EN Official Journal of the European Union C 270/1

Opinion of the European Data Protection Supervisor on the Commission Decision of 12 December 2007 concerning the implementation of the Internal Market Information System (IMI) as regards the protection of personal data (2008/49/EC)

(2008/C 270/01)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular its Article 41,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION

The Internal Market Information System

1. The Internal Market Information System (‘IMI’) is an information technology tool that allows competent authorities in Member States to exchange information with each other in the implementation of the Internal Market legislation. IMI is funded under the ‘IDABC’ programme (Interoperable Delivery of European eGovernment Services to public administrations, businesses and citizens) (1).

2. IMI is designed as a general system to support multiple areas of internal market legislation and it is envisaged that its use will be expanded to support a number of legislative areas in the future. Initially, IMI will be used to support the mutual assistance provisions of Directive 2005/36/EC (‘Professional Qualifications Directive’) (2). From December 2009, IMI will also be used to support the administrative cooperation provisions of Directive 2006/123/EC (‘Services Directive’) (3).

The Opinion of the Article 29 Data Protection Working Party and the involvement of the EDPS

3. During the spring of 2007, the European Commission requested the Opinion of the Article 29 Data Protection Working Party (‘WP29’) to review the data protection implications of IMI. The WP29 issued its Opinion on the data protection aspects of IMI on 20 September 2007 (4). The Opinion of the WP29 supported the Commission's plans to adopt a decision regulating the data protection aspects of IMI, and give a more specific legal basis to the exchange of data within IMI.

4. The EDPS welcomes that the Commission sought the Opinion of the WP29 prior to drafting the IMI Decision. The EDPS actively participated in the work of the subgroup dealing with IMI and supports the conclusions of the Opinion of the WP29. He also welcomes that the Commission informally consulted the EDPS prior to the adoption of the IMI Decision. This gave the opportunity to already provide for suggestions prior to the adoption, which was particularly needed since the procedure concerned a decision by the Commission itself, not a Proposal by the Commission followed by a legislative procedure involving the Council and the European Parliament.

Commission Decision 2008/49/EC

5. On 12 December 2007, the Commission adopted its Decision 2008/49/EC concerning the implementation of the Internal Market Information System (IMI) as regards the protection of personal data (‘IMI Decision’). The Decision took into account some of the recommendations made by the EDPS and the WP29. It furthermore specified the legal basis.

Overall views of the EDPS on IMI

6. The overall views of the EDPS on IMI are positive. The EDPS supports the aims of the Commission in establishing an electronic system for the exchange of information and regulating its data protection aspects. Such a streamlined system may not only enhance efficiency of cooperation, but may also help to ensure compliance with applicable data protection laws. It may do so by providing a clear framework on what information can be exchanged, with whom, and under what conditions.

7. Nevertheless, establishment of the centralized electronic system also creates certain risks. These include, most importantly, that more data might be shared and more broadly than strictly necessary for the purposes of efficient cooperation, and that data, including potentially outdated and inaccurate data, might remain in the electronic system longer than necessary. The security of a database accessible in 27 Member States is also a sensitive issue, as the system is only as safe as the weakest link in the network permits it to be.

8. Therefore, it is very important that data protection concerns should be addressed in a legally binding Community act, as fully and unambiguously as possible.

Clear demarcation of the scope of IMI

9. The EDPS welcomes that the Commission clearly defines and delimitates the scope of IMI, with an annex listing the relevant Community acts on the basis of which information can be exchanged. These currently include only the Professional Qualifications Directive and the Services Directive; however, the scope of IMI is expected to be extended in the future. When new legislation is adopted which provides for information exchange using IMI, the annex will be updated simultaneously. The EDPS welcomes this technique as it (i) clearly delimits the scope of IMI; and (ii) ensures transparency, while at the same time; (iii) allowing flexibility for the case if IMI will be used for additional information exchanges in the future. It also ensures that no information exchange can be carried out through IMI without (i) having an appropriate legal basis in specific internal market legislation allowing or mandating information exchange; and (ii) including a reference to that legal basis in the annex to the IMI Decision.

Main concerns regarding the IMI Decision

10. The EDPS, however, is not satisfied with (i) the choice of the legal basis of the IMI Decision which means that the IMI Decision is now based on uncertain legal grounds (see Section 2 of this Opinion); and (ii) the fact that a number of necessary provisions regulating in detail the data protection aspects of IMI are not incorporated into the document (see Section 3 of the Opinion).

11. Regrettably, in practice, the solution adopted by the Commission means that contrary to the expectations of the EDPS and the WP29, the IMI Decision does not now comprehensively regulate all major data protection aspects of IMI, including, importantly, the manner in which the joint controllers share responsibility regarding notice provision and provide rights of access to data subjects, or the specific, practical issues of proportionality. The EDPS also regrets that there is no specific requirement for the Commission to publish the predefined questions and data fields on its website, which would increase transparency and legal certainty.

2. LEGAL BASIS OF THE IMI DECISION

The IDABC-Decision

12. The legal basis of the IMI Decision, as laid down in the decision itself, is Decision 2004/387/EC of the European Parliament and of the Council of 21 April 2004 on the interoperable delivery of pan-European eGovernment services to public administrations, businesses and citizens (‘IDABC-Decision’) (5), and in particular Article 4 thereof.

13. The IDABC-Decision itself is an instrument in the framework of Title XV of the Treaty Establishing the European Community (‘EC Treaty’): Trans-European networks. Article 154 of the EC Treaty provides that the Community shall contribute to the establishment and development of trans-European networks in the areas of transport, telecommunications and energy infrastructures. Such action shall aim at promoting the interconnection and interoperability of national networks as well as access to such networks. Article 155 lists the measures the Community can adopt in this framework. These are (i) guidelines; (ii) any measures that may prove necessary to ensure the interoperability of the networks, in particular in the field of technical standardisation; (iii) as well as the support of projects. The IDABC-Decision is based on Article 156(1), dealing with the procedure of adoption.

14. Article 4 of the IDABC-Decision states inter alia that the Community shall implement projects of common interest. Those projects must be included in a rolling work programme and the implementation must be in accordance with the principles of Article 6 and 7 of the IDABC-Decision. Those principles mainly encourage a wide participation, foresee a solid and impartial procedure and provide for a technical standardisation. They also aim at ensuring the economic reliability and feasibility of projects.

The Services Directive and the Professional Qualifications Directive

15. As explained earlier, in the initial period, the Internal Market Information System shall be used for the exchange of personal data in the context of two directives: — the Services Directive, and — the Professional Qualifications Directive.

16. Article 34(1) of the Services Directive provides for a specific legal basis for the establishment of an electronic system for the exchange of information between Member States, as an accompanying measure for the purposes of the Directive. Article 34(1) reads: ‘The Commission, in cooperation with Member States, shall establish an electronic system for the exchange of information between Member States, taking into account existing information systems’.

17. The Professional Qualifications Directive does not foresee a specific electronic system for the exchange of information but clearly requires information to be exchanged under several of its provisions. Relevant provisions mandating information exchange include Article 56 of the Directive, requiring the competent authorities of the Member States to work in close cooperation and to provide mutual assistance in order to facilitate application of the Directive. The second paragraph of Article 56 provides that certain sensitive information is processed while respecting data protection legislation. Further, Article 8 also specifically provides that competent authorities of the host Member State may ask competent authorities of the Member State of establishment to provide any information relevant to the legality of the service provider's establishment and his good conduct, as well as the absence of any disciplinary or criminal sanctions of a professional nature. Finally, Article 51(2) provides that in the event of justified doubts, the host Member State may require from the competent authorities of a Member State confirmation of the authenticity of the attestations and evidence of formal qualifications and training.

The need for a proper legal basis for the provisions on data protection

18. The protection of personal data is recognised as a fundamental right in Article 8 of the Charter of Fundamental Rights of the Union and in the case law on the basis of Article 8 of the European Convention on Human Rights (‘ECHR’).

19. According to its Article 1, the IMI Decision specifies the functions, rights and obligations of IMI actors and IMI users in relation to data protection requirements. The EDPS understands from Recital 7 that the IMI Decision is meant as a specification of the general Community framework of data protection under Directive 95/46/EC and Regulation (EC) No 45/2001. It specifically deals with the definition of controllers and their responsibilities, data retention periods and the rights of data subjects. The IMI Decision, thus, deals with limitations/specifications of fundamental rights and it aims at specifying subjective rights of citizens.

20. Based on the case-law under the ECHR, there should be no doubt about the legal status of provisions restricting fundamental rights. Those provisions must be laid down in a legal instrument, on the basis of the EC Treaty, which can be invoked before a judge. If not, the result would be legal uncertainty for the data subject since he cannot rely on the fact that he can invoke the rules before a Court.

21. The issue of legal certainty is even more eminent since under the system of the EC Treaty it will be primarily the national judges who will have discretion to decide which value they attach to the IMI Decision. This might lead to different outcomes in different Member states and even within one Member State. This legal uncertainty is not acceptable.

22. The absence of (security about) a legal remedy would be in any event contrary to Article 6 of the ECHR which provides for the right of a fair trial, and the case law on this Article. In such a situation, the Community would not fulfil its obligations under Article 6 of the Treaty on the European Union (‘TEU’), which requires the Union to respect fundamental rights, as guaranteed by the ECHR.

Imperfections of the legal basis chosen

23. The EDPS is deeply concerned that by choosing Article 4 of the IDABC-Decision as the legal basis of the decision, the drafters of the Commission Decision may not have met the test of legal certainty outlined above. The EDPS lists below the following elements, which may raise doubts about the adequacy of the choice of the legal basis of the IMI Decision: — the framework of Title XV of the EC Treaty, Trans-European Networks. Under this framework the European Community can contribute to establishing these networks, in order to make the European citizen profit from better, safer and cheaper transport, telecommunications and energy (6). It is uncertain whether this framework is also meant for networks between public authorities, needed for the implementation of legislative acts as is the case of IMI, — the measures foreseen in Title XV of the EC Treaty (Article 155). As said before, these consist of (i) guidelines; (ii) any measures that may prove necessary to ensure the interoperability of the networks, in particular in the field of technical standardisation; (iii) as well as the support of projects. Although the Article is not entirely clear — ‘any measures’ can mean anything — this list of possible measures suggests that the objectives of Title XV will be achieved primarily by non legislative measures. The EDPS emphasises that in this context the term ‘any measures’ refers in particular to technical standardisation, — Article 4 of the IDABC-Decision aims to implement projects of common interest specified in the rolling work programme. On the basis of this Work Programme, the IMI-system was set up and financed. However, the EDPS is not convinced that Article 4 can be used as a legal basis for rules on data protection, binding on the IMI actors and providing for subjective rights to citizens, — Article 6 and 7 of the IDABC-Decision — referred to in Article 4 — set out principles for the implementation of projects of common interest. These principles deal with participation, the procedure and technical standardisation, as well as the economic reliability and feasibility of projects. They have nothing to do with principles of data protection, nor with other comparable principles of public law, — the procedure of the IDABC-Decision: According to the 30th Recital of the decision implementing measures should be adopted in accordance with Council Decision 1999/468/EC of 28 June 1999 laying down the procedures for the exercise of implementing powers conferred on the Commission (7). This requires involvement of a ‘comitology’-committee with representatives of the Member States. The Recitals of the IMI-Decision do not refer to any involvement of such a committee. To our knowledge, such a committee has not been involved, — another specific point is that the IMI Decision is addressed to the Member States. For this reason and despite the references in the IMI Decision to Regulation (EC) No 45/2001 and the mentioning of the Commission in Article 6 as an IMI actor, the IMI Decision cannot relate to the processing of personal data by the Commission itself.

Possible solutions to remedy the imperfections of the legal basis chosen

24. The IMI Decision needs a solid legal basis, for the reasons mentioned above. There are serious doubts whether the legal basis of the IMI Decision fulfils the requirement of legal certainty. The EDPS recommends that the Commission reconsiders this legal basis and seeks solutions to remedy the imperfections of the legal basis chosen, with a possible consequence of replacing the IMI Decision by a legal instrument that fulfils the requirement of legal certainty.

25. In this context, the most appropriate solution might be the possibility of adopting a separate legal instrument for the IMI-system, by the Council and the European Parliament, similar to the Schengen Information System, the Visa Information System and other large-scale IT databases.

26. The EDPS suggests analysing this option. This separate legal instrument could then deal with the functions, rights and obligations of IMI-actors and IMI-users in relation to data protection requirements (the subject matter defined in the IMI Decision) and also with other requirements relating to the establishment and functioning of the IMI-system.

27. A second option could be finding a legal basis in the different internal market instruments. As far as the IMI Decision applies to the exchange of personal data in the context of the Services Directive, it should further be analysed whether this directive itself — in particular, Article 34 — could provide for the necessary legal basis. As far as the IMI Decision applies to the exchange of personal data in the context of the Professional Qualifications Directive, a similar approach could work as well: a specific and clear legal basis may also be created, by amending the Directive itself.

28. As for further internal market legislation that may, in the future, require information exchanges among competent authorities in Member States, a specific legal basis may at each time be adopted in such specific new legislation.

3. OBSERVATIONS ON THE CONTENT OF THE IMI-DECISION

29. In this Section of the Opinion, the EDPS discusses the provisions regulating the data protection aspects of IMI, as they are included in the IMI-Decision. The suggestions of the EDPS could be included in a new legal instrument replacing the IMI-decision as proposed above. However, in the absence of such a new instrument the suggestions could be included in the IMI-Decision itself, after amending this decision.

30. In addition, some of the suggestions can already now be applied in practice by the IMI-actors, without amending the decision. The EDPS expects the Commission to take the recommendations provided in this Opinion on board at least on the operational level, as far as they relate to activities of the Commission as IMI-actor, and thus subject to the supervision of the EDPS.

Article 2 — Pre-defined data fields: transparency and proportionality

31. The EDPS welcomes that the Commission published on the IMI website the first set of pre-defined questions and other data fields. These relate to information exchanges under the Professional Qualifications Directive.

32. To make this good practice a clear obligation on the Commission, and thus ensure and further improve transparency, the EDPS recommends that a legal instrument for IMI provides for an obligation for the Commission to publish the pre-defined questions and other data fields on the IMI website.

33. As regards proportionality, a legal instrument for IMI should specify that the pre-defined questions and other data fields must be adequate, relevant, and not excessive. In addition, the EDPS has two specific recommendations regarding proportionality: — a clear specification that IMI is not intended to be routinely used to do background checks on migrant professionals and service providers but only in case applicable legislation allows it and where there are reasonable doubts (i) as to the authenticity of the information provided by the migrant service provider to the Competent Authority in the host Member State or (ii) as to his/her eligibility to establishment or exercise of his/her profession in the host Member State, — in order to minimize unnecessary transmission of sensitive but not always relevant data, a provision laying down that whenever no actual criminal record information is strictly necessary to be transferred, pre-defined questions and answers in the IMI interface should not include a request for criminal records and should be phrased differently, in such a way to minimize sharing sensitive data. For example, a host country's Competent Authority may be satisfied with knowing that a migrant lawyer is legally registered and in good standing with his home bar association, and does not need to know whether he has a road traffic offence on his criminal record, if that does not prevent him from working as a lawyer in his home country.

Article 3 — Joint control and allocation of responsibilities

34. The allocation of responsibilities in Article 3 of the IMI Decision is unclear and ambiguous. The EDPS acknowledges that it may not be feasible to specifically designate in the IMI Decision every single processing operation and allocate responsibility for each to the Commission or to a particular Competent Authority in a particular Member State. However, at least with respect to the most important data protection obligations of a controller, some guidance should have been given in the IMI Decision.

35. In particular, the EDPS recommends that a legal instrument for IMI specifies that: — each Competent Authority and IMI coordinator is a controller with respect to its own data processing activities as a user of the system, — the Commission is not a user, but the operator of the system, and it is responsible, first and foremost, for the technical operation, maintenance, and ensuring the overall security of the system, and that — the IMI actors share responsibilities with respect to notice provision, and provision of right of access, objections, and rectifications in the manner outlined in the (newly inserted) paragraphs, as discussed under the headings below.

Notice to data subjects

36. The EDPS recommends that a new paragraph should be inserted into a legal instrument for IMI to allocate responsibilities for notice provision among the joint controllers following a ‘layered’ approach. In particular, the text should specify the following: — first, the Commission, on its webpage dedicated to IMI, should provide a comprehensive privacy notice including all items required under Articles 10 and 11 of Regulation (EC) No 45/2001 in a clear and simple language. The EDPS recommends that the notice should not only cover the limited processing operations of the Commission with respect to data it has access to (personal data of IMI users) but also provide a general notice with regard to the information exchanges between Competent Authorities in the different Member States, which is the purpose of the database, — second, and in addition, each Competent Authority should provide a privacy notice on its webpage. The privacy notice should include reference and link to the Commission's privacy notice and further details specific to that particular authority or Member State. Any country-specific limitations on the rights of access or information must, for example, be set forth on these notices. Notice provision may be coordinated by the single liaison office among the Competent Authorities within a specific country, — third, and finally, at the latest at the time of uploading personal data, and unless a restriction may be applied, notice should also be given to data subjects directly, by means other than the privacy notice on the website. A recommended approach may be to include a brief reference to the IMI and a link to the relevant privacy notices on the Internet in any correspondence that Competent Authorities exchange with the data subject (usually the migrant service provider or professional).

Rights of access, objection, and rectification

37. The EDPS also recommends that a new paragraph should be inserted, in order to: — specify to whom data subjects should address their access request, objection, or request for rectification, — specify which Competent Authority will be competent to decide about those requests, and — set forth a procedure in case the data subject submits his/her request to an IMI actor which is not competent in deciding about those requests.

38. Furthermore, it should be specified that the Commission can only provide access to data to which the Commission itself has legitimate access. Therefore, the Commission will not be under an obligation to provide access to exchange of information between Competent Authorities. If a data subject nevertheless turns to the Commission with such a request, the Commission needs to direct the data subjects, without undue delay, to the authorities which have access to the information and advise the data subject accordingly.

Article 4 — Retention of personal data of data subjects of the information exchanges

39. Article 4(1) of the IMI Decision provides for a data storage period of six months as of the ‘formal closure’ of an information exchange.

40. The EDPS understands that Competent Authorities may need some flexibility in retaining data due to the fact that beyond the initial question and answer, there may be follow-up questions regarding the same case between Competent Authorities. Indeed, during the preparation of the Opinion of the WP29, the Commission explained that the administrative procedures in the framework of which information exchanges may be necessary are usually completed within a couple of months and the six months retention period was designed to allow flexibility for any unexpected delays.

41. With that said, and based on the explanations of the Commission, the EDPS doubts whether there is a legitimate reason to keep the data in IMI for another six months after the formal closure of an information exchange. Therefore, the EDPS recommends that the six months deadline for automatic deletion should start as of the date when the requesting authority first contacts its counterpart in any specific information exchange. Indeed, a better approach would be to set the automatic deletion date according to the different types of information exchanges (always counting the deadlines from the start of the exchange). For example, whereas a six months retention period may be appropriate for information exchanges under the Professional Qualifications Directive, it may not necessarily be adequate for other information exchanges in future internal market legislation.

42. The EDPS also adds that should his recommendations not be taken into account, at the very least, it should be clarified what is meant by ‘formal closure’ of an information exchange. In particular, it must be ensured that no data could remain in the database longer than necessary simply due to the fact of a competent authority failing to ‘close the case’.

43. Further, the EDPS recommends that in the second paragraph of Article 4, the logic of deletion-retention should be reversed. The Commission should honour deletion requests within 10 working days in any event whether or not the other Competent Authority in the information exchange would like to keep the information on IMI. However, there should be an automated mechanism to notify this other Competent Authority, so that it would not loose the data and could, if it wished so, download or print the information and store it for its own purposes outside IMI and subject to its own data protection rules. A ten day notice period appears reasonable both as a minimum and as a maximum timeline set. The Commission should only be able to delete information before this ten day deadline if both authorities confirm their wish for deletion.

Security measures

44. The EDPS also recommends specifying that security measures, whether taken by the Commission or by the Competent Authorities, should be taken in accordance with best practices in Member States.

Joint supervision

45. As the information exchanges under the IMI are subject to multiple national data protection laws and the supervision of multiple national data protection authorities (in addition to the applicability of Regulation (EC) No 45/2001 and the supervisory authority of the EDPS to certain aspects of the processing operations), the EDPS recommends that a legal instrument for IMI should also provide clear provisions facilitating joint supervision of IMI by the various data protection authorities involved. The joint supervision could be modelled in the same way as has been done in the legal instruments on the establishment, operation and use of the second generation Schengen Information System (SIS II) (8).

4. CONCLUSIONS

46. The EDPS supports the aims of the Commission in establishing an electronic system for the exchange of information and regulating its data protection aspects.

47. The IMI Decision needs a solid legal basis, for the reasons mentioned above. The EDPS recommends that the Commission reconsiders its choice of legal basis and seeks solutions to remedy the imperfections of the legal basis chosen, with the possible consequence of replacing the IMI Decision by a legal instrument that fulfils the requirement of legal certainty.

48. As an ultimately most sound solution, the EDPS suggests analysing the possibility of adopting a separate legal instrument for the IMI-system, at the level of the Council and the European Parliament, similar to the Schengen Information System, Visa Information System and other large-scale IT databases.

49. Alternatively, it could be analysed whether Article 34 of the Services Directive and similar provisions yet to be adopted with respect to other internal market legislation could provide for the necessary legal basis.

50. Additionally, the Opinion provides for a number of suggestions on the provisions regulating the data protection aspects of IMI, to be included in a new legal instrument replacing the IMI Decision as proposed above or, in the absence of such a new instrument to be included in the IMI Decision itself, after amending this decision.

51. Many of the suggestions can already now be applied in practice by the IMI-actors, without amending the Decision. The EDPS expects the Commission to take the recommendations provided in this Opinion on board to the extent possible, at least on the operational level, as far as they relate to activities of the Commission as IMI-actor.

52. These recommendations relate to transparency and proportionality, joint control and allocation of responsibilities, notice to data subjects, rights of access, objection, and rectification, data retention, security measures and joint supervision.

Done at Brussels, 22 February 2008. Peter HUSTINX European Data Protection Supervisor

(1) See point 12 of this Opinion.

(2) Directive 2005/36/EC of the European Parliament and of the Council of 7 September 2005 on the recognition of professional qualifications (OJ L 255, 30.9.2005, p. 22).

(3) Directive 2006/123/EC of the European Parliament and of the Council of 12 December 2006 on services in the internal market (OJ L 376, 27.12.2006, p. 36).

(4) WP29 Opinion No 7/2007 on data protection issues related to the Internal Market Information System (IMI), WP140.

(5) OJ L 144, 30.4.2004, as corrected by OJ L 181, 18.5.2004, p. 25.

(6) See Commission White Paper on Growth, Competitiveness and Employment (COM(93) 700 final).

(7) OJ L 184, 29.12.2006, p. 23.

(8) See Articles 44-46 of Regulation (EC) No 1987/2006 of the European Parliament and of the Council of 20 December 2006 on the establishment, operation and use of the second generation Schengen Information System (SIS II) (OJ L 381, 28.12.2006, p. 4) and Articles 60-62 of Council Decision 2007/533/JHA of 12 June 2007 on the establishment, operation and use of the second generation Schengen Information System (SIS II) (OJ L 205, 7.8.2007, p. 63).