EN Official Journal of the European Union C 295/1

Opinion of the European Data Protection Supervisor on the proposal for a Regulation of the European Parliament and of the Council on Community statistics on public health and health and safety at work (COM(2007) 46 final)

(2007/C 295/01)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1),

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (2), and in particular its Article 41,

Having regard to the request for an opinion in accordance with Article 28(2) of Regulation (EC) No 45/2001 received on 12 February 2007 from the European Commission,

HAS ADOPTED THE FOLLOWING OPINION:

Consultation of the EDPS

1. The proposal for a Regulation of the European Parliament and of the Council on Community statistics on public health and health and safety at work (hereinafter ‘the proposal’) was sent by the Commission to the EDPS for consultation, in accordance with Article 28(2) of Regulation (EC) No 45/2001. In view of the mandatory character of Article 28(2) of Regulation (EC) No 45/2001, the EDPS welcomes the explicit reference to this consultation in the preamble of the Proposal, in the language used by the Commission (‘After consulting the European Data Protection Supervisor’), which is a consistent and standardized way of referring to EDPS Opinions.

2. It is the first time that the EDPS has been directly consulted on a proposal for a Regulation in the field of Community statistics. However, there have been several acts adopted on this general subject before the appointment of the EDPS. This consultative opinion follows the contacts between the EDPS secretariat and the services of the relevant DG of the Commission (Eurostat) as well as a meeting held in the premises of Eurostat, in the framework of the EDPS inventory exercise 2007.

The proposal in its context

3. The proposal's goal is to give a consolidated and firm basis for collections already implemented or for which methodology is currently being developed or implementation prepared, through providing a basic legal act in the areas of public health and health and safety at work statistics. Indeed, it is clear to the EDPS that the current proposal refers to existing practices and fulfils the need of a legal background to these practices. The domains covered by the proposal relate to ongoing activities and developments carried out together with the Member States in the relevant groups of the European Statistical Office (hereinafter ‘Eurostat’) or, in the area of public health, of the Partnership on public health statistics.

4. As stated in the proposal, it aims at establishing the framework for all current and foreseeable activities in the field of Public health and Health and Safety at Work statistics carried out by the European Statistical System (i.e. Eurostat), the national statistical institutes and all other national authorities responsible for the provision of official statistics in these areas. It is understood that the proposal is not aimed at policy developments for these two fields, which are carried out respectively under Articles 152 and 137 of the Treaty. The proposed regulation sets the general principles and describes the main contents of the related data collection in its Annexes I to V for the 5 domains concerned, namely statistics on health status and health determinants, health care, causes of death, accidents at work as well as occupational diseases and other work-related health problems and illnesses.

5. The EDPS notes that several initiatives (Council Resolution, Decision, Commission Communication, Action Plan) (3) called for the development of specific legislation in the statistical field which would improve the quality, comparability and accessibility of data on health status using the Community Statistical Programme. Moreover, the EDPS understands that a common statistical data collection on the Systems of Health Accounts has been recently implemented together with the Organisation for Economic Cooperation and Development (OECD) and the United Nations (through the World Health Organisation (WHO).

6. The need for a legal basis has emerged because until now statistical data collections were carried out on the basis of ‘gentlemen's agreements’ with the Member States in the framework of the five years Community Statistical Programmes (from 2003 till 2007) and its annual components. Decision No 1786/2002/EC of the European Parliament and of the Council of 23 September 2002 adopting a programme of Community action in the field of public health (2003-2008) (4) stated that the statistical element of the information system on public health is to be developed, in collaboration with Member States, using as necessary the Community statistical programme to promote synergy and avoid duplication. In particular, in the area of public health statistics, the developments and implementations in the three strands (causes of deaths, health care and health interview surveys, disability and morbidity) are steered and organised according to a partnership structure between Eurostat, together with leading countries and Member States. The proposal also presents a great interest in that there is a need for a high standard statistical information system for assessing achievements of policies and developing and monitoring further actions in both areas of public health and health and safety at work. This proposal will also enable Member States to benefit from improved planning in terms of time and from clearer requirements for the requisite data standards.

7. The EDPS is pleased to see that an impact assessment has been carried out by the Commission, proposing different alternatives regarding the development of statistics in the areas of public health and health and safety at work, whose current proposal for a Regulation is one of those alternatives (5). The EDPS also agrees with the fact that a Regulation is the legal instrument most appropriate for statistical actions which require detailed and uniformed application throughout the Community.

8. Article 285 of the Treaty establishing the European Community lays down the legal basis of statistical activities at European level. This Article sets out requirements relating to the production of Community statistics and, as underlined in its paragraph 2, requires ‘conform[ity] to [standard of] impartiality, reliability, objectivity, scientific independence, cost-effectiveness and statistical confidentiality’. This Article implies that measures for the production of statistics are of exclusive competence at Community level.

9. The production of Community statistics is governed by the rules set out in Council Regulation (EC) No 322/97 of 17 February 1997 (6) on Community Statistics, as amended by Regulation (EC) No 1882/2003 of the European Parliament and of the Council (7). Besides, statistical confidentiality is guaranteed through Council Regulation (Euratom, EEC) No 1588/90 of 11 June 1990 on the transmission of data subject to statistical confidentiality to the Statistical Office of the European Communities (8) and by Commission Regulation (EC) No 831/2002 of 17 May 2002 implementing Council Regulation (EC) No 322/97 on Community Statistics, concerning access to confidential data for scientific purposes (9). Moreover, the proposal also refers to Commission Decision 97/281/EC (10) of 21 April 1997 on the role of Eurostat as regards the production of Community statistics.

10. Finally, the EDPS is also aware that a proposal of the European Parliament and of the Council on European statistics will be presented by the Commission in autumn 2007, according to the agenda planning of the Commission (11). This Regulation will have an impact on the protection of individual's rights and freedoms with regard to the processing of personal data in the field of statistics. This Regulation will develop and harmonise the general legal framework and the impact of this Regulation on the current analysis can not be ignored. The EDPS will follow the developments regarding this text and issue a reaction, in the light of his consultative role, based on his inventory.

11. Moreover, following the meeting held in the Eurostat premises, the EDPS and Eurostat will conduct a common review of the processing operations put in place in Eurostat when dealing with individual records for statistical purposes. This review will be conducted in parallel to the intervention of the EDPS regarding the proposal for a Regulation on European statistics.

The relevant data protection legal framework

12. Recitals 11 and 12 of the proposal state that the present Regulation (proposal) ensures full respect for the right to the protection of personal data as provided for in Article 8 of the Charter of Fundamental Rights of the European Union and that the Directive 95/46/EC and Regulation (EC) No 45/2001 shall apply in the context of the Regulation.

13. Directive 95/46/EC (further the Directive) and Regulation (EC) No 45/2001 (further Regulation (EC) No 45/2001) consider data concerning health as special categories of data whose processing should in principle be prohibited. However, they allow the processing of personal data on health for reasons of substantial public interest subject to provision of appropriate safeguards. According to the proposal, the substantial public interest is constituted by ‘the statistical requirements to which Community action in the field of public health, national strategies for the development of high-quality, accessible and sustainable health care and Community strategy on health and safety at work give rise, as well as requirements arising in connection with structural indicators, sustainable development indicators and European Community health indicators and other sets of indicators which it is necessary to develop for the purpose of monitoring Community and national political actions and strategies in the areas of public health and health and safety at work’ (12). It is necessary, however, to provide specific and suitable safeguards so as to protect the fundamental rights and the privacy of individuals. The Commission considers that Regulations (EC) No 322/97 and (Euratom, EEC) No 1588/90 provide the appropriate safeguards for the protection of individuals in the case of the production of Community statistics on public health and health and safety at work.

Data Protection and Statistical Confidentiality

14. The proposal underlines the importance of statistical confidentiality of data received by Eurostat. This concept of confidential data has to be analysed in the light of the notion of personal data, as defined by Directive 95/46/EC.

15. The definition of personal data contained in Article 2(a) of Directive 95/46/EC reads as follows: ‘Personal data shall mean any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity’. Moreover, recital 26 of the Directive states: ‘whereas, to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person’. The Article 29 Working Party recently issued an opinion (13) on the concept of personal data, analysing its four main components (‘any information’, ‘relating to’, ‘identified or identifiable’, ‘natural person’).

16. Statistical confidentiality is defined by Article 13 or Regulation (EC) No 322/97 as follows: ‘Data used by the national authorities and the community authority for the production of Community statistics shall be considered confidential when they allow statistical units to be identified, either directly or indirectly, thereby disclosing individual information. To determine whether a statistical unit (14) is identifiable, account shall be taken of all the means that might reasonably be used by a third party to identify the said statistical unit. By derogation, data taken from sources which are available to the public and remain available to the public at the national authorities according to national legislation, shall not be considered confidential’. The concept of reasonableness is applied to the protection of confidentiality. This recognises the fact that, although all reasonable measures must be taken to prevent disclosure, absolute protection of data would prevent the production of virtually all outputs.

17. The two definitions have similarities in their wordings, in that they use similar vocabulary. It seems obvious to the EDPS that Article 13 of Regulation (EC) No 322/97 has been written with Directive 95/46/EC in mind. However, it is also important to underline that the (almost) similar definitions are related to two different concepts and that they cover two different terms that should not be mistaken, ‘confidentiality’ on one side and ‘personal data’ on the other side. For instance, the definition of confidentiality also deals with non natural/physical persons, while the notion of personal data relates exclusively to natural persons. Moreover, the definition of confidentiality, unlike the notion of personal data, excludes data taken from sources which are available to the public and remain available to the public. Therefore, some data which may not be considered as confidential anymore from a statistical point of view could still be considered as personal data from a data protection point of view.

18. The same analysis occurs with the notion of anonymity. Although, from a data protection view, the notion of anonymity would cover data that are no longer identifiable (see recital 26 of the Directive), from a statistical point of view, anonymous data are data for which no direct identification is possible. This definition implies that indirect identification of data would still qualify these data as anonymous, from a statistical point of view.

19. Moreover, the EDPS is aware that statistical data which are being processed will mainly be indirectly identifiable data. Therefore, it is important that the guidelines and methodologies which are developed by Eurostat regarding the protection of confidential data should explicitly mention the treatments from a data protection point of view. It is therefore the opinion of the EDPS that, in order to avoid possible misunderstandings when using these notions, the context and legal framework in which these notions are being used should be always clearly and precisely defined.

20. This is also important in the sense that the current legal framework enables access to anonymised microdata available at Eurostat only for scientific purposes. The release of the data sets to researchers is governed by Regulation (EC) No 831/2002 (15) and (EC) No 1104/2006 (16). According to this text, access to confidential data shall mean either access on the premises of the Community authority or release of anonymised microdata. Therefore, these anonymised data, understood from a statistical point of view, might still allow indirect identification of statistical units. In this case, any transfer of data relating to identifiable individuals for scientific purposes would be a transfer of personal data and should therefore comply with the relevant Articles of Directive 95/46/EC on transfer of data.

Transmission, dissemination and publication of statistical data

21. From a data protection point of view, the cornerstone of the proposal is Article 6. It foresees that Member States shall transmit the microdata or, depending on the domain and subject concerned, the aggregated data, including confidential data as defined by Article 13 of Regulation (EC) No 322/97, and the metadata, required by this Regulation and measures implementing it, to the Commission (Eurostat) in accordance with the existing Community provisions on transmission of data subject to statistical confidentiality.

22. Therefore, the proposal deals with the transmission of specific categories of health related data from Member States to Eurostat. Three categories of data are concerned: microdata, aggregated data and metadata. From a statistical point of view, microdata consist of individual statistical records relating to single statistical units. The manual on ‘protection of confidential data in Eurostat’ (17) states that an increasing number of Eurostat units are working with microdata, which are divided in two sub-categories: (a) Directly identifiable microdata, which are those individual data which include the name and/or address, and/or some other publicly known or available identifier — such as identifying number, which allow the microdata record to be linked to an individual. Direct identifiers are normally removed from microdata transmitted to Eurostat by national statistical authorities. (b) Indirectly identifiable microdata which are those individual data which do not contain directly identifying information, but which do contain enough information to allow the statistical unit to be identified (with reasonable certainty) with the expenditure of a reasonable amount of time, money and effort. The EDPS believes that the data which are more likely to contain personal data are the microdata.

23. Indeed, the metadata and aggregated data usually carry less possibilities of identifying a statistical unit. Metadata rather describe the context in which data are gathered and used for the statistical tasks to be performed and aggregated data typically relate to broad classes, groups, or categories, so that it is not possible to distinguish the properties of individuals within those classes, groups, or categories. They would normally not be personal data, depending on the domain and subject concerned.

24. As to the microdata covered by the proposal, Article 1 describes the subject matter of the proposal. The Article foresees that statistics have to be provided ‘in the form of a minimum data set’ and is further developed within the five annexes of the proposal (as underlined by Article 2 of the proposal). These annexes cover the different domains in which Eurostat intends to request Member States to supply statistics and establish the minimum data set, which are required for Community action in the field of public health. From the analysis of the annexes by the EDPS, it is possible that some of the minimum data set required may imply the processing of personal data. Regarding the processing operations of these data entering Eurostat and which are provided by Member States, it is also important to assess the applicability of Regulation (EC) No 45/2001. During the common review which the EDPS will conduct with the Eurostat services, an in-depth analysis of the minimum data set required for each processing operations and an analysis of the processing operations implemented in Eurostat will be carried out, in order to determine whether any notifications should be submitted for prior checking (see below points 27 and 28). This review should also ensure that appropriate safeguards are put in place in the use which is made of the data.

25. Regarding transfer of data, the EDPS wants to stress that any transfer of personal data from Eurostat outside the European Union should comply with the relevant Articles of Regulation (EC) No 45/2001 on transfer of data to third countries (Article 9). Indeed, the proposal, in its recital 8, underlines the cooperation of Eurostat with the United Nations (through the World Health Organisation (WHO) and the International Labour Organisation (ILO)) as well as with the Organisation for Economic Cooperation and Development (OECD). It is also underlined that a common statistical data collection on the Systems of Health Accounts has been recently implemented together with the OECD and the WHO. The EDPS welcomes such cooperation, when it takes the form of cooperation on methods of work and methodology in certain domains, but stresses that if transfers of statistical data which could be considered as personal data themselves are foreseen, they should comply with the conditions imposed by the Regulation.

26. As regards conservation periods for statistical purposes, the first collections of data about health determinants by Eurostat took place more than 10 years ago. Article 4(e) of Regulation (EC) No 45/2001 states that ‘personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. The Community institution or body shall lay down that personal data which are to be stored for longer periods for historical, statistical or scientific use should be kept either in anonymous form only or, if that is not possible, only with the identity of the data subjects encrypted. In any event, the data shall not be used for any purpose other than for historical, statistical or scientific purposes’. The EDPS understands the interests and needs to keep statistical information through time, as statistical methodologies evolve and research based on longer periods may be conducted. There is no general limitation set in the proposal regarding the conservation period of data by Eurostat. The EDPS generally believes that the standard on confidentiality of data implemented by Eurostat regarding the protection of confidential data is high and that the protection for microdata is ensured. However, this is without prejudice to any analysis made through prior-check, where the EDPS would detect deficiencies. Therefore, it is only on a case by case basis that such evaluation should be made.

Prior checking

27. As already underlined, the proposal states that Member States compile data concerning public health and health and safety at work. The sources are thus national. Therefore, in the context of the proposal, personal data will usually be processed by competent national authorities, and will thus fall within the scope of national laws implementing Directive 95/46/EC. However, Eurostat will further process these data. In this case, this processing will be subject to Regulation (EC) No 45/2001. Therefore, the current legal framework on data protection provides for a harmonized level of protection throughout the EU.

28. In this context, Article 27(1) of Regulation (EC) No 45/2001 has to be taken into account. It subjects to prior checking by the EDPS processing operations likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes. Article 27(2) of the Regulation contains a list of processing operations likely to present specific risks in the above sense, among them health related personal data (Article 27(2)(a)). In as much as microdata might be personal data related to health, their processing will be subject to prior checking by the EDPS. Where this processing has already started in the past, such a prior check might also be conducted on an ex-post basis.

Conclusion

The EDPS welcomes the proposal for a Regulation on Community statistics on public health and health and safety at work. This Regulation would give a firm basis to the existing practices of gathering and evaluating Community statistical data. Ultimately, it would lead to the production of meaningful statistics in the field.

However, the EDPS would like to stress the following points:

— the guidelines and methodology which are developed on the basis of the Regulation should take into account and where necessary specifically address the differences between Data Protection and Statistical Confidentiality as well as the notions which are specific to each area,

— if transfers of personal data to third countries are foreseen, they should comply with Article 9 of Regulation (EC) No 45/2001,

— the conservation periods of statistical data are based on well developed standards of confidentiality. These standards are without prejudice of analysis which should be conducted on a case by case basis,

— a common review of the processes put in place in Eurostat when dealing with individual records for statistical purposes should be conducted and may lead to the need for prior-checking. This common review should consist of the analysis of the minimum data set required for each processing operations and an analysis of the processing operations implemented in Eurostat.

Done at Brussels, 5 September 2007. Peter HUSTINX European Data Protection Supervisor

(1) OJ L 281, 23.11.1995, p. 31.

(2) OJ L 8, 12.1.2001, p. 1.

(3) As explained in the recitals of the Proposal.

(4) OJ L 271, 9.10.2002, p. 1.

(5) A second alternative was to continue to develop statistics in the areas of public health and health and safety at work using ‘gentlemen agreements’ with the Member States and a third and last alternative was to develop and adopt various proposals for Regulations EC concerning either public health statistics and health and safety at work separately or each domain and related statistical tool separately.

(6) OJ L 52, 22.2.1997, p. 1.

(7) OJ L 284, 31.10.2003, p. 1.

(8) OJ L 151, 15.6.1990, p. 1.

(9) OJ L 133, 18.5.2002, p. 7.

(10) OJ L 112, 29.4.1997, p. 56.

(11) Proposal for a Regulation of the European Parliament and of the Council on European Statistics —2007/ESTAT/023.

(12) Recital 12 of the Proposal.

(13) Article 29 Working Party, Opinion 4/2007 on the concept of personal data, adopted 20 June 2007, available on the website of the Working Party.

(14) A statistical unit is defined in Regulation (EEC) No 1588/90 as a basic unit covered by statistical data transmitted to the SOEC (i.e. Eurostat).

(15) Commission Regulation (EC) No 831/2002 of 17 May 2002 implementing Council Regulation (EC) No 322/97 on Community Statistics, concerning access to confidential data for scientific purposes.

(16) Commission Regulation (EC) No 1104/2006 of 18 July 2006 amending Regulation (EC) No 831/2002 implementing Council Regulation (EC) No 322/97 on Community Statistics, concerning access to confidential data for scientific purposes.

(17) Manual on Protection of Confidential data in Eurostat, December 2004.