EN Official Journal of the European Union C 27/4

Executive summary of the Opinion of the European Data Protection Supervisor on the Commission proposal for a Directive of the European Parliament and of the Council on the enforcement of Directive 96/71/EC concerning the posting of workers in the framework of the provision of services and on the Commission proposal for a Council Regulation on the exercise of the right to take collective action within the context of the freedom of establishment and the freedom to provide services

(The full text of this Opinion can be found in EN, FR and DE on the EDPS website http://www.edps.europa.eu)

2013/C 27/03

1. Introduction

1.1. Consultation of the EDPS

1. On 21 March 2012, the Commission adopted: — a proposal for a Directive of the European Parliament and of the Council on the enforcement of Directive 96/71/EC concerning the posting of workers in the framework of the provision of services (the Posting of Workers proposal) (1), and — a proposal for a Council Regulation on the exercise of the right to take collective action within the context of the freedom of establishment and the freedom to provide services (the Collective Action proposal) (2).

2. The two related proposals were sent to the EDPS for consultation on 26 March 2012.

3. The EDPS welcomes the fact that the Commission consulted him formally after the proposals were adopted and that this Opinion is referred to in the preamble of the Posting of Workers proposal. However, he regrets that he was not given the opportunity to provide informal comments before the draft proposals were adopted.

1.2. Objectives and background of the proposals

4. The objective of the Posting of Workers proposal is to improve, enhance and reinforce the way in which Directive 96/71/EC concerning the posting of workers in the framework of the provision of services (Posting of Workers Directive (3)) is implemented, applied and enforced in practice across the European Union. The proposal aims to achieve this by establishing a general common framework for better and more uniform implementation, application and enforcement of the Directive, including measures to prevent any circumvention or abuse of the rules (4).

5. The objective of the Collective Action proposal is to clarify the general principles and applicable rules at EU level with respect to the exercise of the fundamental right to take collective action within the context of the freedom to provide services and the freedom of establishment (5).

1.3. Relevant provisions; objectives of the EDPS Opinion

6. While it is not the main objective of either of the two proposals to process personal data, at least one of the proposals — the Posting of Workers proposal — requires the processing of a significant amount of personal data. As will be shown below, these personal data may relate to the posted workers as well as to individuals acting on behalf of the posting undertakings such as their corporate officers, management, company representatives, or employees. In addition, the posting undertakings themselves may also be natural persons. If so, their personal data may also be processed. Some of the data processed may be sensitive (6): in particular, data on suspected circumvention or abuse of the rules may be exchanged among competent authorities.

7. From the data protection perspective, the three most relevant provisions of the Posting of Workers proposal are — Article 6(2) which allows bilateral information exchanges (consisting of ‘(replies) to reasoned requests for information’), — Article 6(6), which requires Member States to ensure that registers of service providers may be consulted by competent authorities of the other Member States ‘in accordance with the same conditions’, and — Article 7(2), which requires the Member State of establishment, on its own initiative, to communicate to the Member State to which the posting takes place relevant information regarding possible irregularities.

8. The processing of personal data in all three cases is foreseen to take place via the Internal Market Information system (IMI) (7).

9. As to the Collective Action proposal, the alert mechanism foreseen in Article 4 appears to allow the exchange of personal data, possibly including sensitive data (information about participation in strikes or similar collective action (8)). However, as will be noted in Section 4 below, the exchange of personal data appears not to be the legislative intention and, therefore, any concerns can presumably be addressed by a simple clarification that no sensitive personal data shall be contained in these alerts.

5. Conclusions

32. The EDPS welcomes that the Posting of Workers proposal addresses data protection concerns. The EDPS also welcomes the fact that the use of an existing information system, IMI, is proposed for the administrative cooperation, which already offers, at the practical level, a number of data protection safeguards, and for which specific safeguards are expected to be adopted soon under the IMI Regulation.

33. To address any remaining data protection concerns, the EDPS provides the following recommendations.

34. As a general comment, the EDPS recommends that the reference to the applicable data protection framework should be set forth in a substantive provision rather than in a recital and should be further nuanced by reference to ‘national rules which implement’ Directive 95/46/EC.

35. On bilateral information exchanges under the Posting of Workers proposal (Article 6(2)), the EDPS recommends that the permissible purposes of information exchange should be more clearly specified in the proposal. In particular, the phrase ‘possible cases of unlawful transnational activities’ should be deleted and the provision should be redrafted to ensure that any exchange of personal data is only possible for the purposes of ‘investigation of any abuses of applicable rules on the posting of workers’ (or other necessary purposes clearly specified in the proposal).

36. On access to registers of service providers by competent authorities of other Member States (Article 6(6)), the EDPS recommends that the proposal should more clearly specify what registers are actually concerned. This Article should not, in particular, be used as a legal basis to allow access to registers established in some Member States where posting undertakings need to declare, among other things, certain personal data relating to their posted employees.

37. In addition, if and when interconnection of registers is planned as a common European project in this area as well, data protection safeguards must be carefully considered at the European level.

38. With regard to the alert system on possible irregularities (Article 7(2)), the EDPS recommends that the proposal: — unambiguously specify that alerts can only be sent in case of a ‘reasonable suspicion’ of possible irregularities, — should require closure of cases automatically upon receipt of an alert, to help ensure that the alert system will function as a warning mechanism, rather than as a long-term blacklist, and — ensure that alerts are only sent to competent authorities in Member States and that these authorities shall keep the alert information received confidential and not further distribute or publish it.

39. On the Collective Action proposal, Article 4 should clarify that no sensitive personal data shall be contained in these alerts.

Done at Brussels, 19 July 2012. Giovanni BUTTARELLI Assistant European Data Protection Supervisor

(1) COM(2012) 131 final.

(2) COM(2012) 130 final.

(3) Directive 96/71/EC of the European Parliament and of the Council of 16 December 1996 concerning the posting of workers in the framework of the provision of services (OJ L 18, 21.1.1997, p. 1).

(4) See Explanatory Memorandum, page 11, Section 3.1, paragraph 1.

(5) See Explanatory Memorandum, page 10, Section 3.1, paragraph 4.

(6) Falling within the definition of ‘special categories of data’ in the meaning of Article 8(5) of Directive 95/46/EC.

(7) See Article 19 of the Posting of Workers proposal, which amends Annex I of the IMI Regulation. See also Commission proposal for a Regulation on administrative cooperation through the Internal Market Information system (the IMI Regulation) available at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2011:0522:FIN:EN:PDF. The Regulation on IMI is expected to be adopted later this year. In November 2011, the EDPS issued an Opinion on the Commission proposal (OJ C 48, 18.2.2012, p. 2).

(8) That is, ‘special categories of data’ in the meaning of Article 8(1) of Directive 95/46/EC.