No C 277/12 Official Journal of the European Communities 5. 11. 90 
time limit which the chairman may lay down according to 
the urgency of the matter, if necessary by taking a vote. The 
opinion shall be recorded in the minutes; in addition, each 
Member State shall have the right to ask to have its position 
recorded in the minutes. The Commission shall take the 
utmost account of the opinion delivered by the Committee. 
It shall inform the Committee of the manner in which its 
opinion has been taken into account. 
FINAL PROVISIONS 
Article 31 
1. The Member States shall bring into force the laws, 
regulations and administrative provisions necessary for 
them to comply with this Directive by 1 January 1993. 
THE COUNCIL OF THE EUROPEAN COMMUNITIES, 
Having regard to the Treaty establishing the European 
Economic Community, and in particular Article 100A 
thereof, 
Having regard to the proposal from the Commission, 
In cooperation with the European Parliament, 
Having regard to the opinion of the Economic and Social 
Committee, 
(1) Whereas Council Directive ... concerning the protec­
tion of individuals in relation to the processing of 
personal data exhorts Member States to ensure the 
protection of privacy; 
(2) Whereas currently in the European Community new 
advanced digital public telephone networks are 
emerging which give rise to specific requirements 
concerning the protection of personal data and 
privacy of the user; 
(3) Whereas this is the case, in particular, with the 
introduction of the integrated services digital network 
(ISDN) and public digital mobile networks; The provisions adopted pursuant to the first subparagraph 
shall make express reference to this Directive. 
2. The Member States shall communicate to the Commis­
sion the texts of the provisions of national law which they 
adopt in the field covered by this Directive. 
Article 32 
The Commission shall report to the Council and the 
European Parliament at regular intervals on the implemen­
tation of this Directive, attaching to its report, if necessary, 
suitable proposals for amendments. 
Article 33 
This Directive is addressed to the Member States. 
(4) Whereas the Council, in its resolution of 30 June 1988 
on the development of the common market for 
telecommunications services and equipment up to 
1992 (1), has called for steps to be taken to protect 
personal data, in order to create an appropriate 
environment for the future development of telecom­
munications in the Community; whereas the Council 
has re-emphasized the importance of the protection of 
personal data and privacy in its resolution of 18 July 
1989 on the strengthening of the coordination for the 
introduction of the integrated services digital network 
(ISDN) in the European Community (2); 
(5) Whereas the European Parliament has underlined the 
importance of the protection of personal data and 
privacy in telecommunications networks, in particular 
with regard to the introduction of the integrated 
services digital network (ISDN) (3) (4) (5); 
(6) Whereas Commission recommendation 81/679/EEC 
calls for the adoption and ratification by Member 
(!) OJ No C 257, 4. 10. 1988, p. 1. 
(2) OJ No C 196, 1. 8. 1989, p. 4. 
(3) OJ No C 7, 12. 1. 1987, p. 334. 
(4) OJ No C 12, 16. 1. 1989, p. 69. 
(5) OJ No C 12, 16. 1. 1989, p. 66. Proposal for a Council Directive concerning the protection of personal data and privacy in the 
context of public digital telecommunications networks, in particular the integrated services digital 
network (ISDN) and public digital mobile networks 
COM(90) 314 final — SYN 288 
(Submitted by the Commission on 27 July 1990) 
(90/C 277/04) 
5. 11. 90 Official Journal of the European Communities No C 277/13 
States of the Council of Europe Convention for the 
protection of individuals with regard to automatic 
processing of personal data which spells out general 
principles for the protection of personal data; 
(7) Whereas a number of Member States have adopted 
and ratified this Convention; 
(8) Whereas Council Decision ... opens negotiations with 
a view to the accession of the European Economic 
Community, in the fields in which it is competent, to 
the Convention of the Council of Europe for the 
protection of individuals with regard to automatic 
processing of personal data; 
(9) Whereas Council Directive ... [concerning the protec­
tion of individuals in relation to the processing of 
personal data implements the adoption of these 
general principles in the Community]; 
(10) Whereas, in the case of public digital networks, 
specific legal, regulatory, and technical provisions 
must be made in order to protect personal data and the 
privacy of users with regard to the increasing risks 
connected with the computerized storage and proces­
sing of personal data in such networks; 
(11) Whereas Member States are currently developing 
divergent provisions in this area; 
(12) Whereas given the obstacles resulting from these 
divergent legal, regulatory, and technical provisions 
concerning the protection of personal data and 
privacy in the context of the implementation of public 
digital telecommunications networks in the Com­
munity, in particular the integrated services digital 
network (ISDN) and public digital mobile networks, 
the full establishment of a Community-wide market in 
telecommunications services and equipment requires 
the rapid introduction of harmonized provisions; 
(13) Whereas this Directive should determine the extent to 
which personal data may be collected, stored and 
processed in connection with the provision of 
telecommunications services; 
(14) Whereas the collection, storage, and processing of 
personal data by a telecommunications organization is 
justified for the purposes of the provision of the 
intended service only and may not be used without 
specific authorization by law or the subscriber's prior 
consent for any other purpose; whereas such collec­
tion, storage, and processing of personal data may, in particular, not be used to give such telecommuni­
cations organization any undue competitive ad­
vantage over other service providers; 
(15) Whereas this Directive should implement in the 
telecommunications sector the general principles 
concerning the subscriber's right to inspect the 
personal data stored about him/her, his right to 
request the rectification or erasure of such data, if 
necessary, as well as his right to prevent non-
authorized disclosure of his personal data; 
(16) Whereas this Directive must provide for harmoniz­
ation of the Member States' rules concerning the 
protection of privacy in the field of itemized call 
statements; 
(17) Whereas, it is necessary, as regards the calling line 
identification, to protect both the right of the calling 
party to remain anonymous and the privacy of the 
called party with regard to unidentified calls; 
(18) Whereas safeguards must be provided for the users of 
teleshopping and videotex services against unauthor­
ized use of their personal data as well as for the 
subscribers in general against intrusion into their 
privacy by means of unsolicited calls; 
(19) Whereas it is necessary to ensure that the introduction 
of technical features of telecommunications equip­
ment for data protection purposes is harmonized in 
order to be compatible with the implementation of the 
internal market of 1992; 
(20) Whereas the implementation of this Directive with 
regard to third countries must take into account the 
level of protection of personal data and privacy in 
those countries as provided for in the Council 
Directive [concerning the protection of individuals in 
relation to the processing of personal data]; 
(21) Whereas all matters concerning protection of personal 
data and privacy in the context of public digital 
telecommunications networks, which are not covered 
by the provisions of this specific Directive, the Council 
Directive mentioned above shall apply; 
(22) Whereas this Directive does not address issues of 
protection of personal data and privacy related to 
national security; 
(23) Whereas it is useful for the preparation of measures 
intended to implement or modify this Directive to 
draw on the experience of the Working Party on the 
Protection of Personal Data composed of represent­
atives of the supervisory authorities of the Member 
States, set up by Article 27 of Council Directive ... 
No C 277/14 Official Journal of the European Communities 5. 11. 90 
[concerning the protection of individuals in relation to 
the processing of personal data]; 
(24) Whereas such measures must be prepared with the 
assistance of the Committee composed of represent­
atives of the Member States set up by Article 30 of 
Council Directive ... [concerning the protection of 
individuals in relation to the processing of personal 
data], 
HAS ADOPTED THIS DIRECTIVE: 
Article 1 
1. This Directive provides for the harmonization of the 
provisions required to ensure an equal level of protection of 
privacy in the Community and to provide for the free 
movement of telecommunications equipment and services 
within and between Member States. 
2. The Member States shall adopt the necessary specific 
provisions in order to guarantee the protection of personal 
data and privacy in the telecommunications sector in 
accordance with this Directive. 
Article 2 
1. Without prejudice to the general provisions of Council 
Directive ... concerning the protection of individuals in 
relation to the processing of personal data, this Directive 
applies specifically to the collection, storage, and proces­
sing of personal data by telecommunications organizations 
in connection with the provision of public telecommuni­
cations services in public digital telecommunications 
networks in the Community, in particular via the 
integrated services digital network (ISDN) and public 
digital mobile networks. 
2. In case a Member State has not yet implemented the 
integrated services digital network (ISDN) or public digital 
mobile networks, the provisions of this Directive will be 
implemented to the extent that they also apply to services 
based on analogue networks. 
Article 3 
For the purposes of this Directive, 
1. 'personal data' means any information relating to an 
identified or identifiable individual; 
2. 'telecommunications organization' means a public or 
private body, to which a Member State grants special or 
exclusive rights for the provision of a public telecom­
munications network and, where applicable, public 
telecommunications services; 3. 'public telecommunications network' means the public 
telecommunications infrastructure which permits the 
conveyance of signals between defined network termi­
nation points by wire, by microwave, by optical means 
or by other electromagnetic means; 
4. 'public telecommunications service' means a telecom­
munications service whose supply Member States have 
specifically entrusted inter alia to one or more 
telecommunications organizations. 
Article 4 
1. Collection, storage and processing of personal data by 
a telecommunications organization is justified for telecom­
munications purposes only, in particular in order to 
establish connections for the transmission of voice, data or 
image, to produce bills, to compile directories, and for 
other legitimate operational purposes, for example fault 
clearance, prevention of misuse of the telecommunications 
organization's equipment, or registration of incoming calls 
in accordance with Article 13 (1). 
2. The telecommunications organization shall not use 
such data to set up electronic profiles of the subscribers or 
classifications of individual subscribers by category. 
Article 5 
1. Personal data of the subscriber may be collected and 
stored to the extent necessary to conclude, perform, amend 
or terminate the contract with the telecommunications 
organization. After termination of the contract the data are 
to be erased unless and for so long as they are required to 
deal with complaints, to recover charges or to comply with 
other obligations imposed by the law of the Member State, 
in conformity with Community law. 
2. The contents of the information transmitted must not 
be stored by the telecommunications organization after the 
end of the transmission, except where required by 
obligations imposed by the law of the Member State, in 
conformity with Community law. 
Article 6 
The subscriber is entitled: 
— to obtain at reasonable intervals and without excessive 
delay or expense confirmation of whether personal data 
relating to him/her are stored as well as communication 
to him/her of such data in an intelligible form, 
— to obtain, as the case may be, rectification or erasure of 
such data if they have been processed in breach of the 
5. 11. 90 Official Journal of the European Communities No C 277/15 
provisions which are imposed by the law of the Member 
State in conformity with Community la,w. 
Article 7 
1. In principle, all personal data processed in connection 
with telecommunication networks and services are to be 
kept confidential. 
2. The personal data may not be disclosed outside the 
services or the network of the telecommunications 
organization without specific authorization by law or the 
subscriber's prior consent. A subscriber shall be held to 
have given such consent only where it is given by way of a 
specific response to a request by the telecommunications 
organization. Without the subscriber's prior consent, these 
personal data must not be disclosed to persons within the 
telecommunications organization who are not dealing with 
the relevant services provided. 
3. The telecommunications organization must not make 
the provision of its service dependent upon such consent. 
Article 8 
1. The telecommunications organization must provide 
adequate, state-of-the-art protection of personal data 
against unauthorized access and use. 
2. In case of particular risk of a breach of the security of 
the network, for example in the field mobile radio 
telephony, the telecommunications organization must 
inform the subscribers concerning such risk and offer them 
an end-to-end encryption service. 
Article 9 
1. Billing data containing the telephone number or 
identification of the subscriber station, the address of the 
subscriber and the type of station, the total number of units 
to be charged for the accounting period, the called 
telephone number, the type and duration of the calls made 
and/or the data volume transmitted as well as other 
information needed for billing such as advance payment by 
instalments, disconnection and reminders, may be stored 
and processed. 
2. Such a general storage of billing data is permissible up 
to the end of the statutory period during which the bill may 
be challenged. Article 10 
1. Traffic data containing the personal data necessary to 
establish calls, or required for billing or other operational 
purposes, such as the telephone number of the calling and 
of the called subscriber, the time each call started and 
finished and the telecommunications service used by the 
subscriber, may be collected, stored and processed as far as 
this is necessary to provide the telecommunications service 
required. 
2. The traffic data stored in the switching centres of the 
telecommunications organization must be erased after 
termination of the call unless the data are anonymized or 
are required for billing or other legitimate purposes in the 
meaning of Article 4. 
Article 11 
Upon application of the subscriber an itemized call 
statement may be produced, containing, among other 
items, the telephone numbers of the called subscribers 
without the last four digits. 
Article 12 
1. With regard to communications between subscribers 
linked to digital exchanges, the calling subscriber must 
have the possibility to eliminate via a simple technical 
facility the identification of his/her telephone number on 
the display of the called subscribers' terminal equipment, 
or its recording in a storage facility of this terminal, on a 
case-by-case basis. 
The transmission of the telephone number may also be 
permanently eliminated by the telecommunications organi­
zation upon application of the calling subscriber. 
2. The called subscriber may apply for permanent 
elimination of the identification of all incoming calls; he/ 
she must also be able to turn off the display of his/her 
terminal equipment, or to eliminate the recording in the 
terminal's storage facility, in order to prevent the 
identification of the incoming calls, on a case-by-case basis. 
The called subscriber must be able to limit the acceptance 
of incoming calls to those which identify the calling 
subscriber's number. 
3. With regard to communications between a subscriber 
linked to an analogue exchange and subscribers linked to 
digital exchanges, the former subscriber is to be informed 
of the identification of his/her telephone number and to be 
offered the permanent elimination of the feature upon 
application. This subscriber must also have the possibility 
No C 277/16 Official Journal of the European Communities 5. 11. 90 
to eliminate the identification on a case-by-case basis. 
Article 13 
1. For a limited period of time, the telecommunications 
organization may override the elimination of the calling 
line identification: 
(a) upon application of a subscriber requesting the tracing 
of malicious calls. In this case, the data containing the 
identification of the calling subscriber will be stored by 
the telecommunications organization and be made 
available upon request to the public authority charged 
with the prevention or pursuit of criminal offences of 
the Member State concerned; 
(b) upon specific court order, in order to prevent or pursue 
serious criminal offences. 
2. A permanent override function must be made available 
upon request: 
(a) to organizations recognized by a Member State which 
answer and deal with emergency calls; and 
(b) to fire brigades operated or recognized by a Member 
State. 
3. The telecommunications organizations shall take the 
necessary steps to ensure that the override function is 
operational on a national and Community-wide basis. 
Article 14 
1. Calls may be forwarded from the called subscriber to a 
third party only if this party has agreed; the third party may 
limit automatic forwarding to those calls which identify the 
calling subscriber's number; the third party must be 
informed via a specific signal of the message that the call 
has been forwarded. 
2. The calling subscriber must be informed automatically 
during the establishment of the connection that the call is 
being forwarded to a third party. 
Article 15 
1. If the content of telephone calls is made accessible to 
third parties via technical devices, such as loudspeakers or 
other on-hook equipment, or stored on tape for own use or 
use by third parties, provision must be made in order that 
the parties concerned are informed via an appropriate 
procedure of such diffusion or storage before the diffusion 
or storage is initiated and for so long as the IT continues. 
2. Paragraph 1 does not apply in the cases covered by 
Article 13 (1). Article 16 
1. The telecommunications organization must ensure 
that the telephone number as well as other personal data of 
the subscriber, in particular concerning the quantity and 
nature of his/her orders when using a teleshopping service 
or concerning the information requested via a videotex 
service, is stored only to the extent strictly necessary to 
supply the service and is only used by the service provider 
for purposes authorized by this subscriber. 
2. Subject to the provisions of Article 20, the service 
provider may not set up electronic profiles of the 
subscribers or classifications of individual subscribers by 
category, without their prior consent. 
Article 17 
1. Subscribers who receive unsolicited calls for advertis­
ing purposes or for the purpose of offering the supply or 
provision of goods and services may notify the telecom­
munications organization conveying such messages that 
they do not wish to receive these calls. 
2. The telecommunications organization must take the 
steps necessary to terminate the transmission of such 
messages to the subscribers concerned. Furthermore, the 
telecommunications organization must keep a list of the 
notifications in a form specified and available for 
inspection by the regulatory authority, in order to prevent 
such calls in future. 
Article 18 
1. In implementing the provisions of this Directive, 
Member States shall ensure, subject to paragraphs (2) and 
(3) of this Article, that no mandatory requirements for 
specific technical features are imposed on terminal or other 
telecommunications equipment which could impede the 
placing of equipment on the market and the free circulation 
of such equipment in and between Member States. 
2. Where provisions can only be implemented by 
requiring specific technical features, Member States shall 
inform the Commission according to the procedures 
provided for by Council Directive 83/189/EEC (*) which 
lays down a procedure for the provision of information in 
the field of technical standards and regulations. 
3. Where required, the Commission will ensure the 
drawing up of common European standards for the 
implementation of specific technical features, in accord­
ance with Council Directive ... [on the approximation of 
the laws of the Member States concerning telecommuni­
cations terminal equipment, including the mutual recog-
(!) OJ No L 109, 26. 4. 1983, p. 8. 
5. 11. 90 Official Journal of the European Communities No C 277/17 
nition of their conformity], and Council Decision 87/95/ 
EEC of 22 December 1986 on standardization in the field of 
information technology and telecommunications (1). 
Article 19 
1. The provisions of this Directive relating to the 
telephone service shall be applied to other public digital 
telecommunications services to the extent that these 
services present similar risks for the privacy of the user. 
2. The measures necessary for the implementation of 
paragraph 1 shall be adopted by the Commission after 
consultation of the Working Party referred to in Article 22 
and in accordance with the procedure laid down in 
Article 23. 
Article 20 
To the extent that the full achievement of the objectives of 
this Directive requires the application of its provisions to 
service providers other than telecommunications organiza­
tions, the Commission may adopt the measures necessary 
for the application of this Directive to those service 
providers after consultation of the Working Party referred 
to in Article 22 and in accordance with the procedure laid 
down in Article 23. 
Article 21 
The details of the application of this Directive and the 
modifications necessary to adapt this Directive to new 
technical developments shall be determined by the 
Commission in accordance with the procedure laid down in 
Article 23. 
Article 22 
1. The Working Party on the Protection of Personal Data 
established according to Article 27 of Council Directive ... approximating certain laws, regulations and adminis­
trative provisions of the Member States concerning the 
protection of individuals in relation to the processing of 
personal data shall carry out the tasks laid down in 
Article 28 of the abovementioned Directive also with 
regard to the data protection measures which are the 
subject of this Directive. 
2. The Working Party will be specifically constituted for 
the purposes of this Directive. 
Article 23 
1. The procedure laid down in Article 30 of Council 
Directive ... approximating certain laws, regulations and 
administrative provisions of the Member States concerning 
the protection of individuals in relation to the processing of 
personal data shall apply. 
2. The Committee established in the framework of that 
procedure will be constituted specifically for the purposes 
of this Directive. 
Article 24 
1. The Member States shall bring into force the laws, 
regulations, and administrative provisions necessary for 
them to comply with this Directive by 1 January 1993 at the 
latest. 
The provisions adopted pursuant to the first subparagraph 
shall make express reference to this Directive. 
2. The Member States shall communicate to the Commis­
sion the texts of the provisions of national law which they 
adopt in the field covered by this Directive. 
Article 25 
(!) OJ No L 36, 7. 2. 1987, p. 31. This Directive is addressed to the Member States.