EN Official Journal of the European Union C 35/10

Opinion of the European Data Protection Supervisor on the legislative package on the victims of crime, including a proposal for a Directive establishing minimum standards on the rights, support and protection of the victims of crime and a proposal for a Regulation on mutual recognition of protection measures in civil matters

2012/C 35/02

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1),

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (2), and in particular Article 41(2) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION

1.1. Background

1. On 18 May 2011, the Commission adopted a package of legislative instruments on the protection of the victims of crime. The legislative package includes a proposal for a Directive establishing minimum standards on the rights, support and protection of victims of crime (the ‘proposed Directive’) and a proposal for a Regulation on mutual recognition of protection measures in civil matters (the ‘proposed Regulation’) (3). Both proposals are accompanied by a Commission communication on strengthening victims' rights in the EU (4).

2. The EDPS was not consulted under Article 28(2) of Regulation (EC) No 45/2001, despite the fact that the legislative initiative was included in the EDPS Inventory of priorities for legislative consultation (5). The present Opinion is therefore based on Article 41(2) of the same Regulation. The EDPS recommends that a reference to this Opinion is included in the preamble of the instruments adopted.

1.2. Objectives and scope of the legislative package

3. The EDPS welcomes the policy objectives of the legislative package, which, in line with the Stockholm programme and its Action Plan, are to strengthen the rights of victims of crime and to ensure that their need for protection, support and access to justice is met (6).

4. The proposed Directive is intended to replace Council Framework Decision 2001/220/JHA on the standing of victims in criminal proceedings (7). It lays down common minimum rules on the rights, support and protection of the victims of crime. In particular, the proposed Directive aims to ensure that victims are treated with respect, that the special needs of vulnerable victims are taken into account, that victims receive adequate support and information, and that they can participate in proceedings (8).

5. The proposed Regulation aims to ensure that victims who benefit from a protection measure in a civil matter in one of the Member States are provided with the same level of protection should they move to another Member State, without having to go through a separate procedure (9). This measure complements the proposal for a Directive on the European Protection Order (the ‘EPO initiative’), dealing with the mutual recognition of protection measures taken in criminal matters. The EPO initiative, on which the EDPS issued an Opinion in October 2010 (10), is currently being discussed in the European Parliament and the Council.

1.3. Aim of the present Opinion

6. The protection of privacy and personal data plays a central role in the area of freedom, security and justice, as laid out in the Stockholm programme, and in particular in the context of judicial cooperation in criminal matters. In October 2010, the EDPS issued an Opinion on the EPO initiative, highlighting the need for a consistent data protection regime with regard to initiatives in the field of judicial cooperation in criminal matters (11). On this occasion, the EDPS stressed that the processing of data in the field of judicial cooperation in criminal matters is characterised by the particular sensitivity of the data involved and by the effects that the related processing may have on data subjects (12). It is therefore necessary to pay due attention to data protection aspects connected to initiatives in this area and introduce adequate rules and safeguards where necessary.

7. According to the EDPS, the respect for privacy and personal data constitutes an essential element of the victim protection that the proposed instruments are intended to ensure. The present Opinion will therefore focus on the privacy-related aspects of the proposals and put forward ideas to improve or strengthen victim protection.

2. ANALYSIS OF THE PROPOSALS

2.1. Directive on the rights, support and protection of victims of crime

8. Various provisions of the proposed Directive deal directly or indirectly with privacy and data protection (13). Generally speaking, the EDPS welcomes these provisions, as they are aimed at preserving victims' privacy. Nevertheless, he finds that the standards of protection could be in some instances strengthened and clarified, without prejudicing their nature as minimum standards.

9. The EDPS' comments will focus mainly on the following aspects: (i) Article 23 of the proposed Directive dealing with the right to protection of privacy and relations with media; (ii) victims' rights of information and access to their own personal data; and (iii) the protection of the confidentiality of communications between the victim and victim support services. These aspects will be discussed in the following subsections.

2.1.1. The protection of the victim's privacy

10. The main substantive provision of the proposed Directive dealing with privacy is Article 23 entitled ‘Right to protection of privacy’. Article 23(1) states that ‘Member States shall ensure that judicial authorities may adopt during the court proceedings, appropriate measures to protect the privacy and photographic images of victims and their family members’. The EDPS has various observations on this provision.

11. Firstly, Article 23(1) does not cover the full right to protection of privacy of the victims of crime. The provision is much more limited in scope as it simply provides for the power of ‘judicial authorities’ to issue protective measures ‘during the court proceedings’. However, the protection of privacy should not only be guaranteed ‘during the court proceedings’, but also during the investigation and pre-trial phase. More generally, privacy should be ensured where necessary from the first contact with the competent authorities and also after the termination of court proceedings.

12. In this respect, it is worth noting that several international instruments have adopted a more ambitious approach compared to Article 23(1). The Council of Europe Recommendation Rec(2006) 8 on assistance to crime victims, for instance, provides that ‘States should take appropriate steps to avoid as far as possible impinging on the private and family life of victims as well as to protect personal data of the victims, in particular during the investigation and prosecution’ (emphasis added) (14). Other instruments contain similar provisions (15).

13. In view of the above, the EDPS recommends adding to Article 23 a first paragraph stating in more general terms that Member States shall guarantee as far as possible the protection of victims’ private and family life as well as the protection of victims’ personal data from the first contact with the official authorities and after the conclusion of criminal proceedings. Furthermore, the current Article 23(1) should be modified so as to enable judicial authorities to issue protective measures also ‘during criminal investigation’.

14. Secondly, Article 23(1) does not contain any indication about the content of the specific measures that may be adopted by judicial authorities to preserve the victim's right to privacy. The EDPS understands the intention to leave Member States the maximum degree of flexibility in this area. However, greater precision may be helpful. In particular, the proposal could provide a list of minimum measures which judicial authorities may adopt, in accordance with national law, in order to protect the privacy of the victim (16). This may include for example the following categories of measures: — non-disclosure or limitation of the disclosure of information concerning the identity and whereabouts of the victims or family members in appropriate cases and under particular conditions (as indicated in recital 22), — order to remove certain confidential data from the file or prohibit the disclosure of specific information, — limiting the publication of sensitive information in the judgments and other decisions that are normally made public.

15. Thirdly, Article 23 does not contain any provision guaranteeing the confidentiality of the information held by public authorities. In this regard, the Council of Europe Recommendation Rec(2006) 8 cited above again provides useful examples. At point 11, the Recommendation provides that States should require all agencies in contact with victims to adopt clear standards by which they may only disclose to a third party information received from or relating to a victim, under the condition that the victim has explicitly consented to such disclosure, or that there is a legal requirement or authorisation to do so. The EDPS urges the legislator to include a similar provision in the proposed Directive.

2.1.2. Privacy and the media

16. The second paragraph of Article 23 provides that ‘Member States shall encourage the media to pursue self-regulatory measures in order to protect victims' privacy, personal integrity and personal data.’ Here, also, the proposal has adopted a minimalistic approach, by simply referring to the instrument of self-regulation.

17. The EDPS understands the reasons for adopting a cautious attitude with regard to this subject and generally agrees with the Commission's approach. The relationship between media and privacy is extremely delicate and complex. It is also an area where, within the boundaries set out by the EU Charter of Fundamental Rights and the European Convention on Human Rights, different traditions and cultural differences across Member States may play an important role. This approach would also appear consistent with the present data protection framework (Article 9 of Directive 95/46/EC), which leaves quite some leeway to Member States in relation to the processing of data carried out for journalistic purposes or for the purpose of artistic or literary expression (17).

18. As to self-regulation, the EDPS is convinced that this instrument can play an important role in reconciling privacy and freedom of expression. Furthermore, Article 23(2) mirrors the approach taken by Recommendation Rec(2006) 8 which also provides that states should encourage the media to adopt and respect self-regulation measures in order to protect privacy and personal data of the victims (18). Self-regulatory instruments may also act in combination with national framework provisions, but these provisions should be compatible with ECHR case law on Article 10 of the European Convention on Human Rights (19).

2.1.3. Specific information and access rights

19. The EDPS notes that Article 3 of the proposed Directive, dealing with the right to receive information from the first contact with a competent authority, does not mention information relating to data protection. In order to ensure adequate protection of their personal data, victims should receive at appropriate times all the information necessary to enable them to fully understand how their personal data will be processed.

20. The EDPS therefore recommends adding to Article 3 an additional provision specifying that victims should be provided with the information concerning the further processing of his/her personal data in conformity with Article 10 of Directive 95/46/EC. In addition, the legislator could consider including rules on victims’ access to their personal data, while preserving the legitimate interests relating to criminal investigation and prosecution.

2.1.4. Confidentiality of communications between victims and support services

21. The proposed Directive recognises the right of crime victims to receive support from the moment the crime takes place, throughout criminal proceedings and after such proceedings depending on victims’ needs (20). Certain categories of victims, such as victims of sexual violence, gender, racial hatred or other bias crimes, or victims of terrorism, may require specialist support services (21), including psychological support. In these cases, the communications between the victim and the professionals providing support services should be adequately protected from disclosure. If this is not done, the victim may be discouraged from communicating freely with his/her counsellor. Thus the EDPS welcomes the requirement in Article 7 that victim support services must be ‘confidential’. However, the scope and the consequences of such confidentiality do need to be clarified.

22. In particular, the proposed Directive does not specify whether the communications of the victims with providers of support services should be deemed ‘privileged’, in the sense that their disclosure in the course of court proceedings is excluded or otherwise restricted. This would normally be the case where the provider of support services is a healthcare professional subject to the obligation of professional secrecy. However, one could imagine cases where support is not provided by such professionals. In these situations, it is doubtful whether the victim would be protected from disclosure.

23. The EDPS therefore recommends specifying that the victim of these particular crimes should have the right to refuse disclosure in any judicial or administrative proceedings of confidential communications with a support service provider and that such communications may be disclosed by a third party only with his/her consent. This should normally be the case also in any criminal proceedings, without prejudice to legitimate and well-founded interests relating to investigation or prosecution (i.e. collection by judicial authorities of indispensable evidence).

2.2. Regulation on mutual recognition of protection measures in civil matters

2.2.1. Applicability of data protection legislation

24. As already mentioned, the proposed Regulation complements the EPO initiative concerning mutual recognition of protection measures in criminal matters. Since the proposed Regulation concerns judicial cooperation in civil matters having cross-border implications (22), its application falls within the scope of the former first pillar and therefore also within the scope of Directive 95/46/EC (23). This was not the case for the EPO initiative.

25. The EDPS therefore recommends that a reference to Directive 95/46/EC is included at least in the recitals of the proposal, stating that personal data processed under the regulation should be protected in accordance with the national laws implementing Directive 95/46/EC.

2.2.2. Information to be provided to the person causing the risk

26. According to Article 5 of the proposed Regulation, a party who wishes to invoke a protection order in another Member State shall provide the competent authorities with a certificate. The certificate shall be issued in accordance with the standard form set out in the Annex to the proposed Regulation. The Annex contains personal data of both the protected person and the person causing the risk, such as their identity and whereabouts, and a description of the protection measure. The EDPS recognises that the personal data included in the certificate as required in the Annex are in principle adequate, relevant and not excessive for the purposes for which they have been collected.

27. However, it is not sufficiently clear from the proposal which personal data of the protected person will be communicated to the person causing the risk, in particular pursuant to Article 13 (24). In this respect, the EDPS considers that the person causing the risk should receive only those personal data that are strictly necessary for the execution of the measure. In addition, the communication in question should, as far as possible, avoid disclosing the address or other contact details concerning the protected person (25). Such a limitation should be specified in the text of Article 13.

3. CONCLUSIONS

28. The EDPS welcomes the policy objectives of the two proposals under consideration and generally shares the approach of the Commission. Nevertheless, he finds that the protection of privacy and personal data of the victims in the proposed Directive could be in some instances strengthened and clarified.

29. With regard to the proposed Directive on the rights, support and protection of victims of crime, the EDPS advises the legislator to: — include in Article 23 a general provision on the protection of privacy and personal data stating that Member States shall guarantee as far as possible the protection of the private and family life of victims and protect personal data of the victims from the first contact with the official authorities, throughout any court proceedings and after such proceedings; furthermore, the current Article 23(1) should be modified so as to enable judicial authorities to issue protective measures also ‘during criminal investigation’, — specify under Article 23(1) a list of minimum measures (as discussed in paragraph 14), which judicial authorities may adopt in order to protect the privacy and photographic images of the victims and their family members, — provide that Member States shall require all authorities in contact with victims to adopt clear standards by which they may only disclose to a third party information received from or relating to a victim under the condition that the victim has explicitly consented to such disclosure or that there is a legal requirement or authorisation to do so, — include in Article 3 a requirement to provide victims with information concerning further processing of his/her personal data in conformity with Article 10 of Directive 95/46/EC and consider whether to include specific provisions on the right to access his/her personal data, — clarify the scope of the confidentiality requirement of victim support services under Article 7, by specifying that the victim shall have the right to refuse disclosure in any judicial or administrative proceedings of confidential communications with a support service provider and that in principle such communications may be disclosed by a third party only with his/her consent (see in particular paragraphs 22-23).

30. With regard to the proposed Regulation on mutual recognition of protection measures in civil matters, the EDPS advises the legislator to: — insert, at least in the recitals of the proposal, a reference to Directive 95/46/EC stating that personal data processed under the regulation should be protected in accordance with the national laws implementing Directive 95/46/EC, — state clearly in Article 13 that the person causing the risk should be provided only with those personal data of the protected person that are strictly necessary for the execution of the measure. The communication in question should, as far as possible, avoid disclosing the address or other contact details concerning the protected person.

Done at Brussels, 17 October 2011. Giovanni BUTTARELLI Assistant European Data Protection Supervisor

(1) OJ L 281, 23.11.1995, p. 31.

(2) OJ L 8, 12.1.2001, p. 1.

(3) Respectively, COM(2011) 275 and COM(2011) 276.

(4) See Commission's communication Strengthening victims’ rights in the EU, COM(2011) 274.

(5) Available on the EDPS website (http://www.edps.europa.eu) in the section: Consultation/Priorities.

(6) See Commission's communication Strengthening victims’ rights in the EU, op. cit., p. 2.

(7) OJ L 82, 22.3.2001, p. 1. The Explanatory Memorandum recognises that while improvements have been achieved in this area, the objectives of the Framework Directive have not been fully realised.

(8) See Commission's communication Strengthening victims’ rights in the EU, op. cit., p. 8.

(9) Ibid.

(10) EDPS Opinion of 5 October 2010 on the European Protection Order and European Investigation Order in criminal matters (OJ C 355, 29.12.2010, p. 1).

(11) Ibid., see in particular Section II of the Opinion.

(12) Ibid., point 1.

(13) See, in particular, recital 22, recognising that protecting privacy of the victim can be an important means of preventing further victimisation; recital 27 referring to the protection of personal data afforded to individuals under Council Framework Directive 2008/977/JHA and to Council of Europe Convention 108; Article 21 dealing with measures to avoid unnecessary questioning concerning victim’s private life and measures allowing a hearing to take place without the presence of the public; Article 23 dealing with the right to protection of privacy and the conduct of the media.

(14) Point 10.8 of Council of Europe Recommendation Rec(2006) 8.

(15) See, for example, draft UN Convention on Justice and Support for Victims of Crime and Abuse of Power, Articles 5(2)(g), 6, 8(6)(g); Guidelines of the Committee of Ministers on the Protection of Victims of Terrorist Acts, adopted on 2 March 2005, point VIII; Guidelines on Justice for Child Victims and Witnesses of Crime, ECOSOC Res 2005/20, 2005, points 8(a), 26 to 28.

(16) This is in line with approach taken in Article 21 concerning the right to protection of vulnerable victims during criminal proceedings.

(17) Article 9 of Directive 95/46/EC provides that Member States shall provide for exemptions and derogations in relation to the processing of data carried out solely for journalistic purposes or for the purpose of artistic or literary expression, which are necessary to reconcile the right to privacy with the rules governing freedom of expression.

(18) Point 10.9 of Council of Europe Recommendation Rec(2006) 8.

(19) Article 10, paragraph 2, of the ECHR permits only limitations to the right of freedom of expressions that are ‘prescribed by law’, and ‘necessary in a democratic society’ in pursuit of specific and important public interests (such as national security, territorial integrity, freedom from crime and disorder, health and morality) or for the protection of the reputation or the rights of others. In her Opinion in the Satakunnan case (Case C-73/07, Tietosuojavaltuutettu v Satakunnan Markkinapörssi and Satamedia, [2008] ECR I-9831), the Advocate General Kokott, rightly noted that ‘[s]trict application of the data protection rules could substantially limit freedom of expression. Investigative journalism would to a large extent be ruled out if the media could process and publish personal data only with the consent of, or in conformity with information provided by, the person concerned. On the other hand, it is obvious that the media may violate the right of individuals to respect for their private life. (17) Consequently a balance must be found.’ (paragraph 43).

(20) See recital 13 and Article 7 of the proposed Directive.

(21) Ibid.

(22) See Article 81 TFEU, i.e. former Article 65 of the EC Treaty.

(23) Directive 95/46/EC shall not apply to the processing of personal data in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security and the activities of the State in areas of criminal law (see Article 3 of the Directive).

(24) Article 13 concerns the information obligations vis-à-vis the person causing the risk.

(25) See in this respect, the EDPS Opinion of 5 October 2010 on the European Protection Order and European Investigation Order in criminal matters, op. cit., paragraphs 45-49.