EN Official Journal of the European Union C 37/6

Opinion of the European Data Protection Supervisor on the proposal for a Regulation of the European Parliament and of the Council amending Council Regulation (EEC) No 3821/85 on recording equipment in road transport and amending Regulation (EC) No 561/2006 of the European Parliament and the Council

2012/C 37/02

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1),

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (2), and in particular Article 28(2) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTION

I.1. Consultation of the EDPS

1. On 19 July 2011, the Commission adopted a proposal for a Regulation of the European Parliament and of the Council amending Council Regulation (EEC) No 3821/85 on recording equipment in road transport and amending Regulation (EC) No 561/2006 of the European Parliament and the Council (the Proposal) (3). The Proposal is accompanied by a communication entitled ‘Digital Tachograph: Roadmap for future activities’ (the Communication) (4). The Proposal and the Communication were sent to the EDPS for consultation on the same day.

2. The EDPS had already been consulted informally in the course of April 2011 on an earlier version of the Proposal, on which he provided informal comments on 13 May 2011. The EDPS welcomes the informal consultation which has helped to improve the text from a data protection point of view at an early stage of the drafting process. Some of those comments have been taken into account in the Proposal. The EDPS would welcome reference to this Opinion in the preamble of the Proposal.

I.2. General background

3. The Proposal deals with the installation and use of recording equipment in vehicles used for the carriage of passengers or goods by road to check compliance of professional road transport drivers with social legislation on driving times and rest periods (5).

4. Since 1985, a tachograph system has been set up for this purpose, based on recording equipment together with tachograph cards (6). The recording equipment records, stores, displays, prints, and provides data output related to driver activities. A tachograph card is a smart card intended for use with the recording equipment; tachograph cards enable the cardholder to be identified by the recording equipment and data to be transferred and stored.

5. The draft proposal amends the current Regulation (EEC) No 3821/85 on the use of recording equipment in road transport (the Regulation) and updates it in line with current technological developments with a view to improving the use of the digital tachograph compared to analogue versions, and to widening its functionalities so as to create a new type of digital tachograph. The new digital tachograph will be enhanced with the following technological features: (i) it will make use of geolocation equipment to collect certain drivers’ location data automatically; (ii) it will use remote communication facilities to perform remote checks; and (iii) it will have a standardised interface with other Intelligent Transport Systems (ITS) allowing it to become an essential component of a vehicle’s ITS platform (7).

6. Many issues raised in the Proposal will require further complementary actions which are described in the Communication. The Communication identifies several measures to be initiated by the Commission, notably including updating, by means of delegated acts, the technical specifications of the digital tachograph laid down in Annex IB of the Regulation and upgrading security mechanisms, as well as amending Directive 2006/126/EC on driving licences to merge the professional drivers’ cards used in tachographs with their driving licences.

I.3. Data protection issues raised by the Proposal

7. The use of recording equipment in road transport involves the processing of personal data relating to professional drivers. A large part of the processing relies upon the use of geolocation equipment and remote communication facilities, which are technologies that have considerable impact on individuals’ privacy and data protection.

8. The Proposal thereby impinges on the privacy of professional drivers in a very visible way, in particular since it allows the constant monitoring of drivers’ whereabouts and introduces the possibility of remote controls by control authorities, who will have constant direct access to the data stored in tachographs. Furthermore, the envisaged merging of the driver card with the driving licence might also affect the current protection afforded to drivers’ data.

9. It is therefore essential that the processing of data through tachographs within the European Union is done in accordance with the EU data protection framework, as set out in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, Article 16 of the Treaty on the Functioning of the European Union as well as Directive 95/46/EC (8) and Directive 2002/58/EC (9).

10. It is worth noting that at the time the Regulation was adopted in 1985, there was no comprehensive data protection framework in the EU. The current review of the Regulation is therefore an opportunity to update the Regulation in line with the current data protection regime.

11. The EDPS particularly welcomes the introduction in the Proposal of a recital and a dedicated provision on data protection (10). The EDPS however notes that these provisions alone do not resolve all data protection issues raised by the different measures put forward in the Proposal. Therefore, additional guarantees should be included in the Proposal and in the complementary measures described in the Communication.

12. In this Opinion, the EDPS points to several aspects of the Proposal which require further consideration from a data protection standpoint. The EDPS will focus in particular on the following issues, which will be examined in turn in Section II below: (i) the general data protection and security requirements set out in the dedicated provisions of the Proposal; (ii) the proportionality of the data processing undertaken through tachographs; (iii) the modalities of access to the data and the further use of the data recorded in tachographs; and (iv) the specific issues raised by the proposed use of driver cards.

II. ANALYSIS OF THE PROPOSAL

II.1. General data protection and security requirements

General data protection measures to be implemented by data controllers, Member States and tachograph designers

13. The EDPS welcomes the insertion of a dedicated provision on data protection in Article 34 of the Proposal. Article 34 clearly underlines the responsibility of owners of vehicles and/or transport undertakings, as data controllers, to comply with applicable data protection law. Amongst other things, this will require them to inform professional drivers about the processing of their data in tachographs, grant drivers access to their data and rectify incorrect or incomplete data. The EDPS underlines that such information about the processing must be complete for all the processing activities undertaken, and he therefore welcomes the fact that Article 5(6) of the Proposal requires data controllers to inform drivers specifically about the possibility of remote control by control authorities. The EDPS further emphasises that data controllers must notify the processing to the supervisory authorities as provided for in Articles 18 to 20 of Directive 95/46/EC.

14. This provision also puts particular emphasis on the duty of Member States and independent supervisory authorities to ensure that the processing of personal data in tachographs used in road transport is done in accordance with applicable data protection law. This will require that Member States adopt specific measures with respect to the use of specific technologies, such as Global Navigation Satellite System (GNSS), remote communications and ITS interfaces, or as concerns the electronic exchange of information on driver cards and storage of records by transport undertakings. Whenever possible, data protection authorities in the Member States should be consulted before the adoption of such measures, in order to develop frames that are compatible with applicable data protection requirements.

15. The EDPS welcomes the fact that the concept of privacy by design is embedded in the Proposal by providing that recording equipment must be ‘designed in such a way as to ensure privacy’. The EDPS emphasises that from an early stage of digital tachograph design, this should be privacy- and data protection-friendly. These privacy-friendly measures should be appropriately reflected in the update of specifications contained in Annex IB.

16. However, as underlined in paragraph 11 above, Article 34 and recital 15 of the Proposal alone do not tackle all data protection concerns linked to the use of tachographs. Therefore, the EDPS highlights in this Opinion the additional measures necessary to guarantee a satisfactory level of data protection in tachographs.

The Proposal insufficiently describes the security requirements to be met for the use of tachographs

17. The EDPS considers that the security requirements for the digital tachograph, contained in several parts of the Proposal and in Article 15, are insufficiently developed in the Proposal. Furthermore, the EDPS underlines that the Proposal introduces the use of many technologies so as to create a ‘new digital tachograph’, for which the current Annex IB is outdated and contains neither relevant specifications nor appropriate security measures.

18. The EDPS underlines that industry might suffer from the unclear legal framework resulting from the adoption of an updated Regulation introducing many technological changes whose technical specifications will not be detailed in the existing, outdated annexes. There is therefore a risk that privacy-unfriendly measures and frameworks are developed by industry until the specifications are updated, and this risk will exist for as long as the review process of these annexes is taking place, i.e. until end of 2014.

19. The EDPS strongly recommends that the introduction of any technological update (GNSS, remote communication, ITS) in tachographs is duly supported by carrying out privacy impact assessments to evaluate the privacy risks raised by the use of these technologies.

20. The EDPS furthermore recommends inserting in the Proposal a dedicated article on the level of security to be achieved at all stages of development and use of tachographs (not only in the design and installation phases but also, and rather importantly, during their use). This article should emphasise the following: — appropriate security measures must be adopted to preserve the confidentiality of the data, to ensure data integrity and to prevent fraud and unlawful manipulation, — the whole chain of processing, which includes not only the recording equipment and the cards themselves but also the system of remote communication and the use of GNSS equipment, must respect the security requirements of Article 17 of Directive 95/46/EC, — for purposes of accountability, the way independent evaluators will perform their work should be clarified, — privacy impact assessments should be carried out before introducing any technological update.

21. To promote good data protection practices, it would be helpful that the EDPS and the Article 29 Working Party of Data Protection Authorities were included in the list of participants at the Tachograph Forum foreseen in Article 41 of the Proposal.

II.2. Proportionality of the data processing

The Proposal lacks clarity and certainty on the modalities of the processing which are left to a later update of Annex IB of the Regulation

22. The Proposal lacks precision and certainty regarding many modalities of the processing, which should however be clarified to ensure that these measures respect the proportionality principle set out in Article 6(1)(c) of Directive 95/46/EC. This notably concerns the types of data processed and recorded in tachographs and through use of geolocation equipment, the period of time such data may be kept and which recipients are allowed access to which data, in particular regarding the use of remote communications.

23. Many of the data processing details are currently set out in Annex IB of the Regulation, which is no longer up to date and will later be subject to review by means of delegated acts of the Commission. There is therefore no legal certainty about whether the processing envisaged will meet the conditions of proportionality, since many measures are left to be decided later on in regulatory committees. Furthermore, there is a risk that during the time taken to update the annexes, industry will develop its own schemes, which may lead to possible discrepancies.

24. The EDPS does not support such an approach and recommends clarifying in the Proposal itself the general modalities of the processing, only leaving the precise details to be dealt with in annexes. The EDPS regrets that the Proposal no longer describes the categories of data to be collected and recorded in the digital tachographs, although this was clearly specified in Article 5 of the earlier version of the Proposal communicated to the EDPS (e.g. movement and speed of the vehicle, time measurement, location of starting and ending of the driver’s daily working period, identity of the driver, activity of the driver, events and faults). Article 34(3) of the Proposal now only provides that ‘only data strictly necessary for the purpose of the processing shall be processed’ without specifying the types of data that will be processed.

25. The EDPS strongly recommends describing the general modalities of the processing in the text of the Regulation, which, contrary to the adoption of annexes, would be approved through the ordinary legislative procedure. This approach would help bring more legal certainty to professional drivers, which in turn would reinforce the valid use of the data in court.

26. The EDPS underlines that appropriate consideration should also be given to the proportionality principle when modifying Annex IB in line with technological developments. He strongly recommends that the EDPS is duly consulted during updating of Annex IB of the Regulation. The EDPS believes that this update should take place as soon as possible to ensure that harmonised technical specifications are embedded in tachographs by industry.

The use of geolocation equipment and recording of location data

27. The EDPS notes that according to recital 5 of the Proposal, the recording of geolocation data is justified to support control officers during controls. In view of the purpose limitation principle set out in Article 6(1)(b) of Directive 95/46/EC, the EDPS emphasises that the location data recorded on tachographs should not be used for any other incompatible purpose.

28. Although only two specific pieces of location data would be recorded according to Article 4 of the Proposal (identification of the starting and ending place of the daily work period), the EDPS understands that the use of geolocation equipment will enable constant positioning of the vehicle, and thus of the driver. This could be done for several purposes, for example to monitor speed and direction, to check if the vehicle is moving or not, etc. In view of Article 4 of the Proposal and the purpose limitation principle, the EDPS underlines that such uses would not be allowed. The EDPS emphasises that the installation and use of devices for the direct and principal purpose of allowing employers to monitor remotely and in real time the actions or whereabouts of their employees should not be permitted.

II.3. Access to the data recorded in digital tachographs and further use

29. Access to the data stored in the recording equipment may be granted at all times to (i) control authorities for control checks, and (ii) the relevant undertaking so it can comply with its legal obligations, in particular as set out in Articles 28 and 29 of the Proposal. The EDPS welcomes the fact that restrictive access rights to the data have been defined according to user type and/or identity.

Remote control by control authorities

30. Pursuant to recital 6, remote communications for control purposes are justified to facilitate targeted roadside checks and to reduce the administrative burden created by random checks on transport undertakings. The EDPS understands the convenience of introducing such a measure but recalls that adequate safeguards must be implemented in view of the privacy risks of such continuous remote access to the information stored in the recording equipment.

31. In this respect, the EDPS notes with satisfaction that Article 5 of the Proposal provides a number of important safeguards, in particular that: (i) such remote access is restricted only to the competent control authorities; (ii) the scope of the data exchanged with control authorities shall be limited to those strictly necessary for targeted roadside checks; (iii) there is a clearly defined short retention period of two hours of the data gathered during remote checks; (iv) information about the possibility of remote controls shall be provided to drivers by the owner or holder of the vehicle; and (v) appropriate security measures must be implemented to ensure data integrity and authentication.

32. The EDPS however considers that it is not sufficiently clear which data can be exchanged through remote communications. To ensure that the amount of data communicated to control authorities is not excessive, the EDPS recommends formulating Article 5(3) differently. Instead of listing data that will not be communicated, he suggests that Article 5(3) provides for an exhaustive list of the data which may be communicated.

33. With respect to sanctions, the EDPS also stresses that a remote control should not lead to automatic fines or penalties for the driver or undertaking. Since actual remote control is done without the knowledge of the person concerned, appropriate steps must be taken before any decision is reached. The remote control therefore should be seen as a preliminary measure which may lead to an in-depth control in the presence of the driver, should control officers have detected any anomalies in the preliminary phase.

Cross-border exchanges of data

34. The Communication from the Commission indicates that a number of third countries apply the principles of the road transport regulations and the tachograph regulation. In the current version of the Proposal, there is no indication of any international exchange of tachograph data. It should be clarified in the Proposal whether any cross-border exchanges of data are contemplated with third country authorities, in which case appropriate data protection safeguards will be required to ensure that an adequate level of protection is guaranteed when data are transferred to these third countries, in compliance with Articles 25 and 26 of Directive 95/46/EC.

Further use of the data in context of Intelligent Transport Systems (ITS)

35. Making tachographs an essential component of Intelligent Transport Systems raises a number of privacy and data protection issues, which were underlined by the EDPS in his Opinion on the ITS Directive (11).

36. The further processing of data recorded or produced by the tachograph for use in intelligent transport systems applications should only take place if the further processing is not incompatible with the original purpose of collection. This must be assessed on a case-by-case basis.

37. Data controllers must ensure that the further processing of tachograph data for use in an ITS application is done according to one of the legal bases listed in Article 7 of Directive 95/46/EC. The EDPS underlines that amongst all the legal bases available, consent of drivers may be difficult to rely upon, considering the employment context within which the processing operations take place. Drivers might be pressed by their employer to use certain ITS applications for which they would therefore not have given their truly free consent (12).

38. As a consequence, the EDPS suggests modifying Article 6(2) of the Proposal to state that ‘vehicles (…) shall be fitted with recording equipment equipped with a harmonised interface allowing the data recorded or produced to be used for intelligent transport systems applications. Further use of the data recorded in tachographs shall only be allowed provided that the driver has freely agreed to such further processing and that all other requirements of Article 6 of the Directive 95/46/EC are met’.

39. The EDPS furthermore emphasises that all data recorded or produced by the tachograph should not be automatically accessible for use in other ITS applications but only those that would be strictly necessary for the processing in that ITS application. This should be emphasised in Article 6(3) of the Proposal. The EDPS recommends that a specific privacy assessment is conducted for each application to determine which data are strictly necessary for the processing and the time limit during which such data should be kept.

II.4. Driver cards

Integrating driver cards with driving licences

40. Article 27 envisages merging the functionalities of driver cards with driving licences. Considering the potential amount of information recorded about driver activities, the driver card is more than a simple identity card certifying that the person is a professional driver. It is therefore more intrusive from a data protection viewpoint since it is aimed at monitoring a person's compliance with social regulations in the field of road transport.

41. The integration of this card with the driving licence raises data protection concerns, in particular in view of the purpose limitation principle and of the proportionality principle. Furthermore, the necessity and benefit of integrating the driver card into the driving licence have not been sufficiently demonstrated. In particular, it is not proven how such integration would be the best way to help fight fraud and misuse of driver cards. The EDPS recommends that this integration should only be envisaged after a privacy and security impact assessment has been carried out. This should be clearly mentioned in Article 27 of the Proposal.

42. Furthermore, such integration will require amending Directive 2006/126/EC on driving licences, a proposal for which shall be put forward by the Commission. Considering the data protection aspects raised by such amendments, the EDPS underlines that he wishes to be duly consulted on this proposal.

Exchange of information on driver cards through TACHOnet

43. Information on driver cards will be exchanged electronically through national electronic registers before driver cards are issued to check that the applicant does not already hold such a card. This exchange of information will be done through an existing system, TACHOnet. Article 26 provides the legal basis for such an electronic exchange of information. The EDPS welcomes the fact that the specific personal data recorded in these registers are clearly spelled out in Article 26 of the Proposal, as well as their retention period and the authorised recipients of the data. The EDPS emphasises that all the general modalities of the processing in TACHOnet should be described in this Article and that only purely technical specifications shall be adopted by means of implementing acts.

44. The EDPS notes that the role of the Commission in the interconnection of the electronic registers lacks sufficient clarity. He emphasises that this role should be further clarified in the proposed implementing acts. He further stresses that whenever this role would involve the processing of personal data by the Commission, such processing should respect Regulation (EC) No 45/2001.

III. CONCLUSION

45. The EDPS welcomes being consulted on a Proposal which impinges on the privacy of professional drivers in a very visible manner. He particularly welcomes the fact that a dedicated provision on data protection is provided for in the Proposal. The EDPS notes however that this provision alone cannot tackle all the data protection issues raised by the measures put forward in the Proposal. Additional guarantees are therefore required in the Proposal and in the complementary measures described in the Communication.

46. The EDPS considers that the general modalities of the processing in tachographs should be set out in the Proposal itself and not in annexes to the Regulation. The main aspects of the processing should be described in the Proposal itself, such as the types of data recorded in tachographs and through geolocation equipment, the recipients, and the time periods for retention. The annexes of the Regulation should only provide purely technical details of general principles that have been set out in the Regulation itself.

47. Furthermore, the EDPS notes that the existing annexes are outdated, which might lead to discrepancies in how tachographs are developed by industry. The Proposal introduces many technological updates, for which no relevant technical specifications are set out in the existing annexes to the Regulation. There is a risk that privacy-unfriendly frameworks will be developed by industry for as long as the update of the annexes to the Regulation is pending. The EDPS urges the Commission to update the annexes of the Regulation as soon as possible.

48. The EDPS recommends introducing the following amendments in the Proposal: — insert a dedicated provision on the level of security to be achieved in tachographs and provide that a privacy impact assessment shall be carried out before introducing any technological update, — clarify the specific and legitimate purposes for which constant geolocation will be carried out; it should be clearly specified in the Proposal that the installation and use of devices for the direct and principal purpose of allowing employers to monitor remotely and in real time the actions or whereabouts of their employees is not permitted, — define in Article 5(3) an exhaustive list of data that can be exchanged with control authorities and ensure that remote controls do not lead to automatic sanctions, — clarify whether there will be any cross-border data exchanges with control authorities in third countries, and if so adopt adequate data protection safeguards to ensure compliance with Articles 25 and 26 of Directive 95/46/EC, — require data controllers to ensure that the further processing of the data recorded in tachographs for use in ITS applications is done in compliance with Directive 95/46/EC, in particular that professional drivers give their express and free consent to this and that such further processing is not incompatible with the original purpose of collection; furthermore, it should be emphasised in Article 6(3) that access to the data stored in the tachograph equipment shall be restricted only to those strictly necessary for the processing in the ITS application, — provide in Article 27 that the merging of the driver cards with driving licences should only be envisaged after a privacy and security impact assessment has been carried out, — clarify further the role of the Commission in the exchange of information on driver cards through national electronic registers and the modalities of exchange.

49. The EDPS calls on Member States to consult data protection supervisory authorities before adopting national measures for tachographs, in particular those measures on the use of geolocation equipment, remote communications, ITS interfaces and TACHOnet.

50. To ensure appropriate consideration of data protection requirements in further complementary actions by the Commission, the EDPS wishes to be included in the list of participants in the Tachograph Forum and to be consulted on the update of Annex IB and on the Proposal to amend Directive 2001/126/EC on driving licences.

Done at Brussels, 5 October 2011. Giovanni BUTTARELLI Assistant European Data Protection Supervisor

(1) OJ L 281, 23.11.1995, p. 31.

(2) OJ L 8, 12.1.2001, p. 1.

(3) COM(2011) 451 final.

(4) COM(2011) 454 final.

(5) See in particular, Regulation (EC) No 561/2006 on driving times and rest periods, Directive 2002/15/EC on the organisation of the working time of persons performing mobile road transport activities, and Directive 92/6/EEC on the installation and use of speed limitation devices for certain categories of motor vehicles in the Community.

(6) A tachograph card may be of the following types: (i) driver card; (ii) control card; (iii) workshop card; and (iv) company card; see definitions in Article 2 of the Proposal.

(7) As per Directive 2010/40/EU of the European Parliament and of the Council of 7 July 2010 on the framework for the deployment of Intelligent Transport Systems in the field of road transport and for interfaces with other modes of transport (OJ L 207, 6.8.2010, p. 1).

(8) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281, 23.11.1995, p. 31.

(9) Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OL L 201, 31.7.2002, p. 37).

(10) See recital 15 and Article 34 of the Proposal.

(11) EDPS Opinion of 22 July 2009 on the Communication from the Commission on an Action Plan for the Deployment of Intelligent Transport Systems in Europe and the accompanying Proposal for a Directive of the European Parliament and of the Council laying down the framework for the deployment of Intelligent Transport Systems in the field of road transport and for interfaces with other transport modes, OJ C 47, 25.2.2010, p. 6:

http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2009/09-07-22_Intelligent_Transport_Systems_EN.pdf

(12) See Article 29 Working Party Opinion 15/2011 on consent: http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2011/wp187_en.pdf