COMMISSION STAFF WORKING PAPER

Impact Assessment

Accompanying the document

Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) and Directive of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data

Disclaimer

This impact assessment report commits only the Commission's services involved in its preparation and the text is prepared as a basis for comment and does not prejudge the final form of any decision to be taken by the Commission.

Article 29 Working Party (WP 29): Data Protection Working Party established by Article 29 of Directive 95/46/EC. It provides the European Commission with independent advice on data protection matters and supports the development of harmonised policies for data protection in the EU Member States.

Binding corporate rules (BCR): Codes of practice based on European data protection standards, approved by at least one Data Protection Authority, which multinational organisations draw up and follow voluntarily to ensure adequate safeguards for transfers or categories of transfers of personal data between companies that are part of a same corporate group and that are bound by these corporate rules.

Controller* or Data controller: Natural or legal person, public authority, organisation, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data.

Data Protection Authority (DPA)*: National supervisory authority, acting with complete independence, responsible for monitoring the application of data protection rules at national level (e.g. handling complaints from individuals, carrying out investigations and inspections of data controllers' activities, engage in legal proceedings against violations of data protection rules).

Data Protection Impact Assessment (DPIA): A process whereby a conscious and systematic effort is made to assess privacy risks to individuals in the collection, use and disclosure of their personal data. DPIAs help identify privacy risks, foresee problems and bring forward solutions.

Data Protection Officer (DPO): A person responsible within a data controller or a data processor to supervise and monitor in an independent manner the internal application and the respect of data protection rules. The DPO can be either an internal employee or an external consultant.

Data subject: An identified or identifiable person to whom the "personal data" relate.

Personal data* (sometimes simply referred to as "data"): Any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.

Personal data breach**: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed in connection with the provision of a publicly available electronic communications service in the Union.

Processing of personal data*: Processing of personal data means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.

Processor* or Data processor: The processor is the natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller.

Sensitive data: Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, data concerning health or sex life, and data relating to offences, criminal convictions or security measures.

Table of contents

List of Annexes. vi

1........... Introduction. 7

2........... Procedural Issues and Consultation of Interested Parties. 8

2.1........ Identification. 8

2.2........ Organisation and timing. 8

2.3........ Consultation of the IAB.. 8

2.4........ Consultation and expertise. 9

3........... Problem definition.. 10

3.1........ Evaluation of the EU data protection framework. 10

3.2........ Problem 1 – Barriers for business and public authorities due to fragmentation, legal uncertainty and inconsistent enforcement 11

3.2.1..... Description of the problem.. 11

3.2.2..... Who is affected and to what extent?. 19

3.3........ Problem 2 – Difficulties for individuals to stay in control of their personal data. 21

3.3.1..... Description of the problem.. 21

3.3.2..... Who is affected and to what extent?. 29

3.4........ Problem 3 – Gaps and inconsistencies in the protection of personal data in the field of police and judicial cooperation in criminal matters. 31

3.4.1........ Description of the problem.. 31

3.4.2..... Who is affected and to what extent?. 35

3.5........ The drivers behind the identified problems. 35

3.6........ Baseline scenario: How would the problem evolve?. 36

3.6.1..... Fragmentation, legal uncertainty and inconsistent enforcement 36

3.6.2..... Difficulties for individuals in exercising their data protection rights effectively. 37

3.6.3..... Inconsistencies and gaps in the protection of personal data in the field of police and judicial cooperation in criminal matters and inconsistency of the rules. 37

3.7........ SUBSIDIARITY AND PROPORTIONALITY.. 37

3.7.1..... Subsidiarity. 37

3.7.2..... Proportionality. 38

3.8........ Relation with fundamental rights. 39

4........... Policy Objectives. 40

5........... Policy options. 44

5.1........ Options to address Problem 1: Barriers for business and public authorities due to fragmentation, legal uncertainty and inconsistent enforcement 45

5.1.1..... Addressing fragmentation and legal uncertainty. 45

5.1.2..... Addressing inconsistent enforcement 48

5.2........ Options to address Problem 2: Difficulties for individuals in exercising their data protection rights effectively 50

5.2.1..... Addressing individuals' insufficient awareness and loss of control and trust 50

5.2.2..... Addressing the difficulty for individuals to exercise their data protection rights. 52

5.3........ Options to address Problem 3: Gaps and inconsistencies in the protection of personal data in the field of police and judicial cooperation in criminal matters. 54

5.3.1..... Addressing gaps in the Framework Decision. 54

5.3.2..... Addressing fragmentation. 56

6........... Analysis of Impacts. 63

6.1........ Policy objectives 1 and 2: Enhancing the internal market dimension of data protection and increasing the effectiveness of data protection rights. 63

6.1.1..... POLICY OPTION 1: Interpretation, technical support tools, encouragement of self-regulation and cooperation and standardisation. 63

6.1.2..... POLICY OPTION 2: Legislative amendments addressing gaps in current harmonisation, clarifying and strengthening individuals' rights and reinforcing responsibility of data controllers and processors, reinforcement and harmonisation of DPA powers and strengthening of their cooperation. 65

6.1.3..... POLICY OPTION 3: Detailed harmonisation and rules at EU level in all policy fields and sectors, centralised enforcement and EU wide harmonised sanctions and redress mechanisms. 71

6.2........ Objective 3: Enhancing the coherence of the EU data protection framework in the field of police and judicial cooperation in criminal matters. 74

6.2.1..... POLICY OPTION 2: Strengthened specific rules and new instrument with extended scope. 74

6.2.2..... POLICY OPTION 3: Extended specific rules and full integration of general principles in former third pillar instruments. 75

7........... Comparing the Options. 79

7.1.1..... Analysis. 79

7.1.1..... Policy Option 1. 79

7.1.2..... Policy Option 2. 79

7.1.3..... Policy Option 3. 79

7.2........ Summary table comparing the policy options. 81

7.3........ Preferred Option. 87

7.4........ Impacts on simplification of the Preferred Option. 90

8........... Monitoring and evaluation. 92

List of Annexes

Annex 1: Current EU Legal instruments on data protection

Annex 2: Evaluation of the implementation of the Data Protection Directive

Annex 3: Data protection in the areas of police and judicial co-operation in criminal matters

Annex 4: Summary of replies to the public consultation on the Commission's Communication on a Comprehensive Approach on Personal Data Protection in the European Union

Annex 5: Detailed Analysis of Impacts

Annex 6: Detailed Assessment of Impacts of the Introduction of Data Protection Officers (DPOs) and Data Protection Impact Assessments (DPIAs)

Annex 7: Analysis of the Impacts of Policy Options on Fundamental Rights

Annex 8: Consultation of SMEs

Annex 9: Calculation of Administrative Costs in the Baseline Scenario and Preferred Option

Annex 10: Impacts of the preferred option on competitiveness

1. Introduction

The centrepiece of EU legislation on data protection, Directive 95/46/EC[1] (hereinafter "the Directive"), was adopted in 1995 with two objectives in mind: to protect the fundamental right to data protection and to guarantee the free flow of personal data between Member States. It was complemented by several instruments providing specific data protection rules in the area of police and judicial cooperation in criminal matters[2] (ex third pillar), including Framework Decision 2008/977/JHA (hereinafter "the Framework Decision")[3].

Rapid technological and business developments have brought new challenges for the protection of personal data. The scale of data sharing and collecting has increased dramatically. Technology allows both private companies and public authorities to make use of personal data on an unprecedented scale in order to pursue their activities. Individuals increasingly make personal information available publicly and globally. Technology has transformed both the economy and social life.

Building trust in the online environment is key to economic development. Lack of trust makes consumers hesitate to buy online and adopt new services, including public e-government services. If not addressed, this lack of confidence will continue to slow down the development of innovative uses of new technologies, to act as an obstacle to economic growth and to block the public sector from reaping the potential benefits of digitisation of its services, e.g. in more efficient and less resource intensive provisions of services. This is why data protection plays a central role in the Digital Agenda for Europe[4], and more generally in the Europe 2020 Strategy[5].

The Lisbon Treaty defines the right to data protection as a principle of the EU and introduces a specific legal basis for the adoption of rules on the protection of personal data[6] that also applies to police and judicial cooperation in criminal matters. Article 8 of the EU’s Charter of Fundamental Rights (CFR) enshrines data protection as a fundamental right.

The European Council invited the Commission to evaluate the functioning of EU instruments on data protection and to present, where necessary, further legislative and non-legislative initiatives[7]. In its resolution on the Stockholm Programme, the European Parliament[8] welcomed a comprehensive data protection scheme in the EU and called for the revision of the Framework Decision among other measures.

The Commission's broad public consultations and extensive stakeholder dialogues have confirmed that there is general agreement that the current framework remains sound as far as its objectives and principles are concerned. However, it has not prevented fragmentation in the way data protection is implemented across the Union, which causes legal uncertainty and a widespread public perception that there are significant privacy risks associated notably with online activity[9].

This is why it is time to build a stronger and more coherent data protection framework in the EU, backed by strong enforcement that will allow the digital economy to develop across the internal market, put individuals in control of their own data and reinforce legal and practical certainty for economic operators and public authorities.

The Commission highlighted the policy objectives of this reform in its Communication on a comprehensive approach on personal data protection in the European Union adopted on 4 November 2010[10]. It is now translating these policy objectives into concrete reform proposals.

This impact assessment focuses on the review of the Directive and the Framework Decision. The Commission will assess the need to adapt other legal instruments to the new general framework at a later stage[11].

2. Procedural Issues and Consultation of Interested Parties 2.1. Identification

Title: Impact assessment on the reform of the data protection regulatory framework

Lead DG: Justice

Agenda planning number: AP 2010/279, CWP 2011 Annex 1

2.2. Organisation and timing

The evaluation and impact assessment process for the review of the personal data protection regulatory framework started with a general public consultation phase in May 2009. Evaluations of the Directive and of the Framework Decision were carried out by the Commission services in 2010 and 2011 (see below § 3.1 and annexes 2 and 3). Two external studies[12] supported the evaluation and impact assessment. A specific report by the Commission evaluates the implementation of the Framework Decision by Member States.[13]

The inter-service impact assessment steering group was convened for the first time on 3 March 2010 and met again on 27 May 2010, 9 March 2011 and 14 July 2011. The following Commission services were invited to participate in the steering group: the Secretariat-General, the Legal Service, DG AGRI, DG AIDCO, DG COMM, DG COMP, DG EMPL, DG ENER, DG ESTAT, DG HOME, DG INFSO, DG JRC, DG MARKT, DG MOVE, DG OLAF, DG RTD, DG SANCO, DG TAXUD, DG TRADE and the EEAS.

2.3. Consultation of the IAB

Following the IAB opinion, the following changes were made to the present report:

· The objectives of the current legal framework (to what extent they were achieved, to what extent they were not), as well as the objectives of the current reform, were clarified;

· More evidence and additional explanations/clarification were added to the problems' definition section;

· A section on proportionality was added;

· All calculations and estimations related to administrative burden in the baseline scenario and in the preferred option have been entirely reviewed and revised (including Annex 9 on administrative burden calculations), and the relation between the costs of notifications and the overall fragmentation costs has been clarified;

· Impacts on SMEs, particularly of DPOs and DPIAs have been better specified;

· The analysis of impacts (especially economic ones, on competitiveness) has been improved;

· The description of the options has been revised and clarified;

· A table comparing the different options was added, as well as on the preferred option;

· A new annex (n° 10) on competitiveness proofing of the preferred option was added.

2.4. Consultation and expertise

The evaluation included a broad-based consultation process, which lasted for more than two years and included two phases of public consultation.

The first general public consultation was launched in May 2009 with a conference on personal data protection. The replies to the consultation and the summary of the results are available at: http://ec.europa.eu/justice/news/consulting_public/news_consulting_0003_en.htm. A second public consultation was launched following the adoption of the Commission's Communication of 4 November 2010[14]. A summary of the responses is included in annex 4.

Targeted consultations were also conducted with key stakeholders; specific events were organised on 29 June 2010 with Member State authorities and on 1 July 2010 with private stakeholders, including private companies, as well as privacy and consumers' organisations.

In November 2010, Vice-President Reding organised a roundtable on the data protection reform and on 28 January 2011 (Data Protection Day), the European Commission and the Council of Europe co-organised a High-Level Conference to discuss issues related to the reform of the EU legal framework as well as to the need for common data protection standards worldwide (http://www.data-protection-day.net/init.xhtml?event=36). Two Conferences on data protection were hosted by the Hungarian and Polish Presidencies of the Council on 16-17 June 2011 and on 21 September 2011 respectively.

Dedicated workshops and seminars on specific issues were held throughout 2011. On 24 January ENISA (the European Network and Information Security Agency, dealing with security issues related to communication networks and information systems) organised a workshop on data breach notifications in Europe[15]. On 2 February the Commission convened a workshop with Member States' authorities to discuss the implementation of the Framework Decision and, more generally, data protection issues in the area of police cooperation and judicial cooperation in criminal matters. On 21-22 February the Fundamental Rights Agency held a stakeholder consultation meeting on "Data Protection and Privacy". A discussion on key issues of the reform was held on 13 July 2011 with national Data Protection Authorities.

EU citizens were consulted through a Eurobarometer survey held in November-December 2010[16].

The "Article 29 Working Party" (WP29)[17] provided several opinions and useful input to the Commission[18]. The EDPS also issued a comprehensive opinion on the issues raised in the Commission's November 2010 Communication[19].

A large majority of stakeholders agreed that the general principles remain valid but that there is a need to adapt the current framework in order to better respond to challenges posed by the rapid development of new technologies (particularly online) and increasing globalisation, while maintaining the technological neutrality of the Directive. Private sector data controllers in particular have underlined the need to increase harmonisation within the EU and to better apply the existing data protection principles in practice. Furthermore, they consider that the complexity of the rules on international transfers of personal data constitutes an impediment to their operations as they regularly need to transfer personal data from the EU to other parts of the world.

3. Problem definition 3.1. Evaluation of the EU data protection framework

The main and overarching objective of the current legal framework on data protection is to ensure a high level of data protection for all individuals in the EU.

The Directive also aims at achieving an equivalent level of data protection in all Member States in order to ensure the free flow of information within the internal market.

In the police and criminal justice area, a specific aim – enshrined in the Framework Decision – is to enhance mutual trust and thus support the exchange of personal data between police and judicial authorities.

All these objectives, which remain entirely valid today, have only been partially achieved under the current legal framework.

As to the first objective, the Directive contains principles that are still sound and guarantee a high level of protection. However, there are today new challenges to the protection of personal data that could not be foreseen 16 years ago, when the Directive was adopted, linked to technological developments and globalisation. In particular, the development of the internet has greatly facilitated and increased the scale of data collecting and sharing, across geographical and virtual borders. The result is that personal data today may be processed more easily and on an unprecedented scale by both private companies and public authorities, which increases the risks for individuals' rights and challenges their capacity of keeping control over their own data (see Section 3.3., Problem 2 below). Moreover, there are wide divergences in the way Member States have transposed and enforced the Directive, so that in reality the protection of personal data across the EU cannot be considered as equivalent today.

Differences in national transposition and enforcement have also limited the achievement of the "internal market objective" of the Directive, as highlighted already in the 2003 and 2007 implementation reports[20]. Although there is no evidence that any Member State has ever blocked the flow of personal data to or from another Member State, these differences in approach have led to costly legal fragmentation and uncertainty with negative consequences for businesses, individuals and the public sector (see Section 3.2., Problem 1 below).

The application of the EU data protection acquis in the area of police cooperation and judicial cooperation in criminal matters, in particular the Framework Decision, resulted in gaps and inconsistencies, which have affected both the level of protection for individuals and the mutual trust and cooperation between police and judicial authorities (see Section 3.4., Problem 3 below).

3.2. Problem 1 – Barriers for business and public authorities due to fragmentation, legal uncertainty and inconsistent enforcement 3.2.1. Description of the problem

The current divergences in the implementation, interpretation and enforcement of the Directive by Member States hamper the functioning of the internal market and cooperation between public authorities in relation to EU policies. This goes against the fundamental objective of the Directive of facilitating the free flow of personal data in the internal market. These divergences raise the compliance costs related to data processing and transfer operations between Member States, without any corresponding benefit in terms of data protection, and may discourage some economically or socially beneficial activities which would require cross-border transfers of data within the EU. It is estimated that the fragmentation of the legal framework gives rise to administrative burden costing EU firms close to € 3 billion per year.

The rapid development of new technologies and globalisation further exacerbates this problem. A comparative study on different approaches to new privacy challenges for the European Commission[21] found that

"We have seen dramatic technological change since the European Commission first proposed the Data Protection Directive in 1990. The Internet has moved out of the university lab into 56% of European homes and 95% of OECD businesses. Computer processing power has continued to follow Moore’s Law, with transistor density doubling every 18-24 months – around one thousand-fold in the last two decades. Computer storage capacity and communications bandwidth have both been increasing even more quickly, doubling every 12 months and hence a thousand-fold each decade. These exponential increases have radically increased the ability of organisations to collect, store and process personal data. The physical environment is now saturated with sensors such as CCTV cameras and mobile phones, with biometric and electronic identifiers used to link data to individuals. In the digital world almost every communication and Web page access leaves behind detailed footprints. The Internet and mobile information appliances allow large quantities of personal data to be trivially moved between jurisdictions. Data mining tools attempt to find patterns in large collections of personal data, both to identify individuals “of interest” and to attempt to predict their interests and preferences. New multinational companies have sprung up around these technologies to service a global customer base, with smaller enterprises outsourcing employee and customer data processing to developing world companies."

There are hardly any business transactions today which are not supported by information technology. Online transactions produce a trail of personal data by their very nature. With the introduction of loyalty cards and other systems, even day-to-day retail operations in normal supermarkets now leave a trail of personal data. Most travelling and leisure activities and service contracts have become unthinkable without the processing of personal data at a large scale. While for some traditional services, e.g. payment cards, the revenue from the collection and use of data has become more important than that from the actual consumer service, new business models have emerged that rely exclusively on this revenue source for their financing and profit, e.g. some search engines and social networking services monetizing their data through targeted advertising.

Where these services are provided online, they are generally accessible regardless of the geographic location of user and service provider, and the operation of the service includes the transfer of personal data across borders. Large enterprises can afford the necessary legal expertise to ensure compliance with all relevant legislations and/or the technical efforts to ensure that their offering is adapted for each jurisdiction to the local requirements. Small and medium enterprises, on the contrary, do not have the resources for such expertise or adaptation and accordingly refrain from offering their services online altogether or choose to refuse servicing customers outside their national jurisdiction. While data protection legislation is not the only element contributing to these difficulties for businesses – others include intellectual property law, taxation and elements of civil law – it is one of the elements that need to be addressed in a comprehensive strategy to remove remaining obstacles in the digital single market, in line with the Commission's initiatives under the Stockholm Action Plan and the Digital Agenda for Europe.

a) Fragmentation and legal uncertainty

A first cause of the existing fragmentation of the legal framework on data protection is the fact that the Directive contains a number of provisions that are broadly formulated, and - sometimes intentionally - leave Member States significant room for manoeuvre in transposing them. For example, Article 5 of the Directive states that "Member States shall […] determine more precisely the conditions under which the processing of data is lawful". Furthermore, there is currently no strong mechanism to ensure a harmonised interpretation of the Directive. The Commission’s implementing powers are limited to the external dimension of the Directive (transfers of data to third countries). The opinions of the Article 29 Working Party on questions covering "the application of the national measures adopted under this Directive in order to contribute to the uniform application of such measures"[22] are not binding and are therefore not always followed in practice by DPAs.

As a consequence, key provisions and concepts have been interpreted and transposed in quite different ways by Member States, so that the same processing is treated divergently across Member States and thus impacts cross-border processing activities by public authorities and businesses. This concerns, for example, the following issues[23]:

- Consent:

Consent is currently defined in the Directive as "any freely given specific and informed indication", of the data subject's wishes to give his/her agreement to the processing of personal data relating to him or her[24] which must be "unambiguously given" in order to make the processing of personal data legitimate. National laws have transposed this concept quite differently and consequently national DPAs apply different interpretations of consent and of its modalities. In particular, the meaning of "unambiguously given" consent is interpreted in a variable manner: in some Member States, consent has to be given "expressly" and in some cases even in writing[25], while other Member States and DPAs also accept some forms of implied consent[26]. The consequence is that a valid consent in one Member State would not be legally valid in others, therefore creating uncertainty amongst data controllers operating in several Member States on whether a data processing is lawful or not.

- Sensitive data[27]:

"Sensitive data" are special categories of data (i.e., data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and data concerning health or sex life) whose processing shall in principle be prohibited, unless certain conditions are fulfilled and safeguards provided.

Some Member States have specified and added categories to those included in the Directive, for example biometric data (e.g. the Czech Republic, Slovenia and Estonia) genetic data (Bulgaria, the Czech Republic, Estonia, Luxembourg and Portugal) or party membership (Poland). Some Member States have also included data from the judiciary, for example information about previous convictions or criminal behaviour (e.g. Cyprus, the Czech Republic, Estonia, Slovenia, Spain, the Netherlands and Poland). On the other hand, some national laws do not consider as sensitive data on ethnic origin, political opinions or philosophical beliefs. There is also a very varied implementation – due to the room for manoeuvre left by the Directive in this respect – of the exceptions from the general prohibition of processing 'sensitive data'. For example, in relation to the possibility of processing health-related data (an exception to the general prohibition), some Member States (e.g. Cyprus and Denmark) allow this only when data are processed by health professionals, whereas in the Czech Republic and in Slovakia processing of such data is possible also for health insurance purposes. Also in this case, different requirements across Member States entail legal uncertainty and costs for both private (e.g. companies operating in the health sector) and public data controllers (on this aspect, see Section 3.2.2 b).

- Notification:

Currently data controllers have the obligation to notify their processing operations to national DPAs, unless there are grounds for being exempted[28]. A large discretion is left to Member States in deciding possible exemptions to such obligation (and any other form of simplification), so that the same data processing activity could involve an obligation to notify the DPA in some Member States and not in others. For example, some Member States have made extensive use of the possibility for exemptions from the notification requirement by increasing the accountability of the data controller - in particular through the appointment of a Data Protection Officer (DPO)[29] – while others make very limited exemptions. Moreover, several DPAs charge for notifications, whereas others do not (the charge for a single notification ranges from about €23 to €599 and may depend on whether a data controller is a natural or legal person, public or private sector etc)[30].

All of this imposes costs and cumbersome procedures on business, without delivering any clear corresponding benefit in terms of data protection. All economic stakeholders have confirmed in the course of the public consultation that the current notification regime is unnecessarily bureaucratic and costly. DPAs themselves agree on the need to revise and simplify the current system[31].

This problem is made more acute by the current regime on applicable law as established by the Directive[32], which allows for a "cumulative" and simultaneous application of different national laws to a same data controller established in several Member States. This means that such controller will have to comply with the different national laws, obligations and varied requirements that apply for each of its establishments. It is important to note that the notion of "establishment", as confirmed by the opinion of the Article 29 Working Party on the issue[33], has generally been interpreted broadly by DPAs. In practice even an attorney office, a one-man office or a simple agent in a Member State are often considered as an "establishment", and thus lead to the application of the national laws of the Member States concerned.

This means that the fragmentation – and the costs linked to that (see Section 3.2.2 below) - caused by diverging national requirements combined with the simultaneous application of national laws affects not only large enterprises with physical establishment/branches in Member States but most of the companies carrying out cross-border activities.

Example 1 below helps to show how these costs arise.

Example 1 [34]: Legal complexity and cost of notifications for a data controller processing personal data in 15 Member States

A chain of shops has its head office in Member State X and franchised shops in 14 other Member States. Data relating to clients are collected in every shop, but are transferred to the head office in Member State X where some activities related to the processing of data take place (e.g. targeted advertising). The data protection law of Member State X would therefore be applicable to the processing activities carried out by the head office. However, the individual shops remain responsible for processing of their customers' personal data, which take place in the context of the shops' activities (for example, the collection of customers' personal data). To the extent that processing is carried out in the context of each shop's activities, it is subject to the law of the Member State where that shop is established. This means that each shop must notify its personal data processing operations to the national DPA according to the data protection law of the Member State where the shop is established, if notification is required by that law. The head office in Member State X and the individual shops in the other Member States could therefore be faced with the following scenario regarding notifications: - Five Member States exempt all data controllers from notification requirements except in cases of sensitive data processing; hence the shops established in those five Member States do not have to notify their data processing operations. - Member State X and four additional Member States A, B, C and D oblige all data controllers to notify processing operations and charge a fee of €300. The head office and the shops established in those five Member States have to notify the Data Protection Authority (DPA) in the Member State where they are established. - Three Member States E, F and G exempt data controllers from notifications only if they have appointed a Data Protection Officer (DPO). If not, they have to notify and pay a charge of €150. The shops in these Member States have not appointed a DPO and therefore they have to notify their operations. - Member State H obliges data controllers to notify processing only when processing is done through automated means and charges a fee of €500. The shop has to notify. - Member State I obliges all data controllers to notify and charges a fee of €25. In all cases where the shops have to notify the data processing operations in accordance with national data protection rules, the head office of the company has to consult a local lawyer to ensure legal compliance. Taking an average legal cost across the EU of €250/hour and assuming four hours of legal work per Member State, excluding the Member States that do not oblige data controllers to notify processing, the company would incur a cost of €10,000 in order to obtain legal advice. Including the notification fees for the processing activities in Member States X and A-I, the total costs of the notification requirement would be €12,475.

The overall cost of notifications – only in terms of administrative burden - is of approximately €130 million per year (see Annex 9 for details). In addition to the administrative burden, other direct and indirect costs of the requirement and its fragmentation have to be taken into account. This includes, inter alia, direct fees for notifications collected by some data protection authorities.

Notifications are, however, only one procedural element illustrating the effect of fragmentation with particular clarity, but by far not the most important one in terms of its economic effect. A more detailed estimation of the overall effects of fragmentation is provided in Annex 9.

Fragmentation also negatively affects efficiency and effectiveness of public authorities as explained under Section 3.2.2 b) below.

- Transfers to third countries

Divergent approaches in the transposition of the Directive also apply to the provisions on transfers to third countries, which are additionally challenged by the increasingly globalised nature of data flows (i.e. the fact that personal data are being transferred across a large number of virtual and geographical borders, such as in the framework of "cloud computing").

This is illustrated by the following:

a) Adequacy:

One of the criteria for transferring personal data to a third country is that the latter provides for an 'adequate' level of protection in relation to the data being transferred[35]. Currently, the decision on such adequate level of protection of a third country may be taken either by the Commission – in which case all Member States are bound by it - or by Member States themselves. In the latter case, some Member States allow the data controller itself to conduct the adequacy check (e.g. the UK), while others reserve it for national authorities, in particular the DPAs (e.g. France). This leads to a situation whereby transfers towards a certain third country may be considered lawful (as the level of data protection is considered to be adequate) in a Member State but not in others, and thus creates legal uncertainty for data controllers operating in more than one Member State that want to transfer data lawfully to a third country.

b) "Standard contractual clauses":

These are standard data protection clauses, established by Commission Decisions, to be included in contracts that allow data transfers from a data controller established in the EU to data controllers and processors in third countries[36]. Although Member States are under the obligation to recognise the standard contractual clauses approved by the Commission as fulfilling the requirements laid down by the Directive for the transfer of data to a third country - and can thus not refuse the transfer - some of them still require their national DPAs to review them and give their prior authorisation to the transfer. In such cases, data controllers are subject to unnecessary and varied requirements/authorisations, in spite of the establishment of model clauses aimed at facilitating the transfers while ensuring the necessary guarantees in terms of protection.

c) "Binding Corporate Rules" (BCRs):

"Binding Corporate Rules" (BCRs) are internal rules followed by a multinational corporation for transfers of personal data between the groups of companies belonging to the same multinational corporation, approved by one (or more) DPAs. BCRs have been developed as a matter of practice by DPAs and by the WP29[37] on the basis of an extensive interpretation of Article 25(2) of the Directive, in order to facilitate data transfers within multinationals operating worldwide. In such cases, if the transfers had to be regulated via contractual clauses (standard or not), this would require the conclusion of a myriad of contracts between the different entities of the group, which would have to follow the requirements provided for under the different national laws applicable. This type of situation can be avoided via the use of BCRs, which are therefore recognised as a useful tool by economic stakeholders, particularly by companies operating across several Member States and third countries. There are, however, some shortcomings that currently discourage companies from using them[38], such as:

- not all Member States and DPAs recognise the decisions taken by other DPAs and impose additional national requirements. The so-called "mutual recognition procedure" – whereby BCRs are reviewed and approved only by the "lead DPA", assisted by two other concerned DPAs[39] - is currently accepted only by 17 Member States plus the 3 EEA countries;

- the length of the current procedure for recognising/approving BCRs: six months as an average, but up to two years in complex cases and even longer when several authorisations are required according to national law;

- BCRs are currently limited to data controllers and do not cover data processors[40];

- the uncertainty about the possibility of applying BCRs to "groups of companies", because there is no clear definition of what this would cover.

According to feedback from stakeholders, particularly large enterprises, the above situation is an obstacle to business operations and reduces the attractiveness of the EU as a business location, as companies regularly need to transfer personal data from EU Member States to other world regions.

b) Inconsistent enforcement of data protection rules across the EU

In the 2003 implementation report of the Directive, the Commission considered enforcement as one of the problematic issues – mainly due to the limited resources of DPAs and to their non-prioritisation of enforcement tasks - stressing that "more vigorous and effective enforcement" was needed to improve compliance with the legislation. "Closer cooperation among the supervisory authorities" was also seen as a means – as an alternative to the revision of the Directive – to remedy the divergences between Member States' laws.

However, as confirmed by a comprehensive report issued recently by the Fundamental Rights Agency[41], the situation has not really improved since then.

– Limited resources available to DPAs

First of all, there are still important variations in the level of funding of data protection authorities and the resources available to them. Some DPAs are still under-resourced[42] and have thus difficulties in handling all complaints they receive, in carrying out enforcement actions and in cooperating effectively with other DPAs[43].

– Different powers of national DPAs

Secondly, in some Member States the "effective powers of intervention" of DPAs as required by the Directive[44] are limited: for example, not all DPAs have the power to stop processing (e.g. BE), order the destruction or erasure of data (e.g., BE, DE, SE), access data banks and filing systems (e.g. UK) or to refer/bring the case before the judicial authorities (e.g., EE). Equally, not all DPAs have the power to impose fines on data controllers (e.g. BE, DK, LT, HU, AT, PL, SE); when fines are foreseen, their amount also varies considerably (see Annex 2 for details). In some cases, DPAs may only negotiate amicable solutions with those having violated the law or to refer them to courts (e.g., BE). Finally, some DPAs appear not to act with "complete independence" as required by Article 28(1) of the Directive and interpreted by the Court of Justice[45]. This means that the effective level of data protection varies across the EU, with the consequence that EU citizens’ fundamental rights – the right to privacy, for example – may in practice differ from one Member State to the next.

– Lack of effective cooperation between DPAs and absence of regulatory powers for the European Commission

The Directive establishes a general duty of mutual cooperation and information exchange between national supervisory authorities[46]. However, as highlighted by DPAs themselves, practical cooperation between national supervisory authorities in cross-border cases can and should be improved[47].

Moreover, existing non-binding mechanisms and structures to ensure DPAs cooperation and to contribute to the "uniform application" of national laws on data protection – the Article 29 Working Party (WP29), in particular - are deficient in this regard[48]. While the WP29, and advisory body to the Commission[49], regularly adopts opinion on the interpretation of different provisions of the Directive to help uniform application, these are not binding and are not always followed by DPAs[50].

In addition, the fact that the Commission also ensures the secretariat of the WP29[51] leads to uncertainties as to the demarcation between the role of the Commission as an Institution, on the one hand, and its role as secretariat, on the other. For example, while the Directive states that WP29 "[shall] act independently", some of its opinions - largely publicised in the press – have been perceived by some stakeholders as being "the Commission's view (or interpretation)" of a certain matter related to the Directive[52]. This misperception can be particularly problematic in cases where the opinions openly criticise EU policies[53]. On the other side, WP29 tends to consider that its independence can be undermined by the fact that the Commission provide for its secretariat and determine the available resources.

The result of the above is that the existing governance system often leads to divergent decisions of DPAs vis-à-vis the same data controller for the same data processing, i.e. there is currently no "one-stop shop" for data controllers. This adds further to the uncertainty and costs faced by companies. No single DPA has a complete overview of the processing activities of companies that are established (or, if based outside the EU, have appointed a representative) in several Member States and are subject to different national laws as well as to the "jurisdiction" of different DPAs.

This clearly does not help addressing, and on the contrary exacerbates, the problem of legal fragmentation at EU level and prevents an effective and consistent handling of cases where the right to data protection is affected on a European – if not global – scale.

Example 2 below illustrates the difficulties in ensuring a common and consistent European approach in enforcing the rules vis-à-vis data controllers affecting personal data across the EU and highlights the limits of the current enforcement model, as well as the lack of satisfactory cooperation between national DPAs.

Example 2: Different approaches towards online mapping services A multinational company with several establishments in EU Member States has recently deployed an online navigation and mapping system across Europe. This system collects images of all private and public buildings, and may also take pictures of individuals. The data protection safeguards applied to this service and thus the requirements imposed upon data controllers vary substantially from one Member State to another. Depending on the Member States and on their implementation of the notification requirements into national law, a notification may or may not be required for this system. In one Member State, the deployment of this service led to a major public and political outcry, and some aspects of it were considered to be unlawful. This concerned, for example, the inclusion of un-blurred pictures of persons entirely unaware that they were being photographed. The company then offered additional guarantees and safeguards to the individuals residing in that Member State after negotiation with the competent DPA. However the company refused to commit to offer the same additional guarantees to individuals in other Member States facing similar problems. Whereas in some Member States the company was sanctioned, in other Member States the DPAs considered that such a navigation or mapping system was in line with data protection requirements. The WP29 attempted, unsuccessfully, to coordinate the different DPAs positions so as to have a common EU approach and ensure a consistent enforcement of the rules vis-à-vis data controllers and individuals.

3.2.2. Who is affected and to what extent?

a) Economic operators

As the Directive leads to the simultaneous application of national laws where the controller is established in several Member States, data controllers operating across borders need to spend time and money (for legal advice, to prepare the required forms/documents etc) to comply with different, and sometimes contradictory, obligations, such as the different requirements for notifications of data processing to DPAs. According to stakeholders' feedback, the data controller has to bear an administrative burden estimated to correspond to around €200 per (new) notification to the DPA, without including the notification fees charged by the DPA itself. This leads to an overall administrative burden of € 130 million per year due to notifications requirements (see Annex 9 for details). In addition to the administrative burden, other direct and indirect costs of the requirement and its fragmentation have to be taken into account. This includes, inter alia, direct fees for notifications collected by some data protection authorities.

As highlighted above, notifications are only one procedural element illustrating the effect of fragmentation with particular clarity, but by far not the most important one in terms of its economic effect. A more detailed estimation of the overall effects of fragmentation is provided in Annex 9.

The administrative burden resulting from the fragmentation within the EU internal market is estimated at about € 2.9 billion per annum[54], accounting for about half of the overall administrative burden linked to the Directive (i.e. about € 5,3 billion). These estimates are based on the Standard Cost Model and do not take account of compliance costs other than "administrative burden" (for example, to adapt to variable security requirements in different Member States). These additional compliance costs are, however, difficult to quantify given the variety of requirements across Member States.

To give an idea of overall compliance costs born by large and very large companies, a recent study - concerning companies based both inside and outside Europe[55] - estimates that each of these large multinational companies spends as an average €2.5 million per year on overall compliance with various data protection obligations (including administrative burden and other costs). A large part of these compliance costs are due to the fragmentation of national data protection rules - within the EU and beyond - and also cover compliance obligations non-data protection related. The same study concludes that the cost of non-compliance for such companies is much higher[56].

However, fragmentation is not only a problem for large, multinational enterprises. On the contrary, the complex situation on the ground deriving from diverging and sometimes conflicting data protection requirements at national level also constitutes a disincentive for all enterprises operating in the internal market from expanding their operations cross-border or establishing in more than one Member State. This problem thus concerns all EU businesses, including micro-enterprises and SMEs: this complexity leads to significant costs in terms of legal fees if they consider expanding their operations cross-border, and often acts as a disincentive from so doing. The outcome is that they do not reap the advantages of the internal market, with subsequent impacts on the EU economy, competition within the EU, and competitiveness in general.

b) Public authorities

Differences between Member States in implementing and interpreting the Directive also create difficulties for public authorities. It is difficult to estimate the costs, including the administrative burden, born by public authorities. Moreover, given the nature of their activities – generally addressed, in most cases, to individuals residing in the Member State of origin - they are likely to be only marginally affected by fragmentation.

However, fragmentation is relevant to the extent that it affects cooperation between national authorities aiming at attaining common EU objectives, for example in the area of public health[57].

One way of ensuring health protection is to produce information on health indicators and trends at EU level to compare national public health between Member States, identify health problems common to Member States and trace their causes, inform EU policy on health and take decisions based on evidence. Health data are considered sensitive under the Directive. Their processing for monitoring public health is only allowed in specific situations, in particular where consent is given by data subjects or for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of healthcare services or where Member States deem processing necessary due to substantial public interest. Since the Directive does not harmonise the rules for the processing of data specifically for public health purposes, Member States' practices vary greatly. As illustrated in the examples below, this lack of harmonisation and divergent national implementation affects cooperation between national authorities aiming at attaining common EU objectives.

Example 3: Divergent practices as a barrier to EU public health cooperation Two examples of difficulties in pursuing public health policies due to divergences in data protection requirements are cancer registries and contact tracing. In the first case, some Member States require the "prior informed consent" of individuals regarding the reporting of cancer incidence and mortality data, whereas other Member States have different requirements. The consequence of these differences is that cancer registries cannot operate in some Member States, or in some cases, the registries even collapse, and the reporting and comparison of cancer incidence across the EU is not sufficiently reliable. In the second case, the collection of data on communicable diseases for contact tracing from entities concerned by travel activities for public health purposes, is not effectively conducted within the EU because some Member States have established diverging conditions for the processing of such data. This problem was particularly acute, for instance, during the H1N1 flu pandemic.

c) Individuals

Legal uncertainty and complexity have a chilling effect of on the preparedness of businesses, in particular SMEs, to offer their services across borders or online at all. This reduces the choice of offerings for consumers and the competition in the market. The potential benefits of the online single market are only available to a limited extent. At the same time, legal uncertainty also affects directly the willingness of consumers to make use of online services and in particular cross border services. Concerns about privacy and data protection are one of the factors that act as obstacles to the full development of the online single market.

3.3. Problem 2 – Difficulties for individuals to stay in control of their personal data 3.3.1. Description of the problem

Individuals enjoy different data protection rights, due to fragmentation and inconsistent implementation and enforcement in different Member States. Furthermore, individuals are often neither aware nor in control of what happens to their personal data and therefore fail to exercise their rights effectively.

Globalisation and technological developments, particularly the fact that personal data are nowadays being transferred across an increasing number of virtual and geographical borders in the online economy, including through "cloud computing", further challenge the control individuals may keep over their own data.

a) Insufficient awareness, loss of control and trust, particularly in the online environment

In the online environment, it is increasingly difficult for individuals to be aware of the processing of the data related to them and the risks linked to such processing, to maintain control over their own data and, ultimately, to assert their rights vis-à-vis data controllers.

Two thirds of European citizens feel that the disclosure of personal data is a major concern for them and six in ten citizens consider that nowadays there is no alternative to disclosing personal data in order to obtain products and services[58]. Three quarters of citizens feel that they have either no or only partial control of their personal data on social networking sites[59].

– Insufficient awareness and underestimation of privacy risks

In order to be in control, individuals need to be aware by whom, on what grounds, from where, for what purposes, and for how long their personal data are being processed and what their rights are in relation to the processing. Currently, the duty to inform the data subject does not cover each of these elements; and even when sufficient information is available, it is often not understandable for the individual[60].

A 2008 survey[61] revealed that on average in the EU only 41% of data controllers maintain and update privacy policy notices. This percentage is even lower for SMEs[62].

When they are provided, online privacy policy notices ("Privacy Statements") are often overly complex, making use of technical and legal terminology. This complexity is reflected in the responses to a 2011 Eurobarometer survey: close to six in ten internet users claim they read privacy policies (58%), but only a third say that they read them and understand them (34%); a quarter say that they read them but do not fully understand them (24%). A quarter say they do not read them (25%), one in twenty say they do not know where to find them (5%) and almost one in ten ignore privacy statements (8%).[63]

The lack of readily available and easily understandable information makes it difficult for individuals to become aware of the risks linked to the use of their personal data and take the necessary measures to ensure their own protection. For instance, almost half of the respondents to a recent Eurobarometer do not feel sufficiently informed on social networking and file sharing sites[64].

This is particularly relevant with respect to children, who tend to underestimate the risks and consequences of making their personal data available online. A recent survey funded under the Safer Internet programme[65] shows that 38% of children aged between 9 and 12 and 77% of 13-16 year olds have a profile on a social network site (SNS)[66] even though the privacy policies of most social networking sites prohibit this. A quarter of 9-12 year olds have their profile as 'public', displaying in some cases private information such as their address and/or phone number to all other users.

– Loss of control and trust

As confirmed by a recent Eurobarometer survey[67], profiling, data mining, and technological developments that ease the exchangeability of personal data make it even more important for individuals to be in control of their personal data. The graph below shows the extent to which individuals feel in control of their personal data online.

||

In a recent Eurobarometer survey, 75% of respondents that owned an account on a social networking site and 80% of online shoppers consider that they have no or only partial control over their personal data. 70% of them are concerned that economic operators processing their personal data may use it for a different purpose than the one they were collected for[68].

In relation to profiling, the Directive grants individuals the right not to be subject to a decision which is based solely on automated processing of data intended to evaluate personal aspects of the data subject. This safeguard only applies to decisions based "solely" on automated processing so that there is a risk that it is easily circumvented by including a merely formal human intervention in the decision process which has no influence on its outcome. Examples for such procedures include the conditions of a telephone service or insurance contract, where conditions and tariffs are adjusted on the basis of a scoring of the potential customers on the basis of general and individual data related to him or her. While the decision to make a specific offer is formally with the sales staff, this person's decision is defined by the outcome of an automated system so that he or she effectively has no margin of decision to deviate from that suggestion. In the specific case of behavioural advertising[69], 54% of Europeans feel uncomfortable with practices which involve online profiling and a large majority of them (74%) would like to be given the opportunity to give (or refuse) their specific consent before the collection and processing of their personal data[70].

With current technologies it is possible to collect and process personal data anywhere, at any time and in many different forms. For instance, mobile devices can nowadays easily obtain information about the geographical location of individuals in real time by many different technological means[71]. Services based on location information are considered one of the most dynamic areas for innovation. Location based services can provide considerable benefits to individuals, from improved real-time routing algorithms which consider traffic density and congestions and provide faster and more fuel-efficient routes than static systems, over faster dispatching of emergency services based on accurate real-time location information, to advertising services in the immediate vicinity of the requesting individual. The possibilities for using location information as parameters in services such as search, social networking or other web 2.0 services are still being explored. On the other hand, location information may be retained to create motion profiles of individuals containing information about their each and every move at a level of detail and for a period far beyond what individuals would remember themselves. Divergent application of data protection rules would not only hamper the development of useful services, but would also reduce citizens' willingness to use existing services when they fear becoming subject of constant monitoring of their lives.

When using online services, individuals are associated with technical (online) identifiers provided by their devices, applications, tools and protocols[72] and leave traces of their activity at each server they communicate with. This interaction log and other information received by the servers, e.g. time and contact of interaction, location data etc, can build a very detailed trace of an individual's online activity. Even without a name or other traditional identifying attribute, it is often possible to effectively identify the individual to whom the data relates. However, legal practice in Member States differs as to the assessment of identifiability of such online data collections (and hence whether to consider such data as personal data) and thereby leaves individuals with uncertainty and effective impossibility to assert their rights regarding the fastest growing and most comprehensive collections of data about their behaviour. While some Member States recognise the sensitivity of such data and provide for clear rules on the use and retention of usage data, others do not provide for legal provisions addressing this issue, leaving the application of data protection principles to decision on a case by case basis.

The fact that important data controllers operating in the digital/online market are established outside the EU makes it even more challenging for individuals to keep control over their own data in such cases and to effectively exercise their rights. The practical application of the criteria provided by the Directive on whether and when EU laws are applicable to processing of personal data by controllers established outside the EU/EEA is currently subject of considerable discussion. Member States apply different interpretations regarding the "use of equipment" on the territory of Member States[73]. Other relevant issues of interpretations concern the identification of the actual data controller and the distinction between controllers and processors. Moreover, even in cases where the applicability of EU legislation is established, enforcement of data protection laws and administrative measures and decisions remains problematic. Even when parts of the equipment used for processing are located within the EU, EU based authorities usually have no means to enforce decisions or sanctions on entities whose main establishment is outside the territory of their jurisdiction. They may also meet difficulties to enforce the basic requirement for the establishment of an EU representative by data controllers not established in the EU but subject to EU legislation. In particular in cases where services are clearly customized to address citizens of a specific EU Member State, by using the county's languages and adapting to its cultural preferences and obtaining revenue from advertising local brands, products and services, it is usually not even possible for the citizen to recognize that by using such services they are entrusting their personal data to a data controller which may not effectively be subject to the adequate data protection legislation.

Where personal data is collected by an entity established in the EU which is part of an international group or acts on behalf of a main service provider outside the EU, provision of services is often based on the transfer of most or all personal data collected to processing facilities outside the EU. In principle, such transfers to third countries are subject to conditions which shall ensure that appropriate data protection safeguards are observed by the receiving entity in a third country. From an individual's perspective, it is important to know whether the controller – e.g. as a provider of a service on the web – complies with the conditions and legal requirements, and how to obtain support in case of a suspected breach of the rules.

– Data breaches

The increased number of data breaches of large companies’ customer databases is an additional factor undermining individuals' trust and confidence. As shown by the example below, these security failures may lead to harmful consequences for individuals, ranging from undesired spam to identity theft[74]. In the context of the SME consultation, in relation to data breaches, 7.1% of respondents have recently experienced a breach (of which 55% actually informed the individuals whose data were affected by breaches) and indicated a cost of less than €500 for the notification (see Annex 8 for details).

Example 4: Recent data breach case putting data subjects' personal data at risk

One recent prominent case of data breach was that of a gaming service, in which according to media reports tens of million user accounts were compromised by hackers, including users' names, addresses and possibly credit card data. A further problem in this case was the fact that the data controller delayed the notification of the breach to data subjects by one week after the breach in the security of the network had been discovered. This attracted additional criticism by users, and prompted questions on whether there needed to be explicit deadlines within which a data controller must notify a data breach to data subjects and supervisory authorities.

Individuals react on the increase of data breaches with raising concern. The percentage of individuals that would want to be informed when their personal data is lost, stolen or altered in any way is constantly increasing and has reached the level of 88% EU wide[75]. At present, EU wide harmonised rules on the notification for data breaches exist only for the electronic communications sector, which are still being implemented by many Member States following the 2009 Telecom Reform. For other sectors, some Member States have implemented rules at national level through different legal instruments (laws, regulations, guidance by the DPA, but no harmonised rules have been established so far. Increasing pressure to establish such rules could move national legislators to adopting national legislation on breach notifications. This could create the risk of increased divergence between Member States on this aspect.

– Fragmentation

Individuals’ confidence and trust is already weakened by the fragmentation, legal uncertainty and inconsistent enforcement of data protection rules across Member States. The same individual, travelling to another Member State or shopping cross-border on the internet, would see his/her rights, and the way of exercising them, vary significantly depending on the applicable national legislation. Thus, individuals, even if they are aware of the data protection provided by their own Member States, often do not know how to exercise their data protection rights when their personal data are processed across several Member States. This is an additional factor reducing their readiness to shop for goods and services from other Member States.

According to the Digital Agenda for Europe, a lack of trust in the online environment is hampering the development of Europe's online economy. A recent Eurostat survey shows that privacy and trust concerns are amongst the top reasons preventing people from buying online[76]. Among people who did not order online in 2009, the top reasons were: payment security concerns, privacy concerns, and trust concerns.

.

Source: Eurostat Community Survey on ICT Usage by Households and by Individuals 2009

b) Difficulties in exercising data protection rights

The Directive provides for a set of rights for individuals, such as the right to access, rectify, block and delete their own data, as well as the right to receive information for what purposes and by whom their data are processed. The Directive also provides judicial remedies as well as the right to receive compensation for damage suffered. These rights are, however, expressed in general terms and the way they can actually be exercised is not clearly specified.

– Difficulties to access one’s own data

Access to personal data is a significant matter[77]: as evidenced by a 2008 survey of data controllers, 46% of data controllers surveyed indicated that their company had received requests for access to personal data in the preceding year[78].

However, individuals can access their own data more easily in some Member States than in others. In some Member States, data controllers are allowed to demand a fee to access their data, while in others it is free of charge[79]. Some Member States impose a deadline on data controllers to respond to access requests, while others do not. The Commission has received several complaints from individuals that asked data controllers for access to the data stored about them and received no or unsatisfactory responses. Complaints to their national data protection authorities did not lead to effective remedies, as these authorities declared themselves not competent or incapable of following up in some cases. All these observations contribute to individuals' perception that their rights are not effectively guaranteed by the current implementation of the framework across the Member States.

– Difficulties to have one's own data deleted – the “right to be forgotten”

The right to request the deletion of data is provided by the Directive, but in practice it is difficult for an individual to enforce this right vis-à-vis the data controller. Recent reported cases about people seeking to have their data deleted from a social network are a telling example of the practical difficulty to exercise this right especially in the online environment[80].

While the Directive already requires that data is not kept in a form which permits identification of data subjects for any longer than necessary for the purposes for which the data were originally collected or for compatible purposes for which they are further processed, in practice this is often not implemented properly. For an individual, it is very difficult to assess the data preservation policies of a data controller. In any case, if the processing of personal data is based only on the consent of the data subjects, there is generally no justification for keeping this data after the data subjects have withdrawn their consent and requested deletion of the data. Faced with different interpretations and practices in different Member States, both individuals and data controller need more clarity on the rules on the deletion of data.

– Difficulties to withdraw and transfer personal data from an application or service – “data portability”

There is also no explicit right for the individual to extract his/her own personal data (e.g. his/her photos or a list of friends) from an application or service in a format that may be processed further, so that the individual may transfer data to another application or service. With increasing use of certain online service, the amount of personal data collected in this service becomes an obstacle for changing services, even if better, cheaper or more privacy friendly services become available. This could mean the loss of contact information, calendar history, interpersonal communications exchanges and other kinds of personally or socially relevant data which is very difficult to recreate or restore. Even where possible, re-entering the data manually into another service can be a major effort. This situation effectively creates a lock-in with the specific service for the user and makes it effectively very costly or even impossible to change provider and benefit from better services available on the market. Portability is a key factor for effective competition, as evidenced in other market sectors, e.g. number portability in the telecom sector.

– Difficulties to access effective remedies

As regards administrative and judicial remedies and compensation, individuals are in most cases not aware of the possibility to lodge a complaint to a DPA: 63% of respondents to a recent Eurobarometer have never heard of any public authority responsible for the protection of personal data[81].

Therefore, in many Member States judicial remedies, while available, are very rarely pursued in practice. This is also related to a general reluctance to bring an action to court against large global companies in particular, when costs for legal action are disproportionate compared to the potential compensation that could be obtained.

Whereas the Directive provides the possibility that associations representing a data subject may lodge claims to the DPA, there is not a right to be represented by an association in a court case, which might otherwise give an incentive and limit the financial risk of going to court in relation to an infringement of data protection rules.

3.3.2. Who is affected and to what extent?

The difficulties in exercising data protection rights potentially affect every individual in the EU, given the rapid growth of digital information on individuals as a result of evolving information and communication technologies. Processing of personal data is part of everybody's daily life: every transaction is likely to create a digital record, e.g. opening a bank account, shopping on line (on average, about 40% of individuals in the EU currently use the internet to purchase goods and services[82]), requesting a shop's loyalty card, buying a book or uploading photos on the internet.

a) Individuals

Individuals, including children, are potentially exposed to different types of harm. This includes reputational or even physical harm (caused e.g. by the publication of health-related data on a public blog without the concerned person's consent or harassment caused e.g. by unsolicited advertising) and also financial harm particularly by identity theft, the total cost of which at EU level is estimated at around €700 million per year[83]. In particular for young people, the disclosure of personal data can cause immense social and mental harm. The media have given much attention to several recent cases where sensitive personal information was published and led to bullying and harassment or serious humiliation so that the victim was driven into suicide. Personal data breaches are also becoming more common and more severe. A 2010 study[84] in the UK indicates that, out of 622 UK-based IT and business managers, analysts, and executives from 15 industry sectors, 71% reported at least one incident of data breach in their respective organisations. The same study reports that while the average organisational cost of a data breach decreased by nearly 3% – from £1.73 million in the 2008 annual study to £1.68 million in 2009 – the average cost per compromised personal data-set rose by £4 (7%), from £60 to £64 (approximately €74[85]).

Based on information from 20 Member States, there were 54,640 complaints concerning (potentially) unlawful processing of personal data or breaches of data protection rights in the EU in 2009[86]. Half of the total number of requests and complaints received by the Commission in 2010 in relation to fundamental rights and freedoms concern data protection[87]. Many individuals may have experienced detriment, but either resolved the issue with the data controller or did not pursue the complaint. Those that pursue a complaint are likely to have experienced significant harm. Over a third (39%) of all potential EU users of the internet may not be fully benefitting because of concerns over safety and data protection[88]. Individuals limit their use of new technologies, particularly the internet and online services, because of lack of trust in the digital environment and fears about possible misuse of their personal data. Those not benefitting from ICT because of fears over data protection lose out in terms of price benefits online and in time taken to access goods and services.

Privacy and the protection of personal data are fundamental rights enshrined in the Charter of Fundamental Rights of the European Union. They play a key role for the exercise of fundamental rights in a broader sense. Many of the fundamental freedoms can only be fully exercised if the individual is reassured that it is not subject of permanent surveillance and observation by authorities and other powerful organisations. Freedom of thought, freedom of expression, freedom of assembly and association, but also the freedom to conduct a business will not be exercised fully by all citizens in an environment where the individual feels that each of her or his moves, acts, expressions and transaction is subject to scrutiny by others trying to control him or her. Exercise of these freedoms is crucial to maintain all fundamental rights.

In a free and democratic society, the individual must have reassurance that fundamental rights are respected. Measures to protect individuals with regard to the processing of personal data must be effective, credible and easily accessible for the individual. Information about risks to privacy must be made accessible and the conditions of the processing of personal data must be transparent and understandable.

In today's digitised society, communication and interaction rely on digital media and communications channels. Web 2.0 tools, including social media, play an increasingly important role for social interaction and exchange. Not being able to use these media effectively restricts the exercise of fundamental rights in the social reality. Where the individual suspects that his or her interactions in this space are subject of surveillance, collection and analysis by authorities, service operators or others, it looses partly the possibility of exercising some fundamental rights. This chilling effect can already be caused by the perception of surveillance, which may or may not exist. The lack of transparency of processing and of accessible means to effectively enforce data protection rules is therefore directly affecting individuals' fundamental rights.

The same effect is also true with regard to the economic aspects of citizens' life. Be it consumers who are subject to profiling and classification, or employees or job candidates subject to extensive research and analysis of their online activities, the economic possibilities of individuals are reduced towards the organisations having access to extensive data collections about them. The individual's negotiation position is severely affected by the imbalance of information and the possibility of the other side to use detailed knowledge of the situation and needs, e.g. when offering a loan or an employment contract with less advantageous conditions for the consumer or employee.

Lack of transparency of data processing, lack of credible enforcement and the absence of effective remedies and sanctions for violations of the principles contribute to creating a climate in which the individuals do not rely on exercising their fundamental freedoms and economic rights fully, even when some concerns regarding data collection and surveillance may be exaggerated over the reality. Doubts about the actual degree of protection have a chilling effect on democracy and also on the economic activity in the market.

b) Economic operators

Many economic activities are linked to the processing of personal data. The current inconsistent application of EU laws impacts the take-up of online and audiovisual media services. Individuals limit their use of new technologies because of a lack of trust in the digital environment and fears about possible misuse of their data. This creates costs for economic operators and public authorities and slows down innovation. Strong growth of the internet economy, widespread use of new mobile devices and the expansion of e-commerce and other web-based services could bring tremendous economic benefits.

c) Public authorities

Public authorities have undertaken considerable investments in making public services accessible online. This dematerialisation can create considerable benefits in terms of efficiency, quality of services and reduction of resources required for the provision of services. When citizens can enter their requests for certain public service directly into online systems, they enjoy a better service then when they would have to go to the authority physically or to communicate in writing, while the authority at the same time saves resources for servicing physical visitors or processing paper mail and for entering data into their systems.

The potential benefits require citizens' willingness to make use of online offerings. Lack of confidence and trust in the services, fear or potential misuse of data collected will make many potential users refrain from using these services. With growing concern about privacy in the online world, this section of the population may grow further. This development reduces the value of the investments in public online services and their positive effects for the public budget, when the more traditional and more expensive ways of offering public services have to be maintained.

3.4. Problem 3 – Gaps and inconsistencies in the protection of personal data in the field of police and judicial cooperation in criminal matters 3.4.1. Description of the problem[89]

The scope of the Directive, based on an internal market legal basis, specifically excluded police and judicial cooperation in criminal matters. The Framework Decision adopted in 2008 to regulate data processing in the area of police cooperation and judicial cooperation in criminal matters reflects the specificities of the pre-Lisbon "pillar" structure of the EU[90] and is characterised by a limited scope and various other gaps, often leading to legal uncertainty for individuals and law enforcement authorities, as well as to practical difficulties of implementation. Moreover, while the Framework Decision contains general data protection principles (e.g., on lawfulness of data processing, right to access, rectify and delete one's own personal data), it provides at the same time for wide possibilities of derogating to them at national level, thereby not harmonising them. This does not only risk emptying such principles of their very purpose – and thus negatively affecting the fundamental right of individuals to the protection of their personal data in this area - but also hinders the smooth exchange of personal data between relevant national authorities. This situation is aggravated by the uncertain relation between the Framework Decision and existing "former third pillar" instruments with specific data protection rules, which adds to the complexity of the legal framework at EU level and increases the legal uncertainty for both individuals and law enforcement authorities.

a) Limited scope of application of the Framework Decision

The Framework Decision is limited in scope in that it does not cover data processing by police and judicial authorities at domestic (purely national) level, since its scope is limited to cross-border processing activities (i.e. personal data that "are or have been transmitted or made available" between Member States or between a Member State and Union authorities or bodies[91]). This is problematic both in legal and in practical terms. Legally, the newly established Article 16 TFEU covers all areas "which fall under the scope of Union law" - thus including police cooperation and judicial cooperation in criminal matters[92]. Hence, both 'purely domestic' and 'cross-border' activities are covered. Given that the Framework Decision only covers cross-border processing activities of police and judicial authorities in criminal matters, the legislator has now the duty to extend its scope in order to fill this gap, which causes several problems[93].

First of all, as confirmed by several Member States' experts during the workshop organised on 2 February 2011 on the implementation of the Framework Decision and in the replies to the Commission's questionnaire related to the implementation of the Framework Decision[94], personal data which have been gathered in a purely domestic context can hardly be factually distinguished from data that have been subject to cross-border transmission. Plus, a priori, any purely domestically processed data may be subject to cross-border transmission. This somehow "artificial" distinction thus complicates the actual implementation and application of the Framework Decision: law enforcement authorities are burdened by unmanageable distinctions between domestic data and data transmitted or available for transmission. Criminal files are in quite a number of cases composed of data originating from different authorities. The consequence of the limited scope is that parts of such files — the parts containing data originating from authorities in other Member States — are protected under the Framework Decision whereas other parts are not protected, or at least not under the same regime. In addition, the legal certainty for individuals can be harmed since data originating from third countries, but not exchanged between Member States are not covered by the Framework Decision. The processing of those data entails specific risks to the data subject should there be, for instance, no legal obligation in a Member State to examine the accuracy of those data.

Secondly, good co-operation between Member States requires there to be mutual trust between Member States, as a condition for a successful exchange of information. If common standards are applied to the processing of data this will facilitate cooperation and mutual exchange of information between Member States' law enforcement authorities.

Finally, this distinction exists neither in the Directive nor in the relevant Council of Europe instruments[95].

b) Low level of harmonisation of the Framework Decision

The Framework Decision provides for a very minimum level of harmonisation and leaves a very large room for manoeuvre to Member States in terms of its implementation into national law, for example in relation to the right of access of individuals to personal data related to them (Article 17) or to the exceptions to the purpose limitation principle (Articles 3 and 11). Provisions on information to be given to data subjects are very general (Article 16) and basically refer to national laws, and therefore implemented variably. Moreover, the Framework Decisions allows national laws to impose higher safeguards than those established in there for any issue covered (Article 1(2)). In certain cases, specific national processing restrictions in place in one Member State have to be met by the other Member States (Article 12). Therefore, exchanges of information still remain subject to very different national ‘rules of origin’ and varying standards that affect efficiency in law enforcement cooperation. As a consequence, police authorities may have to apply heterogeneous legal requirements to processing systems containing data originating from different Member States depending on various factors, such as whether personal data have been collected domestically or not, whether each of the transmitting bodies has given its consent for the envisaged purpose, whether further processing restrictions requested by each of the transmitting bodies exist etc.

Also rules on international transfers (Article 13) leave a large room of discretion to Member States in assessing the "adequacy" of a third country for the purposes of transferring personal data to prevent, investigate, detect or prosecute criminal offences or the execution of criminal penalties. This creates legal uncertainty and affects practical implementation, as pointed our by some Member States in their reply to the questionnaire on the Implementation of the Framework Decision, calling for more uniform rules in this area[96]. The absence of a sufficiently harmonised system for the exchange of personal data with third countries also harms the trust between the authorities of the Member States, since an authority might be less willing to share information with an authority in another Member State if this Member State could also share this information with authorities of third countries in the absence of clear safeguards. It also enables "forum shopping" by authorities of third countries: those authorities could ask for information in the Member State with is considered to have the lowest legal requirements for transfers.

Additionally, the Framework Decision does not contain any mechanism – no implementing powers for the Commission, no advisory group similar to the "Article 29" Working Party - fostering a common approach in its implementation or supporting common interpretation of its provisions. The Commission has currently no infringement powers in cases of non- or incorrect transposition of the Framework Decision, and the Court of Justice has limited powers as well for a transitional 5-year period from the entry into force of the Lisbon Treaty[97].

c) Additional gaps and shortcomings of the Framework Decision

The Framework Decision also fails to address issues that are particularly important in the framework of data processing by police cooperation and other law enforcement authorities.

First of all, there are no specific provisions in the Framework Decision regulating the processing of genetic data for the purposes of a criminal investigation or a judicial procedure. As pointed out very clearly by the European Court of Human Rights[98], this is an area were clear rules are essential to regulate the scope and application of measures by law enforcement authorities. The Court ruled that protection afforded by Article 8 of the European Convention on Human Rights would otherwise be unacceptably weakened by the use of modern scientific techniques (such as DNA testing) in the criminal justice system without a careful balancing between the potential benefits of the extensive use of such techniques against important private-life interests.

Other relevant issues not covered by the Framework Decision, which are included in some other "former third pillar" instruments as well as in Recommendation No R (87) 15 of the Committee of Ministers to Member States regulating the use of personal data in the police sector, are the following:

– The need to distinguish personal data according to their degree of accuracy and reliability, or whether they are based on facts or on opinions or personal assessments. The lack of such a requirement could actually undermine the data being exchanged between police authorities as they will not be able to ascertain whether the data can be construed as ‘evidence’, ‘fact’, ‘hard intelligence’ or ‘soft intelligence’. This could have the consequence of hampering security operations and of making it more difficult for courts to secure convictions;

– The need to distinguish between different categories of data subjects (criminals, suspects, victims, witnesses, etc.), and to provide in particular for specific guarantees for data relating to non-suspects. Again, these distinctions are on the one hand necessary for the protection of the concerned individuals and on the other hand for the ability of the recipient law enforcement authorities to be able to make full use of the data they receive.

d) Unclear relation between the Framework Decision and other "former third pillar" instruments

In addition to the above problems linked to the limited scope and other gaps of the Framework Decision, the relation between its provisions and specific data protection rules contained in other "former third pillar" legal acts[99] – adopted prior to the Framework Decision - is not entirely clear. In principle, the Framework Decision leaves unaffected most of the acts previously adopted containing specific data protection provisions, in particular where such provisions constitute "a complete and coherent set of rules"[100]. In other cases, however, the Framework Decision is only partially applicable, i.e. it does not apply where the provisions of these (former third pillar) acts impose conditions upon the receiving Member States that are "more restrictive" than those in the Framework Decision[101]. These rules setting the relation between the Framework Decision and data protection provisions contained in other acts in the area of police and judicial cooperation in criminal matters are unclear and leave a large room for interpretation on a case-by-case basis as to which rules shall apply to a concrete situation.

The result is a fragmented environment creating legal uncertainty for both the concerned individuals and law enforcement authorities. As a consequence, law enforcement agencies may be reluctant to share information for enforcement purposes due to concerns about the legal consequences[102]. This negatively affects the effectiveness of cross-border cooperation in this area.

Example 5 – Difficulties for police authorities created by a variable and complex legal environment

A police authority in one Member State (country A) is dealing with an investigation related to cross-border trafficking of human beings. The nature of the case implies that information, including personal data of suspects, is required from two other Member States (country B and country C).

When processing the data related to the above investigation, the police authorities in country A have to apply different data protection rules for different aspects of the file related to the investigation, depending on whether the data come from their own Member State or have been received from country B or C. This means that, for example, different rules may apply to the further transmission of data related to the investigation – which may not be easily separated/distinguished depending on their origin - to other non-police authorities (i.e., immigration or asylum authorities) or in relation to the information that can be provided to the individuals concerned.

3.4.2. Who is affected and to what extent?

The complex and fragmented legal environment in the area of police cooperation and judicial cooperation in criminal matters is highly problematic as it creates uncertainties about the rules applicable and hence affects individuals, public authorities and private data controllers, in the following way:

– Individuals are unlikely to know which rules apply to the processing of personal data by the police and other law enforcement authorities and thus what their rights are in this context. They also enjoy different rights depending on which Member State or public authority is processing their data.

– The differences in Member States' data protection standards in this area, as well as the uncertainties about the rules to be applied to a specific situation, affect the smooth cooperation between Member States' police and judicial authorities. The fact that different, sometimes conflicting rules, may apply to personal data related to a same investigation – depending on the origin of the data and/or on which specific instruments apply - adds a layer of complexity to the work of police and other competent authorities in Member States, particularly in the case of cross-border matters.

– Private companies operating in different Member States are affected by the absence of common and uniform rules at EU level on issues such as further processing by law enforcement authorities of data held by them.

3.5. The drivers behind the identified problems

The main drivers behind the three problems are the shortcomings of the existing legal framework and of the current governance system in the area of data protection.

As regards the Directive, the analysis of the problems showed that, while most of its key principles remain sound, several of its provisions are not sufficiently clear, are sometimes difficult to apply to new situations and developments and often leave an excessively large margin of manoeuvre to Member States in their national implementation. This leads to important variations and divergences across the EU. Enforcement of the Directive is not always satisfactory and, above all, is inconsistent across Member States.

This has precluded the desired level of harmonisation within the internal market, created legal uncertainty and unnecessary costs for business (Problem 1) and made it difficult for individuals to exercise their rights effectively (Problem 2).

Protection of personal data in the area of police co-operation and judicial co-operation in criminal matters is characterised by a lower level of harmonisation (limited scope, wide derogations, insufficient safeguards) and a fragmented landscape, leading to legal uncertainty (Problem 3). Enforcement is even more problematic in this area given the peculiarities of the "former third pillar acquis" in terms of (limited) powers of the Commission and of the ECJ.

Globalisation and technological developments have contributed to and exacerbated all three problems, by greatly facilitating and encouraging the exchanges and flows of personal data worldwide in all areas and sectors, including law enforcement, with the development of new applications and services and the availability of increasingly sophisticated tools.

3.6. Baseline scenario: How would the problem evolve?

Globalisation and technological developments, which are the common drivers of the problems are expected to pose ever-increasing challenges to the fundamental right to data protection. The extent