EN Official Journal of the European Union C 323/1

Opinion of the European Data Protection Supervisor on the proposal for a Regulation of the European Parliament and of the Council on the citizens’ initiative

2010/C 323/01

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular its Article 16,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1),

Having regard to the request for an opinion in accordance with Article 28(2) of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (2), sent to the EDPS on 31 March 2010,

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTION

1. On 31 March 2010, the Commission adopted a proposal for a Regulation of the European Parliament and of the Council on the citizens’ initiative (3). The proposal follows a public consultation on the subject held between 11 November 2009 and 31 January 2010 (4).

2. The citizens’ initiative is one of the innovations in EU law introduced by the Lisbon Treaty enabling not less then one million citizens who are nationals of a significant number of Member States to invite the Commission to submit a legislative proposal. The proposed Regulation is based on Article 11(4) TEU and Article 24(1) TFEU which provide that the procedures and conditions required for the citizens’ initiative be determined in accordance with the ordinary legislative procedure.

3. The proposal was sent to the EDPS in accordance with Article 28(2) of Regulation (EC) No 45/2001 on the same day as it was adopted. The EDPS was informally consulted prior to the adoption of the proposal. The EDPS welcomed this informal consultation and is pleased to see that most of his remarks have been taken into account in the final proposal.

4. In general, the EDPS is satisfied with the way in which the issue of data protection is addressed in the proposed Regulation. On a detailed level the EDPS has a few suggestions for adjustments. These are discussed in Chapter II of this Opinion.

5. As a preliminary remark, the EDPS would like to underline that full respect for data protection rules contributes considerably to the reliability, strength and success of this important new instrument.

II. DETAILED ANALYSIS OF THE PROPOSAL

6. In accordance with Articles 11(4) TEU and 24(1) TFEU the proposal determines the procedures and conditions for the citizens’ initiative. The proposed Regulation defines the minimum number of Member States, the minimum number of citizens per Member State and the minimum age for citizens to be entitled to participate in an initiative. The proposal furthermore determines the substantive and procedural conditions for the examination of an initiative by the Commission.

7. This Opinion only focuses on the provisions which are relevant from a data protection perspective. These are the rules for the registration of a citizens’ initiative (Article 4), the procedures for the collection of statements of support (Articles 5 and 6) and the requirements for the verification and authentication of statements of support (Article 9). Special attention to data protection is given in Article 12 of the proposal. Article 13 furthermore deals with the liability of the organisers of a citizens’ initiative. These provisions will now be analysed in detail.

Article 4 — Registration of a proposed citizens’ initiative

8. Prior to the collection of statements of support from signatories, the organiser is required to register the initiative with the Commission through an online register. He must provide the information which is set out in Annex II of the proposed Regulation. This information includes personal information of the organiser, namely the full name, postal address and e-mail address. According to Article 4(5) of the proposal a proposed citizens′ initiative will be made public in the register. Although it is not entirely clear from the text, the EDPS assumes that the postal address and e-mail address of the organiser will in principle not be publicly available through the register. Were it otherwise, the EDPS would invite the legislator to assess and explain the necessity of the publication and clarify the text of Article 4 in this respect.

Article 5 — Procedures and conditions for the collection of statements of support

9. The organiser is responsible for the collection of the necessary statements of support from signatories for the proposed citizens’ initiative. According to Article 5(1) statements of support forms must comply with the model set out in Annex III of the proposed Regulation. This model form requires a signatory to provide certain (obvious) personal information, such as the first name and family name and, in case of a paper form, the actual signature. For the purpose of verifying the authenticity of a statement of support by the competent authority the provision of certain other information is also mandatory: the city and country where the signatory lives, their date and place of birth, nationality, personal identification number, the type of identification number/identity document and the Member State which issued this number/document. Other, non-mandatory, fields indicated on the model form are the street where the signatory lives and their e-mail address.

10. The EDPS takes the view that the mandatory information fields in the model form are all necessary for the purpose of organising the citizens’ initiative and securing the authenticity of the statements of support, except for the personal identification number. Differences exist between the Member States as to how the use of such unique identification numbers, where they exist, is regulated. In any event, the EDPS does not see the added value of the personal identification for the purpose of verifying the authenticity of the statements of support. The other requested information can already be considered as sufficient for reaching that purpose. The EDPS therefore recommends deleting this information field from the model form in Annex III.

11. The EDPS also questions the need to include the non-mandatory information fields in the standard form and recommends deleting these fields from the model form in Annex III if such need is not demonstrated.

12. The EDPS furthermore recommends adding a standard privacy statement at the bottom of the model, indicating the identity of the controller, the purposes of the collection, the other recipients of the data and the retention period. The provision of such information to the data subject is required by Article 10 of Directive 95/46/EC.

Article 6 — Online collection systems

13. Article 6 of the proposed Regulation deals with the collection of statements of support using online systems. Article 6 requires the organiser to ascertain, prior to the collection of the statements, that the online collection system has adequate security and technical features in place to ensure that, inter alia, the data provided online is securely stored ‘[so] that it may not be modified or used for any other purpose than its indicated support of the given citizens’ initiative and to protect personal data against accidental or unlawful destruction or accidental loss, alteration or unauthorized disclosure or access’ (5).

14. Article 6(2) furthermore states that the organiser may, at any time, ask the relevant competent authority to certify that the online collection system complies with these requirements. Such certification shall in any case be requested by the organiser prior to submitting statements of support for verification (see Article 9 below).

15. Article 6(5) furthermore obliges the Commission to adopt technical specifications for the implementation of these security rules in accordance with the comitology procedure foreseen in Article 19(2) of the proposal.

16. The EDPS welcomes the emphasis laid in Article 6 of the proposal on the security of online collection systems. The obligation to ensure the security of the data processing is one of the data protection requirements, which can be found in Article 17 of Directive 95/46/EC. The EDPS is pleased to see that following the informal comments of the EDPS the Commission has aligned the text of Article 6(4) of the proposal with the text of Article 17(1) of Directive 95/46/EC. The EDPS furthermore welcomes the inclusion in Article 6(4) of an obligation to ensure that data is not used for any other purpose than its indicated support of the given citizens’ initiative. However, the EDPS encourages the legislator to include a comparable obligation with a general scope in Article 12 (see point 27 below).

17. The EDPS has doubts as to the timing of the certification by the relevant competent authority. The organiser is only obliged to request such certification ultimately before he submits the collected statements of support for verification to that authority. He may do so at an earlier stage. Assuming that the certification of the online system has added value, the EDPS takes the view that the certification should take place before the statements are collected in order to prevent the collection of personal data of at least one million citizens through a system which afterwards would appear to be not sufficiently secured. The EDPS therefore invites the legislator to include this obligation in the text of Article 6(2). Of course it should thereby be assured that the certification procedure does not constitute an unnecessary administrative burden for the organiser.

18. In relation to this, the EDPS wishes to point at Article 18 of Directive 95/46/EC which obliges controllers to notify a processing operation to the national data protection authority before carrying out the processing operation, unless certain exemptions apply. It is not clear how this obligation to notify, subject to exemption, relates to the certification by the competent national authority under the proposed Regulation. With a view to preventing administrative burdens as much as possible, the EDPS invites the legislator to clarify the relation between the notification procedure of Article 18 of Directive 95/46/EC and the certification procedure of Article 6 of the proposed Regulation.

19. Turning to the implementing rules for the technical specifications. The EDPS expects to be consulted before these implementing rules will be adopted. Particularly since the Commission staff working document on the outcome of the Green Paper mentions several systems proposed during the public consultation to ensure the authenticity of online signatures, one of which is the idea of a European citizen's smartcard allowing e-signatures. Such a system obviously brings in new data protection considerations (6).

Article 9 — Verification and certification of statements of support by the Member States

20. Having collected the necessary statements of support from the signatories, the organiser has to submit these statements to the relevant competent authority for verification and certification. The organiser transfers the personal information of the signatories to the competent authority of the Member State which issued the identification document of the signatory as indicated in the statement of support. Within three months, the competent authority has to verify the statements of support on the basis of ‘appropriate checks’ and deliver a certificate to the organiser (7). The certificate is used when the initiative is actually submitted to the Commission.

21. The EDPS welcomes this decentralised system whereby the Commission will not be in the possession of the personal information of the signatories but only of the certificates issued by the national competent authorities. Such a system diminishes the risks for improper handling of personal data as it minimises the recipients of that data.

22. It is not clear from the text what the ‘appropriate checks’ by the competent authority mean. Also the relevant Recital 15 does not provide any clarity on the matter. The EDPS wonders how the authenticity of the statements of support will be checked by the competent authorities. He is particularly interested in knowing whether the competent authorities will be able to control the statements against information on the identity of citizens available from other sources, such as national or regional registers. The EDPS invites the legislator to specify this issue.

Article 12 — Protection of personal data

23. Article 12 of the proposed Regulation is solely dedicated to the protection of personal data. The provision underlines that the organiser as well as the competent authority must respect Directive 95/46/EC and the national provisions adopted pursuant thereto. In Recital 20 mention is also made of the applicability of Regulation (EC) No 45/2001 when the Commission is processing personal data by registering the organiser of an initiative. The EDPS welcomes these statements.

24. The provision furthermore makes explicit that the organiser and the competent authority must be considered as data controllers for the purposes of their respective processing of personal data. The EDPS is pleased with this specification. The controller has primary responsibility for compliance with data protection rules. Article 12 of the proposal avoids any doubt as to who must be considered as controller.

25. Article 12 also provides for the maximum retention periods of the collected personal data. For the organiser the term is set at one month after having submitted the initiative to the Commission, or at least 18 months after the date of registration of a proposed initiative. The competent authorities have to destroy the data one month after having issued the certificate. The EDPS welcomes these limitations as they ensure compliance with the requirement laid down in Article 6(1)(e) of Directive 95/46/EC.

26. The EDPS is furthermore satisfied with the repetition in Article 12 of the text taken from Article 17(1) of Directive 95/46/EC on security of data processing. It is thereby made clear that these obligations are not only applicable when an online collection system is used (see point 13 and further above), but to all situations covered by the proposed Regulation.

27. As stated in point 16 above, the EDPS recommends the legislator to add another paragraph to Article 12 ensuring that personal data collected by the organiser (either through an online collection system or by any other means) is not used for any other purpose than its indicated support of the given citizens’ initiative and furthermore that data received by the competent authority is used only for the purpose of verifying the authenticity of statements of support for a given citizens’ initiative.

Article 13 — Liability

28. In Article 13 it is stated that the Member States must ensure that the organisers resident or established on their territory shall be liable under their civil or criminal law for infringements of the proposed Regulation and in particular for, inter alia, non-conformity with the requirements for online collection systems or the fraudulent use of data. In Recital 19 reference is made to Chapter III of Directive 95/46/EC which deals with judicial remedies, liability and sanctions and states that this chapter is fully applicable as regards the data processing carried out in application of the proposed Regulation. Article 13 of the proposal must be seen as an addition to this referring explicitly, contrary to Chapter III of Directive 95/46/EC, to the civil and criminal law of the Member States. The EDPS obviously welcomes this provision.

III. CONCLUSION AND RECOMMENDATIONS

29. As stated in the introduction, and as has become clear from the analysis in Chapter II of this Opinion, the EDPS is generally satisfied with the way in which the issue of data protection is addressed in the proposed Regulation on the citizens’ initiative. Data protection has clearly been taken into account, and the proposal is drafted in a way which ensures conformity with data protection rules. The EDPS is particularly pleased with Article 12 which is solely dedicated to data protection and which clarifies responsibilities and retention periods. The EDPS wishes to underline that full respect for data protection rules contributes considerably to the reliability, strength and success of this important new instrument. Although generally satisfied with the proposal, the EDPS still sees room for further improvements.

30. The EDPS recommends that the legislator amends Article 6 in such a way that the organiser is obliged to request certification of the security of the online collection system before he starts collecting the statements of support. In addition, such certification procedures should not constitute an unnecessary administrative burden for the organiser. The EDPS furthermore recommends clarifying the relation between the notification procedure of Article 18 of Directive 95/46/EC and the certification procedure of Article 6 of the proposed Regulation.

31. In order to further improve the proposal, the EDPS recommends the legislator: — to assess the necessity of the publication of the postal and e-mail address of the organiser of an initiative, and to clarify the text of Article 4 of the proposal, should such publication be envisaged; — to delete the request for the personal identification number and the non-mandatory information fields from the model form in Annex III; — to add a standard privacy statement to the model form contained in Annex III which ensures compliance with Article 10 of Directive 95/46/EC; — to clarify what is meant by the ‘appropriate checks’ in Article 9(2) which have to be performed by the competent authority when verifying the authenticity of statements of support; — to add another paragraph to Article 12 ensuring that personal data collected by the organiser is not used for any other purpose than its indicated support of the given citizens’ initiative and that data received by the competent authority is used only for the purpose of verifying the authenticity of statements of support for a given citizens’ initiative.

Done in Brussels, 21 April 2010. Peter HUSTINX European Data Protection Supervisor

(1) OJ L 281, 23.11.1995, p. 31.

(2) OJ L 8, 12.1.2001, p. 1.

(3) See COM(2010) 119 final, accompanied by Commission staff working document which describes the outcome of the public consultation on the Green Paper on a European citizens’ initiative, SEC(2010) 730.

(4) For the Green Paper, see COM(2009) 622.

(5) See Article 6(4) of the proposal.

(6) See SEC(2010) 730, p. 4.

(7) See Article 9(2) of the proposal.