EN Official Journal of the European Union C 28/9

Executive summary of the Opinion of the European Data Protection Supervisor on the Commission proposal for a Council regulation amending Regulation (EEC, Euratom) No 354/83, as regards the deposit of the historical archives of the institutions at the European University Institute in Florence

(The full text of this Opinion can be found in English, French and German on the EDPS website: http://www.edps.europa.eu)

2013/C 28/05

1. Introduction

1.1. Consultation of the EDPS

1. On 16 August 2012, the Commission adopted a proposal for a Council regulation amending Regulation (EEC, Euratom) No 354/83, as regards the deposit of the historical archives of the institutions at the European University Institute in Florence (‘the proposal’) (1). The proposal was sent to the EDPS for consultation on the same day.

2. Before the adoption of the proposal, the EDPS was given the possibility to provide informal comments. Many of these comments have been taken into account in the proposal. As a result, the data protections safeguards in the proposal have been strengthened. The EDPS welcomes the fact that the Commission also consulted him formally after the proposal was adopted and that this Opinion is referred to in the preamble of the proposal.

1.2. Objectives and background of the proposal

3. Council Regulation (EEC, Euratom) No 354/83 of 1 February 1983 concerning the opening to the public of the historical archives of the European Economic Community and the European Atomic Energy Community (2) (‘the Archives Regulation’) requires EU institutions and bodies to establish historical archives and to open them to the public once they are 30 years old. The Archives Regulation allows each institution and body to hold its historical archives in whatever place it considers most appropriate.

4. The objective of the proposal is to amend the Archives Regulation and to make the deposit of paper archives at the European University Institute in Florence (‘EUI’) mandatory for all EU institutions and bodies (with the exception of the Court of Justice and the European Central Bank). In fact, the European Commission, the Council of the European Union and the European Parliament are already depositing their paper archives at the EUI on the basis of contractual arrangements. Thus, as the explanatory memorandum explains, the proposal does not change the status quo but rather ‘aims to confirm the role of the EUI in managing the historical archives of the institutions. It will create a sound legal and financial basis for the partnership between the EU and the EUI.’

5. The proposal will also not change the existing rules and procedures by which the EU institutions and bodies open their historical archives to the public after 30 years. The proposal will furthermore not change the ownership of the historical archives, which will remain with the depositing institutions/bodies. In short: the proposal contains limited and targeted amendments to the Archives Regulation, rather than proposing a comprehensive modernisation and overhaul.

1.3. Relevance to data protection; objectives of the EDPS Opinion

6. In order to carry out their tasks, the European institutions and bodies process vast amounts of data, including personal data. Some of the personal data processed may be particularly sensitive from a data protection point of view (3) and/or may have been given to the institutions or bodies concerned in confidence, without the expectation that they will one day become publicly available: for example, personal data contained in medical or personnel files of staff members, or personal data processed in connection with disciplinary and harassment procedures, internal audits, various types of complaints or petitions, and trade, competition, anti-fraud, or other investigations.

7. Some of these personal data, including some of those posing prima facie the greatest risks to the individuals concerned, are destroyed after a specified period of time, once they are no longer in use for the initial purposes for which they were collected (or for other compatible ‘administrative’ purposes).

8. However, a significant portion of the documents held by the European institutions and bodies, including, possibly, the personal data in them, will not be destroyed but rather will ultimately be transferred to the historical archives of the European Union, and will be made publicly available for historical, statistical and scientific purposes (4).

9. It is important that European institutions and bodies have clear policies of what personal data should or should not go to the historical archives, and how to safeguard those personal data that will be preserved and made publicly available via the historical archives. These policies need to ensure protection of privacy and the personal data of the individuals concerned, and to balance the protection of these fundamental rights with the right of access to documents and the legitimate interests in historical research.

10. For the moment, although document management, data retention and archiving policies exist at many European institutions and bodies (see, for example, the Common Conservation List (‘CCL’), an internal administrative document issued by the Commission (5)), these policies provide only limited guidance on data protection. The CCL and similar documents should be further developed or complemented with more specific and more nuanced guidance on data protection.

11. In addition, it is to be noted that the existing policies are formulated in internal documents, rather than in a legislative instrument adopted by Council and Parliament. Indeed, beyond a brief reference in its Article 2(1) to ‘documents covered by the exception relating to privacy and integrity of the individual, as defined in Article 4(1)(b) of Regulation (EC) No 1049/2001’ (6), the current text of the Archives Regulation does not specify what personal data may be transferred to the historical archives, and thus, ultimately disclosed publicly.

12. The referred Article 4(1)(b) of Regulation (EC) No 1049/2001, in turn, must be interpreted in accordance with applicable data protection laws, including Regulation (EC) No 45/2001, and in accordance with the jurisprudence of the Court of Justice of the European Union. To decide what personal data should be placed in the historical archives, thus, requires a complex case-by-case analysis.

13. The revisions of Directive 95/46/EC (7) and Regulation (EC) No 1049/2001 are currently both underway, and the revision of Regulation (EC) No 45/2001 should also follow in due course. While it is hoped that these legislative changes will contribute to clarity, due to their general nature, it is unlikely that they will provide sufficiently specific guidance to European institutions and bodies with regard to their archiving practices. As for the Archives Regulation itself, the Commission has proposed limited amendments only, not affecting Article 2(1) and other substantive provisions.

14. The EDPS, in this Opinion, will suggest a few targeted changes that can be included on the occasion of the current, more limited review of the Archives Regulation. Additionally, he will highlight the need for adoption of specific measures, including adequate implementing rules, to ensure that data protection concerns are effectively addressed in the context of legitimate record keeping for historical purposes.

15. To provide context, Section 2 will briefly discuss some general data protection issues and current trends related to the opening up and digitalisation of EU historical archives, anonymisation and de-anonymisation, as well as the Commission's open data initiatives.

10. Conclusions

65. The EDPS welcomes that the proposal addresses data protection concerns, involving in particular: — the provisions on applicable law, — the determination of the supervisory authority, — the specification of the EUI's role as a processor, and — the requirement to adopt implementing rules to address data protection issues at the practical level.

66. To address remaining data protection concerns, the EDPS recommends that the proposed amendment to the Archives Regulation: — specify the key objectives and minimum content of the implementing rules as well as the procedure for their adoption, including a governance structure to ensure a harmonised and coordinated approach, a clear time-frame for adoption, and consultation of the EDPS, — clarify the rules applicable to security of personal data held in the historical archives, — provide safeguards with regard to the private archives held by the EUI, and — provide at least some minimum clarifications with regard to the privacy exception in Article 2 of the Archives Regulation.

Done at Brussels, 10 October 2012. Peter HUSTINX European Data Protection Supervisor

(1) COM(2012) 456 final.

(2) Council Regulation (EEC, Euratom) No 354/83 (OJ L 43, 15.2.1983, p. 1).

(3) Such as ‘special categories of data’ in the meaning of Article 10 of Regulation (EC) No 45/2001.

(4) Article 1(2) of the Archives Regulation provides a definition for both ‘archives’ and ‘historical archives’ (of EU institutions and bodies). Archives are defined as ‘all those documents of whatever type and in whatever medium which have originated in or been received by one of the institutions or by their representatives or servants in the performance of their duties, which relate to the activities of the (EU)’. Historical archives, in turn, are defined as ‘that part of the archives (of the institutions) which has been selected … for permanent preservation’ … ‘no later than 15 years after their date of creation’, via ‘an initial sorting process with the purpose of separating documents that are to be preserved from those that have no administrative or historical value’.

(5) SEC(2007) 970, adopted on 4 July 2007, currently under revision. See also the 7 May 2007 EDPS Comments on the draft CCL of 2007 at: http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Supervision/Adminmeasures/2007/07-05-07_commentaires_liste_conservation_EN.pdf

(6) OJ L 145, 31.5.2001, p. 43.

(7) See the Commission proposal for a regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data (COM(2012) 11 final). See also the 7 March 2012 EDPS Opinion on the data protection reform package, available at: http://www.edps.europa.eu/EDPSWEB/edps/Consultation/Reform_package;jsessionid=46ACCFDB9005EB950DF9C7D58BDE5377