid down In Councl I Decision 
(1) 87 /373/EEC , 
HAS ADOPTED THIS DIRECTIVE: 
CHAPTER I 
GENERAL PROVISIONS 
Article 1 
ObJect of the Directive 
1. The Member States shal I ensure, In accordance with this Directive, the 
protection of the privacy of Individuals In relation to the processing of 
personal data contained In data fl les. 
2. The Me~ber States shal I neither restrict nor prohibit the free flow of 
personal data between Member States for reasons to do with the protection 
afforded under paragraph 1. 
(1) OJ No L 197, 18.7.1987, p. 33. 
-50 -
Article 2 
Definitions 
For the purposes of this Directive: 
(a) "personal data" means any Information relating to an Identified or 
Identifiable Individual ("data subject"); an Identifiable Individual 
Is notably an Individual who can be ldent~fled by reference to an 
Identification number or a slml lar Identifying particular~ 
(b) "depersonal lze" means modify personal data In such a way that the 
Information they contain can no longer be associated with a specific in­
diviciJ~l or an individual canable of being detenmined except at the price of an excessive effort 
In terms of staff, expenditure and time; 
(c) "personal data fl le" (fl le) means any set of personal data, whether 
central lzed or geographically dispersed, undergoing automatic 
processing or which, although not undergoing automatic processing, are 
structured and accessible In an organized col lectlon according to 
specific criteria In such a way as to facl lltate their use or 
combination; 
(d) "processing" means the fol lowlng operations, whether or not performed 
by automated means: the recording, storage or combination of data, and 
their alteration, use or communication, Including transmission, 
~lssemlnatlon, retrieval, blocking and erasur~; 
·(e) "cc:mtroller of the file" means the natural or legal person, public 
authority~ agency or other body competent under Community law or the 
national taw of a Member State to decide what wl I I be the purpose of 
the file·, which categories of personal data wll r be stored, which 
operations wl 11 be appl led to them and which third parties may have 
access to them; 
-51 -
(f) "supervisory authority" means the Independent publ le authority or 
other Independent body designated by each Member State In accordance 
with Article 26 of this Directive; 
(g) "publ le sector" means al I the authorities. organizations and entitles 
of a Member State that are governed by public law, with the exception 
of those which carry on an Industrial or commercial activity, and 
bodies and entitles governed by private law where they take part In 
the exercise of official authority; 
(h) "private sector" means any natural or legal person or association, 
Including public-sector authorities, organizations and entitles In so 
far as they carry on an Industrial or commercial activity. 
Article 3 
Scope 
1.The Member States shal I apply this Directive to fl les In the publ le and 
private sectors with the exception of flies In the publ le sector where the 
activities of that sector do not fall within the scope of Community law. 
2. This Directive shall not apply to fl les held by: 
(a) an Individual solely for private and personal purposes; or 
(b) non-profit-making bodies, notably_ of a political, philosophical, 
rel1glous. c~lturaf, trade-union, sporting or l~lsure nature, as part 
of their legitimate alms, on condition that they' relate only to those 
members and corresponding members who have consented to being Included 
therein and that they are not communicated to third parties. 
-52 -
Article 4 
Law applicable 
1. Each Member State shall apply this Directive to: 
(a) all flies located In Its territory; 
(b) the controller of a file resident In Its territory who uses from Ita 
territory a file located In a third country whose law does not provide 
an adequate level of protection, unless such use Is only sporadic. 
2. Each Member State shall apply Articles 5, 6, 8, 9, 10, 17, 18 and 21 of 
this Directive to a user consulting a file located In a third country from 
a terminal located In the territory of a Member State, unless such use la 
only sporadic. 
3. Where a file Is moved temporarily from one Member State to 
·another, the latter shall place no obstacle In the way and shall not 
require the completion of any formalities over and above those applicable 
In the Member State In which the file Is normally located. 
-53 -
CHAPTER 11 
LAWFULNESS OF PROCESSING IN THE PUBLIC SECTOR 
Article 5 
Principles 
1. SubJect to Article 6, the Member States shall, with respect to flies 
In the public sector, provide In their law that: 
<a> the creation of a file and any other processing of personal data shall 
be lawful In so far as they are necessary for the performance of the 
tasks of the public authority In control of the file; 
(b) -the processing of data for a purpose other than that for which the 
file was created shall be lawful If: 
-the data subJect consents thereto; or 
lt Is effected on the basis of Community law, or of a law, or a 
measure taken pursuant to a law, of a Member State conforming 
with this Directive which authorizes lt and defines the limits 
thereto; or 
-the legitimate Interests of the data subject do not preclude 
such change of purpose; or 
Article 8 lt Is necessary In order to ward off an Imminent threat to 
public order or a serious Infringement of the rights of others. 
Processing In the public sector having as Its obJect 
persona I data · 
1. The Member States shall provide In their law that the communication of 
personal data contained In the flies of a public-sector entity shall 
be lawful only If: 
-·54-
(a) lt Is necessary for the performance of the tasks of the public-sector 
entity communicating or requesting communication of the data; or 
(b) lt Is requested by a natural or legal person In the private sector who 
Invokes a legitimate Interest, on condition that the Interest of the 
data subject does not prevail. 
2. Without prejudice to paragraph 1, the Member States may specify the 
conditions under which the communication of personal data Is lawful. 
3. The Member States shall provide In their law that, In the 
circumstances referred to In paragraph 1(b), the controller of the 
file shall Inform data subjects of the communication of personal data. 
The Member States may provide for the replacing of such provision of 
Information by prior authorization by the supervisory authority. 
Article 7 
Obligation to notify the supervisory authorltl 
1. The Member States shall provide In their law that the creation of l 
public-sector file the personal data In which might be communicated 
shall be notified In advance to the supervisory authority and recorded 
In a register kept by that authority. The register shall be freely 
available for consultation. 
2. The Member States shall specify the Information which must be notified 
to the supervisory authority. That Information shall Include at least 
the name and address of the controller of the. file, the purpose of the 
file, a description of the types of data lt contains, the third 
parties to whom the data might be communicated and a description of 
the measures taken pursuant to Article 18. 
3. The Member States may provide that paragraphs 1 and 2 shall apply to 
other public-sector fl les and that consultation of the register may be 
restricted for the reasons stated In Article 15(1). 
-55 -
CHAPTER Ill 
LAWFULNESS OF PROCESSING IN THE PRIVATE SECTOR 
Article 8 
Principles 
1. The Member States shall provide In their law that, without the consent 
of the data subject, the recording In a file and any other processing 
of personal data shall be lawful only If lt la effected In accordance 
with this Directive and If: 
<a> the processing. is carr led out under a contract, or In the context of a 
CJ,SSi-caltractual relationship of trust, with the data subject and Is 
necessary for ·. its d lscharge: or 
Cb> the data cane fran sources genera I I y access I b le to the pub I I c and 
their processing is Intended solely for correspondence purposes: or 
Cc> the-ccntroller of the file Is pursuing a legitimate Interest, on 
ca'lditicn that the Interest of the data subject does not preva 11. 
2. The Member States shall provide In their law that lt shall be for the 
controller of the file to ensure that no communication le Incompatible 
with the purpose of the file or Is contrary to public policy. In the 
event of on-line consultation, the s ... obligations shall be Incumbent 
on the user. 
3. Without prejudice to paragraph 1, the Member States may specify the 
conditions under which the processing of personal data Is lawful.· 
-56 -
Article 9 
Obligation to lnfor• the data subJect 
1. The Member States shall, with respect to the private sector, provide 
In their law that at the time of first communication or of the 
affording of an opportunity for on-line consultation the controller of 
the file shall Inform the data subject accordingly, Indicating also 
the purpose of the file, the types of data stored therein and his name 
and address. 
2. The provision of Information under paragraph 1 shall not be mandatory 
In the circumstances referred to In Article 8(1)(b). There shall be 
no obligation to Inform where communication la required by law. 
3. If the data subject objects to communication or any other processing, 
the controller of the file shall cease the processing obJected to 
unless he Is authorized by law to carry lt out. 
Article 10 
Special exceptions to the obligation to Inform the data subJect 
If the provision of Information to the data subject provided for In Article 
9(1) proves Impossible or Involves a disproportionate effort, or comes up 
aga 1 nst the overriding legitimate Interests of the contro 11 er of the f I I e or a 
similar Interest of a third party, the Member States may provide In their 
law that the supervisory authority may authorize a derogation. 
-~-
Article 11 
Obligation to notify the supervisory authority 
1. The Member States shall provide In their law that the controller of 
the file shall notify the creation of a personal data file where the 
data are Intended to be communicated and do not come from sources 
generally accessible to the public. The notification shall be made to 
the supervisory authority of the Member State In which the file Is 
located or, If lt Is not located In a Member State, to the supervisory 
authority of the Member State In which the controller of the file 
resides. The controller of the file shall notify to the competent 
national authorities any change In the purpose of the file or any 
change in his address. 
2. The Member States shall specify the Information which must be notified 
to the supervisory authority. That Information shall Include at least 
the name and address of the controller of the file, the purpose of the 
file, a description of the types of data lt contains, the third 
parties to whom the data might be communicated and a description of 
the measures taken pursuant to Article 18. 
3. The Member States may provide that paragraphs 1 and 2 shall apply to 
other private-sector flies and that the Information referred to In 
paragraph 2 shall be accessible to the public. 
-58 -
CHAPTER IV 
RIGHTS OF DATA SUBJECTS 
Article 12 
lnforMd consent 
Any giving of consent by a data subject to the processing of personal data 
relating to him within the meaning of this Directive shall be valid only 
If: 
(a) the data subject Is supplied with the following Information: 
the purposes of the file and the types of data stored; 
the type of use and. where appropriate, the recipients of the 
personal data contained In the file: 
the name and address of the controller of the file; 
(b) lt Is specific and express and specifies the types of data, forms of 
processing and potential recipients covered by lt; 
(c) lt may be withdrawn by the data subject at any time without 
retroactive effect. 
Article 13 
Provision of Information at the time of collection 
1. The Member States shall guarantee Individuals from whom personal data 
are collected the r lght to be Informed. at least about: 
(a) the purposes of the file for which the lnfor~atlon Is Intended; 
(b) the obligatory or voluntary nature of their reply to the questions to 
which answers are sought; 
(c) the consequences If they fall to reply; 
(d) the recipients of the Information; 
(e) the existence of the right of access to and rectification of the data 
relating to them; and 
(f). the name and address of the controller of the file. 
-59 -
2. Paragraph 1 shal I not apply to the collection of Information where to 
Inform the data subject would prevent the exercise of the supervision 
and verification functions of a public authority or the maintenance of 
pub 11 c order. 
Article 14 
Additional rights of data subJects 
The Member States shall grant a data subject the following rights: 
1. To oppose. for legitimate reasons, the processing of personal data 
relating to him. 
2. Not to be subject to an administrative or private decision Involving 
an assessment of his conduct which has as Its sole basis the automatic 
processing of personal data defining his profile or personality. 
3. To know of the existence of a file and to know Its main purposes and 
the Identity and habitual residence, headQuarters or place of business 
of the controller of the fl le. 
4. To obtain at reasonable Intervals and without excessive delay or 
expense confirmation of whether personal data relating to him are 
stored In a file and communication to him of such data In an 
lntell lglble form. 
TI)e· f,4pr.hcr State~ may provide that the right of access to medical data may be exercised cr~ly thrc 
a doctor. 
5. To obtain. as the case may be, rectification, erasure or blocking of 
such data If they have been processed In violation of the provisions 
of this Directive. 
-60-
6. To obtain uoon reau~3t and fr~e of charge the erasure of data relating 
to him h~ld In fl~o~ used far market rese~rch or advertising purposes. 
7. To obtain~ !n the ovent cf the applleatlon of paragraph 5 and If the 
dnta h~ve bA~r. ccmmur.lcated to third parties, notification to the 
latter of the r8ctlflcatlon, orasure or blocking. 
8. To hav~ a Judicial remedy If tha rights guaranteed In this Article are 
!nfrlnqed4 
Artlcl" 15 
Exceetlonft to tha data subJr.u:tta right of acce_ss to p!!bllc-sector flies 
1. Th~ Memb~r States may limit by statute the rights provided for In 
points 3 and 4 of Article 14 for reasons relating to: 
(a} national $ecurlty, 
(b) dBfflli"'CA, 
(c) crlmln~l proceedings, 
(d) oubllc aafety, 
(e) a dt~ly e~tahlished· paramount economic and financial Interest of a 
~ember State or of the European Communities, 
(f) th~ ne~d for the nubile authorities to perform monitoring or 
lnsp~ctlon functlor.s, er 
(g) en eQuivalent right of another Individual and the rights and freedoms 
of others. 
2. In the circumstances referred to In paragraph 1, the supervisory 
~uthorlty shall be empowered to carry outR at the request of the data 
subJect, the nec~ssary checks on the file. 
3. The u~mber States may place limits on the data subject's right of 
access to data ccmpllod temporarily for the purpose of extracting 
statistical Information thArefr~~. 
-M -
CHAPTER V 
DATA QUALITY 
Article 1S 
1. The Member States shall provide that personal data shall be: 
(a) collected and processed fairly and lawfully; 
(b) stored for specified, explicit and lawful purposes and used In a way 
compatible with those purposes; 
(c) adequate, relevant and not excessive In relation to the purposes for 
which they are stored; 
(d) accurate and, If necessary, kept up to date; Inaccurate or Incomplete 
data shall be erased or rectified; 
(e) kept In a form which permits Identification of the data subjects for 
no longer than Is necessary for the purpose for which the data are 
stored. 
2. lt shall be for the controller of the file to ensure that paragraph 1 
Is complied with. 
-~-
Article 17 
Special categories of data 
1. The Member States shall prohibit the automatic processing of data revealing 
ethnic or racial origin, political opinions,·religious or philosophtcal 
beliefs or trade~union·membership, and.of data concerning health or sexual 
·Life, without the express and·written consent, freely given, of the data 
subject. 
2. The Member States may, on Important public Interest grounds, grant 
derogatlons from paragraph 1 on the basis of a law specifying the 
types of data which may be stored and the persons who may have access 
to the file and providing suitable safeguards against abuse and 
unauthorized access. 
3. Data concerning criminal convictions shall be held only In public­
sector flies. 
Article 18 
Data security 
1. The Member States shall provide In their law that the controller of a 
file shall take appropriate technical and organizational measures to 
protect personal data stored In the file against accidental or 
unauthorized destruction or accidental loss and against unauthorized 
access, modification or other processing. 
-6-3-
such measures sha I I ensure, In respect of automated f 1 lea~ an 
appropriate level of security having regard to the state of the art In 
this field, the cost of taking the measures, the nature of the data to 
be protected and the assessment of the potential risks. To that end, 
the controller of the file shall take Into consideration any 
recommendations on data security and network lnteroperablllty 
formulated by the Commission In accordance with the procedure provided 
for In Article 29. 
2. Methods guaranteeing adequate security shall be chosen for the 
transmission of personal data In a network. 
3. In the event of on-line consultation, the hardware and software shall 
be designed In such a way that the consultation takes place within the 
limits of the authorization granted by the controller of the file. 
4. · The obllgat Ions referred to In paragraphs 1, 2 and 3 shall ·also be 
Incumbent on persons who, either de facto or by contract, control the 
operations relating to a file. 
5. Any person who In the course of his work has access to Information 
contained In flies shall not communicate lt to third parties without 
the agreement of the controller of the file. 
CHAPTER VI 
PROVISIONS SPECIFICALLY RELATING TO CERTAIN SECTORS 
Article 19 
The Member States may grant1 In respect of the press and the audiovisual 
medla,derogatlons from the provisions of this Directive In so far as they 
are necessary to reconcile the right to privacy with the rules governing 
freedom of Information and of the press. 
-64 -
Article 20 
The Member States shall encourage the business circles concerned to 
participate In drawing up European codes of conduct or professional ethics 
In respect of certain sectors on the basis of the principles set forth In 
this Directive. 
CHAPTER VII 
LIABILITY AND SANCTIONS 
Article 21 
Liability 
1. The Member States shall provide In their law that any Individual whose 
personal data have been stored In a file and who suffers damage as a 
result of processing or of any act Incompatible with this Directive 
shall be entitled to compensation from the controller of the file. 
2. The Member States may provide that the controller of the file shall 
not be liable for any damage resulting from the loss or destruction of 
data or from unauthorized access If he proves that he has taken 
appropriate measures to fulfil the requirements of Articles 18 and 22. 
Article 22 
Processing on behalf of the controller of the file 
1. The Member States shall provide In their law that the controller of 
the file must. where processing la carried out on his behalf. ensure 
that the necessary security and organizational measures are taken and 
choose a person or enterprise who provides sufficient guarantees In 
that respect. 
-65 -
2. Any person who collects or processes personal data on behalf of the 
controller of the file shall fulfil the obligations provided for In 
Articles 16 and 18 of this Directive. 
3. The contract shall be In writing and shall stipulate, In particular, 
that the personal data may be divulged by the person providing the 
service or his employees only with the agreement of the controller of 
the f 11 e. 
Article 23 
Sanctions 
Each Member State shall make provision In Its law for the application of 
dissuasive sanctions In order to ensure compliance with the measures taken 
pursuant to this Directive. 
CHAPTER V I I I 
TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES 
Article 24 
Principles 
1. The Member States shall provide In their law that the transfer to a 
third country, whether temparary or permanent, of. personal data which 
are undergoing processing or which have been gathered with a view to 
processing may take place only If that country ensures an adequate 
level of protection. 
2. The Member States shall Inform the Commission of cases In which an 
Importing third country does not ensure an adequate level of 
protection. 
-6{S -
3. Where the Commission finds, either on the basis of Information 
supplied by Member States or on the basis of other Information, that a 
third country does not have an adequate level of protection and that 
the resulting situation Is likely to harm the Interests of the 
Community or of a Member State, lt may enter Into negotiations with a 
view to remedying the situation. 
4. The COmmission may decide. In accordance with the procedure laid down 
In Article 30(2) of this Directive, that a third country ensures an 
adequate level of protection by reason of the International. 
commitments lt has entered Into or of Its domestic law. 
5. Measures taken pursuant to this Article shall be In keeping with the 
obligations Incumbent on the COmmunity by virtue of International 
agreements, both bilateral and multilateral, governing the protection 
of Individuals In relation to the automatic processing of personal 
data. 
Article 25 
Deroqat Ion 
1. A Member State may derogate from Article 24(1) In respect of a given 
export on submission by the cot:'troller of the file of sufficient proof 
that an adequate level of protection will be provided. The 
Member State may grant a derogation only after lt has Informed the 
Commission and the Member States thereof ~nd In the absence of notice 
of opposition given by a Member State or the COmmission within a 
pe~lod.of ten days. 
2. Where notice of opposition Is given, the commission shall adopt 
appr·oprlate measures In accordance with the ·procedure laid down In 
Article 30(2). 
-67 -
CHAPTER IX 
SUPERVISORY AUTHORITIES AND WORKING PARTY ON THE PROTECTION OF PERSONAL 
DATA 
Article 26 
SUpervisory authoritY 
1. The Member States shall ensure that an Independent competent authority 
supervises the protection of personal data. The authority shall 
monitor the application of the national measures taken pursuant to 
this Directive and perform all the functions that are entrusted to lt 
by this Directive. 
2. The authority shall have Investigative powers and effective powers of 
Intervention against the creation and exploitation of flies which do 
not conform with this Dlrectfve. To that end, lt shall have, Inter 
alia, the right of access to flies covered by this Directive and shall 
be given the power-to gather all the Information necessary for the 
performance of Its supervisory duties. 
3. Complaints In connection with the protection of Individuals In 
relation to personal data may be lodged with the authority by any 
Individual. 
Article 27· 
WOrking Party on the Protection of Personal Data 
1. A working Party on the Protection of Personal Data Is hereby set up. 
The Working Party, which shall have advisory status and shall act 
Independently, shall be composed of representatives of the supervisory 
authorities provided for In Article 28 of all the Member States and 
shall be chaired by a representative of the COmmission. 
-68 -
2. The secretariat of the Working Party on the Protection of Personal 
Data shall be provided by the Commission's departments. 
3. The Working Party on the Protection of Personal Data shall adopt Its 
own rules of procedure. 
4. The Working Party on the Protection of Personal Data shall examine 
questions placed on the agenda by Its chairman, either on his own 
Initiative or at the reasoned request of a representative of the 
supervisory authorities, concerning the application of the provisions 
of Community law on the protection-of personal data. 
Article 28 
Tasks of the WOrking Party on the Protection of Personal Data 
1. The Working Party on the Protection of Personal Data shall: 
(a) contribute to the uniform application of the national rules 
adopted pursuant to this Directive; 
(b) give an opinion on the level of protection In the Community and 
In third countries; 
(c) advise the Commission on any draft additional or specific 
measures to be taken to safeguard the protection of privacy. 
2. If the Working Party on the Protection of Personal Data finds that 
significant divergences are arising between the laws or practices of 
the Member States In relation to the protection of personal data which 
_might affec~ the equivalence of protection In the COmmunity, lt shall 
Inform the Commission accordingly. 
3. The Working Party on the Protection of Personal ~ata may formulate 
recommendations on any questions concerning the protection of 
lndlvlduals In relation to personal data In the Community. The 
recommendations shall be recorded In the minutes and may be 
transmitted to the Advisory COmmittee referred to In Article 30. The 
Commission shall Inform the Working Party on the Protection of 
Personal Data of the action lt has taken In response to the 
recommendations. 
-69 -
4. The Working Party on the Protection of Personal Data shall draw up an 
annual report on the situation regarding the protection of Individuals 
In relation to the processing of personal data In the COmmunity and In 
third countries, which lt shall transmit to the commission. 
. CHAPTER X 
RULE-MAKING POWERS OF THE COMMISSION 
Article 29 
Exercise of rule-maklna powers 
The Commission shall, In accordance with the procedure laid down In Article 
30(2), adopt such technical measures as are necessary to apply this 
Directive to the specific characteristics of certain sectors having regard 
to the state of the art In this field and to the codes of conduct. 
Article 30 
Advisory eo.Mittee 
1. The Commission shall be assisted by a committee of an advisory nature com­
posed of the representatives of the Member States and-chaired by a repre­
sentative of the Commission. 
2. The representative of the Commission shall submit·to the committee a draft of 
the measures to be taken. The ~lttee shall deliver Ita opinion on 
the draft within a time limit which the chairman·may lay down according to 
the urgency of the matter, if. necessary by tak-ing 
a vote. The opinion shall be recorded In the •lnutea; in addition, 
each Member State shall have the right to ask to trave its position recorded in 
the minutes. The Commission shall take the utmost account of the 
opinion delivered by the c.ommlttee. lt shall Inform the c.onnlttee of 
the manner In which Its opinion has been taken Into account. 
-70 -
FINAL PROVISIONS 
Article 31 
1. The Member States shall bring Into force the laws, regulations and 
administrative provisions necessary for them to comply with this 
Directive by 1 January 1993. 
The provisions adopted pursuant to the first subparagraph shall make 
express reference to this Directive. 
2. The Member States shall communicate to the Commission the texts of the 
provisions of national law which they adopt In the field covered by 
this Directive. 
Article 32 
The Commission shall .report to the Council and the European Parliament at 
regular Intervals on the Implementation of this Directive, attaching to Its 
report, If necessary, suitable proposals for amendments. 
Article 33 
This Directive Is addressed to the Member States. 
Done at Brussels, For the Council 
-71 -
PROPOSITION DE DIRECTIVE DU OONSEIL 
VISANT AU RAPPROCHEMENT DE CERTAINES DISPOSITIONS 
LEGISLATIVES. REGLEWENTAIRES ET ADMINISTRATIVES 
DES ETATS MEUBRES 
RELATIVES A LA PROTECTION DES PERSONNES 
A L • EGARD DU TRA I TEYENT DES DONNEES 
A CARACTERE PERSONNEL 
1. Llgne budg6talre concern6e (6ventuellement l cr6er) : 
A 2511 : Frals de reunions de comlt6s dont la consultation n'est pas un 
~16ment obllgatolre de la proe6dure de formation d'actes communautalres. 
2. Base ''sale (ou autre> 
Article 100 A 
3. Proposition de classification en d6pense obllgatolre/non obltgatotre 
<avec Justification succlncte en vertu de la declaration commune du 30 
Juln 1982) : 
non-ob llgato 1 re 
4. Description et Justification de l'actlon 
4.1. ObJectlfs:- assurer la protection des personnes l 1'6gard des 
donn6es i caract~re personnel, 
-permettre la circulation transfrontl,re de donnees l 
caract~re personnel dans la Communaut6, 
-permettre le bon fonctlonnement du march6 lnt6rleur. 
4.2. Cr6atlon de 2 comites competents en matl,re de protection des 
personnes l 1'6gard des donnees l caract•re personnel (Art. 27,30) 
personnes concern6es : 1. Pour le Comlte de protection des donnees l 
caract,re personnel (Art. 27) : 
represe~tants de l'autorlt6 de contr&le de 
tous les Etats membres (groupe 4) 
2. Pour 1 e COrn 1 t6 consu I tat If (Art. 30.) 
representant& des Eta~s membres (groupe 3) 
4.3. Un repr6sentant de la Commission pr6slde le Comlt6 de protection 
des donn6es i caract,re personnel et le Comlt6 consultatlf. 
Le secretariat du Comlt6 de protection des donn6es l caract,re 
personnel est assure par les services de la Comm~sslon. 
-72 -
5. Nature de la d6pense et mode de calcul 
5.1. Nature : r6unlons 
5.2. Calcul (frals de participation des membres des 2 Comlt6a) 
-Comlt6 de protection des donn6es : 
24 membrea (non-gouvernementals) x 3 r6unlons 
a 2 jours x 1180 ECU (590 ECU/jour) • 84.960 ECU* 
-Comlt6 consultatlf : 
24 membres (gouvernemental) x 1 r6unlon a 2 ·Jours x 
780 ECU (390 ECU/Jour> -18.720 ecu• 
e. Incidence flnancl~re de l'actlon sur les cr6dlts d'lnterventlon 
6.1. Ech6ancler des cr6dlts d'engagement et de paiement 
CE-CP 
1993 103.880 ECU 
1994 " H 
1995 H " 
1996 " " 
1997 " " 
6.2. Part du flnancement communautalre dans le coQt total 1001 
7. Observations 
1. Le Comlt6 de protection des donn6es 6 caract6re personnel (Art. 27) 
11 est lnstltu6 ce Comlt6 6 caract6re consultatlf et lnd6pendant et 
est compos6 de repr6sentants de l'autorlt6 de contrble de tout lea 
Etats membres, pr6sld6 par un repr6sentant de la Commission. 
Ce Comlt6 6tabllt son r6glement lnt6rleur. Le secr6tarlat du Comlt6 
est assur6 par lea services de la Commission. 
Missions de ce Comlt6 : voir Art.28. 
2. Le Comlt6 consultatlf (Art.30) : 
11 est lnatltu6 un Comlt6 consultatlf compos6 des repr6sentants des 
Etats membres, pr6sld6 par le repr6sentant de la Commission. 
La Commission est asslst6e par ce Comlt6 afln de prendre lea 
6ventuelles mesures compl6mentalres n6cessalres pour adapter les 
dispositions de la directive aux sp6clflclt6s ·de certalnes secteurs. 
* estimation 
• ... 
... -72a -
FICHE D'INPACT SUR LA CONPETITIVITE ET L'EYPLOI 
1. Quelle oat la Juatlflcatlon prlnclpale de la .. sure? 
-· Aaauror la protection d•a poraonnea i l',gard des donn6es i caract•r• per aQnne I • 
-Parmettre la circulation transfrontlire de donn6es i caract•re personnel 
dana la Communaut6. 
-Permettre le bon fonct lonnament du •arch6 lnt6r leur·. 
11. caract6rlatiQUea dea entreDrlaes concern6es. 
La proposition concerne toutea lea entreprlaea qui utlllaent des flchlers 
de donn••• i caract•r• personnel quel que aolt leur taille ou leur aecteur 
d'actlvlt,. 
Ill. Quellea eont lea obligations l~s6ea dlrect ... nt au1 entreprlaea? 
Se confor .. r au1 dlapoaltlona appllcablea aux traltementa de donn6ea l 
caract•r• peraonnel, notamment celles relatives i la 16gltlmlt6 de ces 
traltemente dana le 1ecteur prlv6. 
IV. Quellea eont lea obllgatlona ausceptlblea d•&tre l~a6ea lndlrecteMent 
au1 entreprlaea via lea autorlt6a localea ? 
Aucune. 
V. Y a-t-11 dea •aurea ap6clalea pour lea PUE ' 
Non. 
~-... -72b -
VI. Quel eat l'effet pr6vlalble? 
a) eur la oa.p6tltlvlt6 del entreprlae• ? .. , ...... 
~.Ji 
.. · .. J 
~ .. : 
.. · 
. . . 
..... ~ .• J; 
... ·.~ 
·.·:;! 
:·.'t' 
.· -~' Le1 r6glel de protectlon.e•appllquent i toutea lea entreprlaes et 
611•1neront lea dlatoralona de concurrence ddea i I 'actuelle ·---··-·. ··.··.,'. 
·.:~: •••• f 
dleparlt6 dea 16glalatlona natlonalea. En ce qui concerne le~r ~ 
COIIP6tltlvlt6 lnternatlonale, ta directive pr6volt dea n6go.clatlona· 
avec lea paya tlera QUI n•aeaurent paa encore un nlveau de . .-; ... · 
protect Ion ad6quat. · · · · · ·· · 
b) eur 1'.-plol 7 
La direct lve pr6vol t la cr6at Ion d' lnatancea de contr&l.e. 
0 • •. • .• :t-: 
· nat Iona lea. · · .. . .. ·.· .......... . 
VII. L•• ·partWiree aoclaux ont-111 6t6 cOn.a1t6a aur cette propc),lt 1~,-:1· ·. ... 
• t • • I J .. .,. 
. ' 'w 
Non. . . . . . . .. . . ~ 
•. . .... , •· ... ':.· . . . . . . ~ '· 
~ . . . ~ ·.: . 
. f ... 
.. :~ 
•. ~ 
• • ~. 1 
.; .. 
. :.~ 
.· j 
. ··:·i 
. '.! t . . .~,: 
I .... 
·~ ~:; ..... 
•',1 
•:-·· 
. ·,.:; 
·.,. 
-73 -
Draft 
RESOLUTION OF THE REPRESENTATIVES OF THE GOVERNMENTS OF THE MEMBER 
STATES OF THE EUROPEAN COMMUNITIES MEETING WITHIN THE COUNCIL 
THE REPRESENTATIVES OF THE GOVERNMENTS OF THE MEMBER STATES OF THE EUROPEAN 
CO~UNITIES MEETING WITHIN THE COUNCIL, 
Whereas the Council Directive concerning -the protection of 
Individuals In relation to the processing of personal data ensures the 
protection of the privacy of Individuals In relation to the processing of 
personal data contained In data flies In the private and public sectors, 
with the exception of flies In those parte of the public sector which do 
not fall within the scope of Community law, 
Desirous to facilitate cooperation between the administrations of the 
Member States In sectors not falling within the scope of Community law 
while affording a high level of protection for the privacy of the persona 
affected, 
Whereas the principles contained In the Directive give substance to.and amplify 
those contained In the Council of Europe COnvention of 28 January 1981 for 
the Protection of Individuals with regard to Automatic Processing of 
Personal Data, 
HEREBY ADOPT THIS RESOLUTION: 
The Governments of the Member 5tates undertake to :a·pply the 
P r in c i P le s contained i n the C o u n c i l D i re c t i v t: . c o ~ c ern·; n g the 
protection of Individuals In relation to the processing of personal data to 
those parts of the public sector which do not fall within the scope of 
Community law and to set In motion the necessary legislative procedures. 
-74 -
Com.laalon Daclaratlon on the application to the lnatltutlone and other 
bodies of the European Communities of the principles contained In the 
Council Directive concerning the protection of individuals in relation to 
the processing of personal data 
1. The Commission considers that the principles contained in the 
Directive concerning the protection of individuals in 
relation to the procesalng of personal data (Mthe Directive") muat 
apply to the Institutions and other bodies of the European communities. 
2. To that end, the Commission will, at the earlleat opportunity, take and 
p~opose the necessary measures. 
3. Pending the taking of such measures. the Commission undertakea to apply 
the prlnclplea contained In the Directive to the procesalng of peraonal 
data for which lt la responsible. 
4. The Commission considers that the other institutions of the 
Communities must also undertake to apply the prlnclplea contained In the 
Directive to the processing of personal data for which they are 
responsible. 
-75 -
SYN 288 
PROPOSAL FOR A 
COUNCIL DIRECfiVE 
CONCERNING THE PROTECTION OF PERSONAL DATA AND PRIVACY IN THE 
CONTEXT OF PUBLIC llfGITAL TELECOMMUNICATIONS NETWORKS, 
IN PARTICULAR THE INTEGRATED SERVICES DIGITAL NETWORK (ISDN) AND 
PUBLIC DIGITAL MOBILE NETWORKS 
-76 -
CONTENTS 
A SUMMARY .................................................................................................................... . 
B EXPlANATORY MEMORANDUM ....................................................................... 0 
I. Introduction .................................................................................................................... 0 
IT. The new specific requirements with regard to the 
protection of personal data and privacy in the 
telecommunications sector ........................................................................................... . 
m. The approach proposed: the provisions of the 
draft Directive ............................................................................................................... 0 
IV. Conclusions ................................................................................................................... 0 
0 PROPOSAL FOR A COUNCIL DIRECfiVE CONCERNING THE PROTECI10N OF 
PERSONAL DATA AND PRIVACY IN TilE CONTEXT OF PUBLIC DIGITAL 
TELECOMMUNICATIONS NETWORKS, IN PARTICUi.AR TilE INTEGRATED 
SERVICES DIGITAL NETWORK(ISDN) AND PUBLIC DIGITAL MOBILE 
NETWORKS 
-77 -
A. SUMMARY 
The introduction of public digital telecommunications networks is now fully under-way in 
the Community. During the early years of this decade more than 70 % of long distance 
transmission, more than 50 % of long distance switching and more than 30 % of local 
switching will be digitalised. 
The wide-spread introduction of public digital telecommunications networks in the 
Community will allow, in particular with the implementation of the Integrated Services 
Digital Network (ISDN) and the new digital mobile services, vastly enhanced 
telecommunications functions for the general public, but at the same time, will require a 
Community-wide common approach for the protection of privacy, personal data and data 
security with regard to the specific requirements of the new digital telecommunications 
environment. 
The Council and the European Parliament have recognised repeatedly the central role of 
adequate measures concerning data protection and protection of privacy for the future 
development of telecommunications in the European Community. In particular, in its 
resolutions of 14 December 1988 on telecommunications, the European Parliament called 
for specific measures "to ensure data privacy protection and confidentiality" and reminded 
the Commission "of its political responsibility for ensuring that legislative proposals on 
opening up telecommunications markets, in the appropriate legal form, are accompanied 
by action at Community level relating to the protection of personal data". 
In the Community, there is growing attention paid to the impact of digital networks on the 
protection of personal data and privacy. In a resolution adopted at Berlin in August 1989, 
the data protection commissioners of the Member States called for special attention with 
regard to protection of personal data and privacy in the context of ISDN. 
The enclosed proposal is intended to meet these specific requ~ements with regard to the 
protection of personal data and privacy in the field of the new public digital 
telecommunications networks. It is presented in the context of -and complementary to -
the proposals by the Commission for the establishment of a general framework for data 
protection in the Community. 
Effective protection of personal data and privacy is developing into an essential pre-
-78 -
condition for social acceptance of the new digital networks and services. It must be an 
essential component of the Community's telecommunications policy which aims at securing 
for the European citizen the full benefits of advanced telecommunications services, as the 
Community moves towards an environment which will be substantially richer in 
information than before. 
The enclosed proposal for a Council Directive has been drafted with this global objective in 
mind. 
-79 -
B. EXPLANATORY MEMORANDUM 
I. INTRODUCTION 
The current wide-spread introduction of public digital telecommunications in 
the Community, in particular the implementation of the Integrated Services 
Digital Network (ISDN)1 and new djgital mobile servicesl will allow vastly 
enhanced telecommunications functions for the general public, but at the same 
time, will require a Europe-wid~ common approach for the protection of 
privacy, personal data and data security with regard to the specific requirements 
of the new digital telecommunications environment. 
In its Resolution on the coordinated introduction of the Integrated Services 
Digital Network jn the European Community of 12 December 19863, the 
European Parliament stated that the "prospective Integrated Services Digital 
Network (ISDN), evolving from the telephone network, will offer many 
additional services to corporate and private subscribers ... " but called on the 
Commission "to submit proposals on a practical approach towards ensuring 
within the ISDN now emerging throughout Europe, a consistent level of data­
privacy protection commensurate with the enhanced technical capabilities of 
this new network". The European Parliament emphasised this concern further 
in a more general r..ontext in its resolutions of 14 December 19884, where it 
called for specific measures with regard to the use of telecommunications 
networks "to ensure dataMprivacy protection and confidentiality" and reminded 
the Commission "of its political re..~ponsibility for ensuring that legislative 
proposals on opening up telecommunications markets, in the appropriate legal 
form, are accompanied by action at Community level relating to the protection 
of personal data ... ". 
1 Council Recommendation of 22 December 1986 on the coordinated Introduction of the Integrated Service 
Digital Network (ISDN) in the European Community (86/659/EEC). 
2 
3 
4 The ISDN can be considered as a natural evolution of the telephone network. lt will allow via a single acce 
using the existing subscriber line, the transmission of voice (telephony), text, data, and Images in the form 
multitude of more efficient or new services (for details see CouncA Recommendation 86/659/EEC and 
chapter 11.). 
· In accordance with the Council Recommendation, two progress reports on the implementation of ISDN w• 
submitted up to now by the Commission (COM(88) 589; COM(90) 123). 
Council Recommendation of 25 June 1987 on the coordinated introduction of public pan-European cellula 
digital land-based mobite communications in the Community (87 /371 /EEC, OJ N>~ 196, 1? July ~ 987 • P· 
and Council Directive of 25 June 1987 on the frequency bands to be. reserved for the coordinated mtroduc 
of public pan-EuropP,an cellular digital land-based mobile communications in the Comm~nity (87 /3?2/~~c 
OJ f\b L196, 17 July 1987, p. 85), and subsequent proposals by the Commission in the f1eld of public dtgtt 
mobile communications. 
Resolution on Council Recommendation 85/659/EEC, QJ l'bC7, 12 January 1987, P· 334. 
Resolution on Posts and Telecommunications, QJ f\bC12, 16 January 1989, p. 69; resolution on the neec 
overcome the fragmentation in telecommunications, OJ N:> c 12, 16 January 1989, P· 66. 
-80 -
The Council in its resolution of 30 June 1988', by which it adopted the 
principles of the Green Paper on the development of the common market for 
telecommunications setvices and equipment' and gave its general support to the 
objectives of the action programme set out in the communication of9 February 
19887 defmed as one of the major policy goals "to protect personal data and to 
provide for the individual's access, through the communication media, to an 
environment significantly richer in information than before". 
In its resolution on the strengthening of the coordination for the introduction of 
the Integrated Setvices Digital Network (ISDN) in the European Community 
up to 19928, the Council specified its concern further with regard to the ISDN 
by emphasising as necessary "further discussion at European level regarding 
user privacy protection requirements and requirements concerning the security 
of communications in the context of features of new setvices, in accordance with 
the resolution of the European Parliament of 12 December 1986 on 
recommendation 86/659 /EEC". 
The representatives of the authorities responsible for data protection in the 
Member States adopted at their 11th international conference on 28-31 August 
1989 in Berlin a resolution calling for special attention with regard to the 
protection of data and privacy in the context of the ISDN. 
With the enclosed proposal the Commission is responding to this requirement 
for specific Community-wide measures concerning the protection of personal 
data and privacy in the context of the implementation of the new public digital 
telecommunications networks, in particular the Integrated Setvices Digital 
Network and the public digital mobile networks. It takes account of the fact 
that there is deep -and justified -concern concerning the immediate impact 
of digital networks on the protection of personal data and privacy. The 
Commission has also recognised data protection and protection of privacy as an 
essential requirement in the context of the future development of an open 
network environment in the Community'. 
5 . CouncU Resolution of 30 June 1988 on the development of the common market for telecommunications 
services and equipment up to 1992 (0Jr.t>C257, p. 1). . 
6 
7 
8 
9 COM(87) 290. 
Towards a competitive Community-wide telecommunications market In 1992: Implementing the Green Par 
on the development of the common market for telecommunications services and equipment. State of 
discussions and proposals by the Commission (COM(88) 48). 
OJ NoC196,.. · 1 August 1989, p. 4. 
Comn:-on position adopted by the CouncU on 5th February 1990. with a view to adopting a Directive on the 
establishment of the internal market for telecommunications services through the implementation of Open 
Network Provision (OJ ..... ). 
-81 -
The proposal must be seen against the background of discussions and the 
general principles established in Europe with regard to the protection of 
personal data through the Convention of the Council of Europe of 1981 for the 
Protection of Individuals with regard to Automated Processing of Personal 
Data, which has been ratified up to now by seven Member States of the 
Community. The proposal is presented in the context of -and complementary 
to .. the proposals by the Commission for the establishment of a general 
framework for data protection in the Community submitted in parallel, in 
particular the draft Council Directive for the approximation of certain laws, 
regulations and administrative provisions of the Member States concerning the 
protection of individuals in relation to the processing of personal data, the draft 
Council Decision concerning the opening of negotiations in view of the 
adhesion of the European Economic Community, in the fields of its 
competence, to the Convention of the Council of Europe for the Protection of 
Individuals with regard to Automated Processing of Personal Data, and the 
draft Council Decision concerning the security of information systems ; in 
addition, the Commission will develop internal rules with the objective to 
guarantee for the individuals concerned a level of protection equivalent to the 
principles of the Council Directive mentioned above. 
Within this general context, the enclosed Directive is to provide for the specific 
provisions required for the approximation of laws, regulations and 
administrative provisions in the Community in the field of protection of 
personal data and privacy with regard to public fixed and mobile digital 
telecommunications networks and the new "intelligent" functions which they 
provide. 
-82 -
11. THE NEW SPECIFIC REQUIREMENTS WITH REGARD TO THE 
PROTECIION OF PERSONAL DATA AND PRIVACY IN THE 
IELECOMMUNICA TIONS SECfOR 
The "digitalisation" of the public telecommunications networks is now fully 
under way in the Community. During the early years of this decade more than 
70 % of long distance transmission, more than 50 % of long distance switching 
and more than 30 % of local switching will be digitalised. 
Digitalisation means the introduction of fully computer-based exchanges and 
the processing and transmission of all information transmitted via 
telecommunications networks -voice, data and image -in the form of binary 
digits10• The "bit-streams" thus generated can be acted upon directly by the 
intelligence of computers, both inside the network as well as in the subscriber 
terminal. This leads to a new level of quality of service which cannot be 
achieved with traditional "analogue" techniques, as well as a large number of 
new "intelligent" functions which opens a broad range of new activities via 
telecommunications networks. Full "end-to-end" (subscriber-to-subscriber) 
digital communication is offered by the evolving Integrated Services Digital 
Network and the new public digital mobile communications systems11• 
With regard to data protection, the introduction of public digital networks has 
two major consequences. 
On the one hand, the fully computer-based techniques now possible can offer a 
substantially higher degree of data security for specific individual requirements, 
such as sophisticated encryption techniques. 
On the other hand, due to the digital processing of both operational and call 
data and the treatment by computer-based exchanges, it could become possible 
-without adequate data protection measures -to store and monitor 
systematically specific call-related data, such as origin of call. Such a possibility 
was only feasible in traditional analogue-based "non-intelligent" networks by 
making a substantial technical effort and therefore was only implemented under 
very exceptional circumstances. 
At the same time, the new intelligent telecommunications functions, such as 
defined by the ISDN "supplementary services"12, offer substantial additional 
service features to the subscriber which will enhance service quality as well as 
consumer protection, such as detailed billing. The new functions, however, will 
require new specific measures and regulations, if the protection of privacy is to 
be guaranteed in the new environment. 
to Computers process all information in the form of •binary digits•, I.e. by splitting all information into its 
fundamental information elements (bits) with values 0 or 1. 
u See Council Recommendations 86/659/EEC and 87/371 /EEC. footnotes 1 and 2 above. 
12 See for details Council Recommendation 86/659/EEC, footnote 1. 
-83 -
Therefore, the introduction of digital telecommunications networks in the 
Community gives rise, with regard to the protection of personal data, to 
substantial specific issues which must be addressed, such as the handling of: 
subscriber-related information, increasingly stored in computer-held 
subscnber files; 
traffic and other operational data; 
detailed billing data; 
calling-line identification (identification of origin of call); 
automatic call forwarding to third parties; 
unsolicited messages; 
specific technical features for terminal and other equipment which may 
be required, in order to provide for adequate protection. 
The general provisions for protection of personal data, such as initiated by the 
Council of Europe convention and to be established for the Community by the 
Commission's initiatives mentioned above, does provide a broad framework, 
but does not make provisions to the specific details required for addressing 
these issues. 
The general provisions concerning the protection of personal data cannot 
prevent the current emerKence of divereent le&islation. re&J1lations and 
administrative action in the Member States concernina the operation of the 
future di&ital networks which could very soon endanger the common market for 
both telecommunications services and terminal equipment. 
For example, in the field of calling line identification, certain Member States 
plan to provide for a case-by-case elimination of the feature by the calling 
subscriber. If such an elimination will be realised via a button on the telephone 
set, while other operators might decide to provide for the elimination via a code 
to be used before dialling a number, it would create problems for the free 
circulation of terminal equipment in the Community. 
A comparison of the existing national provisions shows considerable 
discrepancies concerning both the contents and the nature of the legal 
instruments· used. Under these circumstances, a situation of legal uncertainty is 
developing in the Community concerning telecommunications networks and 
services, which threatens to hinder substantially the transborder offering of 
services. · 
Without a Directive concerning the specific provisions ~ecessary to implement 
the general principles of protection of data and privacy with regard to public 
digital fiXed and mobile networks, it would be impossible to prevent divergent 
developments in the Community. 
-84 -
At the same time, Community-wide provision for effective protection of 
personal data and privacy is developing into an essential pre-condition for social 
acceptance of the new digital networks and services, as conftrmed by the 
Council at its meeting of 7 November 1989 where it concluded with regard to 
the social aspects of telecommunications on the need to preserve the protection 
of privacy and personal data within a European perspective. 
The enclosed proposal for a Council Directive aims at fulfilling these specific 
requirements. 
-85 -
m. THE APPROACH PROPOSED: THE PROVISIONS OF THE DRAFr 
DIRECTIVE 
The global objective of the proposed Directive is to provide throughout the 
Community for a basic level of protection of personal data and privacy for the 
European citizen, which should be included in the general new digital 
telecommunications offering, while referring requirements for enhanced levels 
of data security for specific individual cases and applications to the specific 
measures to be developed within the framework of the work plan set out in the 
Commission's proposal for a Council Decision concerning security in 
information systems mentioned above. 
The proposed Directive aims at achieving a basic level of protection of the 
general subscriber in the new digital environment by emphasising two 
fundamental principles: 
minimising the risk of abuse by limiting the data processed and stored 
in the context of public telecommunications operations to the bare 
minimum required for ensuring adequate operation, service quality 
and subscriber facilities; 
ensuring fully the right of the subscriber to information self­
determination, both with regard to the telecommunications 
organisation providing the services as well as with regard to the second 
party in a call connection and any third party which may want to gain 
access to the data transmitted or provided in the context of a 
transaction via a public telecommunications network. 
Given that the most profound impact on the general subscriber by the new 
telecommunications environment will be in the field of voice telephony, the 
proposed Directive concentrates on this area. However, it provides for a 
procedure for the application of the provisions relating to the voice telephone 
service to other public digital telecommunications services as applicable, such as 
for public data transmission services in the context of ISDN as well as public 
packet-and circuit-switched data networks, and other related public 
telecommunications services. 
Further, given the current state of transition of the public telecommunications 
networks in the Community and in particular the fact that certain "Stored 
Programme-Controlled" (SPC) Exchanges, while not yet fully digital, do provide 
a number of the intelligent functions in question, the proposed Directive 
provides for those cases where a Member State has not yet implemented the 
Integrated Services· Digital Network or public digital mobile networks, that the 
provisions of the Directive will be implemented to the extent that they also 
apply to services based on analogue networks. . 
With these general principles in mind, the content of the proposed Directive 
addresses in particular: the collection, storage and processing of personal data 
in the subscriber's ftle; the storage and processing of traffic and billing data, in 
particular for the purpose of itemised call statements; the problem of the calling 
line identification; access by third parties; unsolicited calls; and the procedures 
to be chosen for establishing specific technical standards which may be 
required. 
The articles of the Directive are briefly explained hereunder: 
Articles 1 and 2 describe the overall objectives of the Directive and its 
-86 -
agplication to protection of data and privacy in connection with public 
telecommunications services in public digital telecommunications networks in 
the Community. 
Article 3 contains defmitions of important terms in line with the proposal of a 
Council Directive on the implementation of Open Network Provision (ONP) 
mentioned abovell. 
The general principle in Article 4 that the collection, storage and processing of 
personal data by a telecommunications organisation is justified for the pur.poses 
of the grovision of the intended service only and may not be used without 
specific permission by law or without the subscriber's prior recorded consent for 
any other purpose is applied in Article S to the establishment of subscriber files. 
As set out in the introductory statements to the Directive, such collection, 
storage and processing of personal data may in particular not be used to give 
telecommunications organisations any undue competitive advantage over other 
service providers in competitive fields. 
Article 6 enumerates the ri&Jtts of the subscriber concerning his personal data 
held by a telecommunications organisation and Article 7 states the princigle of 
non-disclosure of such data to third parties without his consent or permission by 
law. 
Article 8 should guarantee an adeguate level of protection of data against 
unauthorised access. 
Articles 9 and 10 apply the principle of collection, storage and processing of 
personal data as far as required for telecommunications purposes only to billin& 
and traffic data. Article 11 intends to protect the privacy of the subscribers in 
connection with itemised call statements via the requirement of anonymity of 
the called subscriber. 
Articles 12 and 13 contain detailed provisions concerning the callin& line 
identification. The possibility to eliminate the identification feature should be 
made available, because, among other reasons, callers making calls to and from 
drug and alcohol rehabilitation centres, family abuse shelters or mental health 
services have a legitimate concern that this service feature may compromise 
their anonymity; the same applies to suicide and AIDS hot lines. 
However, the called subscriber can have a legitimate interest in receiving only 
identified calls. In order to guarantee the right of information self­
determination to both the calling and the called parties, the called subscriber 
must therefore have the possibility to limit the acceptance of incoming calls to 
those which identify the calling subscriber's number. 
Moreover, the telecommunications organisation should provide an override 
(blockin&) function against the elimination of the identification feature in case 
of malicious calls; the function must also be made available for purposes of 
pursuit of criminal offences and for emergency services, in particular the fire 
· brigade, in order to prevent abuse of such services. 
Article 14 ensures that the privacy of both the calling and the called subscriber 
is also protected in case of the use of the call forwardin& features. 
t3 See footnote 9. 
-87 -
Article 15 should prevent by technical means the contents of telephone calls 
being stored andlor disclosed to third parties without advance informing of the 
calling subscriber. 
Articles 16 and 17 aim at preventing the unauthorized use of the subscribers' 
personal data by providers of teleshowing and videotex services in order to 
avoid the establishment of consumer proftles as well as at the protection of the 
subscriber's privacy against unsolicited messages. such as unwanted advertising 
via telecommunications means. 
Article 18 is intended to prevent the fact that the introduction of technical 
features based on data protection requirements might create undue restrictions 
to the free circulation of telecommunications equipment and services in the 
Community, by ensuring, where required, the working out of common 
European standards for the implementation of specific technical features. In 
accordance with the Council Directive on the approximation of the laws of the 
Member States concerning telecommunications terminal equipment, including 
the mutual recognition of their conformity14, and Council Decision 87/95 /EEC 
of 22 December 1986 on standardisation in the field of information technology 
and telecommunications15, the technical work is to be entrusted to the 
appropriate European standardisation bodies, in particular the European 
Telecommunications Standards Institute (ETSI) and the CEN/CENELEC. 13 
The final provisions in articles 19 to 25 concern the field of application. the 
procedures for modifications necessaty to adapt this Directive to new technical 
developments and consultation procedures. It is foreseen that a committee 
composed of representatives of the authorities responsible for data protection 
in the Member States and a committee composed of the representatives of the 
Member States shall assist the Commission in the implementation of the 
Directive. These committees are proposed to be the committees defmed for 
these purposes in the draft Council Directive for the approximation of certain 
laws, regulations and administrative provisions of the Member States 
concerning the protection of individuals in relation to the processing of personal 
data submitted in parallel as mentioned above, but would be specifically 
constituted for the purposes of this Directive. 
t4 COM(89)289 -SYN 204, 27.7.1989. 
t.s OJ NoL~ 7 February 1987, p. 31. 
-88 -
IV. CONCLUSION 
Effective Community-wide protection of personal data and privacy is 
developing into an essential pre-condition for social acceptance of the new 
digital networks and services. 
Without a directive concerning the specific provisions necessary to implement 
the general principles of protection of personal data and privacy with regard to 
the specific requirements of public digital fixed and mobile networks, it will be 
impossible to prevent divergent developments in the Community which would 
very soon endanger the common market for both telecommunications services 
and terminal equipment. 
The attached draft Directive is to provide for these specific provisions. 
The Council is therefore requested to adopt the attached proposal for a 
Directive. 
-89 -
SYN 288 
PROPOSAL FOR A COUNCIL DIRECI1VE CONCERNING THE PROTECfiON OF 
PERSONAL DATA AND PRIVACY IN THE CONTEXT OF PUBLIC DIGITAL 
TELECOMMUNICATIONS NETWORKS, IN PARTICUlAR THE INTEGRATED 
SERVICES DIGITAL NETWORK(ISDN) AND PUBLIC DIGITAL MOBILE 
NETWORKS 
-90 -
THE COUNCIL OF THE EUROPEAN COMMUNITIES, 
Having regard to the Treaty establishing the European Economic Community, and in 
particular Article lOOa thereof; 
Having regard to the proposal from the Commission•~ 
In co-operation with the European Parliament 2; 
Having regard to the opinion of the Economic and Social Committee ~; 
t. Whereas £ouncil Directive:... concerning the Rrotection of 
individuals in relation to the processing of personal data exhorts MenDer States to 
ensure the protection of privacy ; 
2. Whereas currently in the European Community new advanced digital public telephone 
networks are emerging which give rise to specific requirements concerning the 
protection of personal data and privacy of the user ; 
3. Whereas this is the case, in particular, with the introciJctioo of the Integrated Services Digital 
Network (ISDN) and public digital mobile networks; 
2 
3 
-91 -
4. Whereas the Council in its Res o l ut 1.on of 30th June 1988 on the 
development of the common market for telecommunications services and equipment 
up to 1992 4-. has called for steps to be taken to protect personal data, in order to 
create an appropriate environment for the future development of telecommunications 
in the Community; whereas the Council has re-emphasized the importance of the 
protection of personal data and privacy in its Resolution of 18th July 1989 on the 
strengthening of the co-ordination for the introduction of the Integrated Services 
Digital Network (ISDN) in the European CommunitY 5~ 
5. Whereas the European Parliament has underlined the importance of the protection of 
personal data and privacy in telecommunications networks, in particular with regard 
to the introduction of the Integrated Services Digital Network (ISDN) 6, ?., 8,-
6. Whereas Commission Recommendation 81/679/EEC calls for. the 
adoption and ratification by Member States of the Council of Europe Convention for 
the protection of individuals with regard to automatic processing of personal data 
which spells out general principles for the protection of personal data; 
7. \tl'lereas a n.JJber of Member States have adopted and ratified this Convention; 
8. Whereas Council Decision ... ? opens negotiations with a view to the accessim of the 
European Economic Community, in the fields. in which it is cmpetent, to the Ca"'VE!nticrt of 
the Council of Europe for the Protection of Individuals with regard to Automatic 
Processing of Personal Data~. 
4· OJ ft) c 257, 4.10.1988, p. 1. 
51 Orl\0 c 196;, 1.8.1989, p.4. 
6 OJ ftl C 7,·: 12. 1 • 1987, p. 334. 
7 
OJ. No c 1-2, 16.1.1989, p. 69. 
8 
OJ No c 12, 16.1.;1989, p. 66. 
9 OJ ... 
-92 -
9. Where as. Council Directive • • • I concerning the protection of 
individuals in relation to the processing of personal data implements the adoption of 
these general principles in the Community _7, 
10. Whereas in the case of public digital networks, specific legal, regulatory, and technical 
provisions must be made in order to protect personal data and· the privacy of users with 
regard to the increasing risks ·connected with the computerized storage and 
proce&~ing of personal data in such networks; 
11. Whereas Member States are currently developing divergent provisions in this area; 
12. Whereas given the obstacles resulting from these divergent legal, regulatory, and 
technical provisions concerning the protection of personal data and privacy in the 
context of the implementation of public digital telecommunications networks in the 
Community, in particular the Integrated Services Digital Network (ISDN) and public 
digital mobile networks, the full establishment of a Community-wide market in 
telecommunications services and equipment requires the rapid introduction of 
harmonised provisions; 
13. Whereas this Directive. should determine the extent to which personal data may be 
collected, stored and processed in connection with the provision of 
telecommunications services; 
14. Whereas the collection, storage, and processing of personal data by a 
telecommunications organisation is justified for the purposes of the provision ')f the 
intended service only and may not be used without specific a.rthori zatia1 by Law or the 
'subscriber's prior ·consent for any other ,purpose; . whereas such collection, 
storage, and processing of personal data maJ. in particula.;;not be used t~ give such 
telecommunications organisation any undue competitive advantage over other service 
providers; 
-93 -
15. Whereas this Directive should implement in the telecommunications sector the general 
principles concerning .. the subscriber's right to ·inspect the p~rsonal data 
stored about him/her, his right ~o .. request the -rectificatioo or erasure of such data, ; 
necessary, as well as. ·h~ijs_ .nightl~0:.p:revent non-authorized disclosure of his 
personal data; 
16. Whereas this Directive must provide for harmonization of the Member States' 
ru~es con c-e r n_i n g the protection of privacy in the field of itemized call 
statements; 
17. Whereas, it is necessary, as regards-the calling line identificatioo, to protect both the 
right of the calling party to remain anonymous and the privacy of the called party with 
regard to unidentified calls; 
18. Whereas safeguards must be provided for the users of teleshopping and videotex 
services against unauthorized use of their personal data as well as for the subscribers 
in general against intrusion into their privacy hy means of unsolicited calls; 
19. Whereas it is n'ecessary to ensure that: the introduc~i·on of technical features 
telecommunications equipment for data protection purposes is harmonised in order to 
be compatible with the implementation of the internal market of 1992; 
20. Whereas the implementation of this Directive with regard to third countries must take 
into account the level of protection of personal data and privacy in those countries 
as provided for in Council D.irective {_-cpncerning the protection of 
·individuals in relation to the processing of personal data_/;· 
· 21. •.c1ereas all 1natters c(]'lceming protecti(]'l. of· persmal data anl pri~acy in the cmtP.xt of Plbl ic. 
digital telecommunications networks, which are not cove~ by the pnovisions of this specific 
Directive, the Council Directive mentioned above shall apply; 
22. Whereas this Directive does not address issues of protection of personal data and 
privacy related to -national security; 
-94 -
23. Whereas it is useful for the preparation of measures intended to implement or modify 
this Directive to draw on the experience of the Working Party on the Pr.ot.ection of 
Personal~ Data composed of .representati-ves of the supervisor·y authorities of 
the Me"mber States, set up by_ Article 27 __ of -~ouncil.Directive 
!._ ~oncerning.t.ht! protection of __ ind'ividuals in relation to the proces.sing 
of personal data_7; 
24. Whereas such measures must be prepared with the assistance of the committee 
composed of representatives of the Member States set up by Arti'c le 30 .of 
Council Directive •••• !_-concerning the protectlon of individuals 
in relation to the processing·of personal--data 7. --
-95 -
HAS ADO PIED TinS DIREcriVE: 
Article 1 
1. This Directive provides for .the. harmonisation of the provisions required 
to ensure an ~qual level of protection of-privacy in ttle Community and to 
provide for the free movement of telecommunications equipment and services 
within and between Member States. 
2. The Member States shall adopt the necessary specific provisions in order 
to guarantee~ the protection of per·sonal data and privacy in the telecom­
munications sector in accordance with this Directive. 
A[ticle 2 
1. Without prejudice to the general pr.ov1s1ons of Council Directive ••• 
concerning the protect ion ... of ·individuals in relation to the processing 
of personal data, this Directive applies specifically to the collection, storage, and 
processing of personal data by telecommunications organizations in connection with 
the provision of public telecommunications services in public digital 
telecommunications networks in the Community, in particular via the lritegrated 
Services Digital Network (ISDN) and public digital mobile networks. 
2. In case a Member State has not yet implemented the Integrated Services Digital 
Network (ISDN) or public digital mobile networks, the provisions of this Directive will 
be implemented to the extent that they also apply to services based on analogue 
networks. 
-96 -
Article 3 
For the purposes of this Directive, 
1. • "persdrtal Data• means any information relating to an identified or identifiable 
individual ; 
2. '·telecommunications organization" means a public or private body, to which a 
Member State grants special or exclusive rights for the provision of a public 
telecommunications network and, where applicable, public telecommunications 
services; 
3. ··public telecommunications network" means the public telecommunications 
infrastructure which permits the conveyance of signals between defined network 
termination points by wire, by microwave, by optical means or by other 
electromagnetic means; 
4. "public telecommunications service" means a telecommunications service whose 
supply Member States have specifically entrusted inter alia to one or more 
telecommunications organizations. 
Article 4 
1. Collection, storage and processing of personal data by a telecommunications 
organization is justified for telecommunications purposes only, in particular in order 
to establish connections for the transmission of voice, data or image, to produce bills, 
. to comp~e directories, and for other legitimate operational purposes, for. example fault 
clearance, prevention of misuse of the telecommunications organization's equipment, 
or registration of incoming calls in accordance with Article 13( 1 ). 
2. The telecommunications organization shall not use such data to set up electronic 
profiles of the subscribers or classifications of individual subscribers by category. 
-97 -
ArticleS 
1. Personal data of the subscriber may be collected and stored to the extent necessary to 
condude, 'J)erforin, amendg._tenninate the CO'ltract with. the tetecam..nicat~a'lS organizatim. 
After termination of the contract the data are to be erased: unless and for so long as 
they are required to deal with complaints, to recover charges or to comply with other 
obligations imposed by the law of the Member State, in conformity with Community 
law. 
2. The contents of the information transmitted must not be stored by the 
telecommunications organization after the end of the transmission, except where 
required by obligations imposed by the law of the Member State, in conformity with 
Community law. 
Article6 
The subscriber is entitled 
to obtain at reasonable intetvals and without excessive delay or expense 
confirmation of whether personal data relating to him/her are stored as well as 
communication to him/her of sucb data in an intelligible form, 
to obtain, as the case may be, rectification or erasure of such data if theY have 
been processed.: in breach ot tl:le..provisia1S.Y1ich are intJC)Sed by the law ·of the 
Member State in conformity with Community law. 
-98-
Article 7 
1. In principle, all personal data processed in connection with telecommunication 
networks and services are to be kept confidential. 
2. The personal data may not be disclosed outside the services or the network of the 
telecommunications organization without specific. authorizati<l"l by law or tne . _ 
Slbscri'ber's prior calSent. A slbscrieer. shall be ha[d tcfhave given such 
"coosent mly where it is gi.ven by ·way of a specific response to a request 
by the telecommunications organization. Without the subscriber's prior consent, 
these personal data must not be disclosed t~ persons within the 
telecommunications organization who are not dealing with the relevant services 
provided. 
3. The telecommunications organization must not make the provision of its service 
dependent upon such consent. 
Article 8 
1. The telecommunications organization must provide adequate, state-of-the-art 
protection of personal data against unauthorized access and use. 
2. In case of particular risk of a breach of the security of the netw:>rk, for excirple in the fie 
nd>i le radio telephony, the telecai1i'U'licatiCJ:lS orgcni~tim nust infonn the stbscribers 
concerning such risk and offer them an end-to-end encryption service. 
-w-
Article 9 
1. Billing data containing the telephone number or identification of the subscriber 
station, the address of the subscriber and the type of station, the total number of units 
to be charged for the accounting period, the called telephone number, the type and 
duration of the ea Us made and/ or the data volume transmitted as well as other 
information needed for billing such as advance payment, payment by instalments, 
disconnection and reminders, may be stored and processed. 
2. Such a general storage of billing data is permissible up to the end of the statutory 
period during which the bill may be challenged. 
Article 10 
1. Traffic data containing the personal data necessary to establish calls, or required for 
billing or other operational purposes, such as the telephone number of the calling and 
of the called subscriber, the time each call started and finished and the 
telecommunications service used by the subscriber, may be collected, stored and 
processed as far as this is necessary to provide the telecommunications service 
required. 
2. The traffic data stored in the switching centres of the telecommunications 
organization must be erased after termination of the call unless the data are 
anonymised or are required for billing or other legitimate purposes in the meaning of 
Article 4. 
Article 11 
Upon application of the subscriber an itemized call statement may be produced, 
containing. among other items, the telephone numbers of the called subscribers 
without the last four digits. 
-100-
Article 12 
1. With regard to · communications between subscribers linked to digital exchanges, 
the calling subscriber must have the possibility to eliminate via a simple technical 
facility the identification of his/her telephone number on the display of the called 
subscribers' terminal equipment, or its recording in a storage facility of this terminal, 
on a case-by-case basis. 
The transmission of the telephone number may also be permanently eliminated by the 
telecommunications organization upon application of the calling subscriber. 
2. The called subscriber may apply for permanent elimination of the identification of all 
incoming calls; he/she must also be able to turn off the display of his/her terminal 
equipment, or to eldmitlate the recording in the terminal's storage facility, in order to 
prevent the identification of the incoming calls, on a case-by-case basis. 
The called subscriber must be able to limit the acceptance of incoming calls to those 
which identify the calling subscriber's number. 
3. With regard to ~ c ommun; cat; on s ·. between a subscriber linked to an analogue 
exchange and subscribers linked to digital exchanges, the former subscriber is to be 
informed the identification of his/her telephone number and to be offered 
the permanent elimination of the feature upon application. This subscriber must also 
have the possibility to eliminate the identification on a case-by-case basis. 
-101 -
Article 13 
1. For a limited period of time, the telecommunications organization may override the 
elimination of the calling line identification 
a) upon application of a subscriber requesting the tracing of malicious calls. In 
this case, the data containing the identification of the calling subscriber will be 
stored by the telecommunications organization and be made available upon 
request to the public authority charged with the prevention or pursuit of 
criminal offences of the Member State concerned; 
b) upon specific court order, in order to prevent or pursue serious criminal 
offences. 
2. A permanent override function must be made available upon request, 
a) to organizations recognized by a Member State whi eh answer and deal with 
emergency callii, and 
b) to fire brigades operated or recognized by a Member State. 
3. The telecommunications ~ganisations s~all take the necessary steps to ensure that 
the override function is operational on a national and Community-wide basis. 
Article 14 
1. Calls may be forwarded from the called subscriber to a third party only if this party 
has agreed; the third party may limit automatic forwarding to _those calls .tlich identif 
calling subscriber's number ; the third party must be informed via a specific signal of 
the message that the call has been forwarded. 
2. The calling subscriber must be informed automatically during the establishment of the 
-102 -
connection that the call is being forwarded to a third party. 
Article 15 
1. If the content of telephone calls is made accessible to third parties via technical 
devices, such as loudspeakers or other on-hook equipment, or stored on tape for own 
use or use by third parties, provision must be made in order that the parties concerned 
are informed via an appropriate procedure of such diffusion or storage before the 
diffusion or storage is initiated and for so long as the it continues. 
2. Paragraph 1 does not apply in the cases covered by Article 13( 1 ). 
Article 16 
1. The telecommunications organization must ensure that the telephone number as well 
as other personal data of the subscriber, in particular concerning the quantity and. nature 
of his/her orders when using a teleshopping service or concerning the information 
requested via a videotex service, is stor-ed mly to the extent strictly necessary to supply 
the service and is 01ly used _by tteservice provider for purposes authorized by this 
subscriber. 
2. Subject to the provisions of Article 20, the service provider may not set up electronic 
profiles of the subscribers or classifications of individ·~ subscribers by category, 
without their prior cmserlt. 
-103-
Article 17 
1. Subscribers who receive unsolicited calls for cd!ertising purposes or for the 
purpos_e of ·~ffering the supply or provision of goods and services may 
notify the telecommunications organization conveying such messages that they do not 
wish to receive these calls. 
2. The telecommunications organization must take the steps necessary to terminate the 
transmission of such messages to the subscribers concerned. Furthermore, the 
telecommunications organization must keep a list of the notifications in a form 
specified and available for inspection by the regulatory authority, in order to prevent 
such calls in future. 
Article 18 
1. In implementing the provisions of this Directive, Member States shall ensure, subject 
to paragraphs (2) and (3) of this Article, that no mandatory requirements for specific 
technical features are imposed on terminal or other telecommunications equipment 
which could impede the placing of equipment on the market and the free circulation 
of such equipment in and between Member States. 
2. Where provisions can only be implemented by requiring specific technical features, 
Member Stat~· shall inforin the Carmissiei'l according to the proced.Jres.provided for 
. by Council Directive 83/189/EEC:1 ° W"tich ·lays dow1 a proced.Jre "tor. the provisioo of 
information in the field of technical standards and regulations. 
10 . · OJ t«> L 109, 26.4.1983, p.8. 
r ' 't 
I 
·~ 
-104-
3. Where required, the Commission will ensure the· drawing LP of caTIYO"l Europea1 
standards for the implementation of specific technical features, in accordance with CCU'lCi l Di rec· 
five ••••• EEC _ -~ .. tpn the approximation of the laws of the Member States concerning 
telecommunications terminal equipment, including the mutual recognition of their 
conformi@11
1 and Council Decision 87/95 /EEC of 22nd December 1986 on 
standardisation in the field of information technology and telecommunications-1 ~ 
Article 19 
1. The provisions of this Directive relating to the telephone service shall be applied to 
other public digital telecommunications services to the extent that these services 
present similar risks for the privacy of the user. 
2. The measures necessary for the implementation of paragraph 1 -shall ~ aci::pted by the 
Commission after consultation of the ~rki~. party referred to in Arti'cte 22 cn::J in 
accordance with the procedure laid down in Article 23. 
Article 20 
To the extent that the full achievement of the objectives of this Directive requires the 
application of its provisions to service providers other than telecommunications 
organizations, the Commission may· adopt the measures necessary for the application 
of this Directive to those service providers after consultation of the ~~«>rking party 
referred to in Article 22 and in accordance with the prOcedure laid down in Article 23. 
~1 OJ t«l c. 
12 OJ tb L 36,_7.2.1987, p. 31. 
-105 -
Article 21 
The details of the application of this Directive and the modifications necessary to 
adapt this Directive to new technical developments shall be determined by the 
Commission in accoraance with the procedure laid down in Article 23. 
Article 22 
I. The working Party on the Protection of Personal Data established according to Article 27 
of Council Directive .... _ a pp r ox i mat i n g . certain laws, regulations and 
administrative provisions of the Member States concerning the protection of 
individuals in relation to the processing of personal data shall carry out the tasks laid dow1 
in .Article 28 of the above mentioned Directive also with regard to the data protection 
measures which are the suhject of this Directive. 
2. .The t,.Orking parcy will be specifically crnstituted for the purposes of this Directive. 
Article 23 
I. The procedure laid dcw1 in Article 30 of Ca..nci l Directive 
approximating certain laws. regulations and administrative provisions of the 
Member Stiltes concerning the protection of individuals in relation to the processing 
of personal data shall ~ly. 
2. The committee established in the framework of tret procedure will·be constituted 
specifically for the purposes of this Directive. 
-1~-
Article 24 
1. The Member States shall bring into force the laws, regulations, and administrative 
provisions necessary for them to comply with this Diective by 1 January 1993 at the 
latest. 
The provisions adopted pursuant to the first subparagraph shall make express 
reference to this Directive. 
2. The Member States shall communicate to the Commission the texts of the provisions 
of national law which they adopt in the field covered by this Directive. 
Article 2S 
This Directive is addressed to the Member States. 
Done at Brussels, For the Council 
-107 -
Flea FINANCIERE 
PROPOSIDON DE DJJt.!:CIIVE DU CONSEIL CONCERJCAXJ' L\ PROTECilON DES 
DOJ\"NEES .A CA:RACIERE PERSONN'EL ET DE lA 'YIE PltME IW8 LE CDNIEX:a: DES ltESEAUX DE 
"IELECC>MM1»t~CA.110NS t."UMERIQDa PUBUCS, Er EH PA.Rl'JCIJUER DV ltESEAU Nt7MEIUQVE A 
IN'l'EGRA'DON DE SEIMCES ( RNIS ) ET DJ:S U&AVX Mm1E1t1Q01S MOB1LIS PUBLICS. 
Eo 1990 : B 7700 
En 1.991 et uercices ultmeurs: BS-4010 
2. Base teple 
· Article 100 A 
3. Prpposjtion de daMffiqtion en dfpense ohligatoire /non qbliptoire 
DOD -obJiptoire 
4. Dmgjption et justification de !'action: 
~.1. Ohjectjfs:- assurer la protection des persoDDes 1f9J"d des dODD6es l CU"aL"tk"e 
personoel, 
.. permettre la citc:ulatioo tran.sfront:W~re ck dann&s a c::anc:te-e personnel 
daDs la Commonaat~ 
• pamettre le bon fondiormement du man:M Jat&ieur. 
-108 -
4.3. Un :-spr&entmt ~e b eo~.qon preside le arcupe de proteaion des donn&s l 
'caract~ ~..oc.e.d et le Co.z.it~ ~-: ... .-i!!tatif.;'...e sec;:ftarlts.t du goupe et du Comite de 
protcctimt des c:k .. -~.,&:s A euticte.re ~ilnel .~ ~ulJ:ti par 1':3 semees de la 
~~on. 
5.1. Na.ture : rc§unicm., 
(frais de partldpatfon des membres des 2 Cmnit& ) 
5.2. Ca1cnJ.: • Oroupe de protection des dotmees: (d. fiche 5.nandl!re de la directive 
g~n&'ale) 
24 t.l.~bres ( gouveme.menta.ux ) x 3 r~unlons x 2 jours x 390 ECU /jour = 
56.160 ECU • 
6.1. Ech!ancier de£ crUit.S d'~cgagement et de paiement 
CE-CP 
1~93 : 56.163 :ECU 
1994 : 56.160 .. 
1995 : 56.160 • 
1996 : S6.160 • 
1997:56.160-" 
6.2.. Part du financemcnt c:umnmnauuire daas le c.o!tt total: 100 9D 
-..... 
...... -109 -
7. Observations : 
1. Le groupe de protection des dona<!es A car.ta:~e personnel (Art. 22 ): 
D at mJtitu~ c:e groupe l cantctere amsuJr.!.ti:f et m~dant et est CO~ de 
repr&enta.nts de l'autorit~ de contrOle de tous les £tats membres, pr&id~ par un 
representant de Ja Commission. 
Ce groupe &bUt son r~ement int&i~ur. Le se.cnrariat du graupe es1 ..ur6 par les 
services de la Commission. 
Missions de ce p-oupe :voir An. 22 
2. Le Camit~ coDSUltadf ( Ait • 23 ) 
n est institu~ un Comft~ c:onsultatif compos~ des repr&ectants des Etats Membres, 
pr&id~ par le 1 ept &entant de la ~on. 
La Commission est assist~ par c:e Comltt! afin de prendre les brentueDes mesures 
co~l&Denta.ires nkessaires pour ac.apter les dispositions de Ja directive aux 
~cit& de c.erta.iDs sed.eurs. 
-110 -
R~tlon for a Counoll Declalon on the opening of 
negotlatiC)IW with a view tot'-acc•aelon of the European ~-unaties to 
the Council of EurOPe Convention for the protection of lncllvlduala with 
regard to the autout le prOC*aalng of "r80f'Mll data 
EX PLAN;\ TORY UEl«lRAM)W: 
1. The protection of Individuals with re.gard to the processing of 
personal data is both an Individual rlg~t and a necessary 
precondition for the development of lnt~rnatlonal trade. 
2. The orocasalr.g of personal dat• la Indispensable for International 
trade In goods and servlca• and for eloeer collabOration between 
countries. 
3. The Commission ha$ forwarded to the COUne!i a propOsal for a 
Dlrecttva on prcvl~lng Jndlv!duals througncut the Community with a 
high 'evftl of protection -~th reQ~rd to the processing of personal 
data. This action should be supplemented by Initiatives designed to 
guarante• Individuals an eQuivalent level of protection with regard 
to th~ $•change of data between the Commanity and non-member 
c®ntrtes" 
... A ccnver~tion for the protaeth'n of Individuals with regard to 
automatic proc$aalng of personal data was concluded in the Council 
of Euroue in 1se1. The purpos~ cf tno Convention ts to secure In 
the territory of each Party for every Individual, whatever his 
nattonailty or restdenee~ respect for his r!ghta and fundamental 
fre~d~~s, and ~n p~rt~cular h~~ rlght tQ pr5vacy, with regard to 
automatl~ processing of personal data re!•ting to him. This 
Convention a~so lays down that a Party shall not, for the sole 
purpose of 'th$ prnt~ct I c:.n of pr 1 va.ey ~ or oh I b 1 t or subJect to 
special zuthorlsat!on tranaborder flows of personal data going to 
the territory of another Party. 
5. tn tts Recommendation of 2G JuJy 1981, the Commission Invited 
Member States of the ~nlty to ratifY the Council of Europe 
Convention for th• protection of Individuals with regard to 
automatic procesal~g of personal data. Thla Recom.endatlon also 
specifies that ''all tho Member States do not sign and ratify the 
Convention within a reasonable tt~. the eom.taalon reserves the 
right to propose that the Councl• adopt an Instrument on the basis 
· of the EEC Treaty. 
8. Thla Convention haa not yet boen ratified by ail Member States of 
the Communlty1. lt Is necessary and desirable for the Community to 
acceed to this Convention In order to ensure the protection of 
personal data and the transborder exchange·of such data with non­
member countr~as, and.to make the Convention more attractive to 
non-member countries wlahlng to exchange data as freely as possible 
with the Community. 
1. The Convention (STE 108 of 28 January 1981) has been signed by the 
following Member States: Belgium, Greece, Ireland, Italy, the 
Netherlands and Portugal. lt haa been ratlfled by Denmark, France. 
the Federal Republic of Ger•any, Luxembourg, Spain and the United 
Klngdoll. 
-'ii1 -
7. f t ' s t :.us pr o~ef!d that the Comlll e•l on r ~cr,..~nd the Coune 1 ; to 
authorlz! the Commission to negotiate with tho Council of Europe 
and the States th~t are oarty to the Co~ventton for the prot~ct~on 
of lndtvtduals with regard to autom•tle processing of p~rsonal data 
an additional protocol th1t will enabl• th• Eurooesn ~nttlee to 
b~e~~ p~rty to thla convention for the·fl~lda for whleh they are 
renponslbie. 
a. 4he t.~laslon will condUct these n~gotlatl~~• In eon$u~tatlon with 
the representatives of the Member States, in accordance with the 
~'recttves annexed to this COmmunication or of auch aa may be 
forwarded to lt by the COUncil. 
9. The Uem.b•r States of th• Community, all of which are Members of the 
Council of Europe, will fully suppOrt CoMMunity action during the 
nftgotlatlona for the acceaAion of the Eurooe•n Community whenever 
thh.l aueatlon ,_rH!on within the Counci-l cf Europe. 
Annex: Negotiating directives 
/ -112 -
NEGOTIATINQ DIRECTIVES 
1. The purpose of the negotiations la to conclude an additional 
protocol to allow the CoMmunity to become a contracting party to 
the Convention for the fields for which lt la responsible. The 
following principles shall be respected: 
2. The European Community shall be repre .. nted within the Consultative 
eom.lttee set up under Article 18 of the Convention by the 
CO..Iaalon of the European COmmunltlea. 
After the eom.taalon haa arranged coordination at Community level, 
the representative of the European Community shall be given a 
number of votes equal to the total nu.ber of votea held by the 
national delegation• of the w..ber Statea of the CoMMunity that are 
party to the Convention In all queatlona relating to the processing 
of personal data In the flelda which are the reaponalblllty of the 
COmmunity. 
In all other questions, each national delegation shall have one 
vote. 
3. In order to ensure that the additional protocol allowing the 
CommUnity to become a contracting party to the Convention enters 
Into force within a reasonable tl .. , the CO..Iaalon, supported by 
the Member Statea, will propose that an opting out procedure for 
Ita adoption be Included In the text of the protocol. 
/ 
) 
; i 
! 
-113 -
PROPOSAL FOR A COUNCIL DECISION 
IN THE FIELD OF 
Information Security 
Executive Summary 
Information under its various forms increasingly contributes to individual, corporate and 
national wealth. The growth and performance of an estimated 2/3 of the economy relies on 
manufacturing or services heavily dependent on information technology, telecommunications 
and broadcasting, and therefore depends critically on the accuracy, security and 
"trustworthiness" of information. This is of as great importance and interest for individuals as 
for commerce, industry and public administrations. Correspondingly, the protection of 
information in all its aspects, here referred to as Information Securityl, has become a central 
policy issue and a major concern world-wide. 
Major changes have occurred during the last decades. but those ahead may be even greater. 
Desk-top supercomputers, Satellite Direct Broadcasting. Digital Mobile Radio, Integrated 
Broadband Communications and other new applications of technologies are under development 
and will provide the means for low-cost, mobile, high performance communication world-wide 
on an unprecedented scale. The advent of efficient global communication has placed greater 
emphasis on the need to provide adequate "protection" over levels of service availability, 
message integrity and privacy commensurate with the expected level of administrative or 
technical threat. 
The subject is of great importance for socio-economic development of the EuropeaJt 
Community and the completion of the Internal Market in 1992. A consistent approach at 
European level should create at the same time an increasing feeling of confidence vis-a-vis 
the use of new information technology and telecommunication services and help to avoid the 
formation of new barriers between the individual Member States and with other countries. 
Therefore, there is an urgent need to address requirements and options for action at 
Community level in close collaboration with sector actors and Member States. Any action must 
take into account both national and international commercial, legal and technical 
developments. Because Information Security is involved in the protection not just of property 
and people. but also of society itself, Member States regard it as a topic which touches upon 
national sovereignty. 
At the same time. for the Community and its Member States. it is vital that Information 
Security does not become a constraint to the promotion of harmonious development in the 
Community and to relations with other countries. As such, development of a harmonised 
approach to information security must form an integral part of the Community policies related 
to the strengthening of the European Community socio-economic performances. international 
competitiveness and the completion of the internal market. 
The key issue is to provide effective and practical security for. information held in an 
electronic form to the general users. administrations and the business community without 
compromising the interests of the public at large. 
1> Information Sec:urfty (IS) is concerned with the protection of infonnation stored, processed or 
trans.itted in electronic fona, against deliberate and accidental threats. Electronic Information 
services need a secure telec:OimU'Iication infrastructure, secure ten~inals (including processors and 
data bases) as well as secure usage. 
-115-
Action at Community level will need to involve concerted efforts in establishing the required 
technology, standards, verification and certification procedures and regulations (where 
required) in the framework of the Community policy making. 
The intention of the Commission is to encourage a debate with the sector actors in the 
Community on Information Security issues and to develop a consensus on the appropriate steps · 
to be considered. This debate could be initiated on the basis of the statement of issues and 
lines of action identified in the annex to this note. In this debate. and in view of the 
responsibilities of Member States in this domain. it is of crucial importance that the 
Community initiative can rely on a close collaboration with senior officials of Member States. 
It is therefore proposed that the Commission shall be assisted by a committee of an advisory 
nature, composed of representatives of the Member States and chaired by the representative of 
the Commission. The working of this committee has to reflect the specificities of the domain. 
This committee would be called the Senior Officials Group on Information Security (SOG­
IS). 
The most important issue of protection of personal data is dealt with in a proposal of 
Directive which is sent in parallel with the present communication. 
't\ ? 
-116-
A~ New ~halltn~~~-~n!l_tb.e~S~tclt!Js.u~ns_l~mk~J\.I!.U_Q)lti~al Imn~.u! 
lg..(QD.tt~tion 5ft!!rity 
I. The management and use of information supported by Information Technology and 
Informatics Services in all spheres of economic, social and political life is pervasive. It 
has permitted the integration of activities via a global communications system, 
connecting manufar.turing plants, research establishments, data bases .. computer centres, 
service provid~rs as well a.s centres of political and economic decision-taking. 
2. This increa~ed integration of separate activitie., generates very considerable value-added 
in terms of saving~ or increasing efficiency. It is therefore a key-factor in international 
competitiveness. However, it also increases the need to protect the justifiable interests 
of the individuals, the general public, commerce, industry, operators, services providers 
and national administrations. 
3. For the service sector to grow, and with it investments in electronic equipment, 
telecommunications, hroadc3sting, computer and terminal equipment and a wide range 
of telematics applications to take place, a secure European Electronic Information 
Environment must be offered. Widespread acceptance and approval by all parties is 
important to safeguard legitimate interests and to prevent misuse and abuse of 
informatiort. This must be achieved in a way which is both efficient yet adequate for 
users under various legal systems. In addition, information security systems must protect 
privacy, inte1lectual property, fair competition, national security and other interests. 
4. With the introduction of microcomputers, the use of Information Technology, 
Telecommunications and Broadcasting has grown beyond the professional domain and 
has become a "'consumer activity" with associated "consumer services". Along with this 
quantitative change, a very significant qualitative change has occurred: 
telecommunications now permits interworking and communication on a global scale. 
5. Major chan~es have occurred during the last decades, but those ahead may be even 
greater.·-. Desk-top supercomputers, Satellite Direct Broadcasting, Digital Mobile Radio, 
Integrated Broadband Communications and other new applications of technologies are 
under development and will provide the means for low-cost, mobile, high performance 
communication world-wide on an unprecedented scale. 
6. The advent of efficient global communication represents a qualitatively and 
quantitatively new challenge for the need to provide adequate "protection" over levels of 
service availability, message integrity and privacy, commensurate with the expected level 
of administrative or technical threat. 
7. The growing willingness of industry, government and society as a whole to use 
information services has resulted in them becoming an integral part to the basic fabric 
of every day life. Command, Communication and Control in general, Process Control in 
manufacturing, Transportation, Financial Services, Automated Office systems, etc all 
require levels of availability and operational robustness not fully understood in the 
original service or component design. 
8. New applications will be defined and implemented that may not be achieved within the 
present architectural frameworks. A fundamental re-definition of architecture and 
performance standards (including the needs to assure conformance) relating to services 
and underlying components may be necessary. 
-117 -
9. New disciplines and supporting organisations/occupations will need to be created to 
achieve these higher levels of operational expectations. The major needs will, however, 
be driven by cultural not technical changes. The global exploitation of information 
services supported by comprehensive telecommunications networks will change the 
perception in society of organisational/human relationships. ' 
10. Increasingly communication will either be through intermediaries, as in various levels of 
added-value services supported by IT, or will take place directly after intermediaries 
have approved the contact. In such situations trust will need to be explicitly defined in 
the context of organisational relationships, authorities/privileges and many 
service/product 'quality controls'. Care must be taken in such a society that the rights 
of individuals and organisations are fully reflected in legislation and regulatory controls. 
In parallel, technologies must be conceived and implemented in a way which meets 
security demands. 
B. The need for an action at Communitx level in collaboration with Member States 
11. With the protection of property, the person, and even society at stake, it is obvious that 
information security is an area of major responsibility for the Member States. Both for 
defense and the normal functioning of its institutions, each Member State is directly 
concerned with security. These national concerns of governments have led, historically, 
to a strong long-standing competence in information security, and the exercise of 
control over its technology and techniques to prevent the diffusion of sensitive aspects. 
Although each user must be responsible for choosing his own security, his choices rely 
essentially on guarantees which, in the final analysis, come from public authorities, 
through, for example the legal limits they fix. 
12. EEC policies and programmes for the development of the Information and 
Telecommunication Industries and for the achievement of the Internal Market, may be 
seriously impeded unless an active policy is adopted on the initiation, development and 
promotion of Information Service Security Standards. For the Community, it is vital 
that Information Security does not become a constraint to the promotion of harmonious 
development within the Community and to relations with other countries. As such, 
development of a harmonised approach to information security must form an integral 
part of the Community policies related to the strengthening of the European industry 
socio-economic performance and international competitiveness, and to the completion of 
the Internal Market. 
13. More specifically, it must involve concerted efforts in establishing the required 
standards~ verification· and certification procedures, technological developments and 
regulations (where required) in the framework of the Community policy· making. 
Because of the highly technical nature of the underlying issues, concertation of efforts 
implies collaboration of actors at the pre-competitive stage of R&D 
14. "Open Standards" adoption by Governments (US/UK GOSIP), by· the western Defense 
community (NA TO/NOSI), by the computer and telecommunications industry as well as 
network operators (ISO OSI standards) has resulted in greater emphasis on security issues 
in information systems, architectures, standards, communications protocols and 
component techniques. 
-118 -
I 5. Only an estimated 2% of the services which will be available in the Community by the 
year 2000 are available today. By then services will typically be able to respond to user 
needs and offer a range of integrated features combining voice, data and image in a 
flexible manner. The realisation of user requirements for information security such as 
data protection, privacy, authentication, authorisation, billing, etc. will correspondingly 
be much more difficult to assure. It is for this reason that Information Security and the 
related technical features such as integrity need to be systematically developed and 
investigated. US Authorities are funding programmes on Trusted Computer Systems, 
Open Systems Architectures, protocols and techniques that will accelerate the use of 
proprietary security solutions in the international user community. It must be a primary 
concern for Member States to be an equal partner in addressing standardisation in this 
domain. Following a de facto standardisation would risk creating new technological 
dependencies which may seriously impede the international competitiveness of 
Community's economies. This implies that the corresponding efforts are made in the 
Community as a prerequisite for a constructive interaction with countries outside the 
Community, mainly the US. 
16. To sum it up, because of their respective responsibilities, both the Community and its 
Member States have a strong interest in the key questions: 
How will effective specifications and standards for information security be defined 
and promulgated? 
How will the formal evaluation and certification that products and systems conform 
to the security standards (both functionally and in giving assurance) be 
implemented? 
How will security products and systems be implemented, provided and used? 
17. Information security is a typical example of a policy where the principle of subsidiarity 
may be applied, in view of the inherent complexity of the subject, the involvement of 
numerous actors and the necessity to deploy a range of policy tools. An action plan is 
essential telling what should be done, by whom and how. On the one hand, the Member 
States have to handle these questions; on the other hand, the Community has a strong 
interest in working out terms ensuring the compatibility between on one side the 
completion of the Internal Market, the achievement of the Citizens' Europe, the 
implementation of a telecommunications policy and the competitivity of the European 
community electronics and electronic information services industries, and on the other 
side the response to the basic requirements of the individuals and the business for 
information security. · Therefore, and in order to focus the effort, various types of 
·actions and a procedural structure are proposed below as a basis for further in-depth 
studies leading to measures to be taken at the appropriate level. 
-119 -
Proposal for a 
COUNCIL DECISION 
IN THE FIELD OF 
INFORHADON SECURITY 
THE COUNCIL OF THE EUROPEAN COMMUNITIES 
Having regard to the Treaty establishing the European Economic Community, and in 
particular Article 23S thereof, 
Having regard to the proposal from the Commission,( I) 
Having regard to opinion of the European Parliament,(2) 
Having regard to the opinion of the Economic and Social Committee,(3) 
Whereas the Community has as its task, by establishing a common market and progressively 
approximating the economic policies of the Member States, to promote throughout the 
Community a harmonious development of economic activity, a continued and balanced 
expansion, increased stability, accelerated raising of the standard of living, and closer 
relations of the States belonging to it; 
Whereas there information stored, processed and transmitted electronically plays an 
increasingly important role in so c ~ at I and economic activities; 
Whereas the advent of efficient global communication and the pervasive use of electronic 
handling of information emphasises the need for adequate protection; 
Whereas the European Parliament has repeatedly stressed the importance of information 
security in its deliberations and decisions; 
(1) OJ No C ••• 
(2) OJ No C .. . 
(3) OJ No C .. . 
-120 -
Whereas the Economic and Social Committee has emphasised the need to address information 
security related issues in Community actions, particularly in view of the impact of the 
completion of the internal market; 
Whereas it is necessary to develop a global strategy for information security in order to 
ensure the security of the user on the Community level and avoid the creation of new 
technical obstacles to communication; 
Whereas the inherent complexity of information security issues calls for subsidiarity, 
the active involvement of several sectors and :the conce~ted us~ of several policies; 
Whereas actions on national, international and Community level provide a good basis; 
Whereas there is a close link between telecarm..nicati·~- sta-dirdisatim, infonnatim 
market and RD&T policies and the work already undertaken in these domains by the 
European Community; 
Whereas it is appropriate to assure the concertation of efforts, by building m existing natimal 
and international work and by promoting the cooperation of the principal protagOnists· ealCemed; 
whereas it is therefore appropriate to proceed within the framework of a coherent ·acticn plan; 
Whereas the responsibility of the Member States in this domain implies a concerted approach 
based on a close collaboration with senior officials of the Member States. 
HAS DECIDED AS FOLLOWS: 
Article 1 
l. An action plan in the field of information security (INFOSEC) is adopted for a period 
of 24 months starting on [ ]. 
2. The action plan is designed to develop a global strategy providing the users of 
electronically stored, processed or transmitted information with protection of 
information systems against accidental or deliberate threats. 
3. The action will take into account and s&pport the evolving European and world-wide 
standardisation activities in the field. 
·~ 
' 
-121 -
Article 2 
The action plan, the details of which are set out in the Annex hereto shall compris 
the following lines of action: 
I. development of an information security strategy framework; 
11. analysis of inf~rmation security requirements; 
Ill. solutions for immediate and interim needs; 
IV. specifications, standardisation and verification of information security; 
V. integration of tec~logical and operational developments for infonmation security within a 
general strategy; 
VI. integration of certain security functions in infonmation systems. 
Article 3 
The action plan shall be irrplemented _by thl:! Commission in collaboration with the 
organisations and enterprises concerned and in close association with the Member States. 
Article 4 
The amount attributed to this action shall be detennined in the ~rse of the arn.Jal bujgetary 
P'rocedure. 
Article S 
. The Commission shall serd to. the-Eurqlean Parl ianent ard the Council a report on the 
results of the action within three months of its completion. 
Article 6 
For the implementation of the action plan, the Commission shaU consult, as necessary, a 
Senior Officials Group on Information Security (SOGIS>. This group shall consist of\ tw 
representatives of each Member State and of the Commission. A CcirmissiO, representative 
shall be in the chair~ 
(' , 
.J 
-122 -
The members of the Group may be assisted by experts or advisers depending on the 
, nature of the issues under consideration. 
The proceedings of the Group shall be confidentiaL The Group shall adopt its own ruies 
of procedure. The secretariat shall be provided by the Commission. 
Done at Brussels, For the Council 
-123 -
ANNEX 
Summary of Action Lines 
1. Action Line I -Develovment of an Information Security Strategy Framework 
1.1 Issue 
1. Information security is recognised as a pervasive quality necessary in modern society. 
Electronic Information services need a secure telecommunication infrastructure, secure 
terminals (including processors and data bases) as well as secure usage. An overall 
strategy, considering all aspects of information security, needs to be established, 
avoiding a fragmented approach. Any strategy for the security of information processed 
in an electronic form must reflect the wish of any society to operate effectively yet 
protect itself in a rapidly changing world. 
1.2 Objective 
2. A strategically oriented framework has to be established to reconcile social, economic 
and political objectives with technical, operational and legislative options. The sensitive 
balance between different concerns, objectives and constraints has to be found by sector 
actors working together in the development of a common perception and agreed strategy. 
These are the prerequisites for reconciling interests and needs both in policy making and 
in industrial developments. 
1.3 Status and trends 
3. The situation is characterized by growing awareness of the need to act. However, in the 
absence of an initiative to concert the efforts it seems very likely that dispersed efforts 
in · various sectors will be taken which create de facto a situation which will be 
contradictory, creating progressively more serious legal, social and economic problems. 
1.4 Requirements. oPtions and Priorities 
4. Such a shared framework would need to address and situate tisk analysis and risk 
management concerning the vulnerabilities of information and related services, the 
alignment of laws and regulations associated with computer/telecommunications abuse 
and misuse, administrative infrastructures including Security Poli"cies and how these may 
be effectively implemented by various industries/disciplines, and social and privacy 
. concerns (eg the application of identification, authentication and possibly authorization 
schemes in a democratic environment). 
5. Clear guidance is to be provided for the development of physical and logical 
architectures for secure distributed information services, standards, guide-lines and 
definitions for assured security products and services, pilots and prototypes to establish 
the viability of various administrative structures, architectures and standards related to 
the needs of specific sectors. 
-124 -
6. Security Awareness must be created in order to influence the attitude of the users 
towards an increased concern about security in IT and telecommunication systems. 
2. Action Line 11 -Information Security Requirements 
2.1 Issue 
7. Information security is the inherent pre-requisite for the protection of privacy, 
intellectual property, commercial confidentiality and national security. This leads 
inevitably to a difficult balance and sometimes choices, between a commitment to free 
trade and a commitment to securing privacy and intellectual property. These choices 
and compromises need to be based on a full appreciation of requirements and the impact 
of possible information security options to respond to them. 
8. User requirements imply information security functionalities interdependent with 
technological, operational and regulatory aspects. Therefore~ a systematic investigation of 
information security requirements forms an essential part of the development· of 
appropriate and effective measures. 
2.2 Objective 
9. Establishing the nature and characteristics of user requirements and their relation to 
information security measures. 
2.3 Status and Trends 
10. Up to now, no concerted effort has been undertaken to identify the rapidly evolving 
and changing requirements of the major actors for Information Security. EC Member 
States have identified the requirements for harmonisation of national activities 
(especially of the "IT security criteria"). Uniform evaluation criteria and rules for mutual 
recognition of evaluation resuits/certifica~es are of major importance. 
2.4 Requirements. oPtions and Priorities 
11. As a basis for a consistent and transparent treatment of the justified needs of the sector 
· actors it is considered necessary to develop an agreed classification of user requirements 
and its relation to information security provision. 
12. It is. also considered important to identify requirements for legislation, regulations and 
codes of practice in the light of an assessment of trends in service characteristics and 
technology, to identify alternative strategies for meeting the objectives by 
administ~ative, service, operational and technical prQvisions, and to assess the 
effectiveness, user-friendliness and costs of alternative information security option and 
strategies for users, service providers and operators. 
-125 -
3. Action Line Ill -Solutions for Immediate and Interim Needs 
3.1 Issue 
13. At present it is possible to protect adequately computers from unauthorised access from 
the outside world by "isolation" ie by applying conventional organisational and physical 
measures. This applies also to electronic communications within a closed user group 
operating on a dedicated network. The situation is very different if the information is 
shared between user groups or exchanged via a public, or generally accessible, network. 
Neither the technology, terminals and services nor the related standards and procedures 
are generally available to provide comparable information security in these cases. 
3.2 Objective 
14. The objective has to be to provide, at short notice, solutions which can respond to the 
most urgent needs of users. These should be conceived as open towards future 
requirements and solutions. 
3.3 Status and trends 
15. Some user groups have developed techniques and procedures for their specific use 
responding, in particular, to the need for authentication, integrity, and non-repudiation. 
In general magnetic cards or smart cards are being used. Some are using more or less 
sophisticated cryptographic techniques. Often this implied the definition of user-group 
specific "authorities". However, it is difficult to generalise these techniques and methods 
to meet the needs of an open environment. 
16. ISO is working on OSI information security (ISO DIS 7498-2) and CCITI in the context 
of X400. It is also possible to insert information security segments into the messages. 
Authentication, integrity and non-repudiation are being addressed as part of the 
messages (EDIF ACT) as well as part of the X400 MHS. 
17. Presently, the EDI legal framework is still at the stage of conception. The International 
Chamber of Commerce has published uniform rules of conduct for the exchange of 
commercial data via telecommunications networks. 
18. Several countries (eg FRG, France, the UK and US) have developed or are developing 
criteria to evaluate the trustworthiness of IT and telecommunication products and 
systems and the corresponding procedures for conducting evaluations. These criteria 
have been coordinated with the national manufacturers and will lead to an increasing 
number of trusted products and systems starting with simple products. The 
establishment of national organisations who will conduct evaluations and offer 
certificates will support this trend. 
19. Confidentiality provision is considered by most users as less immediately important. In 
the future, however, this situation is likely to change as advanced communication 
services and in particular mobile services will have become all pervasive. 
3.4 Requirements. options and priorities 
20. It is essential to develop as soon as possible the procedures, standards, products, and 
tools suited to assure information security on public communications networks. A high 
priority should be given to authentication, integrity and non-repudiation Pilot projects 
should be carried out to establish the validity of the proposed solutions. Solutions to 
priority needs on EDI are looked at in the TEDIS programme within the more general 
content of this action plan. 
-126 -
4. Action Line IV -Snecification. standardisation and Verification for Information Security 
4.1 Issue 
21. Information security requirements are pervasive and as such common specifications and 
standards are crucial. The absence of agreed standards and specifications may present a 
major barrier to the advance of information-based processes and services throughout the 
economy and society. Actions are required to accelerate the development and use of 
technology and standards in several related communication and computer network areas 
that are of critical importance to users, industry and administrations. 
4.2 Objective 
22. Efforts are required to provide a means of supporting and performing specific functions 
in the general areas of OSI, ONP, ISDN/IBC, network management and network security 
for unclassified, but sensitive, information. Inherently related to standardisation and 
specification are the techniques and approaches required for verification. 
4.3 Status and trends 
23. The US, in particular, have taken major initiatives to address information security in the 
non-defence domain. In Europe the subject is treated in the context of IT and 
Telecommunications standardisation in the context of ETSI and CEN/CENELEC in 
preparation of CCIIT and ISO work in the domain. 
24. In view of growing concern, the work in the US is rapidly intensifying and both 
vendors and service provider are increasing their efforts in this domain. In Europe, 
France, the Federal Republic of Germany and the United Kingdom have independently 
started similar activities but a common effort corresponding to the US is only evolving 
slowly. 
4.4 Requirements. options and priorities 
25. In information security there is inherently a very close relationship between regulatory, 
operational, administrative-and technical aspects. Regulations need to be reflected in 
standards and information security provisions need to comply in a verifiable manner to 
the standards and regulations. In several aspects regulations require specifications which 
go beyond the conventional scope of standardisation, ie include codes of practice. 
Requirements for standards and codes of practice are present in all areas of Information 
Security, and a distinction has to be made between the protection requirements which 
correspond to the security objectives and some of the tech~ical requirements which can 
be entrusted to the competent European standard bodies (CEN/CENELEC/ETSI). 
26. Specifications and standards must cover the subjects of. Information Security Services 
(personal and enterprise authentication, non-repudiation protocols, legally acceptable 
electronic proof, authorisation control), Communication Services (image communication 
privacy, mobile communications voice and data privacy, data and image data-base 
protection, integrated services security), Communication and Security Management 
(public/private key system for open network operation, network management protection, 
service provider protection) and Certification (information security assurance criteria 
and levels, security assurance procedures). 
-127 -
5. Action Line V -Technological and Ooerational Develooments for Information Security 
5.1 Issue 
27. Systematic investigation and development of the technology to permit economically 
viable and operationally satisfactory solutions to a range of present and future 
information security requirements is a prerequisite to the development of the services 
market and the competitiveness of the European economy as a whole. 
28. Any technological developments in information systems security will have to include 
both the aspects of computer security and security of communications as most present­
day systems are distributed systems, and access to such systems is through 
communications services. 
5.2 Objective 
29. Systematic investigation and development of the technology to permit economically 
viable and operationally satisfactory solutions to a range of present and future 
information security requirements. 
5.3 Requirements. options and Priorities 
30. Work on information security would need to address development and implementation 
strategies, technologies, and integration and verification. 
31. The strategic R&D work would have to cover conceptual models for secure systems 
(secure against compromise), functional requirements models, risk models, and 
architectures for security. 
32. The technology orientated R&D work would have to include user and message 
authentication (eg. through voice analysis and electronic signatures), technical interfaces 
and protocols for encryption, access control mechanisms, and implementation methods 
for provable secure systems. 
33. Verification and validation of technical system security and its applicability would be 
investigated through integration and verification projects.; 
34. In addition to the consolidation and development of security technology, a number of 
accqmpanying measures are required concerned with the creation, maintenance and 
consistent application of standards, and the validation and certification of IT and 
telecommunication products with respect to their security properties, including validation 
and certification of methods to design and implement systems. · 
35. The 3rd RDT Community Framework Programme might be used to foster cooperative 
projects at precompetitive and prenormative levels. 
-128 -
6. Action Line VI -Information Security Pro¥isions 
6.1 Issue 
36. Depending on the exact nature of the Information security features required functions 
will need to be incorporated at different parts of the communication systems including 
terminals/computers, services, network management to cryptographic devices, smart 
cards, public and private keys etc. Some of these can be expected to be embedded in 
the hardware or software provided by vendors while others may be part of distributed 
systems (eg network management), in the possession of the individual user (eg smart 
cards) or provided from a specialised organisation (eg public/private keys). 
37. Most of the information security products and services can be expected to be provided 
by vendors, service providers or operators. For specific functions, eg the provision of 
public/private keys, auditing, authorisation there may be the need to identify and 
mandate appropriate organisations. 
38. The same applies for certification, evaluation and verification of quality of service 
which are functions which need to be addressed by organisations independent of the 
interestS of vendors, services providers or operators. These organisations could be 
private, governmental, or licensed by government to perform delegated functions. 
6.2 Ob iective 
39. In order to facilitate a harmonious development of the provision of information security 
in the Community for the protection of the public and of business interests it will be 
necessary to develop a consistent approach as to the provision of information security. 
Where independent organisations will have to be mandated, their functions and 
conditions will need to be defined and agreed and where required embedded into the 
regulatory framework. The objective would be to come to a clearly defined and agreed 
sharing of responsibilities between the different actors on a Community level as a pre­
requisite for mutual recognition. 
6.3 Status and trends 
40. At present information security provision is well organised only for specific areas and 
limited to addressing the specific needs. The organisation on a European level is mostly 
informal and mutual recognition of verification and certification is not yet established 
outside closed groups. With the growing importance of information security the need 
for defining a consistent approach to information security provision in Europe and 
internationally is becoming urgent. 
6.4 Reauirements. options and oriorities 
41. Because of the number of different actors concerned and the close relations to 
regulatory and legislative questions it is particularly .important to pre-agree on the 
principles which should govern the provision of information security. 
In developing a consistent approach to this question one will need to address the aspects 
of identification and specification of functions requiring, by their very nature, the 
availability of some independent organisation, (or interworking organisations). This 
could include functions such as the administration of a public/private key system; 
-129 -
In addition, it is required to identify and specify, at an early stage, the functions which 
in the public interest need to be entrusted to independent organisation (or interworking 
organisations). This could, for example include auditing, quality assurance, verification, 
certification and similar functions; 
-130 -
FINANCIAL ST A TEMEJ\1 
Wormatioa SKvrlty (lNFOSEC) 
Preparatory Action 
BUDGET BEADING 
Subsection B6, Item 1104 
l. LEGAL BASE AND PROPOSED CLASSIFICATION 
Article [235] 
Non compulsory expenditure. 
~. DESCRIPTION 
CollaboratioD in the development or proposals I.Dd 8C'lions relatiq to ia!ormation 
seeuricy u tu as they require or signif'iC2.Dtly benefit from a concened approach 
at Commuzdty level. The focus or the work ls 10 relate 10 lbe Deed.s or the 
general public, commerce, servi;e providers and adm.inistrations aDd ac1<1re.sses the 
requirements for a collaborating approach to teelmoloclcaJ research, 
Stllldardlsation and related issues as relevant for the development or a consistent 
European approach to ic!orm.ation se:urity with particular nf'erence to the 
completion or the internal market in 1992. 
ne aoal of the INFOSEC action is to m.t.ke a major CODtri~uticm 10 the obje~ve 
of the 
•de-.elop."Mtfl of tZclions to prt1Yidin1 ~//,cri•~ 11111 pi'Gt:dclll seavlry for 
in/ormmz·un Mid in tm elecrro'lic form to w ReMTIM suers. llllmlnistrtlllons tJJtd 
business COI'I'IInll1llr.v willwul compromlsln: tM lllle1'al of the publit Al ltu,r.• 
The present proposal is the result or the preliminary illvestiptions by experts, 
CODSultaticms &Dei OD•&OiD& related work. . 
The lcope o( the preparatory actiOD is to foca.s OD 
L development or IJ1 iDtormatioD secw:ity .... y £J'I.ID&work 
D. mformation security requir~ments 
m. 10lutions for immtd.iare &Dd interim aeeds 
IV. specific:::n.ioas, studard.isatioc ud veriiadoA or mtonutioc security 
V. leC.Uoloaical aod operatioG3l develol)mUD lor Wormatioc security 
VI. mtormation security provision. 
.,. 4. -131 -
JlJSTifiCADON 
~velOI'!nen.t or a harmonised appr'lach to lnrormation security must form an 
integrt\J part or t~e CommunitY policies related to the completion of the Jntemal 
Marke~ stttnathen.i.n& of sociO-$COnomic performance and irnematior~ 
competitivtme$$. It is vital that Intormation Security does DOt become a 
constraint to the promotion of harmcnious c:1evelopmeat in tha Community and to 
reladous with other countries. I1\ add.ition, information s~urley sysurms must 
J)rotect privacy, intellectual propeey, ra.ir competition, national secaz:ky :.:;1 
other ictJ!Te'i!!. 
Thr pr~posod ac:;o.a resi)Vnds to an urgeat uted to f'acilimte 1.11d acee~ ·:.:.~ 
emeratcce or aentTally accepted, eff'oc:tive and practicable meaans : .. 
information socarlry. ne action wm becef"it from synerz,!es with la-l'i~.i 
proil"U!UllC$ in the field of inf'ormation technolopes (ESPRIT) i:ad 
telecommanlc:atlons (ltACE) as well as the on-goio& work on telecommDDic:uioos, 
sta.ndardisation and informa.tiou market pollcies. 
:.. ~'DICATIVE FINANCIAL PLANNING 
... · ~ lmplicarloru for expenditure. 
5.0 .0 Total cost 0\o-et the whole of the expected duration ot 2 years (in MioECL~ 
From t!le Dudget ':1! the Communjtles: 12.0 
From the other sec:tots at the natiow level: O.t} 
~ ~. J Mu!ti-•uuuw schedule (~ MioEC'U): 
1~9! Commitment 
.A ,_,,~,mtioDS 
12 TOTAL 12.0 
Payment · 
.A .. ,prc::riations 
6 
2 
12 
Th.is e:cpud.it&Je ~o .. -m the Com.mu.a.iry•s ~~ c.o~t:ib~:.Zc:1 to ~ytiQJ· __ , ..... ___ : __ ... ·----~rt .... s ~ev•loP'.'I'ft•!lt or ol!".tl!t"";r.l,. at:..: ....... -.. c ":h't ~ ..... _ ..,.. ..... _., .... -.... ...... _ _, ~ .... =-',......, l..alw ... ~ ..,....-. .,.,.., ... .., .... ,._..,.,. ~-,._.., -. 
!':On.sulta.d~n &.:.d er..a~U.til.&ceat ot eo?:Uensus. 
-132 -
• 
Given the fact that the action is iJ.D3..Deed in Sab~ctioo 6 of tbe budget devot~d 
to Researc:h and Investment expencUture, administrative costs (Committee a.cd 
worki.Dg party meetings, coosaltation of exPerts. m.Sions, document 4inri"burioo 
or dissem.lnadon or techn.iques, use or data procemn&. telecom.m\nucat!on and 
broadcasting equipment) an covered directly by the bndaet item. 
The following table fives the indicative breakdown ~r the various cateaories or 
expenditwe (in MloECU): 
1991 1992 
5.0.2 a) 41,123 ~.too 
5.0.% b) la '&oraal 1,177 1,900 
or which Expcns 0,400 0,600 
Other opention.al expenditure · 0.$00 0:115 
Infrastl'Umre 0,050 0,100 
I.n!orm.a.tion aDd publication 0.050 0.100 
Statutory staff 0.111 0.315 
6. FIN~~CIAL lltl.PLICATIONS FOR STAFF ~1> CURRENT AD~tTh"'STR.ATIYE 
APPROPRL.t. TIONS 
;._ The statutory resear:h nz!f invoh:ed, i.e. S A, J -B, t·C, wiU be entered in the 
research staff table llld is p!.id out c·f the appropriations entered onto Item B6-
8104. 
The administrative expenditure y.·lll be aovemed by the inttnu.l rules en mia.i .. 
budgets decided by the Commi.ssion on 2.2. :t.iay 1990. 
FINANCING OF £XPINDITURE 
The appropriatio~ to covn lhe Commu.nity•s contn1N"tion to this project will be 
deten:r:linec1 m the context o{ the annual buc1setary procedure. 
IMPLICAnONS FOR REVENUE 
Cootribution or the statutory research staf'f' to tbe retlremeAt scheme uc! the 
sickness iDsuruce. 
-133 -
9. TYPE OF CONTROL 
.. Adm.iJ:I.istralive control by the Director General for Financial Control u 
regards budJet implementation; 
-Control or ach.ievemeDt 
SOG-IS 
~ntrol by officials or the Commission 
audit by the Court a! Aud.i COl'S iD acc:ordance with provisions or the 
Treaty; 
• In ~--ordance with Article 2 c:C the ri!Wleial R.eauladous, me 1111 ot 
appropriatious wlU be subject ro ualyses or oost•eff'ectlveness ud the 
ra'isadora or qo&Dtltled abjec:tives will be moDJtored.