WRITTEN QUESTION E-1686/00

by Jonas Sjöstedt (GUE/NGL) to the Commission

(29 May 2000)

Subject: Implementation of EU's data protection directive

Have all Member States now ratified the data protection directive? In the summer of 1999, the responsible Swedish Minister, Leijon, said that a new data directive should be drafted to clear up the doubts concerning the publication of personal data on the Internet. How strictly have the Member States interpreted who is entitled to publish names on the Internet? Is anyone entitled to publish journalistic material on the Internet and how stringent is the requirement that publication must be for literary, artistic or journalistic purposes?

Answer given by Mr Bolkestein on behalf of the Commission

(18 July 2000)

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(1) was transposed within the prescribed period (24 October 1998) by only four Member States. At present, five Member States have not yet taken national measures to implement the Directive, and the Commission has instituted infringement proceedings.

To the Commission's knowledge, the question of the publication of personal data on the Internet has so far been raised only in Sweden. There the matter arose because of the first version of the Swedish law, which placed greater restrictions on the transfer of personal data to third countries than the Directive. In the meantime, the Swedish law has been amended to fall in line with the Directive.

The Directive applies to all processing of personal data, including publication on the Internet. It obliges Member States to lay down exemptions or derogations from some of its rules for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression. Any derogation or exemption must therefore follow the principle of proportionality in order to maintain a balance with the right to privacy of the data subject. No derogation or exemption from the provisions on security may be granted. The supervisory authorities responsible for this sector must in any case retain certain ex-post powers.

Derogations and exemptions might not be necessary where the flexibility of various provisions of the Directive or the derogations allowed under other specific provisions (which of course must also be interpreted narrowly) already allow a satisfactory balance to be struck between privacy and freedom of expression.

Where the Member State finds it necessary to establish certain exemptions, these are available to any person processing personal data strictly for the purpose specified.

The Member States must therefore evaluate the interests involved while complying with the Directive's criteria of strict purpose, necessity and proportionality.

To provide guidance on interpreting the Directive on this matter, the Working Party on the Protection of Individuals with regard to the Processing of Personal Data established by Article 29 of Directive 95/46/EC adopted Recommendation 1/97 Data protection law and the media (WP 1, available in all official languages under the following address:

http://europa.eu.int/comm/internal_market/en/media/dataprot/wpdocs/index.htm).

(1) OJ L 281, 23.11.1995.