WRITTEN QUESTION E-0673/00

by Cristiana Muscardini (UEN) and Roberta Angelilli (UEN) to the Commission

(9 March 2000)

Subject: Transfer of personal data and respect for privacy

Pursuant to Articles 29 and 31 of Directive 95/46(1) on the protection of individuals with regard to the processing of personal data, the Working Party on Protection of Individuals and the data protection committee have been recognised as essential bodies in the debate on fixing the rules governing the application of the directive in question outside EU territory and notably in the United States. Negotiations with that country have now been in progress for two years, with no date set for their conclusion.

Can the Commission say:

1. What points does the EU consider as essential as regards guarantees and which cannot be agreed under the approach currently being adopted in the negotiations?

2. Are the differences between the legal systems concerned so great as to prevent a compromise solution being reached that would provide firm guarantees for citizens and consumers?

3. Would not acceptance by Europe of the self-regulation principle proposed by the United States (safe harbour) be liable to weaken the protection of privacy and undermine the rules laid down in the directive?

4. Given the danger that the conclusion of the negotiations may be postponed indefinitely, would it not be better to use contractual models for the transfer of data outside the European Union, such as those drawn up by the Council of Europe and the International Chamber of Commerce?

5. Does the Commission not think that, in any case, the EU's main requirement should be to provide adequate protection of personal data for European citizens and ensure legal certainty for European businesses?

(1) OJ L 281, 23.11.1995, p. 31.

Answer given by Mr Bolkestein on behalf of the Commission

(2 May 2000)

The informal dialogue that the Commission has been conducting with the United States Department of commerce in accordance with Article 25 of Directive 95/46/EC of the Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data reached a provisional conclusion at the end of March 2000. The Parliament has already been informed that the Commission is presently recommending that Member States, meeting in the management committee set up under Article 31 of the data protection Directive, examine the American proposal for a safe harbor with a view to issuing a positive opinion on the level of protection it provides. When such an opinion is delivered it will enable the Commission, on the basis of Article 25.6 of the data protection Directive, to adopt a decision recognising the safe harbor as providing adequate protection for the transfer of personal data to the American companies participating.

Companies that voluntarily adhere to self-regulatory system of the safe harbor will be required to disclose unambiguously and publicly their commitment to comply with the safe harbor principles and to be subject to the statutory powers of an American public body. In case of non-compliance with the principles, such a body must be empowered to investigate complaints and to obtain relief against unfair or deceptive practices as well as redress for individuals, irrespective of their country of residence or nationality.

The Commission considers these guarantees to be sufficient for both Community operators and citizens and hence does not consider that the proposed adequacy finding will undermine the rules laid down in the directive. In particular the Commission recalls the approach of the working party of data protection commissioners established under Article 29 of the Directive, recognising that self-regulation can in principle deliver effective privacy protection(1).

The Commission's goal is not only to conclude the discussions with the United States as soon as possible, but also to initiate proceedings leading to the adoption of a Commission decision, based on Article 26.4 of the data protection Directive, recognising standard contractual clauses which offer sufficient safeguards for data transfers to any third country. The Commission considers that such clauses are needed to complement adequacy findings for specific third countries or sectors thereof, by providing an instrument available to Community operators to export data to any third country on a case by case basis.

The Commission agrees with the Honourable Members that the Community's primary concern should be to provide adequate protection of personal data transfers to third countries and legal certainty for European businesses. It believes that it has successfully worked towards achieving both these goals.

(1) Working Document WP 12 Transfers of personal data to third countries: Applying Articles 25 and 26 of the EU data protection directive, adopted on 24 July 1998 and available at http://europa.eu.int/comm/internal.