WRITTEN QUESTION P-0792/00

by W.G. van Velzen (PPE-DE) to the Commission

(9 March 2000)

Subject: Data protection

A hearing was recently held in the European Parliament on data protection, at which (among other topics) the communications interception project Echelon was discussed. It seems that this system is used worldwide by the USA to intercept telephone, fax, mobile phone and e-mail communications; software may also apparently have inbuilt keys which may be used as a secret back door through which a citizen may be followed into his computer and his activities monitored.

The Directive on data protection in the telecommunications sector (European Parliament and Council Directive 97/66/EC of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector(1)) imposes obligations on service and network providers but appears not to cover software.

1. Has the Commission received any complaints about this matter?

2. Is the Commission prepared to amend Directive 97/66/EC to plug the software loophole in the interest of providing actual protection of citizens against the unwanted monitoring and interception of computer contents and communications flows?

3. Does the Commission consider that with increasingly comprehensive interception by the authorities and with wide-ranging obligations for service providers to store their customers' data the Member States have struck a proper balance between the citizen's right to privacy and the interests of national security and crime prevention?

4. Is the Commission, in the context of its duty to ensure the proper transposition of European directives into national law, examining the proportionality of measures taken by the Member States pursuant to the exemptions permitted by the European data protection directives? What are its findings in this connection?

(1) OJ L 24, 30.1.1998, p. 1.

Answer given by Mr Liikanen on behalf of the Commission

(3 May 2000)

1. No.

2. Directive 95/46/EC(1) on the processing of personal data covers all processing of personal data irrespective of the hardware or software used. The working party of data protection commissioners established under Article 29 of this Directive has addressed the problem of invisible and automatic processing of personal data on the Internet performed by software and hardware.

In its recommendation 1/99 of 23 February 1999, the working party described the problem of privacy-invading features embedded in software and hardware used for communications over the Internet. The working party called on the software and hardware industry to develop privacy-compliant products in line with the data protection rules of the general data protection Directive 95/46/EC and the telecommunications data protection Directive 97/66/EC(2). One of the objectives of the 1999 review of the telecommunications regulatory framework is to ensure a consistent, technology neutral application of existing rules and to propose amendments where technological neutrality is not guaranteed. At present providers of public telecommunications services and networks are under specific legal obligations to guarantee the security of their networks, to ensure the confidentiality of communications and to delete traffic data.

Since the adoption of the telecommunications data protection Directive, the services delivered over telecommunications networks have evolved with the rise of the Internet. Regarding the software which is necessary for these new telecommunications services, such as some software used for sending e-mails and browsers used for surfing the Internet, compliance with data protection rules is not entirely satisfactory as the working party of data protection commissioners has noted. Clearly, there is no technological neutrality in a situation where the protection of the privacy of the user depends on whether certain functionalities necessary for a telecommunications service are in the network or in the software. The Commission is considering various possibilities to tackle this problem. Concrete proposals will be made when the Commission adopts its legislative proposals for the new regulatory framework for electronic communications.

3. and 4. The Commission will pursue its obligation under the EC Treaty to monitor the transposition and effective implementation of directives by the Member States, bearing in mind the case law of the Court of justice concerning the strict interpretation of the scope of exceptions to fundamental principles of law and civil liberties. As part of this monitoring the Commission will examine the proportionality of the legislative measures taken by Member States on the basis of Article 13 of Directive 95/46/EC and Article 14.1 of Directive 97/66/EC. These provisions allow Member States to adopt legislative measures that restrict the application of some of the data protection principles established by the Directives in order to safeguard the interests which are mentioned in Articles 13 and 14. However, such restrictions may only be permitted under national law if they are necessary to safeguard the interests mentioned in Articles 13 and 14.

Until now, the process of transposition and implementation in the Member States of the data protection directives has been slow. While the Commission has initiated infringement proceedings, it is currently difficult to have a complete picture of the situation concerning the proportionality of the national legislative measures that provide the basis for lawful interception of telecommunications. The Commission will report further on the progress achieved in the next report on the implementation of the telecommunications regulatory package.

(1) Directive 95/46/EC of the Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and the free movement of such data (OJ L 281, 23.11.1995).

(2) Directive 97/66/EC of the Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector (OJ L 24, 30.1.1998).