Amended proposal for a COUNCIL DIRECTIVE on the protection of individuals with regard to the processing of personal data and on the free movement of such data
Date: 1992-10-15
Institutions: European Commission
Subjects: confidentiality, cross-frontier data flow, disclosure of information, fundamental rights, personal data, protection of privacy

COMMISSION  OF  THE  EUROPEAN  COMMUNITIES 

COM(92) 422 final - SYN 287 

Brussels, 15 October  1992 

Amended proposal for  a 
COUNCIL DIRECTIVE 

on the protection of  individuals with regard to the 
processing of  personal data and on the free movement 
of such  data 

(presented by the Commission  pursuant to Article 149(3) 
of the EEC Treaty) 

- 2 -

EXPLANATORY MEMORANDUM 

INTRODUCTION 

On  18 July 1990  the  Commission  sent  the  Council  a  set  of  proposals, 
including  two directives  and  a decision, which  were aimed  at facilitating 
the  free  movement  of  data  in  the  Community;  they  sought  to  do  this  by 
ensuring  a  high  level  of  protection  for  individuals  with  regard  to  the 
processing  of  personal  data  and  by  tightening  the  security  of  data 
processing  with  particular  consideration  for  the  development  of  open 
telecommunications networks. 

The Economic and Social Committee delivered its opinion on the proposals on 
24 April 1991 (OJ No C 159, 17 June 1991). 

Parliament  was  consulted  under  the  cooperation  procedure,  and  its 
committees studied the proposals in detail.  On 10 February 1992 Parliament 
considered  the  report  of  the  Committee  on  Legal  Affairs  and  Citizens' 
Rights  (the  rapporteur  was  Mr Hoon),  and  on  11 March,  virtually 
unanimously,  Parliament  approved  the  proposals  subject  to  numerous 
amendments. 

On 31 March the Council adopted the proposal for a Decision in the field of 
security information systems (OJ No L 123, 8 May 1992). 

The  amended  proposal  put  forward  here  is  intended  to  take  account  of 
Parliament's opinion. 

A. Main amendments 

1. The approach to protection 

The amended proposal makes two major changes at Parliament's request: 

- it  drops  the  formal  distinction  between  the  rules  applying  in  the 

public sector and the rules applying in the private sector; 

- it  expands the  provisions  on  the  procedures  for  notification  to the 

supervisory authority and on codes of conduct. 

The amendments have the advantage of making it clear that the protection 
provided is the same in both the public and the private sectors. 

They  also  help  to  avoid  excessive  bureaucracy  and  make  for  greater 
convergence and equivalence between the methods used to ensure effective 
protection  in  the  Member States,  by  clarifying  the  notification 
procedures  and  the  terms  of  reference  of  the  independent  supervisory 
authorities in the light of the degree of danger which the processing of 
personal  data  may  represent  for  the  rights  and  freedoms  of  data 
subjects. 

- 3 -

2. Concepts and definitions 

Parliament suggested that the concept of a "file"  should be  dropped, on 
the grounds that it was outdated and irrelevant given the development of 
automation  and  telecommunications,  and  that  the  collection  of  data 
should  be  included  among  the  operations  which  would  constitute 
"processing"  of  personal  data;  after  considering  Parliament's 
amendments  the  Commission  is  now  proposing  that  the  subject-matter  of 
the  rules  should  in  fact  be  the  processing  of  personal  data.  This 
change has two advantages: the principles of protection laid down by the 
Directive  are  not  dependent  on  a  particular  technology  or  form  of 
organization; and the concept of the processing of data allows a general 
approach to be  taken, with  attention focusing  on the data  used  and the 
whole sequence  of operations  carried out  in the  light  of the objective 
in view. 

The Commission nevertheless considers it necessary to retain and clarify 
the concept of  a "file",  so that  where processing  is not  automated  the 
scope  of  the  Directive  can  be  restricted  to  personal  data  which  are 
entered or intended for entry in such files. 

Lastly, the  proposal  now supplies  a definition  of the  "third  party"  to 
whom personal data are disclosed. 

3. Scope and specific exemptions 

The  following  amendments  are  proposed  in  response  to  Parliament's 
concerns.  Their purpose is to guarantee and to reconcile the rights and 
freedoms involved, so as to ensure that data can move freely. 

(i)  The initial proposal would have excluded processing carried out by 
non-profit-making  organizations  from  the scope  of  the  Directive; 
this was criticized  as inappropriate, and  in  line with certain of 
Parliament's  amendments  concerning  the  processing  of  sensitive 
data it  is now  proposed  that  processing of  this kind  should  fall 
within  the  scope  of  the  Directive,  with  provision  for  special 
exemption  from the  obligation to  notify  where necessary  in  order 
to guarantee freedom of opinion. 

(ii)  Where  processing  is carried  out  for  purposes of  journalism  it  is 
proposed that Member States should be required, rather than merely 
permitted,  to lay  down the  exemptions  necessary  to reconcile  the 
right of privacy with freedom of speech. 

(iii) Processing  may  involve  no  particular  danger, and  be  carried  out 
for example to satisfy a legal obligation, and it is proposed that 
there should be an exemption from the obligation to notify in such 
cases. 

- 4 -

4. Third countries 

The rule intended to prevent the Community rulej from being circumvented 
in the course of transfers of data to non—Community countries takes the 
form of a ban on the transfer of data to countries which do not provide 
an adequate level of protection; this has now been clarified in order to 
remove any ambiguity as to the purpose pursued.  Tests by which adequacy 
is  to  be  measured  have  been  added.  Exceptions  to  the  principle  have 
also  been  laid  down  in  a  limited  number  of  cases  where  particular 
circumstances appear to justify this. 

B. Form and content of the amended proposal 

The proposal has been restructured in order to take account of the dropping 
of  the  formal  distinction  between the  public  and  private  sectors  and  the 
expansion  of  the  provisions  on  notification  to the  supervisory  authority 
which have already been referred to.  The new structure is also intended to 
provide a  plainer exposition of  the different components in the  protection 
mechanism.  Lastly,  it  takes  account  of  criticism  of  redundancy  in  the 
initial version.  This restructuring of the proposal affects Chapters II to 
VI  of  the  initial  proposal;  these  are  now  for  the  most  part  grouped 
together  in  a single  Chapter II, which  sets out  all the  general  rules on 
the  lawfulness  of  the processing  of  personal  data,  one  by  one,  in  a  new 
order.  The structure of Chapters I, VII and after have not been changed. 

The new Chapter II  is divided into sections, which  lay down the principles 
which  are to govern the design and implementation of  processing operations 
carried  out on  personal data (Sections I, II  and III),  the data subject's 
rights  of  information,  access  and  objection  (Sections IV,  V  and  VI), 
obligations  regarding  security  (Section VII),  and  procedures  for 
notification to supervisory authorities (Section 8). 

Section  I  sets  out  principles  governing  the  quality  of  data  to  be 
processed;  the principles are common to the laws of all Member States, and 
derive  from Council of  Europe Convention No 108.  Section I corresponds to 
Article 16  in  the  initial  proposal.  The  inclusion  of  data  collection  in 
the definition of processing, which was  asked for  by Parliament  has made a 
few  drafting  changes  necessary.  Parliament's request  that  data  should  be 
storable for academic purposes has also been met here. 

One of the  principles listed in Section I, that data must  be processed  for 
a  legitimate  purpose,  is  clarified  in  Section II,  which  deals  with  the 
grounds  for  processing  data.  This  Section  reproduces  and  clarifies  the 
exhaustive  list  of  the  various  circumstances  in  which  processing  may  be 
carried out, and gives it a general character.  The list permits processing 
where  the  data  subject  has  consented, or  where  a  contract  with  the  data 
subject makes it necessary, or to comply with a legal obligation, etc., and 
ends with a clause allowing private interests to be weighed against others. 
This  balance-of-interest  clause  is likely  to concern  very  different  kinds 
of  processing, such as direct-mail  marketing and  the use of  data which  are 
already  a matter of  public record;  Member States are to weigh  the balance 
of  interest  in  accordance  with  procedures  which  they  are  to  establish 
taking  account in  particular of the general principles in  Section I and  of 
the rights of data subjects. 

- 5 -

Section  III  lays  down  specific  rules  governing  types  of  processing  which 
might  interfere  with  fundamental  freedoms.  In  line  with  the  Convention 
already referred to and with Parliament's opinion, which has  been followed 
in part here, these rules provide for stricter protection where the data to 
be  processed  are  sensitive,  that  is  to  say  relating  in  particular  to 
freedom  of  opinion.  These  provisions  correspond  to  Article 17  in  the 
original  proposal.  They  take  account  of  Parliament's  suggestions 
particularly  regarding  processing  carried  out  by  associations  of  a 
political  or  trade-union  character.  In  the  amended  proposal  such 
processing falls within the scope of the Directive, which allows the rights 
of  individuals to  be guaranteed  in this respect  and  the  free movement  of 
such  data  to  be  ensured.  Section 3  also  sets  out  the  rules  already 
referred  to  regarding  processing  for  purposes  of  journalism,  which  are 
intended  to reconcile  the two  fundamental  freedoms of  privacy  and  freedom 
of expression. 

Section IV deals with the obligations of  the controller to inform the data 
subject of the  processing which takes place.  The obligations are  intended 
to ensure  transparency  in  processing,  and  thus to  underpin the  principles 
of the fair processing of data which are laid down in the Council of Europe 
Convention,  and  which  have  already  been  referred  to  in  Section I. 
Section IV corresponds to what were Chapters II, III and IV in the original 
version;  the wording has  been altered  particularly  in order to remove any 
danger  that  it  might  be  interpreted  as requiring  more  information than  is 
necessary. 

Section  V  concerns  the  data  subject's  right  of  access  to data  concerning 
him  and  his  right  to  have  it  rectified.  It  corresponds  to  certain 
provisions  of  Chapter IV  in  the  original  proposal,  and  takes  over 
Parliament's  amendments,  which  generally  broaden  the  scope  of  this 
entitlement  (particularly  the  data  subject's  entitlement  to  be  told  the 
source  of  the  data  being  processed  and  the  reasoning  applied  in  any 
automatic  processing  operation  the  outcome  of  which  is  invoked  against 
him).  The  amended  provisions  also  take  account  of  Parliament's  request 
that the circumstances  in which the exercise of  the right of  access may  be 
restricted  should  be  extended  to the  private  sector  on the  same  terms as 
the public sector. 

Section  VI  concerns  the  data  subject's  right  to  object  on  legitimate 
grounds.  It  corresponds to  the relevant  provisions of  Chapter III  and  IV 
in  the  initial  proposal.  The  requirement  that  data  subjects  must  be 
offered  the  possibility  of  opting  out  of  the disclosure  of  data  to third 
parties with a view to canvassing is laid down here. 

Section  VII  reproduces  the  rules  on  security  which  were  set  out  in 
Chapter V of the  initial proposal, with a few drafting changes. 

Section  VIII  develops  the  original  rules  on  notification.  The  selective 
system  proposed  is  for  the  most  part  taken  over  from  Parliament's 
amendments;  it seeks to ensure that processing is transparent and that its 
purposes are  stated, while directing supervisory  authorities' attention  to 
types of  processing which deserve  special attention  because of the dangers 
they involve.  The system is based on the approach that all processing must 
be  notified  to  the  supervisory  authority  once  it  is  wholly  or  partly 
automatic,  although  one  notification  may  refer  to  a  set  of  processing 
operations  whose  purposes  are  linked  from  the  point  of  view  of  the 
controller  or  in  terms  of  the  data  subject.  On  the  basis  of  their 
experience  it  is  proposed  that  Member States may  take  measures  to exempt 
from  the  notification  requirement  processing  operations  which  do  not 
represent  any  danger to the  data subjects'  rights and  freedoms;  they may 
also simplify  the requirement.  Measures of  this kind  are to  describe the 
processing  operations  covered  and  where  appropriate  the  circumstances  in 
which they are to be carried out.  It is also proposed that the supervisory 
authority may  be empowered to examine notified processing operations before 
they are carried out. 

Chapter  III  groups together  the  provisions of  Chapters IV  and  VII  of  the 
initial  proposal,  dealing  with  the  remedies  open  to  data  subjects, 
liability,  and  penalties.  These  provisions  have  been  amended  to  take 
account of Parliament's opinion. 

Chapter  IV  deals with transfers  of  personal data  to non-member  countries. 
It  corresponds  to  Chapter VIII  of  the  initial  proposal.  It  has  been 
amended in the way already indicated, and leaves scope for the Community to 
develop a common policy on the subject. 

Chapter V  is  concerned  with  codes  of  conduct.  It  corresponds  to  the 
relevant  provisions  in the  original  Chapter VI.  It  follows  Parliament's 
opinion on the involvement of the  independent supervisory  authority  in the 
drawing  up  of  codes  of  conduct.  It  also  allows  Member States  to  give 
trade associations a role in the application of the legislation by allowing 
them to participate in drawing up national codes of conduct. 

Chapter VI  deals  with  the  national  supervisory  authority  and  the 
Working Party  which  is  to  help  to  ensure  that  the  national  provisions 
adopted  pursuant to the Directive  are uniformly  applied  and  to advise  the 
Commission. 
The  investigative  powers  of  the  national  authorities  are 
clarified, as  Parliament had  hoped.  The composition of  the Working Party 
has  been left  unchanged, in order  to guarantee its  independence.  For the 
same  reason  it  is  proposed  that  the  Working Party  should  elect  its  own 
The  circumstances  in  which  it  is  to  be  consulted  by  the 
chairman. 
Commission are spelt out. 

Chapter VII  concerns  the  executive  powers  which  the  Council  is  asked  to 
confer  on  the  Commission.  Here  the  Commission  maintains  its  initial 
proposal, contrary to Parliament's opinion.  The Commission takes the view 
that  technical  measures  will  be  needed  in  order  to  apply  the  Directive, 
given  the  extent  and  the  highly  technical  character  of  the  field  of 
personal data protection. 

- 7 -

Final  provisions:  in  response  to  Parliament's  request  the  proposal  now 
provides  that  after  the date  by  which  Member States must  comply  with  the 
Directive there is to  be a further period  of three years in which  the new 
requirements need not apply to situations already existing. 

- 8 -

COMMENTARY ON THE TITLE AND RECITALS 

TITLE 

Two points have been clarified in the title: 

-  the  words  "and  on the  free movement  of  such  data"  have  been  added  in 
order to emphasize that the proposal is aimed at establishing  a working 
single  market,  on  the  basis  of  a  harmonization  of  legislation  which 
ensures the protection of individuals; 

-  to eliminate  any  ambiguity  as to  the scope  of  the proposal  it  is  made 
clear in  the title that it  is individuals who are  to be  protected, and 
not all persons both natural  and  legal (this change does not affect the 
English version). 

RECITALS 

The  Commission  has  amended  the  recitals  in  order  to take  account  of  the 
changes to the substantive provisions. 

The following specific remarks may also be made: 

Recital No 2  is  drawn  from  Parliament's  opinion  (amendment  No 9), and 
seeks to  point out  the advantages  of  automatic data  processing  systems 
provided they respect individual rights and freedoms; 

it  appeared preferable to place the recital referring to the Council of 
Europe Convention among those describing the requirements of a Community 
policy  on  the  subject,  because  the  Directive  embodies  the  principles 
set  out  in the  Convention;  this recital  has now  become  recital No 10; 
the  same  recital  was  previously  placed  among  those  dealing  with 
transfers of data to non-member countries, as recital No 22; 

a  new recital  No 14 has been  inserted  which seeks  briefly  to summarize 
the principles of protection referred to in the succeeding recitals; 

-  the  changes  in  the  new  recital No 4 and  recital No 5  are  intended  to 
amplify  the  description  of  the  facts  leading  up  to  a  Community 
initiative,  the  justification  for  which  is  then  spelt  out  in 
recitals Nos 7 and 8. 

- 9 -

COMMENTARY ON THE ARTICLES 

CHAPTER I 

GENERAL PROVISIONS 

Article 1 

Object of the Directive 

Article 1  defines  the  object  of  the  Directive.  The  Directive  seeks  to 
ensure  the  free  movement  of  personal  data  between  Member States  by 
providing for a harmonization of national legislation. 

(1)  Paragraph 1 requires Member States to protect the rights and  freedoms 
of  natural  persons  with  respect  to the  processing  of  personal  data, 
and in particular their right of  privacy (the terminology is based on 
that of Article 1 of the Council of Europe Convention). 

(2)  Under  the  Directive  the  protection  provided  is  to  follow  the  same 
lines in all Member States, and will thus be equivalent throughout the 
Community;  and  paragraph 2  accordingly  prevents  Member States  from 
restricting  the  free  flow  of  data  in  the  fields  covered  by  the 
Directive on grounds relating to the protection of data subjects. 

The proposal thus seeks to reconcile the requirements of the single market 
with those of data protection, in line with Parliament's wishes (amendment 
No 10). 

Parliament's  amendment  No 11  has  likewise  been  incorporated  into  the 
amended  proposal,  by  enlarging  the  definition  of  "processing"  in 
Article 2(a) to include the collection of data. 

Article 2 

Definitions 

This  Article  defines  the  main  concepts  used  in  the  Directive.  The 
definitions are taken from the Council of  Europe Convention, but  have been 
adapted  and  clarified  to  ensure equivalent  protection  at  a  high  level  in 
the Community. 

(a)  "Personal  data".  The  amended  proposal  meets  Parliament's  wish  that 
the definition of "personal data" should be as general as possible, so 
as  to  include  all  information  concerning  an  identifiable  individual 
(amendment  No 12).  A  person  may  be  identified  directly  by  name  or 
indirectly by  a telephone number, a car  registration number,  a social 
security number, a passport  number or by  a combination of  significant 
criteria which allows him to be recognized by narrowing down the group 
to which he belongs (age, occupation, place of residence, etc.).  The 
definition  would  also  cover  data  such  as  appearance,  voice, 
fingerprints or genetic characteristics. 

- 10 -

"Depersonalized"  data  are  not  defined:  the  term  is  not  used  in  the 
Directive.  This means that whether or not  data are depersonalized  no 
longer depends on the cost of determining the data subject's identity 
(amendment  No 13).  However,  in  the  specific  case  where  data  are 
compiled in the form of statistics, it has been considered appropriate 
to state that they cannot be considered to be personal data where the 
data subjects can no longer reasonably be identified. 

"Processing  of  personal  data"  ("processing").  The  definition  given 
here  is  likewise  an  extensive  one,  the  better  to  ensure  that 
individuals are  protected (amendment  No 15), as  it  covers  everything 
from  the  collection  to the  erasure  of  data,  including  organization, 
use,  consultation,  disclosure  by  transmission,  dissemination  or 
otherwise  making  available  (amendment  No 16),  comparison  and 
suppression. 

"Personal  data  file"  ("file").  This  definition,  which  covers  both 
automatic  and  non-automatic  files,  is  now clarified.  In the  case of 
non-automatic  processing  it  allows  the  scope of  the Directive  to  be 
confined  to  sets  of  data  which  are  structured  so  as  to  facilitate 
access and  searches for data on individuals.  Personal data which  are 
not  organized  so  that  they  can  be  used  with  reference  to  the  data 
subjects themselves are thus excluded.  In practice data of  this kind 
do  not  present  the  same  dangers  for  individuals,  and  it  is  more 
realistic not to subject them to the same obligations. 

To  ensure  that  individuals  are  properly  protected  the  criteria  for 
access  must  have  the  "object  or  effect"  of  facilitating  the  use  or 
comparison  of  data.  This  means  that  the  data  subject  has  does  not 
have to prove intention, something which  might have  made it  difficult 
to apply the national legislation. 

The  word  "comparison"  has been  preferred  to "combination"  because  it 
is  appropriate  both  to  automatic  processing  and  to  files  kept  on 
paper. 

"Controller".  The definition  is  borrowed  from  the  definition  of  the 
"controller of the file" in the Council of Europe Convention. 

But as the Directive sets out to regulate the use of data in the light 
of  the  object  being  pursued,  it  is  preferable  to  speak  of  the 
"controller", and to drop any reference to a "file" or to "data". 

The  controller  is  the  person  ultimately  reponsible  for  the  choices 
governing  the  design  and  operation  of  the  processing  carried  out 
(usually  a  chief  executive  of  the  company),  rather  than  anyone  who 
carries  out  processing  in  accordance  with  the  controller s 
instructions.  That  is  why  the  definition  stipulates  that  the 
controller decides the "objective" of the processing.  This is in line 
with  Parliament's  amendment  No 17.  The  controller  may  process  data 
himself,  or  have  them  processed  by  members  of  his  staff  or  by  an 
outside processor, a legally separate person acting on his behalf. 

-li­

fe)  "Processor".  This  is  a  useful  definition  proposed  by  Parliament 

(amendment No 18). 

(f)  "Third  party".  This  definition  is  taken  from  one  of  Parliament's 
amendments (No 134); it  has  been reworded  in the  amended  proposal  in 
order  to  make  it  clear  that  third  parties  do  not  include  the  data 
subject, the controller, or any  person authorized to process  the data 
under the  controller's  direct  authority  or  on  his  behalf,  as  is the 
case with the processor. 

Thus persons  working  for  another  organization, even  if  it  belongs to 
the same group or holding company, will generally be third parties. 

On the other  hand, branches  of  a  bank processing  customers'  accounts 
under  the direct  authority  of  their  headquarters  would  not  be  third 
parties.  The  same  would  apply  to  the  employees  of  insurance 
companies;  in the case  of  insurance brokers, on  the other  hand, the 
position may vary from case to case. 

(g)  "The data subject's consent".  In the initial proposal  the definition 
of  a  person's  consent  to the  processing  of  data  concerning  him  was 
given in Article 12, dealing with the rights of data subjects. 

This  caused  some  confusion;  some  interested  parties  drew  the 
conclusion that all processing  required the prior  consent of the data 
subject, whereas  consent was only  one of  the possible  grounds making 
processing lawful. 

It  seems  more  logical,  therefore,  to  put  the  rules  on  consent  in 
Article 2, with  a  few  changes  of  wording  so  as  to  cast  them  in  the 
form of a definition. 

The reference to consent being  "express" has been removed,  lest  it be 
interpreted  as  requiring  written  consent  (a  procedure  confined  to 
sensitive  data  in  Article 8 of  the  amended  proposal).  It  has  been 
replaced  by  the  concept  of  an  "express  indication  of  his  wishes", 
something which may be either oral or in writing. 

The  amended  proposal  makes  it  clear  that  consent  must  be  "freely 
given", in cases  where pressure  might be brought  to  bear on  the data 
subject (the case of a wage-earner and his employer, for example). 

To enable the data subject to make an assessment of the advantages and 
disadvantages  of  the  processing  of  data  concerning  him,  and  to 
exercise  his  rights under  Article 13 of  the  proposal (rectification, 
erasure and  suppression), the consent given  must  be informed  consent. 
The  controller  must  supply  the  data  subject  with  the  information  he 
needs,  such  as  the  name  and  address  of  the  controller  and  of  his 
representative  if  any  (see  Article 4(2)),  the  purpose  of  the 
processing, the data recorded, etc. 

- 12 -

The  data subject's  consent  must  be  "specif i<~",  meaning  that  it  must 
relate to a  particular data  processing oper ι Ion concerning  the data 
subject  carried  out  by  a  particular  controller  and  for  particular 
purposes. 

The  data  subject  may  withdraw  his  consent  at  any  time. 
But  this 
withdrawal  has  no  retrospective  effects;  otherwise  a  processing 
operation  which  was  lawful  when  carried  out  might  become  unlawful 
retroactively. 

Three definitions in the original proposal have been deleted: 

-  the  definition  of  the  supervisory  authority,  which  is  covered  by 

Article 32 of the amended proposal; 

-  the public  and  private sectors,  as the provisions dealing  with the  two 

sectors have been merged (Chapter II of the amended proposal). 

Article  3 

Scope 

Paragraph 1 of the amended proposal seeks to accommodate the views of those 
who  as  far  as  data  processing  is  concerned  would  like  to  refer  only  to 
processing  "by  automatic  means"  (because  automatic  processing  does  not 
necessarily  require the  existence  of  a file)  and  of those  who  are afraid 
that  the Directive  might  be  extended  to  cover  all  data  stored  on  paper, 
whether structured or unstructured. 

The amended proposal therefore lays down separate tests for determining the 
scope  of  the  Directive,  depending  on  whether  or  not  the  data  are  being 
processed  by  automatic  means:  it  is  to  apply  to  the  non-automatic 
processing of data only if the data form part of a file;  on the electronic 
side,  however,  the definition  does  not  depend  on the  presence of  a  file, 
and the Directive applies to any automatic  processing of data even  if they 
do not form part of a file. 

Thus  structured  personal  data  are  caught  by  the  definition  if  they  are 
organized in a manual file or by electronic data processing methods. 

The provision refers to processing "wholly or partly by automatic means  in 
order  to  indicate  that  a  processing  operation  constitutes  a  single  whole 
even if only part (such as the index) is computerized. 

Paragraph 2 makes two exceptions: 

-  the  first  exception  concerns  processing  in  the  course  of  an  activity 
which  falls outside the  scope of  Community  law (in the secret  services 
for  example);  the  scope  of  the  Directive  is  defined  in  terms  of  the 
scope of Community law, so that it can evolve with it; 

-  the second  exception concerns the use of data  in the course of  a purely 

private activity, such as an electronic diary (amendment No 22); 

- 13 -

no  other  exceptions  are  laid  down,  because  if  too  many  types  of 
organization were to  be exempted  from  any  obligation the rights of  the 
individuals  would  no  longer  be  guaranteed:  while  the  rules  governing 
certain types of processing of personal data may well be simplified (see 
Section VIII in  Chapter II, on  notification, which  makes  provision for 
exemption and simplification), a general exemption is not possible. 

The  particular  problem  of  associations  is  dealt  with  in  the  Article 
providing for the exemption of  the collection of sensitive data (Article 8 
in the amended proposal). 

Article 4 

National law applicable 

This  Article  lays  down  the  connecting  factors  which  determine  which 
national law is applicable to processing within the scope of the Directive, 
in order to avoid two possibilities: 

that  the  data  subject  might  find  himself  outside  any  system  of 
protection, and particularly that the law might be circumvented in order 
to achieve this; 

-  that the same processing operation might be governed by the laws of more 

than one country. 

Under  the  original  proposal  the  place  where  the  file  was  located  was  to 
determine  territorial  jurisdiction,  but  this  criterion  has  not  been 
retained in the amended proposal, on the ground that the location of a file 
or  of  a  processing  operation  will  often  be  impossible  to  determine: 
processing  operations  may  have  more  than  one  location  and  take  place  in 
several Member States, particularly  in the case of data  bases connected to 
networks, which are becoming increasingly frequent. 

Under  the  amended  proposal,  therefore,  the  law  applicable  is  defined  by 
reference to the place of establishment of the controller. 

A controller  who is  not  established  in the  Community,  may  for the  purpose 
of  processing  make  use  of  means,  whether  or  not  automatic  (terminals, 
questionnaires etc.), which are located in the territory of a Member State, 
and  here the  law  applicable is  to be  that  of  the state on  whose territory 
those  means  are  located. 
The  controller  must  then  designate  a 
representative established in that Member State, who is to be subrogated to 
the controller's rights and obligations. 

In that case it is the representative who will be subject to the obligation 
to notify (Section VIII  of Chapter  II);  and any  information regarding  the 
controller  which  has  to  be supplied  to  data  subjects  under  the  Directive 
will  have  to  be  supplemented  by  information  on  the  controller's 
representative. 

The  amended  proposal  follows Parliament's  amendment  No 24 in  removing  the 
reference  to  sporadic  use,  a  vague  term  which  would  have  been  open  to 
various interpretations. 

- 14 -

The  reference to the  place of  establishment  of the  controller  means  that 
the  temporary  removal  of  a  file  does  not  affect  the  law  applicable. 
Article 4(3) of the initial proposal has accordingly been dropped. 

CHAPTER II 

GENERAL RULES ON THE LAWFULNESS OF THE PROCESSING OF PERSONAL DATA 

The structure of the amended proposal is different from that of the initial 
proposal:  the  new  Chapter II  groups  together  all  the  rules,  rights  and 
obligations  which  determine the  lawfulness of  processing  operations.  In 
line  with Parliament's  opinion, the  provisions  on  the  public  and  private 
sectors have been run together. 

Article 5 

This  Article  takes  over  Article 6(2)  and  Article 8(1)  and  (3)  of  the 
initial  proposal. 
It  requires  Member States  to  provide  that  the 
processing  of  personal  data  is  lawful  only  if  carried  out  in  accordance 
with Chapter II, which forms a whole. 

By  way  of  explanation the  Article  also  makes  it  clear  that  Member States 
may  in  their  laws  more  precisely  determine  the  circumstances  in  which 
processing  is  lawful,  always  subject  to  Chapter II.  Depending  on  the 
particular area they might for example wish to determine the cases in which 
the  interests  of  the data  subject  prevail  (Article 7(f)), the  methods  by 
which information  is to be given to data subjects (Section IV), or the way 
in  which  the  right  of  objection  is  to  be  exercised  (Section VI). 
Such 
provisions may not stand in the way of the free movement of data within the 
Community. 

SECTION 1 

PRINCIPLES RELATING TO DATA QUALITY 

Article 6 

This  Article  takes over  the thrust  of  Article 5  of  the  Council  of  Europe 
Convention. 

It contains the provisions concerning the fundamental rights of individuals 
with  respect to data  processing, and  has  been put  at  the beginning  of  the 
Chapter  dealing  with the  lawfulness of  processing  operations.  It  will  be 
necessary  to  refer  back  to  this  Article  to  interpret  the  subsequent 
Articles in the Chapter. 

- 15 -

As compared with the Convention the Article  makes several changes intended 
to adapt  the Convention's  wording  to  the  definitions  in  Article 2 of  the 
proposal,  particularly  the  definition  of  "processing",  and  also  to  the 
scope  of  the  Directive,  which  unlike  the  Convention  applies  both  to 
automatic  processing  and  to non-automatic  processing of  data  contained  in 
files. 

Article 6(1)(a) provides that  personal  data  must  be  processed  fairly  and 
lawfully.  The  "processing"  referred  to  is  that  defined  in  Article 2(b), 
and thus includes collection. 

The  rule  laid  down  in  Article 6(1) (a)  excludes  the  use  for  example  of 
concealed  devices  which  allow  data  to  be  collected  surreptitiously  and 
without  the knowledge  of  the data  subject,  by  means of  telephone tapping 
and the like.  This provision also prevents controllers from developing and 
using clandestine processing operations for personal data. 

Article 6(1)(b) states the  principle  of  the  purpose  of  the collection  of 
data (whether  by  automatic or  non-automatic  means).  Personal data  may  be 
stored only for specified, explicit and legitimate purposes. 

The purpose of the collection of personal data must be "specified", that is 
to say that the aim of the collection and use of data has to be defined in 
as  precise  a  fashion  as  possible.  A  general  or  vague  definition  or 
description  of  the  purpose  of  processing  operations  ("for  commercial 
purposes", for example) would  not satisfy  the requirement that the purpose 
be specified. 

The  purpose  must  be  specified  before  the  data  are  collected.  Where  the 
data  are  collected  from  the  data  subject.  Article 11  requires  that  the 
purpose must have been determined at the time of collect-ion. 

A subsequent change in the purpose of a processing operation will be lawful 
only to the extent that it is compatible with the initial purpose. 

Article 6(1)(b) also obliges the controller to determine the purpose of the 
storage and recording of data. 

Personal  data  can  be  stored  and  used  only  for  a  "legitimate"  purpose, so 
that  the  potential  purposes  of  processing  are  limited.  A  processing 
operation may be designed and performed only for a purpose permitted  by the 
Directive and by the domestic legislation in the Member States. 

Article 6(1) (c)  states  that  data  must  be  adequate,  relevant  and  not 
excessive in  relation  to the  purposes for  which  they  are processed.  This 
rule requires that  the nature of  the data  should  correspond  to the end  in 
view. 

Article 6(1) (d)  is  closely  bound  up  with  Article 6(1) (b)  and  (c).  Data 
must  be  accurate  and,  if  necessary,  kept  up  to  date.  If  data  are 
inaccurate  or  incomplete  given  the  purpose  of  the  file,  Article 6(1)(d) 
provides that they are to be erased or rectified. 

- 16 -

Article 6(1) (e)  concerns  the  time  for  which  personal  data  may  be  kept. 
Data  may  be kept  in  a  form  which  permits  identification  of  data  subjects 
for  no  longer  than  is  necessary  to  achieve  the  objectives  for  which  the 
data were recorded. 

In some cases, however, where after a certain period a processing operation 
is no longer needed  for its primary function,  it may be necessary  to store 
the  information,  particularly  for  historical  or  scientific  use. 
Article 6(1)(e)  therefore  states  that,  as  Parliament  had  requested 
(amendment  No 60),  Member States  may  provide  for  further  safeguards  for 
data  stored  for  historical,  statistical  or  scientific  use,  in  order  to 
reconcile on the  one hand  the principle of  the legitimate  purpose and  the 
entitlement  to  have  one's  past  forgotten  and  on  the  other  hand  the 
requirements of research. 

Article 6(2) obliges the controller to ensure that the rules on the quality 
of data laid down in Article 6(1) are complied with. 

SECTION II 

PRINCIPLES RELATING TO THE PROCESSING OF DATA 

Article 7 

Article 7 provides  a simplified  and  restructured  statement  of  the grounds 
on which  personal data  may  lawfully  be  processed; in  the initial  proposal 
this matter was to be found in Articles 5, 6 and 8. 
The  distinction  between  the  public  and  the  private  sectors  has  been 
dropped, as proposed in Parliament's amendments Nos 27, 28 and 29. 

There  is no  longer any  specific  reference to the processing  of  data  for a 
purpose  other  than  the  original  one,  a  possibility  covered  in 
Article 5(1)(b)  of  the  initial  proposal,  or  to  the  lawful  disclosure  of 
personal  data,  which  was  treated  in  Articles 6 and  8(2) of  the  original 
proposal.  It is felt that the general rule that data must be used in a way 
compatible  with  the  purpose  for  which  it  was collected,  laid  down  in  the 
new  Article 6(l)(b),  together  with  the  statement  of  possible  grounds  for 
the  processing  of  data,  set  out  in  the  new  Article 7, will  be  sufficient 
here. 

The criteria which Parliament  proposed  in its  amendments No 30 and 32  have 
been accepted only in a modified form. 

Consent  is no  longer the  main criterion,  subject to  exceptions;  it  is now 
the first of several alternatives (new Article 7(a)). 

The reference to a  "quasi-contractual relationship"  was considered  by  many 
sources to  be vague  and to  fall either  under the  concept of  a contract 
under that of  a legitimate interest (referred  to in  the new  Article 7(f)); 
and  the  wording  "steps at  the  request  of  the data  subject  preliminary  to 
entering  into a  contract"  has now  been  used to  cover the  situation  before 
any contractual relationship is established (new Article 7(b)). 

- 17 -

The reference to processing  in order to  comply with  an obligation  imposed 
by national or Community law has been maintained (new Article 7(c)). 

The same applies to the new Article 7(e) and in part to Article 7(f). 

The new Article 7(d) has been added to provide for cases in which the data 
subject has  a  vital interest  in having  his personal  data processed  but is 
not  in  a  position  to  give  his  consent  (in  serious  medical  cases  for 
example). 

Article 7(f) has been  drafted partly  in response to Parliament's amendment 
No 32; it  expands the initial  Article 8(1)(c), and  takes into  account the 
fact that  there may  be legitimate  interests  at  stake other  than  those of 
the  controller  and  of  the  data  subject.  Article 8(1)(b) of  the  initial 
proposal has  been deleted,  because the  Commission has  established  that in 
certain cases the "sources generally accessible to the public" to which it 
referred  may  in  fact  include  sensitive  personal  data.  In  any  event  the 
data will usually have been processed for specific purposes, and should not 
be  used  for  different  purposes  except  in  accordance  with  the  other 
provisions of the Directive. 

SECTION III 

SPECIAL CATEGORIES OF PROCESSING 

Article 8 

The processing of special categories of data 

This Article corresponds to the original Article 17. 

It  is generally accepted  that  it  is not  so much the  content of  data which 
may  endanger  privacy  as  the  context  in  which  the  data  is  processed. 
However,  there  is  a  broad  consensus  among  the  Member States that  certain 
categories of data do by their nature pose  a threat to privacy.  Article 8 
of the proposed Directive therefore places strict  limits on the processing 
and  use  of  data  revealing  racial  or  ethnic  origin  (which  will  include 
information  on  skin  colour);  political  opinions;  religious,  philosophical 
or ethical  persuasion, which  will  include the fact  that  a person  holds no 
religious belief, as well as information on any activities relating to such 
a  persuasion;  trade-union  membership;  information  on  the  data  subject's 
health, which  will  include his  state of  physical and  mental  health,  past, 
present  and  future,  and  any  indication  of  drug  or  alcohol  abuse;  and 
information  concerning  sexual  life.  Beliefs  besides  religious  or 
philosophical  beliefs  might  constitute  sensitive  data,  and  the  word 
"ethical" has been added accordingly. 

The  Article  initially  proposed  has  been  amended  and  restructured  to take 
account of points raised by· Parliament (amendments Nos 63, 149 and 65). 

- 18 -

paragraph 1 laya  down a general  ban on the processing  of this  "sensitive" 
data  - whether  by  manual or  automatic  means, a  point  included  in response 
to Parliament's amendment No 63. 

paragraph 2 provides for a number of exceptions to the general rule: 

(i)  Rather than requiring "express and written consent, freely given" as 
a general condition for the processing of sensitive data, subject to 
exceptions, it is considered preferable to list consent  as one of a 
number of  alternative exceptions  to the general  prohibition on  the 
processing of such data. 

(ii)  Such  data  may  be  processed  by  foundations  or  associations  of  a 
political,  philosophical, religious or trade-union character  in the 
course  of  their  legitimate  activities,  and  on  condition  that  the 
data  relate  solely  to  members  of  the  body  and  persons  who  have 
freely entered into correspondence with it, and are not disclosed to 
third parties.  Processing of this kind is not to be subject to the 
obligation  to  notify  imposed  in  section  VIII  of  the  amended 
proposal,  something  Parliament  had  requested  in  its  amendment 
No 149. 

(iii)  Processing  may  be  carried  out  in  circumstances  where  there  is 
manifestly  no  infringement  of  the  data  subject's  privacy  or 
freedoms.  Examples of processing of this kind would be the assembly 
of data of a political nature concerning a public representative, or 
the  compilation  of  lists  of  persons  to  be  approached  for  opinion 
poll  purposes  over  a  short  period  of  time,  under  strict  security 
measures. 

Paragraph 3  reproduces  Article 17(2) of  the  initial  proposal,  permitting 
exemptions on "important  public interest grounds."  An exemption  should  be 
given,  for  example,  to  international  human  rights  organizations  which 
require  such  data  for  their  work,  provided  they  can  offer  suitable 
safeguards. 

Parliament  felt  that  data  concerning  criminal  convictions  should  be  held 
only  by  judicial  authorities  (amendment  No 65),  and  this  point  has  been 
accepted  in part  in paragraph 4.  Such data  could  be  held  by  judicial  and 
law  enforcement  authorities,  but  also  by  the  persons  directly  concerned 
with those convictions or by their representatives.  Given the particularly 
sensitive nature of  such data any exemptions would  have to be laid down  in 
legislation, with suitable safeguards specified. 

Parliament  proposed  a  new  Article 3a requiring  Member States to  enact  the 
conditions  under  which  a  national  identification  number,  where  such  a 
number  exists,  or  other  identifier  of  a  general  nature  might  be  used 
(amendment  No 65);  this amendment  has  been  accepted,  and  incorporated  as 
paragraph 5. 

- 19 -

Article 9 

Processing of personal data and freedom of expression 

This Article  corresponds to the  initial  Article 19.  There is  a danger  of 
conflict  between  the  fundamental  rights  of  individuals,  particularly  the 
right to privacy, and the freedom  of expression,  and the Member States are 
here required to lay down exemptions from the requirements of the Directive 
for the press and audiovisual media.  The approach adopted lays emphasis on 
the  obligation  to  balance  the  interests  involved  in  granting  exemptions. 
Account  may  be taken  for  example  of  the  availability  of  remedies or  of  a 
right of reply, the existence of a code of professional ethics, the limits 
laid  down  by  the  European  Convention  on  Human  Rights,  and  the  general 
principles of law. 

To  ensure  a  measure  of  harmonization  it  is  now  to be  obligatory  for  the 
Member States to grant exemptions for the press, the audiovisual media, and 
- an addition to the original text - journalists.  Such exemption would  be 
possible only in respect of processing for journalistic purposes.  The term 
"journalists"  is intended  to include  photojournalists and  writers  such  as 
biographers. 

SECTION IV 

INFORMATION TO BE GIVEN TO THE DATA SUBJECT 

Section IV brings together all the provisions concerning the information to 
be given  to the data  subject  which were  to be  found  loosely  scattered  in 
the initial proposal (initial Articles 9, 13 and 14(3)). 

Article 10 

The existence of a processing operation 

This  Article  corresponds  to  the  initial  Article 14(3), providing  for  the 
right "to know of the existence of a file and to know its main purposes and 
the  identity  and  habitual  residence,  headquarters or  place of  business of 
the controller of the file". 

The following changes have been made. 

It  is  specified  that  this  entitlement  may  be  exercised  on  request. 
"Habitual residence, headquarters or place of business of the controller of 
the file" have  been replaced  by the "name and  address of the controller or 
his  representative",  as  these  are  felt  to  be  sufficient  particulars  to 
allow  the  data  subject  to  exercise  his  rights.  The  data  subject  is  now 
also entitled to know the categories of  data concerned and  the identity of 
any third parties. 

Member States  may  restrict  this  entitlement  in  accordance  with 
Article 14(1)  on  grounds  of  national  security,  defence,  public  safety, 
etc.). 

- 20 -

Article 11 

Collection from the data subject 

This Article grants specific information rights to a data subject from whom 
personal data are collected;  it corresponds to the initial Article 13. 

If  personal data  are to be collected  fairly and  lawfully the data  subject 
must  be able to decide whether  or not to disclose  data relating to  him  in 
full  knowledge  of  the  purposes  of  the  processing,  the  existence  or 
otherwise of a legal obligation to disclose the data, and the consequences 
for him  if  he fails to reply.  To ensure that he can defend his rights and 
monitor the use of  data relating to him he  should also  be informed  of  his 
rights of access and  rectification, and given details of the recipients of 
the data. 

The following changes have been made: 

(i) 

The title now specifies that it is when data are collected from the 
data subject that the Article applies. 

(ii)  This is confirmed  in paragraph 1, which makes it clear that  what is 
involved  is  not  just  a  right  enjoyed  by  the  data  subject,  to  be 
exercised  on request,  but  an obligation  on the  controller  whenever 
personal data  are collected  from data  subjects.  How this  is to  be 
put  into  practice  will  depend  on  the  particular  circumstances  in 
which the data are collected. 

(iii)  Like  Article 13(2) in  the  initial  proposal,  the  new  Article 11(2) 
' empowers  the  Member States  to  restrict  this  duty  to  inform  on 
grounds of an overriding general interest.  The information referred 
to  in  paragraph 1 would  not  have  to  be  supplied  where  that  would 
hinder  or  prevent  the  performance  of  a  monitoring  or  inspection 
function  by  a  public  authority  or  would  hinder  or  prevent  the 
maintenance of public order. 

Article 12 

Disclosure to a third party 

This  Article corresponds  to Article 9 of  the  initial  proposal.  To enable 
the  data  subject  to  exercise  his  rights,  paragraph 1  requires  the 
controller to  inform the  data subject  that data  relating  to him  are being 
disclosed.  This  will  enable  the  data  subject  to  exercise  his  right  of 
access or to object to a continuation of the processing in question. 

Parliament's  amendment  No 35  has  been  accepted  to  the  extent  that  it 
referred  to those  provisions of  amendment  No 32 which have  been  accepted. 
The  Article 8(2)(a)  to  which  Article 35  referred  corresponds  to  the 
Article 7(c) now referred to in Article 13;  Article 8(2)(e) corresponds to 
the  new  Article 7(b),  and  Article 8(2)(g) partly  corresponds  to  the  new 
Article 7(f). 

- 21 -

The data subject's right to object to processing operations, which  include 
disclosure,  is dealt  with  in Section VI, Articles 15 and  16.  The  amended 
Article 15 takes  over the  spirit of  paragraph 3 of Parliament's  amendment 
No 35, omitting  the concept  of  "agent",  which  was felt  to  be  unnecessary 
and confusing. 

In  the  initial  text  the  obligation  to  supply  information  when  data  are 
disclosed  essentially  applied  to  the  private  sector,  but  the  amended 
proposal makes no distinction between the public and private sectors. 

No  reference  is  made  to "on-line  consultation",  since this  is  covered  by 
the word "disclosure".  The obligation to inform is not to apply: 

where disclosure  is  necessary  in order  to safeguard  the data  subject's 
vital interests (it may be impossible to inform him, or may  be contrary 
to his interests to do so); 
where the data subject has already been informed that the data are to be 
disclosed or may be disclosed; 
where disclosure  is required  by  legislation making  an exception  to the 
obligation to inform; 

-  where  the  data  are  disclosed  for  one  of  the  reasons  listed  in 

Article 14(1) (national security, defence, public safety, etc.). 

It is felt that the data subject should be informed not only of the purpose 
of the processing, the type of data concerned, and the name and address of 
the  controller  or  his  representative,  but  also  of  the  recipients  or 
categories  of  recipients,  or  the  existence  of  rights  of  access, 
rectification and objection. 

Article 12(3)  of  the  amended  proposal  corresponds  to  Article 10  of  the 
initial version, which made a special exception to the obligation to inform 
the  data  subject  where  this  proved  impossible  or  would  involve  a 
disproportionate  effort,  or  conflicted  with  the  overriding  legitimate 
interests of  the  controller of  the file  or a  similar  interest of  a third 
party.  It  is now added  that a supervisory  authority granting an exemption 
of this kind must lay  down any suitable safeguards; this is to ensure that 
the data subject's rights and freedoms are not  unduly injured  by a  lack of 
information. 

The power to exempt  from the obligation to inform  should be  exercised, for 
example, in respect of human rights and humanitarian organizations, so that 
their legitimate work is not unduly hindered. 

- 22 -

Article 13 

Right of access 

This  Article  includes  those  provisions  of  the  initial  Article 14  which 
concerned the data  subject's right of  access to his own  personal data  and 
the related right to obtain rectification, erasure or blocking of such data 
(the  original  paragraphs 4, 5  and  7).  Like  Article 14(4) of  the  initial 
text,  the  amended  Article 13(1) confers on the  data subject  the  right  to 
obtain,  at  reasonable  intervals  and  without  excessive  delay  or  expense, 
confirmation  of  the  existence  of  personal  data  relating  to  him  and 
communication of such data to him in an intelligible form. 

It  is  left to  the Member  States to  specify  how such  information is  to  be 
forwarded  to  the  data  subject,  in  order  to  ensure  that  the  data  are 
disclosed  to  the  right  person,  for  example,  or  in  order  to  facilitate 
matters  both  for  the  controller  and  for  the  data  subject  where  several 
processing  operations  are  concerned,  especially  in  the  case  of  manual 
files.  It  is  also  left  to  the  domestic  law  of  the  Member  States  to 
determine  the  meaning  of  the term  "reasonable intervals".  Taking  account 
of  the  interests  both  of  the  data  subject  and  of  the  controller,  the 
domestic  law  of  the  Member  States  may  provide  that  the  controller  is 
entitled  to charge  a data  subject  who exercises  his right  of  access,  but 
the  amount  charged  must  be  no  more  than  the  actual  cost  incurred.  The 
charge must not be excessive. 

Article 13(1), corresponding to the old Article 14(4), has been amended  in 
the light of Parliament's amendment No 48, which has been accepted in part. 
The right of access may be exercised on request.  The data subject is to be 
entitled to obtain information on the source of the data (rather than their 
"general origin",  a term which  was felt  to be too vague,  and  consequently 
to  serve  no  purpose),  and  general  information  on  their  use,  rather  than 
information on their  "exact  use" (a term which was  felt to be  excessively 
burdensome and  bureaucratic).  This provision also  allows Member  States to 
make  special  provision  for  access to  medical data.  To avoid  exposing  the 
data subject  to extreme psychological shock it  could  be required that  such 
information be provided to him by a medical practitioner. 

Article 13(2) has been added  in response to Parliament's amendment  No 132. 
It  is  directed  against  the  misuse  of  the  right  of  access,  against  the 
legitimate  interests of  the data  subject (the example given  by  Parliament 
is that  the data subject may not  be required by any  person to exercise his 
right  of access  as a precondition for employment or  continued employment). 
But  access in  response to a  demand  by a  third  party  may be  required  where 
the  request  is  founded  on  national  or Community  law (an  example would  be 
certificates  of  marital  status  and  the  like,  which  might  be  requested  in 
order to establish social security entitlements). 

Article 13(3),  corresponding  to the  initial  Article 14(5), gives  the  data 
subject  the right of rectification, erasure or suppression  of data  if they 
have been processed in violation of the Directive.  Minor changes have been 
made  in  order to  render  the  amended  text  more  precise,  as Parliament  had 
requested (amendment No 49). 

- 23 -

Amendment No 49 has been accepted in part.  "Data which have been wholly or 
partially  omitted"  are  here  called  "incomplete  data",  and  are  included. 
But the amended text retains the terms "as the case may be" and  "blocking" 
or "suppression", which are surely useful. 

For  the  sake  of  greater  clarity  the  amended  proposal  uses  the  word 
"suppression"  rather  than  the  initial  proposal's  word  "blocking".  The 
concept is intended to cater for cases of data collected, stored, processed 
or  used  in  violation  of  the  rules  in  the  Directive:  the  controller  may 
continue to  store them,  but  is  prohibited  from  processing  or  using  them, 
and  in  particular  from  disclosing  them  to third  parties.  The  suppressed 
data have to be marked in the file in order to inform users of the file of 
the suppression. 

The words "as the case may  be" leave the precise determination of the data 
subject's  entitlement  to  erasure,  suppression  or  rectification  in  the 
various  situations  in  which  personal  data  may  be  processed  and  used  in 
violation of the Directive to the data protection legislation of the Member 
States. 

Article 13(4)  corresponds  to  the  initial  Article 14(7).  This  paragraph 
makes provision for  the data subject's interest in seeing third  parties to 
whom  inaccurate  or  incomplete  data  have  been  disclosed  notified  of  the 
rectification, erasure  or  suppression so  that  they too  can rectify,  erase 
or suppress the data. 

Article 13(5) has been added as an additional safeguard where decisions are 
taken by automatic means and produce results contrary to the data subject's 
interests.  In such a case the data subject has the right to be informed of 
the reasoning used in the processing operation. 

Article 14 

Exceptions to the right of access 

This  corresponds  to  the  initial  Article 15.  It  authorizes  the 
Member States to  restrict  the data  subject's right  of  access to  safeguard 
an overriding  public  interest or  an  interest of another  person  where that 
is equivalent to the data subject's right of privacy. 

It  is  left  to  the  Member  States  to  determine  whether  and  to  what  extent 
they  want  to  include  restrictions  based  on  Article 14  in  their  domestic 
data  protection  legislation,  unless  they  are  obliged  to  do  so  under 
Community  law  (e.g.  under  the  rules  on  banking  supervision  or  money 
laundering).  But the  restrictions which  the provision  permits are  limited 
to those necessary to safeguard fundamental values in a democratic society, 
and they must be adopted by legislation. 

Parliament's amendment  No 54 has been  accepted.  The amended  Article 14 is 
not confined to processing carried out  by the public sector, but extends to 
private sector processing too. 

- 24 -

The 1 ist of  the considerations  justifying the  restriction of  access under 
Article 14 which is set out in paragraph 1 is exhaustive. 

The term "national security" is to be interpreted as meaning the protection 
of national sovereignty against both internal and external threat. 

"Criminal proceedings"  covers the prosecution of crimes which have already 
been committed, whereas the concept of "public  safety" encompasses all the 
policing  functions  of  public  authority,  including  crime  prevention.  The 
phrase "substantial economic and financial interests of the Member State or 
of  the  European  Communities"  refers  to  all  economic  policy  measures  and 
measures to finance the policies of  a Member State  or the Community, such 
as exchange controls, foreign trade controls, and tax collection.  But only 
a  substantial  interest  of  this  kind  would  justify  a  restriction  of  the 
right of access. 

Lastly,  other  people's  interests,  including,  where  appropriate,  those  of 
the  controller  himself,  and  other  people's rights  and  freedoms  are to  be 
considered valid grounds for restricting the right of access, provided they 
are equivalent to the data subject's right of access.  These would  include 
the  trade  secrets  of  others;  the  rules  of  confidentiality  under  which 
lawyers and  medical practitioners operate; a person's right to prepare  his 
or  her  own  defence  in  court  proceedings;  and  the  protection  of  human 
rights.  The  supervisory  authority  ought  to  be  obliged  to  place 
restrictions  on  data  subjects'  right  of  access  to  data  relating  to  them 
held  by  human  rights  organizations  where  unlimited  access  might  endanger 
other individuals (such as the sources of information which was provided in 
confidence) or the overriding interests of such organizations. 

If  a data  subject  is denied  access to data relating to him  contained  in a 
file because an  interest within the scope of Article 14(1) is invoked, the 
data  protection  authority  must,  at  his  request,  carry  out  the  necessary 
inspections  and  checks  on  the  file  in  which  the  data  are  stored;  this 
requirement  was  in  the  original  proposal  (Article 15(2)),  and  is  now  in 
Article 14(2).  The object  of  the  inspections  and  checks  is  to  establish 
the  lawfulness  of  any  processing  in  the  light  of  the  Directive.  When 
carrying  them  out,  the  authority  must  avoid  harming  the  interests  the 
safeguarding of which is provided for in paragraph 1. 

Article 14(3),  which  corresponds  to  the  original  Article 15(3),  empowers 
the Me^nber  States to place limits on the right of access to data  which are 
compiled  only  temporarily,  for  the  purpose  of  extracting  statistical 
information;  such  operations  represent  only  a  minor  threat  to  data 
subjects. 

- 25 -

SECTION VI 

THE DATA SUBJECT'S RIGHT TO OBJECT 

Article 15 

Objection on legitimate grounds 

Article 15(1), which corresponds to Article 14(1) in the original proposal, 
gives  the  data  subject  the  right  to object  on  legitimate  grounds  to the 
processing  of  data  relating  to  him.  "Legitimate  grounds"  of  the  kind 
referred  to  would  include  the  absence  of  any  legal  justification  for  a 
particular  processing  operation,  for  example  because  the  grounds  for 
legitimate  processing  which  are  laid  down  in  Chapter II of  the Directive 
are not  met.  On the other  hand  a data  subject  would  not  have  legitimate 
grounds  for  objecting  to  a  legitimate  processing  operation  which  is 
necessary  to  the  performance  of  a  contract  between  himself  and  the 
controller. 

Paragraph 2 reproduces Article 9(3) of the original proposal.  Where there 
is an objection in accordance with  paragraph 1, the controller is required 
to cease processing. 

Paragraph 3 develops what  was Article 14(6) in  the  initial  proposal.  Its 
aim  is  to  clarify  the  obligation  of  the  controller  with  regard  to  data 
subjects when  he is  authorized  under other  provisions of  the Directive to 
disclose  data  to  third  parties  for  the  purposes  of  marketing  by  direct 
mail.  These  obligations  are  to  apply  regardless  of  whether  this  is 
commercial  marketing  or  canvassing  by  a  charitable  organization  or  a 
political party.  The controller must  satisfy himself  that the opportunity 
to  have  data  erased  without  cost  has  been  expressly  offered  to  data 
subjects  before the  data  are  disclosed.  The  same  obligation  is  to apply 
where  data  are  not  disclosed  but  are  used  for  the  same  purposes  by  a 
controller  for  the  account  of  a third  party.  The controller  may  satisfy 
his  obligations  in  the  course  of  his  regular  correspondence  with  data 
subjects, without necessarily entering into specific correspondence. 

The  paragraph  relates  only  to  written  mail.  Measures  to  protect  persons 
against  unwanted  approaches  made  through  telecommunications  channels  are 
provided  for  in the  amended  proposal  for  a Directive  in  order  to  protect 
individuals in the context of telecommunications networks. 

- 26 -

Article 15 

Automated individual decisions 

The danger of the misuse of data processing in decision-making may become a 
major problem in future: the result produced by the machine, using more and 
more  sophisticated  software,  and  even  expert  systems,  has  an  apparently 
objective  and  incontrovertible  character  to  which  a  human  decision-maker 
may  attach  too  much  weight,  thus  abdicating  his  own  responsibilities. 
Article 16(1)  therefore  lays  down  the  principle  that  a  person  is  not 
obliged  to  accept  a  decision  of  a  public  administration  or  of  a  private 
party  which  adversely  affects  him  if  it  is  based  solely  on  automatic 
processing defining a personality profile. 

The  version  in  the  initial  proposal  has  been  rewritten  in  order  more 
closely to define the limited cases in which these provisions are to apply. 

Three conditions must be satisfied: 

(i)  The  person  must  be  subject  to  an  adverse  decision.  The  decision 
must  be  one  which  can  be  invoked  against  him,  one  which  has 
consequences for  him; thus the  simple fact  of  sending  a  commercial 
brochure to a list of persons selected by computer is not a decision 
adversely affecting them for these purposes. 

(ii)  The decision  must  be taken  solely  by  automatic  processing:  what  is 
prohibited  is  the  strict  application  by  the  user  of  the  results 
nroduced  by  the  system.  Data  processing  may  provide  an  aid  to 
dec i s ion —making,  but  it  cannot  be  the  end  of  the  matter;  human 
judgment must have its place. 

It w*uld be contrary to this principle, for example, for an employer 
to reje-  an application from  a job-seeker on the sole basis of  his 
resu.ls  in  a  computerized  psychological  evaluation, or  to  use  such 
assessment; software  to produce  lists giving  marks  and  classing  job 
applicants  in  order  of  preference  on  the  sole  basis  of  a  test  of 

personality. 

(iii)  The  processing  must  apply  variables  which  determine  a  standard 
profile  (considered  good  or  bad)  to  the  data  concerning  the  data 
subject;  this excludes all cases where the system does not define a 
personality  profile:  for  example, the  fact  that  a  person  is  unable 
to obtain the sum of money he wants from an automatic cash dispenser 
because he  has exceeded  his credit  limit would  not fall  inside this 

definition. 

A new  paragraph 2 is added under which the share of human judgment required 
must  be  in  proportion  to  the  danger  to  the  individual  which  would  be 
represented  by a  decision which has  been drawn up entirely by  computer and 
which applies a personality  profile to him. 

- 27 -

One of Parliament's amendments (No 46) proposed that such a decision should 
be  allowed  if  the  person  consented,  or  where  there  was  a  contract  or  a 
relationship of confidence approaching the state of a contract. 

The  amended  proposal  does  not  accept  the  criteria  suggested;  if  the  two 
sides  are  not  on  equal  terms (which  is  the  case  with  a  job-seeker,  for 
example) neither  consent  nor  the  hope  of  a  contract  provide  a  sufficient 
safeguard. 

Under  paragraph 2 a  data  subject  may  be required  to  accept  a decision  of 
the  kind  referred  to  in  paragraph 1  if  the  decision  is  taken  under  a 
contract  between the  data  subject  and the  controller, or  in the  course of 
the  conclusion  of  such  a  contract,  on  condition  that  the  data  subject's 
request  is  met,  or  that  there  are  appropriate  measures  to  safeguard  his 
legitimate interests (which the Member States are free to clarify).  Such a 
safeguard might be provided  by law, by the notification procedures applied, 
or by internal  measures taken by the controller's organization. 

Thus the  use of  scoring techniques  with a view to the lending  of  money to 
an  individual is  possible,  if  positive decisions  to lend  are based  solely 
on an  automatic  assessment of  the risks;  but  where the score  is  negative 
the  legitimate  interests  of  the  data  subject  must  be  safeguarded,  for 
example by deferring a final answer until the organization has been able to 
carry out a "flesh-and-blood" study of the case. 

SECTION VII 

SECURITY OF PROCESSING 

Article 17 

This Article corresponds to Article 18 of the initial proposal. 

The  potential  danger  to  the  data  subject's  right  of  privacy  does  not 
emanate  entirely  from  the controller,  who collects,  stores,  processes  and 
discloses the individual's data for his own purposes. 

The  right  of  privacy  is  also  jeopardized  if  the  data  subject's  data  are 
misused by  third  parties who have gained unauthorized access to it. 

Article 17  requires  the  Member States  to  oblige  the  controller  to  take 
appropriate technical  and  organizational  measures to  protect  data  against 
the  danger  of  unauthorized  intrusion  by  third  parties,  accidental  or 
unlawful destruction, accidental loss, unauthorized alteration or any other 
unauthorized form of  processing. 

Parliament's  amendment  No 67  has  been  accepted  in  part.  The  initial 
proposal's "automated files" has been replaced  by "the automatic  processing 
of  data".  The  reference  to  "the  cost  of  taking  the  measures"  has  been 
deleted.  "Controller" is the term used throughout the amended text. 

- 28 -

Some minor  changes have been made for reasons of  clarity.  In paragraph 1, 
"unauthorized destruction"  has been replaced  by  "unlawful destruction"  and 
"unauthorized  access"  has  been  replaced  by  "unauthorized  disclosure".  In 
paragraph 2 "adequate security"  has been replaced  by  "an appropriate  level 
of  security".  In  paragraph 3 "on-line  consultation"  has  been replaced  by 
"an opportunity ... for remote access". Paragraph 4 now specifies that  the 
security  obligations  also  apply  to  persons  who  share  responsibility  for 
carrying out the processing, and in particular the processor. 

There  are  two  amendments  of  some  substance.  Where  an  opportunity  is 
provided  for  remote  access,  paragraph 3  now  specifies  that  hardware  and 
software  are to  be utilized  in such  a way  that  access remains  within  the 
limits  of  the  lawfulness  of  the  processing  (and  not  the  limits  of  the 
authorization  granted  by  the controller,  which certainly  would  not  exceed 
the limits of lawful processing, and is thus irrelevant for data protection 
purposes). 

Paragraph 5  makes  an  exception to  the  obligation  not  to  disclose  data  to 
third parties without the controller's agreement: this may be done where it 
is  required  under  national  or  Community  law (in  criminal  investigations, 
for example). 

SECTION VIII 

NOTIFICATION 

Article 18 

Obligation to notify the supervisory authority 

Article 18  reproduces  Articles 7  and  11  of  the  initial  proposal,  which 
dealt  with the  notification to  the supervisory  authority  of  files created 
in the public  and  private sectors.  These provisions have now  been merged, 
as Parliament suggested in its opinion.  The presentation has the advantage 
of  showing  that  the  approach  to  notification  is  the  same  in  whichever 
sector the data are processed. 

But the scope  and content  of the original provisions  have been changed,  in 
order  to  reflect  Parliament's  opinion  and  to  ensure  consistency  in  t e 
amended  proposal.  Under  Parliament's  amendments (Nos 39, 40,  41,  118  an 
199)  the  rules  on  notification  are  expanded  in  several  articles.  η 
initial  proposal  notification  was  intended  to  ensure  that  Process^ 
operations  were  a  matter  of  record;  it  is  now to  serve  as  the  basis  fo 
selective  monitoring  of  the  legitimacy  of  processing  operations  y 
supervisory  authority.  Depending  on  the  degree  of  danger  they  Posent, 
monitoring  of  processing  operations  will  be  carried  out  ex  post, 
general rule, or in advance, in a limited number of cases. 

- 29 -

1. Article 18(1) amends the  obligation to  notify  laid  down  in  the  initial 

proposal as follows: 

(a) For  the  sake  of  consistency  in  the  approach  taken  by  the  amended 
proposal, notification would  now relate to "processing" rather  than 
to  a  "file".  This means  that  supervision will  concentrate  more on 
the  use  made  of  data,  and  the  operations  carried  out  on  data  for 
particular  purposes  (the  nature  of  the  operations,  combinations, 
disclosures  to  third  parties,  the  nature  of  the  data  collected, 
recorded, etc.), and  less on the specific technical organization of 
the data in the file, which may  be of no great significance for  the 
protection of individuals once data are computerized. 

(b) The  fact  that  data  might  be  communicated,  which  in  the  initial 
proposal  was  a  criterion  for  the  presence  of  this  obligation,  has 
been omitted  from the amended version  in view of  the criticisms put 
forward:  it  was  argued  that  it  was  not  a  suitable  test,  as  some 
cases of  disclosure to third  parties do  not  infringe the  rights of 
individuals; and  there was also the danger which might  be presented 
by  purely  internal  processing,  aimed  at  selecting  populations.  It 
was considered preferable to extend the obligation to all processing 
of  personal  data  before the  processing  takes place.  This  approach 
should encourage  controllers to decide on the measures necessary  to 
meet  their  obligations  before they  commence  processing.  But  for  a 
proper idea  of the practical scope of this amendment  account  has to 
be taken of  Article 19, on simplification of and exemption  from the 
obligation to notify. 

(c) To  ensure  that  monitoring  can  take  account  of  the  often  varied 
totality  of  processing  operations carried  out  by  a  controller, and 
to  avoid  inviting  an  excessive  number  of  notifications,  it  is 
proposed  that a single  notification could  cover a  set of  processing 
operations,  whether  or  not  repetitive,  intended  to  serve  a  single 
purpose  or  several  purposes  which  are  related  between  themselves 
from  the  point  of  view  of  the controller  and  of  the data  subject. 
By  way  of  example, a single  notification would  be required  for  all 
the  processing  operations  concerning the  management  of  loans  given 
by  a  credit  institutions:  this  might  include  registering  the 
application,  investigating  it,  approving  it,  recovering  debts  due 
and keeping track of legal proceedings. 

(d) So  that  administration  need  not  become  too  burdensome,  it  is 
proposed  that  the  obligation  to  notify  would  apply  only  to 
processing  which  is  wholly  or  partly  automatic,  while  leaving 
Member States  free to  extend  this obligation  to manual  files  under 
Article 21. 

2. Article 18(2) gives further details of the content of the notification. 

(a) The clause  referring to  the category  or categories  of  data  subject 
has  been  added  (examples  might  be  the  customers  of  the  firm,  the 
staff of the firm, recipients of this or that social benefit, etc.). 

- 30 -

(b) Information  regarding  the  third  parties  to  whom  data  may  be 
disclosed  may  take the  form of  a reference  to categories  of  third 
party (Parliament's amendment No 39). 

(c) For  the  description  of  the  data  to  be  processed,  it  will  now  be 
sufficient to list the categories of data, since too great a measure 
of technical detail  will not significantly  help an understanding  of 
the process involved. 

(d) The reference to the existence of transfers of data to non-Community 
countries has  been added  in order to  facilitate the  application of 
the special rules which are to govern them, and to ensure that their 
specific context is taken into account. 

(e) The description of  the security  measures which  was  included  in  the 
initial  proposal  is  retained  here,  given  the  importance  of  being 
able  to  monitor  such  measures,  particularly  in  view  of  the 
development of remote processing using telecommunications networks. 

Article 18(3)  concerns  the  notification  of  changes  in  the  processing 
being  carried  out.  The  obligation  to  notify  changes  affecting  the 
information  in  the  earlier  notification  is  retained  from  the  initial 
proposal, so as  to ensure that the  list of  processing operations  which 
is accessible to the public is kept up to date, and that monitoring  can 
continue,  which  is  particularly  important  where  the  purposes  of  the 
processing  are  changed  or  where  fresh  groups  of  third  parties  may  be 
given the data concerned. 

Article 18(4) and  (5) reflect Parliament's  opinion  (amendments  Nos 40, 
41, 118 and  199) that certain forms of  processing may  involve a special 
danger to the rights and  freedoms of data subjects  and should  therefore 
be subject  to a  report  or  authorization from  the supervisory  authority 

before they are carried out. 

While  fully  acknowledging  the  variety  of  machinery  which  may  be 
established  in  the  various  Member States,  the  Commission  feels  that 
Article 18(4)  should  require  Member States  to  have  such  processing 
examined  by the  supervisory authority  before it  is carried  out.  Rather 
than  a  non-binding  examination  Member States  are  free  to  require 
authorization by legislation or by the supervisory authority. 

The "specific risks" referred to might have to do with the nature of the 
data to be  processed, for  example where the data is within the  scope o 
Article 8; the  scope  of  the  processing,  which  might  concern  the  whole 
population  of  a  country;  or  the  purpose  in  view,  which  might  be  to 
exclude data subjects from  an entitlement, a  benefit or  a contract (  e 
case of  a  black  list or  an operation  aimed  at  informing third  parties 

on the solvency of individuals). 

- 31 -

Article 18(4) contains a clause intended to limit  the time within which 
the  supervisory  authority  must  examine  a case;  this  has  been  done  in 
the controller's interest.  The approach proposed in this Article should 
not  prevent  Member States  from  taking  measures  to  simplify  the 
obligation  to  notify,  or  to  grant  exemptions  from  it,  as  provided  in 
Article 19, on the basis of the experience they acquire. 

5. For  the  sake  of  completeness  it  should  also  be  pointed  out  that  if  a 
wholly  or  partly  automatic  processing  operation  is  not  covered  by  the 
simplification and  exemption procedures provided  for in  Article 19, nor 
subject to  prior examination, but  is merely  notified to the supervisory 
authority  under  Article 18,  it  will  as  a  rule  be  subject  only  to  ex 
post  checking  by  the  supervisory  authority,  as  will  the  processing 
operations  referred  to  in  Article  19.  Obviously  the  supervisory 
authority  will  satisfy  itself  that the  notification  procedure  followed 
corresponds to the nature of the processing. 

6. In  line  with  the  spirit  of  Parliament's  opinion (amendment  No 39) the 
Community  procedures  laid  down  in  Articles 30  and  34  should  allow 
harmonization of  particular  points where  this is  needed  for  the proper 
operation  of  the  single  market,  with  special  reference  to  Articles 18 
and 19. 

Article 19 

Simplification of and exemption from the obligation to notify 

Article 19  takes over  and  develops Parliament's  amendment  No 39, aimed  at 
simplifying procedures for certain categories of processing. 

Article 19(1)  proposes that  Member States should  be required  to take  such 
measures;  they would  also be free  to grant exemptions from  the obligation 
to notify. 

In  order  to  develop  a  coherent  Community  policy  on  the  protection  of 
individuals,  it  is  proposed  that  a criterion  should  be  added, determining 
the field  in  which  it  is proper  to simplify  and  exempt  from  notification. 
This  refers  to  processing  operations  which  are  not  liable  adversely  to 
affect the rights and freedoms of data subjects. 

Experience  shows  that  a  great  many  operations  in  which  personal  data  are 
processed  in  various  organizations,  large  and  small,  public  and  private, 
are  of  this  nature,  and  thus  do  not  require  any  detailed  or  general 
notification.  These may be forms of processing whose content and scope are 
by  nature  strictly  defined  in  legal  terms,  or  simple  forms  of  processing 
whose legitimacy  interest parties regularly  have the opportunity  to check, 
or  forms  of  processing  which  by  nature  cannot  adversely  affect  data 
subjects,  or  indeed  forms  of  processing  which  are  in  fact  of  a  more 
sensitive  nature  but  which  in  the  particular  context  do  provide  the 
necessary safeguards. 

- 32 -

Article 19(1)  corresponds  to  Parliament1 s  amendment  No 23,  and  proposes 
that a  processing operation should  qualify for  simplification or exemption 
if  its  purpose  is  the  production  of  correspondence  or  papers  by  word 
processing, the  satisfaction of  legal,  accounting, tax  or  social  security 
duties,  or  the  consultation  of  documentation  services  accessible  to  the 
public. 

Member States are  to  permit  simplified  procedures and  to grant  exemptions 
according to circumstances, in the light of their own experience and of the 
specific  character  of  processing  operations,  old  and  new,  in  their  own 
country.  By way of example these measures might include the calculation of 
the wages and salaries of the staff  of a  public body  or private firm,  some 
kinds  of  processing  for  scientific  research  purposes,  and  certain 
operations  concerning  the  medical  records  of  patients  held  by  a  medical 
practitioner or the like. 

Article  19(2)  takes  over  Parliament's  amendment  No 39,  under  which 
simplification of  the obligation to notify  in the  Member States  had  to  be 
the subject of  a legal act.  It is now proposed,  however, in the spirit of 
that amendment, that  the drafting of a simplification or  exemption measure 
must involve the independent supervisory authority.  And in order to ensure 
that  controllers  are  in  a  position  to  judge  with  safety  whether  any 
processing  operations  they  envisage  are  in  accordance  with  the 
simplification measure, it  is proposed that  the measure must  describe each 
category of processing operation covered, specifying the purposes, the data 
or  categories  of  data,  the  category  or  categories  of  data  subject,  the 
third  parties  or  categories  of  third  party  to  whom  the  data  are  to  be 
disclcced,  tne  length  of  time  the  data  are  to  be  stored,  and  where 
appropriate the conditions under which the processing is to be carried out. 

Article 19(3)  takes  up  the  same  amendment  No 39;  amendment  No 39  also 
sought:  to  ^-ke  it  clear  that  simplification  or  exemption  from  the 
obligation :o  .ot.ifv  is not to release the controller from any of the other 
obligations resulting from the Directive. 

Article 20 

Manual processing operations 

Member States are  left free to  apply Section VIII  to manual  files, subject 
to whatever adaptation may be necessary. 

Article 21 

Register of notified processing operations 

Article 21 corresponds to Article 7(1) of the initial proposal, under which 
the supervisory authority was to keep a register of the public sector files 
notified to  it, which was to be freely  available for consultation.  In the 
spirit of Parliament's opinion (amendments No 37 and No 39), Article 21 now 
extends this provision to all notified  processing operations, regardless of 
the sector to which the controller belongs. 

- 33 -

Consultation  of  the  register  may  however  be  restricted,  as  Parliament 
suggested, on the same grounds as are set out in Article 14(1), which deals 
with the restriction of the right of access to data by the data subject. 

In  line with  Parliament's opinion (amendment  No 39), Article 21  lays down 
the  minimum  content  of  entries  in  the  register:  they  must  include  the 
information referred to in Article 18(2), with the exception of measures to 
ensure  the security  of  processing,  whose effectiveness  would  otherwise  be 
reduced. 

CHAPTER III 

JUDICIAL REMEDIES, LIABILITY AND PENALTIES 

Article 22 

Judicial remedies 

Article 22 corresponds to Article 14(8) in the initial proposal.  The scope 
of  the  provision  has  been  broadened.  It  is  now  proposed  that  national 
legislation should  provide data subjects with a  judicial remedy  which will 
enable them where necessary to defend not only the additional rights listed 
in  Article 14 of the  initial proposal  but of  all the rights  given them  by 
the Directive. 

Article 23 

Liability 

Article 23(1),  like  Article 21(1)  in  the  initial  proposal,  places  a 
liability  on the controller  to compensate  any  damage caused  to any  person 
as  a  result  of  a  processing  operation  or  any  act  incompatible  with  the 
Directive.  As  Parliament  requested  in  its  opinion  (amendment  No 73), 
liability  is  made  to  depend  on  "unlawful"  processing.  The  concept  of  a 
"file"  is  replaced  by  that  of  "processing".  The  change  of  wording  means 
that  the  content  of  paragraph 2  in  Parliament's  suggested  version  has  in 
fact  been  incorporated  here.  By  speaking  about  "processing"  the  amended 
proposal  now  includes  the  actual  storage  of  personal  data  as  a  possible 
source of liability, as Parliament had hoped. 

But  the Commission still feels that  Member States should  be free to exempt 
from  liability  where  suitable  security  measures  have  been  taken.  The 
wording  of  the  provision  has  been  clarified.  In  view  of  Parliament's 
opinion  the Commission  now  specifies that  a controller  may  be exempted  in 
whole or only in part. 

- 34 -

Article 24 

Processing by the processor 

This  Article corresponds  to Article 22  of  the original  proposal.  It  aims 
to  ensure  that  the  protection  of  the  data  subject  is  not  deleted  where 
processing is carried out by a third party on the controller's behalf. 

The Article uses the term "processor", which has been  included  in the list 
of definitions at Parliament's suggestion.  In accordance with Parliament's 
wishes,  paragraph 2 emphasizes  that the  processor  may  act  only  within the 
terms of his contract  with the controller.  It is proposed  that an express 
reference  should  be  made  to  the  obligations  imposed  by  the  national 
measures taken under the Directive, which will also apply to a processor. 

Article 25 

Penalties 

The  changes  made  to  the  proposal  here  are  intended  to  take  account  of 
Parliament's  opinion  (amendment  No 77).  They  shift  the  accent  to  the 
persons who may  be punishable.  Penalties may  in general be  imposed on  any 
person who does not comply with the national provisions adopted pursuant to 
the Directive, which may include, as Parliament points  out in  its opinion, 
authorities and organizations governed by public law. 

CHAPTER IV 

TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES 

Article 26 

Principles 

This  Article corresponds  to Article 25  in the  initial  proposal;  it  states 
that  the  transfer  of  personal  data  from  a  Member State  to  a  non member 
country  may  take  place only  if the  non-member country  ensures an  ^equa 
level  of  protection.  Without  such a  provision the  Community s  e forts  to 
guarantee a  high level  of protection  for individuals  could  be  nu 
transfers  to  other  countries  in  which  the  protection  P^^dec 
inadequate.  There  is  also  the  fact  that  free  movement  of  data>  e 
Member States, which the proposal  seeks to establish, will  mean that 
will have to be common rules on transfer to non-Community countri  . 

Y 

- 35 -

In the course of consultation with interested  parties it  became clear that 
in certain cases there would have to be exceptions to this principle.  The 
Commission has therefore reconsidered its initial proposal, in the light of 
Parliament's  opinion.  It  now  proposes  that  the  ban  on  transfers  to 
non-member countries  which do  not  provide an  adequate  level of  protection 
should  be  subject  to  exceptions  compatible  with  the  protection  of 
individuals.  Under  the  amended  proposal,  a  transfer  may  be  made  to  a 
country  which does  not ensure  an adequate  level of  protection  if  the data 
subject has consented in order to take steps preliminary to entering into a 
contract, or if the transfer is necessary for the performance of a contract 
between  the  data  subject  and  the  controller.  In  such  cases  the  data 
subject must have been informed that it  is or might be proposed to transfer 
the data to such a country.  The data subject may decide whether or  not he 
wishes to take  such a  risk.  These exceptions  seem  particularly  useful  in 
the  case  of  data  transfers  linked  to the  transactions  of  banks  or  other 
credit  institutions.  A  transfer  to  a  non-member  country  which  does  not 
provide  an  adequate  level  of  protection  may  also  be  justified  if  it  is 
necessary  on important  public  interest  grounds or  in order  to protect  the 
vital  interests  of  the  data  subject.  These  exceptions  are  intended  to 
allow  international  cooperation  (e.g.  to  combat  money  laundering  or  in 
monitoring  financial  institutions)  or  to  allow  the  transfer  of  medical 
information in circumstances in which the data subject is unable to express 
his wishes. 

Paragraph 2 describes the tests to  be applied  to determine  whether or  not 
protection  is  adequate.  Account  is to  be taken  of  all  the circumstances 
surrounding  a data  transfer operation  or set  of data  transfer operations, 
such  as the  nature of the  data, the purpose  of the  processing operations, 
and  the  legislation  in  force  in  the  other  country.  Both  general  and 
sectoral  legislative  provisions will  have to  be examined  here,  along  with 
the  question  whether  they  are  applied  in  practice,  and  any  professional 
rules  laid  down  in  codes  of  conduct.  As  Parliament  suggested  in  its 
opinion (see amendment No 79), the new paragraph 2 makes it  clear that  the 
adequacy  of  protection  is to  be  assessed  with  reference to  a transfer  of 
data or a set of transfers of data. 

Paragraph 3,  which  corresponds  to  Article 24(2) in  the  initial  proposal, 
has been amended in line with Parliament's opinion (amendment No 79), which 
emphasizes that Member States are to assess the adequacy of  protection and 
to  decide  whether  or  not  to  ban  data transfers  accordingly.  They  are  to 
inform the Commission of such cases of prohibition. 

As Parliament requested (amendment No 80), the Commission is to consult the 
Working  Party  referred  to in  Article 32  before entering  into  negotiations 
with  a  non-Community  country;  this  is  stipulated  in  paragraph 4,  which 
corresponds to the old Article 24(3). 

- 36 -

Article 27 

Particular measures 

Article 27  reflects  the  intention  of  Article 25 of  the  initial  proposal, 
with  some  modifications.  Under  the  new  version  a  Member State  may 
authorize  a  transfer  or  category  of  transfers  of  personal  data  to  a 
non-member country which does not ensure an adequate level of protection if 
the controller  adduces sufficient justification  guaranteeing the effective 
exercise  of  data  subjects'  rights,  and  if  the other  Member States or  the 
Commission  do  not  object  to  the  measure  envisaged  in  accordance  with  a 
procedure  which  the  Article  lays  down.  If  an  objection  is  made  the 
Commission is to take appropriate measures, and may in particular decide to 
orohibit the transfer,  to make it  subject to additional  conditions, or  to 
enter  into negotiations  with the controller  for whom  the transfers  are to 
be made in order to arrive at solutions for the whole Community. 

CHAPTER V 

CODES OF CONDUCT 

codes  of  conduct  - the  term  generally  used  in  other  fields  is  the  one 
employed  in  the  amended  proposal  -  were  covered  by  Article 20  m the 
initial  proposal.  That  provision  aimed  to  encourage  the  drawing  up  of 
Community  codes  only.  The  amended  proposal  contains  two  Articles,  one 
dealing with national codes and the other with Community codes. 

Article  28 

National  codes 

Ration.  They  also  help  to  avo,d 

°™ -ι- 

-~ι·ντ rh have 

^ 

drawn tlL  up, and so on.  But they .11 tave the follow^ features. 

-  they  ate drawn  up voluntarily  by  a profession  or  trade,  although  they 

may be encouraged by  the authorities; 

-  they apply or fill out  the le,isl.tion applicable,  but they „u.t  regain 

within it; 

-  they  are  not  binding  on  third  parti  ' 

always give priority to their own interpretation ot 

•  ^· 

1-hirrt  oarties,  or  on  the  courts,  which  may 

legislation, 

- 37 -

Of course it may happen that the public authorities, and the legislature in 
particular,  themselves  adopt  a  code  drawn  up  by  the  trade,  and  give  it 
binding legislative force; this has happened in certain Member States. 

To  give  such  codes  some  authority,  without  changing  their  essential 
characteristics, the  Commission  proposes that  they  should  be submitted  to 
the  competent  national  authority  for  its  opinion;  in  doing  this  the 
Commission is basing itself on the approach taken by Parliament in the case 
of Community codes (amendment No 72). 

It  is therefore proposed that the supervisory  authority should  be asked  to 
check that codes are well thought out and that the trade associations which 
drew  them up  are representative,  and to  ensure that  codes are  publicized, 
to take  the  views  of  interested  parties or  their  representatives,  and  to 
deliver an opinion to be published alongside the code. 

Article 29 

Community codes 

The  amended  proposal  follows the  lines of  Parliament's opinion  (amendment 
No 72) and the  provisions of  Article 28, the powers given to the  national 
supervisory authority in the case of national codes being given here to the 
Community working  party on data protection.  It will  be for the Commission 
to decide whether or not to publish codes together with the working party's 
opinion for information purposes in the Official Journal. 

CHAPTER VI 

SUPERVISORY AUTHORITY AND WORKING PARTY 

Article 30 

Supervisory authority 

This Article corresponds to Article 26 in the initial proposal; it provides 
for  the  setting  up  of  a  supervisory  authority,  the  essential  feature  of 
which would  be its independence.  The Commission has  accepted Parliament's 
opinion (amendments  Nos 84, 85, 86  and  87),  and  incorporated  Parliament's 
amendments into its own amended proposal. 

(a)  Designation  of  supervisory  authorities:  Paragraph  1  makes  it  clear 
that  Member States  are  free  to  designate  several  independent 
supervisory  authorities.  This  seems  indispensable  for  Member States 
with a federal structure, and for Germany in particular. 

(b)  Powers of supervisory authorities:  In addition to the powers given to 
supervisory  authorities  by  the  provisions  already  discussed, 
particularly  in  connection  with  notifications,  it  is  proposed  that 
supervisory  authorities  should  have  powers  of  investigation  and 
intervention  in  their  dealings  with  controllers,  under  judicial 
control. 

- 38 -

The supervisory  authority's powers of  investigation are intended  to enable 
it  to  collect  from  controllers  the  information  it  needs  to  perform  its 
duties.  The authority  would  have access  to the data  being  processed.  In 
order  to  preserve  the  rights  of  those  subject  to  supervision  by  the 
authority,  obviously, these powers  must  be exercised  in  strict  observance 
of  the  confidentiality  of  the  relevant  data  under  national  law.  A 
provision to this effect is inserted in paragraph 6. 

To  enable the  supervisory  authority  to carry  out  its duties  it  must  also 
have  effective  powers  of  intervention,  such  as  those  enumerated  by 
Parliament  in its  opinion, and  repeated  in the  amended  proposal:  power to 
order suppression, erasure of data, a ban on the processing operation, etc. 
Parliament  referred  to  these  measures  as  "sanctions",  but  it  does  not 
appear necessary that the Directive should define their legal nature. 

Lastly, it  is proposed that the supervisory authority  should have  power to 
bring  an  action  before  the  courts  where  it  finds  that  the  national 
provisions  implementing  the Directive  have  been  infringed.  The  existing 
systems of  national  legislation generally  confer  such a  right.  The right 
follows logically from the power of investigation, as it is only reasonable 
that  an authority  whose duty is to  protect individuals  should not  set the 
machinery  of  justice  in  motion  where  it  finds  an  infringement  of  their 
right  to  protection,  and  also  from  the  right  of  any  person  to  lodge  a 
complaint  with  the  supervisory  authority:  the  consequence  of  such  a 
complaint should indeed be a reference to the courts. 

(c)  Annual  reports:  It  is  very  important  that  the supervisory  authority 
should  be  able  to  present  a  report  on  its  activities  at  periodic 
intervals,  pointing  out  any  difficulties  it  has  met  in  applying  the 
legislation, and indicating the new approach to be taken. 

Article 31 

Working  Party  on  the  Protection  of  Individuals  with  regard  to  the 
Processing of Personal Data 

This Article corresponds to Article 27 in the initial proposal, and sets up 
a committee of the advisory type. 

(a)  Name of the working party 

It  is  proposed  that  the  title  of  the  working  party  be  aligned  on  the 
wording in Article 1(1). 

(b)  Membership and chair 

The  amendments  requested  by  Parliament  (amendments  No 88 and  No 128)  are 
concerned mainly with the membership and chairmanship of the Working Party. 
In  order  to  guarantee  the  working  party's  independence,  a  point  it 
emphasized  in  the  explanatory  memorandum  to  the  initial  proposal,  the 
Commission  has  accepted  the  suggestions  in  Parliament's  opinion  regarding 
the  chairmanship  of  the  working  party,  but  not  those  regarding  its 

membership. 

- 39 -

(i)  Chairmanship:  the  Commission  is  proposing  that  the  working  party 
should  elect  a  chairman  for  a  renewable  term  of  two  years.  This 
term seems sufficiently long to ensure a measure of stability. 

(ii)  Membership: the Commission  is maintaining  its initial  proposal that 
membership should  be restricted  to representatives  of  the national 
supervisory authorities  already  referred to.  If  some Member States 
make  use  of  their  freedom  to  designate  more  than  one  supervisory 
authority,  it  is  proposed  for  the  sake  of  fairness  that  those 
Member States should be represented by a joint representation on the 
working  party.  Otherwise  the  fact  that  a  Member State  had  taken 
advantage of the freedom left to it by  the preceding Articles  might 
produce an unbalanced representation on the Working Party. 

The  Commission  is  asking  that  it  should  be  represented  on  this  working 
party,  and  hopes  that  its  own  departments  can  provide  the  secretarial 
services. 

Article 32 

Tasks of the Working Party 

This  Article  defines  the  tasks  of  the  Working  Party.  The  Working  Party 
would continue to be an advisory body, as provided in the initial proposal. 
It would  advise the Commission, particularly when it was proposed that the 
Commission  should  exercise  its  rule-making  powers  or  put  forward  new 
proposals.  It would help to ensure that provisions adopted pursuant to the 
Directive were applied  in a uniform fashion,  and also  with the development 
of a  common policy on cross-border  flows of data between the Community and 
non-Community  countries.  The Commission would  submit to the Working Party 
any measure proposed in these fields with a view to obtaining its opinion. 

The Working Party  would act  through opinions and  recommendations submitted 
to  the  Commission  and  possibly  to  the  Advisory  Committee.  Here  the 
proposal  accepts  Parliament's  opinion  in  part  (amendments  Nos 90, 91 and 
92) . 

The Commission is to inform the Working Party of the action it has taken in 
response to  its opinions  and  recommendations,  in  a public  report  which is 
to be transmitted to Parliament and to the Council. 

The Commission  shares  Parliament's  concern,  expressed  in  amendment  No 89, 
that the secretariat of the Working Party should be allocated the necessary 
funds to enable it to carry out the tasks given to it by the Directive.  In 
the  budgetary  procedure  and  elsewhere  the  Commission  will  seek  to  ensure 
that  the  Working  Party  does  have  sufficient  funding.  But  is  does  not 
appear  advisable  to  include  a  provision  to  this  effect  in  the  amended 
proposal. 

- 40 -

CHAPTER VII 

RULE MAKING POWERS OF THE COMMISSION 

Articles 33 and 34 

Exercise of rule making powers and Advisory Committee 

The  Community  maintains  its  initial  proposal.  Technical  measures  will  be 
needed  to  apply  the Directive  given  the  breadth  and  the  highly  technical 
nature of the field of personal data processing. 

FINAL PROVISIONS 

Articles 35, 36 and 37 

Article 35(2) proposes a  transitional measure  in  line with what  Parliament 
suggested  for  notification  (amendment  No 37),  namely  that  the  provisions 
adopted  under the Directive should  enter into  force more slowly  in respect 
of  processing  operations  which  began  before  the  date  on  which  those 
provisions enter into force.  A three-year period seems sufficient. 

As Parliament hoped (amendment No 95) it is proposed  in Article 36 that the 
regular report on the implementation  of the Directive which  the Commission 
is to send the Council and Parliament should also be published. 

- 41 -

PROPOSAL FOR A COUNCIL DIRECTIVE 

AMENDED PROPOSAL FOR A COUNCIL 

CONCERNING THE PROTECTION OF 

DIRECTIVE ON THE PROTECTION OF 

INDIVIDUALS IN RELATION TO THE 

INDIVIDUALS WITH REGARD TO THE 

PROCESSING OF PERSONAL DATA 

PROCESSING OF PERSONAL DATA AND ON 

THE FREE MOVEMENT OF SUCH DATA 

THE COUNCIL OF THE EUROPEAN 

THE COUNCIL OF THE EUROPEAN 

COMMUNITIES, 

COMMUNITIES, 

Having regard to the Treaty 

Having regard to the Treaty 

establishing the European Economic 

establishing the European Economic 

Community and in particular 

Community, and in particular 

Articles 10OA and 113 thereof, 

Articles 100a and 113 thereof. 

Having regard to the proposal from 

Having regard to the proposal from 

the Commission, 

the Commission, (1) 

In cooperation with the European 

In cooperation with the European 

Parliament, 

Parliament, (2) 

Having regard to the opinion of the 

Having regard to the opinion of the 

Economic and Social Committee, 

Economic and Social Committee, (3) 

(1) OJ No C 277, 5.11.1990, p. 3; 

OJ No C 

(2) OJ No C ... ; OJ No C ... 

(3) OJ No C 159, 17.6.1991, p. 38. 

- 42 -

(1) Whereas the objectives of the 

(1) Whereas the objectives of the 

Community, as laid down in the 

Community, as laid down in the 

Treaty, as amended by the Single 

Treaty, as amended by the Single 

European Act, include establishing 

European Act, include establishing 

an ever closer union among the 

an ever closer union among the 

peoples of Europe, fostering closer 

peoples of Europe, fostering closer 

relations between the States 

relations between the States 

belonging to the Community, 

belonging to the Community, 

ensuring economic and social 

ensuring economic and social 

progress by common action to 

progress by common action to 

eliminate the barriers which divide 

eliminate the barriers which divide 

Europe, encouraging the constant 

Europe, encouraging the constant 

improvement of the living 

improvement of the living 

conditions of its peoples, 

conditions of its peoples, 

preserving and strengthening  peace 

preserving and strengthening  peace 

and liberty  and promoting democracy 

and liberty  and promoting democracy 

on the basis of the fundamental 

on the basis of the fundamental 

rights recognized in the 

rights recognized in the 

constitutions and laws of the 

constitutions and laws of the 

Member States and  in the European 

Member States and in the European 

Convention for the Protection of 

Convention for the Protection of 

Human Rights and Fundamental 

Human Rights and Fundamental 

Freedoms ; 

Freedoms ; 

- 43 -

(2) Whereas data-processing systems 

are designed to serve society; 

whereas they must respect the 

fundamental freedoms and rights of 

individuals, notably the right to 

privacy, and contribute to economic 

and social progress, trade 

expansion and the well-being of 

individuals ; 

(2) Whereas the establishment and 

(3) Whereas the establishment and 

the functioning of an internal 

the functioning of an internal 

market in which, in accordance with 

market in which, in accordance with 

Article 8a of the Treaty, the free 

Article 8a of the Treaty, the free 

movement of goods, persons, 

movement of goods, persons, 

services and capital is ensured 

services and capital is ensured 

require not only that personal data 

require not only that personal data 

should be able to flow freely, 

should be able to flow freely from 

regardless of the Member States in 

one Member state to another, but 

which they are processed or 

also that the fundamental rights of 

requested, but also that 

individuals should be safeguarded; 

fundamental rights should be 

safeguarded in view of the 

increasingly frequent recourse in 

the Community to the processing of 

personal data in the various 

spheres of economic and social 

activity; 

- 44 -

(4) Whereas increasingly frequent 

recourse is being had in the 

Community to the processing of 

personal data in the various 

spheres of economic and social 

activity; whereas the progress made 

in information technology is making 

the processing and exchange of such 

data considerably easier; 

(3) Whereas the internal market 

(5) Whereas the economic and social 

comprises an area without 

integration resulting from the 

frontiers; whereas, for that 

establishment and functioning of 

reason, the national authorities in 

the internal market within the 

the various Member Sttes are 

meaning of Article 8a of the Treaty 

increasingly being called upon, by 

will necessarily lead to a 

virtue of the operation of 

substantial increase in cross-

Community lax, to collaborate and 

border flows of personal data 

exchange personal data so as to be 

between all those involved in a 

able to perform their duties or 

private or public capacity in 

carry out tasks on behalf of an 

economic and social activity in the 

authority in another Member State; 

Member States; whereas the exchange 

of personal data between 

undertakings in different Member 

States is set to increase; whereas 

the national authorities in the 

various Member States are being 

called upon, by virtue of Community 

law, to collaborate and exchange 

personal data so as to be able to 

perform their duties or carry out 

tasks on behalf of an authority in 

another Member State within the 

context of the area without 

internal frontiers as constituted 

by the internal market; 

- 45 -

(4) Whereas the increase in 

(6) Whereas, furthermore, the 

scientific and technical 

increase in scientific and 

cooperation and the coordinated 

technical cooperation and the 

introduction of new 

coordinated introduction of new 

telecommunications networks in the 

telecommunications networks in the 

Community necessitate and 

Community necessitate and 

facillitate cross-border flows of 

facilitate cross-border flows of 

personal data; 

personal data; 

(5) Whereas the difference in 

(7) Whereas the difference in 

levels of protection of privacy in 

levels of protection of the rights 

relation to the processing of 

and freedoms of individuals, 

personal dat afforded in the Member 

notably the right to privacy, with 

States may prevent the transmission 

regard to the processing of 

of such data from the territory of 

personal data afforded in the 

one Member State to that of another 

Member States may prevent the 

Member State; whereas this 

transmission of such data from the 

difference may therefore constitute 

territory of one Member State to 

an obstacle to the pursuit of a 

that of another Member State; 

number of economic activities at 

whereas this difference may 

Community level, distort 

therefore constitute an obstacle to 

competition and impede authorities 

the pursuit of a number of economic 

in the discharge of their 

activities at Community level, 

responsibilities under Community 

distort competition and impede 

lax; whereas this difference in 

authorities in the discharge of 

levels of protection is due to the 

their responsibilities under 

existence of a wide variety of 

Community law; whereas this 

national laws, regulations and 

difference in levels of protection 

administrative provisions; 

is due to the existence of a wide 

variety of national laws, 

regulations and administrative 

provisions ; 

- 46 -

(6) Whereas in order to remove the 

(8) Whereas, in order to remove the 

obstacles to floxs of personal 

obstacles to flows of personal 

data, the level of protection of 

data, the level of protection of 

privacy in relation to the 

the rights and freedoms of 

processing of such data must be 

individuals with regard to the 

equivalent in all the Member 

processing of such data must be 

States; whereas to that end it is 

equivalent in all the Member 

necessary to approximate the 

States; whereas this objective is 

relevant laws; 

vital to the internal market but 

cannot be achieved by the Member 

States alone, especially in view of 

the scale of the divergences which 

currently exist between the 

relevant laws in the Member States 

and the need to coordinate the laws 

of the Member States so as to 

ensure that the cross-border flow 

of personal data is regulated in a 

consistent manner that is in 

keeping with the objective of the 

internal market as provided for in 

Article 8a of the Treaty; whereas 

Community action to approximate 

those laws is therefore needed; 

- 47 -

(7) Whereas the object of the 

(9) Whereas the object of the 

national laws on the processing of 

national laws on the processing of 

personal data is to protect 

personal data is to protect 

fundamental rights, notably the 

fundamental rights and freedoms, 

right to privacy which is 

notably the right to privacy, which 

recognized both in Article 8 of the 

is recognized both in Article 8 of 

Convention for the Protection of 

the European Convention for the 

Human Rights and Fundamental 

Protection of Human Rights and 

Freedoms and in the general 

Fundamental Freedoms and in the 

principles of Community law; 

general principles of Community 

whereas, for that reason, the 

law; whereas, for that reason, the 

approximation of those laws must 

approximation of those laws must 

not result in any lessening of the 

not result in any lessening of the 

protection they afford but must, on 

protection they afford but must, on 

the contrary, seek to ensure a high 

the contrary, seek to ensure a high 

level of protection in the 

level of protection in the 

Community; 

Community; 

(22) Whereas the principles 

(10) Whereas the principles of the 

contained in this Directive give 

protection of the rights and 

substance to and amplify those 

freedoms of individuals, notably 

contained in the Council of Europe 

the right to privacy, which are 

Convention of 2 8 January 19 81 for 

contained in this Directive, give 

the Protection of Individuals with 

substance to and amplify those 

regard to Automatic Processing of 

contained in the Council of Europe 

Personal Data; 

Convention of 2 8 January 19 81 for 

the Protection of Individuals with 

regard to Automatic Processing of 

Personal Data; 

- 48 -

(9) Whereas the protection 

(11) Whereas the protection 

principles must apply to all data 

principles must apply to all 

files where the activities of the 

processing of personal data  by any 

controller of the file are governed 

person whose activities are 

by Community law; whereas public-

governed by Community  law; whereas 

sector files which are not governed 

processing carried out by a Member 

by Community law should, as is 

State's own authorities, 

provided for in the resolution of 

organizations or other bodies in 

the representatives of the 

the course of activities which are 

Governments of the Member States of 

not governed by  Community law 

the European Communities meeting 

should, as is provided for in the 

within the Council of ..., be 

Resolution of the representatives 

subject to the same protection 

of the Governments of the Member 

principles set forth in national 

States of the European Communities 

laws; whereas, however, data files 

meeting within the Council of ..., 

falling exclusively within the 

be subject to the same protection 

confines of the exercise of a 

principles set out in national 

natural person's right to privacy, 

laws; whereas processing carried 

such as personal address files, 

out by a  natural person for purely 

must be excluded; 

private purposes in connection, for 

example, with correspondence or the 

maintenance of lists of addresses 

must be excluded; 

- 49 -

10) Whereas any processing of 

(12) Whereas, in order to ensure 

personal data in the Community 

that individuals are not deprived 

should be carried out in accordance 

of the protection to which they are 

with the law of the Member State in 

entitled under this Directive, any 

which the data file is located so 

processing of personal data in the 

that individuals are not deprived 

Community must be carried out in 

of the protection to which they are 

accordance with the law of one of 

entitled under this Directive; 

the Member States; whereas, in this 

whereas, in this connection, each 

connection, processing carried out 

part of a data file divided among 

by a person who is established in a 

several Member states must be 

Member State should be governed by 

considered a separte data file and 

the law of that State; whereas, the 

transfer to a non-member country 

fact that processing is carried out 

must not be a bar to such 

by a person established in a third 

protection; 

country must not stand in the way 

of the protection of individuals 

provided for in this Directive; 

whereas, in that case, the 

processing should be governed by 

the law of the Member State in 

which the means used are located, 

and there should be guarantees to 

ensure that the rights and 

obligations provided for in this 

Directive are respected in 

practice ; 

- 50 -

(12) Whereas  national laws may, 

(13) Whereas Member States may more 

under the conditions laid down in 

precisely define in the laws they 

this Directive, specify rules on 

enact or when bringing into force 

the lawfulness of processing; 

the measures taken under this 

whereas, however such a possibility 

Directive the general circumstances 

cannot serve as a basis for 

in which processing is lawful; 

supervision by a Member State other 

whereas, however, more precise 

than the State in which the data 

rules of this kind cannot serve as 

file is located, the obligation on 

a basis for supervision by a Member 

the part of the latter to ensure, 

State other than the Member State 

in accordance with this Directive, 

of residence of the person 

the protection of privacy in 

responsible for the processing, 

relation to the processing of 

since the obligation on the part of 

personal data being sufficient, 

the latter to ensure, in accordance 

under Community law, to permit the 

with this Directive, the protection 

free flow of data; 

of rights and freedoms with regard 

to the processing of personal data 

is sufficient, under Community law, 

to permit the free flow of data; 

(14) Whereas the principles of 

protection must be reflected, on 

the one hand, in the obligations 

imposed on persons, public 

authorities, enterprises or bodies 

carrying out processing, in 

particular regarding quality, 

technical security, notification to 

the supervisory authority, and the 

circumstances under which 

processing is admissible, one such 

possible circumstance being that 

the data subject has consented, 

and, on the other hand, in the 

rights conferred on individuals, 

the data on whom are the subject of 

- 51 -

processing, to be informed that 

processing is taking place, to 

consult the data, to demand 

corrections and even to object to 

processing; 

(15) Whereas any processing of 

personal data must be lawful and 

fair to the person concerned; 

whereas, in particular, the data 

must be relevant and not excessive 

in relation to the purposes for 

which they are processed; whereas 

such purposes must be explicit and 

lawful; 

(11) Whereas any processing of 

(16) Whereas, in order to be 

personal data must be lawful; 

lawful, the processing of personal 

whereas such lawfulness must be 

data must be carried out with the 

based on the consent of the data 

consent of the data subject or with 

subject or on Community or national 

a view to the conclusion or 

law; 

performance of a contract, binding 

on the data subject,  or be 

required by Community law, by 

national law, by the general 

interest or by the interest of an 

individual, provided that the data 

subject has no legitimate grounds 

for objection; whereas, in 

particular, in order to maintain a 

balance between the interests 

involved, while guaranteeing 

effective competition, Member 

States remain free to determine the 

circumstances in which personal 

- 52 -

data may b<=  disclosed to a third 

party for mailing purposes or 

research being carried out by an 

organization or other association 

or foundation, of a political 

nature for example, subject to the 

provisions allowing a data subject 

to object to the disclosure of data 

regarding him, at no cost and 

without having to state his 

reasons ; 

(16) Whereas, if data are to be 

(17) Whereas data which are capable 

processed, they must fulfil certain 

by their nature of infringing 

requirements; whereas the 

fundamental freedoms or privacy 

processing of data which are 

should not be processed unless the 

capable by their very nature of 

data subject gives his written 

infringing the right to privacy 

consent; whereas, however, 

must be prohibited unless the data 

processing of these data must be 

subject gives his explicit consent; 

permitted if it is carried out by 

whereas, however, on important 

an association the purpose of which 

public interest grounds, notably in 

is to help safeguard the exercise 

relation to the medical profession, 

of those freedoms; whereas, on 

derogations may be granted on the 

grounds of important public 

basis of a law laying down 

interest, notably in relation to 

precisely and  strictly the 

the medical profession, exemptions 

conditions governing and limits to 

may be  granted by law or by 

the processing of  this type of 

decision of the supervisory 

data; 

authority laying down the limits 

and suitable safeguards for the 

processing of these types of data; 

- 53 -

(18) Whereas as regards the media 

(18) Whereas the processing of 

the Member States may grant 

personal data for purposes of 

derogations from the provisions of 

journalism should qualify for 

this Directive in so far as they 

exemption from the requirements of 

are designed to reconcile the right 

this Directive wherever this is 

to privacy with the freedom of 

necessary to reconcile the 

information and the right to 

fundamental rights of individuals 

receive and impart information, as 

with freedom of information and 

guaranteed, in particular, in 

notably the right to receive and 

Article 10 of the Convention for 

impart information, as guaranteed 

the Protection of Human Rights and 

in particular in Article 10 of the 

Fundamental Freedoms; 

European Convention for the 

protection of Human Rights and 

Fundamental Freedoms ; 

(14) Whereas the data subject must, 

(19) Whereas, if the processing of 

if his consent is to be valid and 

data is to be fair, the data 

when data relating to him are 

subject must be in a position to 

collected from him, be given 

learn of the existence of a 

accurate and full information; 

processing operation and must be 

given accurate and full information 

where data are collected from him, 

and not later than the time when 

the data are first disclosed to a 

third party if the data subject was 

not informed at the time the data 

were collected; 

(15) Whereas the data subject must 

(20) Whereas any person must be 

be able to exercise the right of 

able to exercise the right of 

access in ordre to verify the 

access to data relating to him 

lawfulness of the processing of 

which are being processed, in order 

data relating to him and their 

to verify the accuracy of the data 

quality; 

and the lawfulness of the 

processing; whereas, therefore, any 

person should be entitled to object 

to the processing of the data on 

legitimate grounds; 

- 54 -

(17) Whereas the protection of 

privacy in relation to personal 

data requires that appropriate 

(21) whereas the protection of the 

rights and freedoms of data 

subjects with regard to the 

security measures be taken, both at 

processing of personal data 

the level of design and at that of 

requires that appropriate technical 

the techniques of processing, to 

prevent any unauthorized 

processing; 

measures be taken, both at the time 

of the design of the techniques of 

processing and at the time of the 

processing itself, particularly in 

order to maintain security and 

thereby to prevent any unauthorized 

processing; 

13) Whereas the procedures of 

(22) Whereas the notification 

notification, in respect of public-

procedures are designed to ensure 

or private-sector data files, and 

disclosure of the purposes and main 

provision of information at the 

features of any processing 

time of first communication, in 

operation, for the purpose of 

respect of private-sector data 

verification that the operation is 

files, are designed to ensure the 

in accordance with the national 

transparency essential to the 

measures taken under this 

exercise by  the data subject of the 

Directive; whereas, in order to 

right of access to data relating to 

avoid unsuitable administrative 

him; 

formalities, exemption from the 

obligation to notify and 

simplification of the notification 

required must be provided for by 

Member States in cases where 

processing does not adversely 

affect the rights and freedoms of 

data subjects provided that it is 

in accordance with a measure taken 

by a Member State and specifying 

its limits; 

- 55 -

(23) Whereas ex post facto 

verification by the competent 

authorities must, in general, be 

considered a sufficient measure; 

whereas, however, Member States 

must provide for checking by the 

supervisory authority prior to any 

processing which poses a particular 

threat to the rights and freedoms 

of data subjects by virtue of its 

nature, scope or purpose, such as 

processing which has as its object 

the exclusion of data subjects from 

a right, a benefit or a contract; 

whereas Member States should be 

entitled to replace such prior 

checking by means of a legislative 

measure or a decision of the 

supervisory authority authorizing 

the processing operation and 

specifying suitable safeguards; 

(20) Whereas, in the event of non­

(24) Whereas, if the person 

compliance with this Directive, 

carrying out processing fails to 

liability in any action for damages 

respect the rights of data 

must rest with the controller on 

subjects, national legislation must 

the file; whereas dissuasive 

provide for a judicial remedy; 

sanctions must be applied in order 

whereas any damage which a person 

to ensure effective protection; 

may suffer as a result of unlawful 

processing must be compensated for 

by the person responsible for the 

processing, who may be exempted 

from liability only if he proves 

that he has taken suitable security 

measures ; 

- 56 -

whereas dissuasive penalties must 

be imposed on any person, whether 

governed by private or public law, 

who fails to comply with the 

national measures taken under this 

Directive; 

(21) Whereas it is also necessary 

(25) Whereas cross-border flows of 

that the transfer of personal data 

personal data are necessary to the 

should be able to take place with 

expansion of international trade; 

third countries having an adequate 

whereas the protection of 

level of protection; whereas, in 

individuals guaranteed in the 

the absence of such  protection in 

Community  by this Directive does 

third countries, this Directive 

not stand in the way of transfers 

provides, in  particular, for 

of personal data to third countries 

negotiation procedures with those 

which ensure an adequate level of 

countries ; 

protection; whereas the adequacy of 

the level of protection afforded by 

a third country must be assessed in 

the light of all the circumstances 

surrounding the transfer operation 

or set of transfer operations; 

- 57 -

(26) Whereas, on the other hand, 

the transfer of personal data to a 

third country which does not ensure 

an adequate level of protection 

must be prohibited; whereas 

provision should be made for 

exemptions in certain circumstances 

where the data subject has given 

his consent or has been informed or 

where protection of the public 

interest so requires; whereas 

particular measures may be taken to 

rectify the lack of protection in a 

third country in cases where the 

person responsible for the 

processing offers appropriate 

assurances; whereas, moreover, 

provision must be made for 

procedures for negotiations between 

the Community and such third 

countries ; 

(27) Whereas Member States may also 

provide for the use of codes of 

conduct drawn up by the business 

circles concerned and approved by 

the supervisory authority, with a 

view to adapting the national 

measures taken under this Directive 

to the specific characteristics of 

processing in certain sectors; 

- 58 -

19) Whereas the Member States must 

(28) Whereas Member States must 

encourage the drawing-up, by the 

encourage the business circles 

business circles concerned, of 

concerned to draw up Community 

European codes of conduct or 

codes of conduct so as to 

professional ethics relating to 

facilitate the application of this 

certain specific sectors; whereas 

Directive; whereas the Commission 

the Commission will support such 

will support such initiatives and 

initiatives and will take them into 

will take them into account when it 

account when it considers the 

considers the appropriateness of 

appropriateness of new, specific 

additional specific measures in 

measures in respect of certain 

respect of certain sectors; 

sectors ; 

(23) Whereas the existence in each 

(29) Whereas the establishment in 

Member State of an independent 

each Member State of an independent 

supervisory authority is an 

supervisory authority is an 

essential component of the 

essential component of the 

protection of individuals in 

protection of individuals with 

relation to the processing of 

regard to the processing of 

personal data; whereas, at 

personal data; whereas such an 

Community level, a Working Party on 

authority must have the necessary 

the Protection of Personal Data, 

means to perform its duties, 

must be set up and be completely 

including powers of investigation 

independent in the performance of 

or intervention and powers in 

its functions; whereas having 

connection with notification 

regard to its specific nature it 

procedures; whereas such authority 

must  advise the Commission and 

must help to ensure transparency of 

contribute to the uniform 

processing in the Member State 

application of the national rules 

within whose jurisdiction it falls; 

adopted pursuant to this Directive; 

whereas the authorities in the 

different Member States will need 

to assist one another in performing 

their duties; 

01 

- 59 -

(30) Whereas, at Community level, a 

Working Party on the Protection of 

Individuals with regard to the 

Processing of Personal Data must be 

set up and be completely 

independent in the performance of 

its functions; whereas, having 

regard to its specific nature, it 

must advise the Commission and, in 

particular, contribute to the 

uniform application of the national 

rules adopted pursuant to this 

Directive; 

(24) Whereas the adoption of 

(31) Whereas the adoption of 

additional measures for applying 

additional measures for applying 

the principles set forth in this 

the principles set out in this 

Directive calls for the conferment 

Directive calls for the conferment 

of rule-making powers on the 

of rule-making powers on the 

Commission and the establishment 

Commission and the establishment of 

aof an Advisory Committee in 

an Advisory Committee in accordance 

accordance with the procedures laid 

with the procedures laid down in 

down in Council Decision 87/373/EEC 

Council Decision 87/373/EEC (4); 

(4) ; 

(8) Whereas the principles 

(32) Whereas the principles set out 

underlying the protection of 

in this Directive regarding the 

privacy in relation to the 

protection of the rights and 

processing of personal data set 

freedoms of individuals, notably 

forth in this Directive may be 

their right to privacy, with regard 

supplemented or clarified, in 

to the processing of personal data 

particular as far as certain 

may be supplemented or clarified, 

sectors are concerned, by specific 

in particular as far as certain 

rules based on those principles. 

sectors are concerned, by specific 

rules based on those principles; 

(4) OJ No L 197, 18.7.1937, p. 33. 

(4) OJ No L 197, 18.7.1987, p. 33. 

- 60 -

(33) Whereas Member States should 

be allowed  a period of not more 

than three years from the entry 

into force of the national measures 

transposing this Directive in which 

to apply such new national rules 

gradually to all processing 

operations already under way; 

(34) Whereas this Directive does 

not stand in the way of a Member 

State's regulating market research 

activities aimed at consumers 

residing in its territory in so far 

as such regulation does not concern 

the protection of individuals with 

regard to the processing of 

personal data, 

- 61 -

CHAPTER 1 

CHAPTER 1 

GENERAL PROVISIONS 

GENERAL PROVISIONS 

Article 1 

Article 1 

Object of the Directive 

Object of the Directive 

1.  The Member States shall ensure, in 

1. In accordance with this Directive, 

accordance with this Directive, 

Member States shall protect the 

the protection of the privacy  of 

rights and freedoms of natural 

individuals in relation to the 

persons with respect to the 

processing of personal data 

processing of personal data, and 

contained in data files. 

in particular their right of 

privacy. 

2 . The Member States shall neither 

2. Member States shall neither 

restrict nor prohibit the free 

restrict nor prohibit the free 

flow of personal data between 

flow of personal data between 

Member States for reasons to do 

Member States for reasons 

with the protection afforded under 

connected with the protection 

paragraph  1. 

afforded under paragraph  1. 

- 62 -

Article 2 

Definitions 

Article 2 

Definitions 

For the purposes of this Directive: 

For the purposes of this Directive: 

(a) "personal data" means any 

(a) "personal data" means any 

information relating to an 

identified or identifiable 

information relating to an 

identified or identifiable 

individual ("data subject"); an 

natural person ("data subject"); 

identifiable individual is 

an identifiable person is one who 

notably an individual who can be 

can be identified, directly or 

identified by  reference to an 

indirectly, in particular by 

identification number or similar 

reference to an identification 

identifying particular; 

number or to one or more factors 

specific to his physical, 

physiological, mental, economic, 

cultural or social identity; 

Data presented in statistical 

form, which is of such a type 

that the persons concerned can no 

longer be reasonably identified, 

are not considered as  personal 

data. 

- 63 -

(b) "depersonalize" means modify 

personal data in such a way that 

the information they contain can 

no longer be associated with a 

specific individual or an 

individual capable of being 

determined except at the price of 

an excessive effort in terms of 

staff, expenditure and time; 

(d) "processing" means the following 

(b) "processing of personal data" 

operations, whether or not 

("processing") means any 

performed by  automated means : the 

operation or set of operations 

recording, storage or combination 

which is performed upon personal 

of data, and their alteration, 

data, whether or not by automatic 

use or communication, including 

means, such as collection, 

transmission, dissemination, 

recording, organization, storage, 

retrieval, blocking and erasure; 

adaptation or alteration, 

retrieval, consultation, use, 

disclosure by transmission, 

dissemination or otherwise making 

available, alignment or 

combination, blocking, erasure or 

destruction; 

(c) "personal data file" (file) means 

(c) "personal data file" ("file") 

any set of personal data, whether 

means any structured set of 

centralized or geographically 

personal data, whether 

dispersed, undergoing automatic 

centralized or geographically 

processing or which, although not 

dispersed, which is accessible 

undergoing automatic processing, 

according to specific criteria 

are structured and accessible in 

and whose object or effect is to 

an organized collection according 

facilitate the use or alignment 

to specific criteria in such a 

of data relating to the data 

way as to facilitate thair use or 

subject or subjects; 

combination ; 

- 64 -

"controller of the file" means 

(d) "controller" means any natural or 

the natural or legal person, 

legal person, public authority, 

public authority, agency or other 

agency or other body who 

body competent under Community 

law or the national law of a 

processes personal data or causes 

it to be processed and who 

Member State to decide what will 

decides what is the purpose and 

be the purpose of the file, which 

objective of the processing, 

categories of personal data will 

which personal data are to be 

be stored, which operations will 

processed, which operations are 

be applied to them and which 

to be performed upon them and 

third parties  may have access to 

which third parties are to have 

them; 

access to them; 

(e) "processor" means any natural or 

legal person who processes 

personal data on behalf of the 

controller; 

(f) "third party" means any natural 

or legal person other than the 

data subject, the controller and 

any person authorized to process 

the data under the controller's 

direct authority or on his 

behalf ; 

- 65 -

(g) "the data subject's consent" 

means any express indication of 

his wishes by which the data 

subject signifies his agreement 

to personal data relating to him 

Article 12 

Informed consent 

Any giving of consent by a data 

being processed, on condition he 

subject to the processing of personal 

has available information about 

data relating to him within the 

the purposes of the processing, 

meaning of this Directive shall be 

the data or categories of data 

valid only if: 

concerned, the recipient of the 

personal data, and the name and 

(a) the data subject is supplied with 

address of the controller and of 

the following information: 

his representative if any; 

- the purposes of the file and 

The data subject's consent must 

the types of data stored; 

be freely given and specific, and 

- the type of use and, where 

subject at any time, but without 

appropriate, the recipients of 

retrospective effect. 

may be withdrawn by the data 

the personal data contained in 

the file; 

- the name and address of the 

controller of the file; 

(b) it is specific and express and 

specifies the types of data, 

forms of processing and potential 

recipients covered by it; 

(c) it may be withdrawn by  the data 

subject at any time without 

retroactive effect; 

- 66 -

(f) "supervisory authority" means the 

independant public authority or 

other independent body designated 

by each Member State in 

accordance with Article 26 of 

this Directive; 

(g) "public sector" means all the 

authorities, organizations and 

entities of a Member state that 

are governed by public law, with 

the exception of those which 

carry on an industrial or 

commercial activity, and bodies 

and entities governed by private 

law where they take part in the 

exercise of official authority; 

(h) "private sector" means any 

natural or legal person or 

association, including public 

sector authorities, organizations 

and entities in so far as they 

carry on an industrial or 

commercial activity. 

- 67 -

Article 3 

Scope 

Article 3 

Scope 

1. The Member States shall apply this 

1. This Directive shall apply to the 

Directive to files in the public 

processing of personal data wholly 

and private sectors with the 

or partly by automatic means, and 

exception of files in the public 

to the processing otherwise than 

sector wherre the activities of 

by automatic means of personal 

that sector do not fall within the 

data which forms part of a file or 

scope of Community law. 

is intended to form part of a 

file. 

2. This Directive shall not apply to 

2. This Directive shall not apply: 

files held by: 

(a) an individual solely for private 

course of an activity which falls 

and personal purposes; or 

outside the scope of Community 

to the processing of data in the 

(b) non-profit-making bodies, notably 

law; 

of a political, philosophical, 

-  to the processing of personal data 

religious, cultural, trade union, 

by a natural person in the course 

sporting or leisure nature, as 

of a purely private and personal 

part of their legitimate aims, on 

activity. 

condition that they relate only 

to those members and 

corresponding members who have 

consented to being included 

therein and that they are not 

communicated to third parties. 

-  68  -

Article 4 

Law applicable 

Article 4 

National law applicable 

1. Each Member State shall apply this 

1. Each Member State shall apply the 

Directive to: 

national provisions adopted under 

this Directive to all processing 

of personal data: 

(a) all files located in its 

territory; 

(b) the controller of a file resident 

(a) of which the controller is 

in its territory who uses from 

established in its territory or 

its territory a file located in a 

is within its jurisdiction; 

third country whose law does not 

provide an adequate level of 

protection, unless such use is 

only sporadic. 

(b) of which the controller is not 

established in the territory of 

the Community, where for the 

purpose of processing personal 

data he makes use of means, 

whether or not automatic, which 

are located in the territory of 

that Member State. 

- 69 -

Each Member State shall apply 

2. In the circumstances referred to 

Articles 5, 6, 8, 9, 10, 17, 18 

in paragraph 1(b) the controller 

and 21 of this Directive to a user 

must designate a representative 

consulting a file located in a 

established in the territory of 

third country from a terminal 

that Member state, who shall be 

located in the territory of a 

subrogated to the controller's 

Member State, unless such use is 

rights and obligations. 

only sporadic. 

Where a file is moved temporarily 

from one Member State to another, 

the latter shall place no obstacle 

in the way and shall not require 

the completion of any formalities 

over and above those applicable in 

the Member state in which the file 

is normally located. 

CHAPTER II 

GENERAL RULES ON THE LAWFULNESS OF 

THE PROCESSING OF PERSONAL DATA 

Article 5 

Member States shall provide that the 

processing of personal data is lawful 

only if carried out in accordance 

with this Chapter. 

Subject to this Chapter, 

Member States may more precisely 

determine the circumstances in which 

the processing of personal data is 

lawful. 

- 70 -

CHAPTER V 

DATA QUALITY 

Article  16 

Principles 

SECTION I 

PRINCIPLES RELATING TO DATA QUALITY 

Article  6 

1. The Member States shall provide 

1. Member States shall provide that 

that personal data shall be: 

personal data must be: 

(a) collected and processed fairly 

(a) processed fairly and lawfully; 

and lawfully; 

(b) stored for specified, explicit 

(b) collected for specified, explicit 

and lawful purposes and used in a 

and legitimate purposes and used 

way compatible with those 

in a way compatible with those 

purposes ; 

purposes ; 

(c) adequate, relevant and not 

(c) adequate, relevant and not 

excessive in relation to the 

excessive in relation to the 

purposes for which they are 

purposes for which they are 

stored; 

processed; 

(d) accurate and, if necessary, kept 

(d) accurate and, where necessary, 

up to date; inaccurate or 

kept up to date;  every step must 

incomplete data shall be erased 

be taken to ensure that data 

or rectified; 

which are inaccurate or 

incomplete having regard to the 

purposes for which they were 

collected are erased or 

rectified; 

- 71 -

(e) kept in a form which permits 

(e) kept in a form which permits 

identification of the data 

identification of data subjects 

subjects for no longer than is 

for no longer than is necessary 

necessary for the purpose for 

for the purposes in view; 

which the data are stored. 

Member States may lay down 

appropriate safeguards for 

personal data stored for 

historical, statistical or 

scientific use. 

2. It shall be for the controller of 

2. It shall be for the controller to 

the file to ensure that 

ensure that paragraph 1 is 

paragraph 1 is complied with. 

complied with. 

CHAPTER II 

SECTION II 

LAWFULNESS OF PROCESSING IN THE 

PRINCIPLES RELATING TO THE 

PUBLIC SECTOR 

GROUNDS FOR PROCESSING DATA 

Article 5 

Principles 

Article 7 

1. Subject to Article 6, the Member 

Member states shall provide that 

States shall, with respect to 

personal data may be processed only 

files in the public sector, 

if : 

provide in their law that: 

- 72 -

the creation of a file and any 

(a) the data subject has consented; 

other processing of personal data 

shall be lawful in so far as they 

are necessary for the performance 

(b) processing is necessary for the 

of the tasks of the public 

performance of a contract with 

authority in control of the file; 

the data subject, or in order to 

take steps at the request of the 

data subject preliminary to 

entering into a contract; 

the processing of data for a 

(c) processing is necessary in order 

purpose other than that for which 

to comply with an obligation 

the file was created shall be 

imposed by national law or by 

lawful if: 

Community law; 

- the data subject consents 

(d) processing is necessary in order 

thereto, or 

to protect the vital interests of 

the data subject; 

- it is effected on the basis of 

Community law, or of a law, or 

(e) processing is necessary for the 

a measure taken pursuant to a 

performance of a task in the 

law, of a Member State 

public interest or carried out in 

conforming with this Directive 

the exercise of public authority 

which authorizes it and defines 

vested in the controller or in a 

the limites thereto, or 

third party to whom the data are 

disclosed; or 

- the legitimate interests of the 

data subject do not preclude 

(f) processing is necessary in 

such change of purpose, or 

pursuit of the general interest 

or of the legitimate interests of 

- it is necessary in order to 

the controller or of a third 

ward off an imminent threat to 

party to whom the data are 

public  order or a serious 

disclosed, except where such 

infringement of the rights of 

interests are overridden by the 

others . 

interests of the data subject. 

- 73 -

Article 6 

Processing in the public sector 

having as its object the 

communication of personal data 

1. The Member States shall provide in 

their law that the communication 

of personal data contained in the 

files of a public sector entity 

shall be lawful only if: 

(a) it is necessary for the 

performance of the tasks of the 

public sector entity 

communicating or requesting 

communication of the data; or 

(b) it is requested by a natural or 

legal person in the private 

sector who invokes a legitimate 

interest, on condition that the 

interest of the data subject does 

not prevail. 

- 74 -

2. Without prejudice to paragraph 1, 

the Member States may specifiy the 

conditions under which the 

communication of personal data is 

lawful. 

3. The Member States shall provide in 

their law that, in the 

circumstances referred to in 

paragraph 1 (b), the controller of 

the file shall inform data 

subjects of the communication of 

personal data. The Member States 

may provide for the replacing of 

such provision of information by 

prior authorization by the 

supervisory authority. 

- 75 -

CHAPTER III 

LAWFULNESS OF PROCESSING IN THE 

PRIVATE SECTOR 

Article 8 

Principles 

1. The Member States shall provide in 

their law that, without the 

consent of the data subject, the 

recording in a file and any other 

processing of personal data shall 

be lawful only if it is effected 

in accordance with this Directive 

and if: 

(a) the processing is carried out 

under a contract, or in the 

context of a quasi-contractual 

relationship of trust, with the 

data subject and is necessary for 

its discharge; or 

(b) the data come from sources 

generally accessible to the 

public and their processing is 

intended solely for 

correspondence purposes; or 

- 76 -

(c) the controller of the file is 

pursuing a legitimate interest, 

on condition that the interest of 

the data subject does not 

prevail. 

2. The Member States shall provide in 

their law that it shall be for the 

controller of the file to ensure 

that no communication is 

incompatible with the purpose of 

the file or is contrary to public 

policy. In the event of on-line 

consultation, the same obligations 

shall be incumbent on the user. 

3. Without prejudice to paragraph 1, 

the Member States may specify the 

conditions under which the 

processing of personal data is 

lawful. 

- 77 -

CHAPTER V 

SECTION III 

DATA QUALITY 

SPECIAL CATEGORIES OF PROCESSING 

Article 17 

Article 8 

Special categories of data 

The processing of special 

categories of data 

1. The Member States shall prohibit 

1. Member States shall prohibit the 

the automatic processing of data 

processing of data revealing 

revealing ethnic or racial origin, 

racial or ethnic origin, political 

political opinions, religious or 

opinions, religious beliefs, 

philosophical beliefs or trade 

philosophical or ethical 

union membership, and of data 

persuasion or trade-union 

concerning health or sexual life, 

membership, and of data concerning 

without the express and written 

health or sexual life. 

consent, freely given, of the data 

subject. 

2. Member States shall provide that 

data referred to in paragraph 1 

may be processed where: 

-Te­

ia.)  the data subject has given his 

written consent to the processing 

of that data, except where the 

laws of the Member State provide 

that the prohibition referred to 

in paragraph 1 may not be waived 

by the data subject giving his 

consent; 

(b) processing is carried out by a 

foundation or non-profit-making 

association of a political, 

philosophical, religious or trade 

union character in the course of 

its legitimate activities and on 

condition that the processing 

relates solely to members of the 

foundation or association and to 

persons who have regular contact 

with it in connection with its 

purposes and that the data are 

not disclosed to third parties 

without the data subject's 

consent; or 

(c) the processing is performed in 

circumstances where there is 

manifestly no infringement of 

privacy or fundamental freedoms. 

The processing of data referred to at 

point (b) shall not be subject to the 

obligation to notify imposed in 

Section VIII of this Chapter. 

- 79 -

The Member States may, on 

3. Member States may, on grounds of 

important public interest grounds, 

important public interest, lay 

grant derogations from paragraph 1 

down exemptions from paragraph 1 

on the basis of a law specifying 

by national legislative provision 

the types of data which may be 

or by decision of the supervisory 

stored and the persons who may 

authority, stating the types of 

have access to the file and 

data which may be processed, the 

providing suitable safeguards 

persons to whom such data may be 

against abuse and unauthorized 

disclosed and the persons who may 

access. 

be controllers, and specifying 

suitable safeguards. 

Data concerning criminal 

4. Data concerning criminal 

convictions shall be held only in 

convictions may be held only by 

public sector files. 

judicial and law-enforcement 

authorities and by the persons 

directly concerned with those 

convictions or by their 

representatives;  Member States 

may, however,  lay down exemptions 

by means of a legislative 

provision which shall specify 

suitable safeguards. 

5. Member States shall determine the 

conditions under which a national 

identification number or other 

identifier of general application 

may be used. 

- 80 -

CHAPTER VI 

PROVISIONS SPECIFICALLY RELATING 

TO CERTAIN SECTORS 

Article 19 

Article 9 

Processing of personal data 

and freedom of expression 

The Member States may grant, in 

With a view to reconciling the right 

respect of the press and the 

to privacy with the rules governing 

audiovisual media, derogations from 

freedom of expression, Member States 

the  provisions of this Directive in 

shall prescribe exemptions from this 

so far as they are necessary to 

Directive in respect of the 

reconcile the right to privacy with 

processing of personal data solely 

the rules governing freedom of 

for journalistic purposes by the 

information and of the press. 

press, the audio-visual media and 

journalists. 

- 81 -

CHAPTER IV 

SECTION IV 

RIGHTS OF DATA SUBJECTS 

INFORMATION TO BE GIVEN 

TO THE DATA SUBJECT 

Article 14 

Article 10 

Additional rights of data subjects 

The existence of a processing 

operation 

The Member States shall grant a data 

1. Member States shall ensure that 

subject the following rights: 

any person is entitled, on 

request, to know of the existence 

3. To know of the existence of a file 

of a processing operation, its 

and to know its main purposes and 

purposes, the categories of data 

the identity and habitual 

concerned, any third parties or 

residence, headquarters or place 

categories of third party to whom 

of business of the controller of 

the data are to be disclosed, and 

the file. 

the name and address of the 

controller and of his 

representative, if any. 

2. Member States may lay down 

exemptions from paragraph 1 in the 

circumstances referred to in 

Article 14(1). 

- 82 -

Article 13 

Provision of information at 

the time of collection 

Article 11 

Collection of data from 

the data subject 

1. The Member States shall guarantee 

1. Member States shall provide that 

individuals from whom personal 

the controller must ensure that a 

data are collected the right to be 

data subject from whom data are 

informed at least about: 

collected be informed at least of 

the following: 

(a) the purposes of the file for 

(a) the purposes of the processing 

which the information is 

for which the data are intended; 

intended; 

(b) the obligatory or voluntary 

(b) the obligatory or voluntary 

nature of their reply to the 

nature of any reply to the 

questions to which answers are 

questions to which answers are 

sought ; 

sought; 

(c) the consequences if they fail to 

(c) the consequences for him if he 

reply ; 

fails to reply; 

(d) the recipients of the 

(d) the recipients or categories of 

information; 

recipients of the data; 

(e) the existence of the right of 

(e) the existence of a right of 

access to and rectification of 

the data relating to them; and 

access to and rectification of 

the data relating to him;  and 

- 83 -

(f) the name and address of the 

(f) the name and address of the 

controller of the file. 

controller and of his 

representative if any. 

2. Paragraph 1 shall not apply to the 

2. Paragraph 1 shall not apply to the 

collection of information where to 

collection of data where to inform 

inform the data subject would 

the data subject would hinder or 

prevent the exercise of the 

prevent the exercise of or the co­

supervision and verification 

operation with the supervision and 

functions of a public order. 

verification functions of a public 

authority or the maintenance of 

public order. 

CHAPTER III 

LAWFULNESS OF PROCESSING 

IN THE PRIVATE SECTOR 

Article 9 

Article 12 

Obligation to inform the data subject 

Disclosure to a third party 

1. The Member States shall, with 

1. Member States shall provide that 

respect to the private sector, 

in the cases referred to in 

provide in their law that at the 

Article 7(b), (c), (e) and (f) the 

time of first communication or of 

controller must satisfy himself 

the affording of an opportunity 

that at the appropriate time, and 

for on-line consultation the 

no later than the time when the 

controller of the file shall 

data are first disclosed to a 

inform the data subject 

third party, the data subject is 

accordingly, indicating also the 

informed of this disclosure and of 

purpose of the file, the types of 

the following information at 

data stored therein and his name 

least : 

and address. 

- 84 -

(a)  the name and address of the 

controller and of his 

representative, if any; 

(b)  the purposes of the 

processing; 

(c)  the categories of data 

concerned; 

(d)  the recipients or categories 

of recipients; and 

(e)  the existence of rights of 

access, rectification and 

objection. 

2. The provision of information under 

2. Paragraph 1 shall not apply where: 

paragraph 1 shall not be mandatory 

the data subject has already been 

in the circumstances referred to 

informed that the data are to be 

in Article 8 (1) (b). There shall 

or may be disclosed to a third 

be no olbigation to inform where 

party; 

communication is required by law. 

-  disclosure to a third party is 

required by a legal provision 

3. If the data subject objects to 

which lays down an exemption from 

communication or any other 

the obligation to inform; or 

processing, the controller of the 

the data are disclosed to a third 

file shall cease the processing 

party for one of the reasons 

objected to unless he is 

listed in Article 14(1). 

authorized by  law to carry it out. 

- 85 -

3. Where the provision of information 

to the data subject proves 

Article 10 

impossible or involves a 

Special exception to the 

disproportionate effort, or runs 

obligation to inform the data subject 

counter to the overriding 

legitimate interests of the 

If the provision of information to 

controller or similar interests of 

the data subject provided for in 

a third party, Member States may 

Article 9 (1) proves impossible or 

empower the supervisory authority 

involves a disproportionate effort, 

to authorize an exemption, laying 

or comes up against the overriding 

down any suitable safeguards. 

legitimate interests of the 

controller of the file or a similar 

intrest of a third party, the Member 

States may provide in their law that 

the supervisory authority may 

authorize a derogation. 

CHAPTER IV 

SECTION V 

RIGHTS OF DATA SUBJECTS 

THE DATA SUBJECT'S RIGHT OF 

ACCESS TO DATA 

Article 14 

Additional rights of data subjects 

Article 13 

Right of access 

The Member States shall grant a data 

Member States shall grant all data 

subject the following rights: 

subjects the following rights: 

- 86 -

4. To obtain at reasonable intervals 

1. to obtain, on request, at 

and without excessive delay or 

reasonable intervals and without 

expense confirmation of whether 

excessive delay or expense, 

personal data relating to him are 

confirmation of the existence of 

stored in a file and communication 

personal data relating to him, 

to him of such data in an 

intelligible form. 

communication to him of such data 

in an intelligible form, an 

indication of their source, and 

general information on their use. 

The Member States may provide that 

Member States may provide that the 

the right of access to medical 

right of access to medical data 

data may be exercised only through 

may be exercised only through a 

a doctor. 

medical practitioner; 

2. to refuse any demand by a third 

party that he should exercise his 

right of access in order to 

communicate the data in question 

to that third party or to another 

party, unless the third party's 

request is founded on national or 

Community law; 

5. To obtain, as the case may be, 

3. to obtain, as the case may be, the 

rectification, erasure or blocking 

rectification of inaccurate or 

of such data if they have been 

incomplete data or the erasure or 

processed in violation of the 

blocking of such data if they have 

provisions of this Directive. 

been processed in breach of this 

Directive ; 

- 87 -

7. To obtain, in the event of the 

4. where point 3 applies, to be 

application of paragraph 5 and if 

notified of the rectification, 

the data have been communicated to 

erasure or blocking to any third 

third parties, notification to the 

party to whom the data have been 

latter of the rectification, 

disclosed; 

erasure or blocking. 

5. to be informed of the reasoning 

applied in any automatic 

processing operations the outcome 

of which is invoked against him. 

Article 15 

Article 14 

Exceptions to the data subject's 

Exceptions to the right of access 

right of access to 

public sector files 

1. The Member States may limit by 

1. Unless obliged to do so by a 

statute the rights provided for in 

provision of Community law, 

points 3 and 4 of Article 14 for 

Member States may restrict the 

reasons relating to: 

exercise of the rights provided 

for in Article 10(1) and in point 

1 of Article 13 where such 

restriction is necessary to 

safeguard : 

(a) national security; 

(a) national security; 

(b) defence; 

(b) defence; 

(c) criminal proceedings; 

(c) criminal proceedings; 

- 88 -

(d) public safety; 

(d) public safety; 

(e) a duly established paramount 

(e) a duly established paramount 

economic and financial interest 

economic and financial interest 

of a Member State or of the 

of a Member State or of the 

European Communities; 

Community; 

(f) the need for the public 

(f) a monitoring or inspection 

authorities to perform monitoring 

function performed by a public 

or inspection functions; or 

authority or an activity 

undertaken to assist the 

performance of such a function; 

(g) an equivalent right of another 

(g) an equivalent right of another 

individual and the rights and 

person and the rights and 

freedoms of others. 

freedoms of others. 

2. In the circumstances referred to 

2. In the circumstances described in 

in paragraph 1, the supervisory 

paragraph 1, the supervisory 

authority shall be empowered to 

authority shall be empowered to 

carry out, at the request of the 

carry out the necessary checks, at 

data subject, the necessary checks 

the data subject's request, so as 

on the file. 

to verify the lawfulness of the 

processing within the meaning of 

this Directive, respecting the 

interests to be protected in 

accordance with paragraph 1. 

- 89 -

3. The Member States may place limits 

3. Member States may limit the right 

on the data subject's right of 

of access of the person concerned 

access to data compiled 

to data temporarily kept in 

temporarily for the purpose of 

personal form and which is 

extracting statistical information 

intended to serve statistical ends 

therefrom. 

of such a type that the persons 

concerned can no longer be 

reasonably identified. 

SECTION VI 

THE DATA SUBJECT'S RIGHT TO OBJECT 

Article 14 

Article 15 

Additional rights of data subjects 

Objection on legitimate grounds 

The Member States shall grant a data 

1. Member States shall grant the data 

subject the following rights: 

subject the right to object at any 

time on legitimate grounds  to the 

1. To oppose, for legitimate reasons, 

processing of data relating to 

the processing of personal data 

him. 

relating to him. 

6 . To obtai LÎ  upon request and free of 

2. Where there is a justified 

charge the  erasure of data 

objection,  the controller shall 

relating to him held in files used 

cease the processing. 

for market research or advertising 

purposes . 

- 90 -

3. The controller must ensure that 

the opportunity to have data 

erased without cost has been 

expressly offered to a data 

subject before personal data are 

disclosed to third parties or used 

on their behalf for the purposes 

of marketing by mail. 

Article 16 

Automated individual decisions 

2.  Not to be subject to an 

1. Member States shall grant the 

administrative or private decision 

right to every person not to be 

involving an assessment of his 

subjected to an administrative or 

conduct which has as its sole 

private decision adversely 

basis the automatic processing of 

affecting him which is based 

personal data defining his profile 

solely on automatic processing 

or personality. 

defining a personality profile. 

2. Subject to the other Articles of 

this Directive, Member States 

shall provide that a person may be 

subjected to a decision of the 

kind referred to in paragraph 1 if 

that decision: 

- 91 -

(a) is taken in the course of the 

entering into or performance of a 

contract, provided any request by 

the data subject has been 

satisfied, or that there are 

suitable measures to safeguard 

his legitimate interests, which 

must include arrangements 

allowing him to defend his point 

of view; or 

(b) is authorized by law which also 

lays down measures to safeguard 

the data subject's legitimate 

interests. 

CHAPTER V 

SECTION VII 

DATA QUALITY 

SECURITY OF PROCESSING 

Article 18 

Data security 

Article 17 

1. The Member States shall provide in 

1. Member States shall provide that 

their law that the controller of a 

the controller must take 

file shall take appropriate 

appropriate technical and 

technical and organizational 

organizational measures to protect 

measures to protect personal data 

personal data against accidental 

stored in the file against 

or unlawful destruction or 

acidental or unauthorized 

accidental loss and against 

destruction or accidental loss and 

unauthorized alteration or 

against unauthorized access, 

disclosure or any other 

modification or other processing. 

unauthorized form of processing. 

- 92 -

Such measures shall ensure, in 

Such measures shall ensure, in 

respect of automated files, an 

respect of the automatic 

appropriate level of security 

processing of data, a suitable 

having regard to the state of the 

level of security having regard to 

art in this field, the cost of 

the state of the art and  the 

taking the measures, the nature of 

nature of the data to be 

the data to be protected and the 

protected, and an evaluation of 

assessment of the potential risks. 

the potential risks involved. To 

To that end, the controller of the 

that end, the controller shall 

file shall take into consideration 

take into consideration any 

any recommendations on data 

recommendations on data security 

security and network 

and network interoperability made 

interoperability formulated by the 

by the Commission in accordance 

Commission in accordance with the 

with the procedure referred to  in 

procedure provided for in 

Article 33. 

Article 29. 

Methods guaranteeing adequate 

2. Methods ensuring an appropriate 

security shall be chosen for the 

level of security shall be chosen 

transmission of personal data in a 

for the transmission of personal 

network. 

data within a network. 

In the event of on-line 

3. Where an opportunity is provided 

consultation, the hardware and 

for remote access, the controller 

software shall be designed  in such 

shall utilize the hardware and 

a way that the consultation tkaes 

software in such a way that the 

place within the limits of the 

authorization granted by  the 

controller of the file. 

access takes place within the 

limits of the lawfulness of the 

processing. 

- 93 -

4. The obligations referred to in 

4. The obligations referred to in 

paragraphs 1, 2, and 3 shall also 

paragraphs 1, 2 and 3 shall also 

be incumbent on persons who, 

be incumbent on persons who share 

either de facto or by contract, 

responsibility for carrying out 

control the operations relating to 

the processing, and, in 

a file. 

particular, on the processor. 

5. Any person who in the course of 

5. Any person who, in the course of 

his work has access to information 

his work, has access to personal 

contained in files shall not 

data shall not disclose it to 

communicate it to third parties 

third parties without the 

without the agreement of the 

controller's agreement, unless he 

controller of the file. 

is required to do so under 

national or Community law. 

- 94 -

CHAPTER II 

SECTION VIII 

LAWFULNESS OF PROCESSING 

NOTIFICATION 

IN THE PUBLIC SECTOR 

Article 7 

Article 18 

Obligation to notify the 

Obligation to notify the 

supervisory authority 

supervisory authority 

1. The Member States shall provide in 

1. Member States shall provide that 

their law that the creation of a 

the controller or his 

public sector file, the personal 

representative, if any, must 

data in which might be 

notify the supervisory authority 

communicated, shall be notified in 

referred to in Article 30 before 

advance to the supervisory 

carrying out any wholly or partly 

authority and recorded in a 

automatic  processing or a set of 

register kept by that authority. 

processing operations of the same 

The register shall be freely 

type intended to serve a single 

available for consultation. 

purpose or several related 

purposes. 

- 95 -

2. The Member States shall specify 

2. Member States shall specify the 

the information which must be 

information to be given in the 

notified to the supervisory 

notification.  It shall include at 

authority. That information shall 

least : 

include at least the name and 

address of the controller of the 

(a) the name and address of the 

file, the purpose of the file, a 

controller and of his 

description of the types of data 

representative, if any; 

it contains, the third parties to 

(b) the purpose or purposes of the 

whom the data might be 

processing; 

communicated and a description of 

(c) the category or categories of 

the measures taken pursuant to 

data subject; 

Article 18. 

(d) a description of the data or of 

the categories of data to which 

3. The Member States may provide that 

the processing relates; 

paragraphs 1 and 2 shall apply to 

(e) the third parties or categories 

other public sector files and that 

of third party to whom the data 

consultation of the register may 

might be disclosed; 

be restricted for the reasons 

(f) proposed transfers of data to 

stated in Article 15 (1). 

third countries; 

(g) a description of the measures 

taken pursuant to Article 17 to 

ensure security of processing. 

- 96 -

CHAPTER III 

3. Any change affecting the 

information referred to in 

paragraph 2 must be notified to 

LAWFULNESS OF PROCESSING 

the supervisory authority. 

IN THE PRIVATE SECTOR 

Article 11 

Obligation to notify the 

supervisory authority 

4. Before processing which poses 

specific risks to the rights and 

freedoms of individuals commences, 

the supervisory authority shall 

examine such processing within a 

1. The Member States shall provide in 

period of  15 days commencing with 

their law that the controller of 

the date of the notification at 

the file shall notify the creation 

the end of which period the 

of a personal data file where the 

authority shall give its 

data are intended to be 

conclusions. 

communicated and do not come from 

sources generally accessible to 

5. Member States may provide that 

the public. The notification shall 

some of the processing operations 

be made to the supervisory 

referred to in paragraph 4 shall 

authority of the Member State in 

be authorized beforehand either by 

which the file is located or, if 

law or by decision of the 

it is not located in a Member 

supervisory authority. 

State, to the supervisory 

authority of the Member State in 

which the controller of the file 

resides. The controller of the 

file shall notify to the competent 

national authorities any change in 

the purpose of the file or any 

change in his address. 

- 97 -

2. The Member States shall specify 

the information which must be 

notified to the supervisory 

authority. That information shall 

include at least the name and 

address of the controller of the 

file, the purpose of the file, a 

description of the types of data 

it contains, the third parties to 

whom the data might be 

communicated and a description of 

the measures taken pursuant to 

Article 18. 

3. The Member States may provide that 

paragraphs 1  and 2 shall apply to 

other private sector files and 

that the information referred to 

in paragraph 2 shall be accessible 

to the public. 

Article 19 

Simplification of and exemption 

from the obligation to notify 

Member States shall provide for 

the taking of measures to simplify 

or exempt from the obligation to 

notify in the case of certain 

categories of processing operation 

which do not adversely affect the 

rights and freedoms of data 

subjects. Such categories of 

processing include the production 

of correspondence or papers, the 

satisfaction of legal, accounting, 

tax or social security duties or 

the consultation of documentation 

services accessible to the public. 

Simplification or exemption 

measures shall be adopted either 

by or after consulting the 

supervisory authority. Such 

measures shall particularly 

specify, for each category of 

processing operation: 

- 99 -

- the purposes of the processing; 

- a description of the data or 

categories of data undergoing 

processing; 

- the category or categories of 

data subject; 

- the third parties or categories 

of third party to whom the data 

are to be disclosed; 

- the length of time the data are 

to be stored; 

- where appropriate, the 

conditions under which the 

processing is to be carried out. 

3. Simplification or exemption from 

the obligation to notify shall not 

release the controller from any of 

the other obligations resulting 

from this Directive. 

Article 20 

Manual processing operations 

Member States may lay down the 

conditions under which Articles 18 

and 19  are to apply to non-automatic 

processing operations involving 

personal data contained in files. 

- 100 -

Article 21 

Register of notified 

processing operations 

Member States shall provide that a 

register of notified processing 

operations must be maintained by the 

supervisory authority. The register 

shall as a minimum in the cases 

provided for in Articles 18 and 19, 

contain the information listed in 

Article 18(2)(a) to (f).  It may be 

inspected by any person subject to 

such restrictions as may be imposed 

by  Member States on the same grounds 

as are set out in Article 14(1). 

CHAPTER VI 

PROVISIONS SPECIFICALLY RELATING 

TO CERTAIN SECTORS 

Article 20 

The Member States shall encourage the 

business circles concerned to 

participate in drawing up European 

codes of conduct or professional 

ethics in respect of certain sectors 

on the basis of the principles  set 

forth in  this Directive. 

- 101 -

CHAPTER IV 

CHAPTER III 

JUDICIAL REMEDIES, LIABILITY 

RIGHTS OF DATA SUBJECTS 

AND PENALTIES 

Article 14 

Article 22 

Additional rights of data subjects 

Judicial remedies 

The Member States shall grant a data 

Member States shall provide for the 

subject the following rights: 

right of every person to a judicial 

remedy for any breach of the rights 

8. To have a judicial remedy if the 

guaranteed by this Directive. 

rights guaranteed in this Article 

are infringed. 

- 102 -

CHAPTER VII 

LIABILITY AND SANCTIONS 

Article 21 

Liability 

Article 23 

Liability 

1. The Member States shall provide in 

1. Member States shall provide that 

their law that any  individual 

any person whose personal data are 

whose personal data have been 

undergoing processing  and who 

stored in a file and who suffers 

suffers damage as a result of an 

damage as a result of processing 

unlawful processing operation or 

or of any act incompatible with 

of any  act incompatible with the 

this Directive shall be entitled 

national provisions adopted 

to compensation from the 

pursuant to this Directive is 

controller of the file. 

entitled to receive compensation 

from the controller for the damage 

suffered. 

2. The Member States may provide that 

2. Member States may provide that the 

the controller of the file shall 

controller may be exempted, in 

not be  liable for any damage 

whole or in part, from his 

resulting from the loss or 

destruction of data or from 

liability for damage resulting 

from the loss or destruction of 

unauthorized access if  he proves 

data or from unauthorized access 

that he has taken appropriate 

measures to fulfil the 

requirements of Articles  18 and 

if  he proves that he has taken 

suitable steps to satisfy the 

requirements of Articles 17 and 

22 . 

24 . 

- 103 -

Article 22 

Article 24 

Processing on behalf of the 

Processing on behalf 

controller of the file 

of the controller 

The Member States shall provide in 

1. Member States shall provide that 

their law that the controller of 

the controller must, where 

the file must, where processing is 

processing is carried out on his 

carried out on his behalf, ensure 

behalf, ensure that the necessary 

that the necessary security and 

security and organizational 

organizational measures are taken 

measures are taken and choose a 

and choose a person or enterprise 

processor who provides sufficient 

who provides sufficient guarantees 

guarantees in that respect. 

in that respect. 

Any person who collects or 

2. The processor shall carry out only 

processes personal data on behalf 

such processing of personal data 

of the controller of the file 

as is stipulated in his contract 

shall fulfil the obligations 

with the controller and shall take 

provided  for in Article  16  and 18 

instructions only from the latter. 

of this Directive. 

He shall comply with the national 

provisions adopted pursuant to 

this Directive. 

The contract shall be in writing 

3. The contract shall be in writing 

and shall stipulate, in 

and shall state, in particular, 

particular, that the personal data 

that personal data processed 

may be divulged by  the person 

thereunder may be disclosed to a 

providing the service or his 

third party by the processor or 

employees only with the agreement 

his employees only with the 

of the controller of the file. 

controller's agreement. 

-  104  -

Article 23 

Sanctions 

Article 25 

Penalties 

Each Member State shall make 

Each Member State shall provide for 

provision in its law for the 

the imposition of dissuasive 

application of dissuasive sanctions 

penalties on any person who does not 

in order to ensure compliance with 

comply with the national provisions 

the measures taken pursuant to this 

adopted pursuant to this Directive. 

Directive. 

CHAPTER VIII 

CHAPTER IV 

TRANSFER OF PERSONAL DATA 

TRANSFER OF PERSONAL DATA 

TO THIRD COUNTRIES 

TO THIRD COUNTRIES 

Article 24 

Principles 

Article 26 

Principles 

1. The Member States shall provide in 

1. Member States shall provide that 

their law that the transfer to a 

the transfer, whether temporary or 

third country, whether temporary 

permanent, to a third country of 

or permanent, of  personal data 

personal data which are undergoing 

which are undergoing processing or 

processing or which have been 

which have been gathered with a 

collected with a view to 

view to processing may take place 

processing may  take place only if 

only if  that country ensures an 

the third country in question 

adequate level of  protection. 

ensures an adequate level of 

protection. 

Notwithstanding the first 

subparagraph. Member States shall 

provide that a transfer to a third 

country which does not ensure an 

adequate level of protection may 

take place on condition that: 

- subject, where appropriate, to 

Article 8(2)(a), the data 

subject has consented to the 

proposed transfer in order to 

take steps preliminary to 

entering into a contract; 

- the transfer is  necessary for 

the performance of a contract 

between the data subject and the 

controller, on condition that 

the data subject has been 

informed of the fact that it is 

or might be proposed to transfer 

the data to a third country 

which does not ensure an 

adequate level of protection; 

-  the transfer is necessary on 

important public interest 

grounds ; or 

-  the transfer is necessary  in 

order to protect the vital 

interests of the data subject. 

- 106 -

2. The adequacy of the level of 

protection afforded by a third 

country shall be assessed in the 

light of all the circumstances 

surrounding a data transfer 

operation or set of data transfer 

operations; particular account 

shall be taken of the nature of 

the data, the purpose or purposes 

and duration of the proposed 

processing operation or 

operations, the legislative 

provisions, both general and 

sectoral, in force in the third 

country in question and the 

professional rules which are 

complied with in that country. 

2. The Member States shall inform the 

3. Member States shall inform the 

Commission of cases in which an 

Commission of cases where they 

importing third country does not 

consider that a third country does 

ensure an adequate level of 

not ensure an adequate level of 

protection. 

protection. 

3. Where the Commission finds, either 

4. Where the Commission finds, either 

on the basis of information 

on the basis of information 

supplied by  Member States or on 

supplied by  Member States or on 

the basis of other information, 

the basis of other information, 

that a third country does not have 

that a third country does not 

an adequate level of protection 

ensure an adequate level of 

and that the resulting situation 

protection and that the resulting 

is likely  to harm the interests of 

situation is likely to harm the 

the Community or of a Member 

interests of the Community or of a 

State, it may enter into 

negotiations with a view to 

remedying the situation. 

Member State, it may enter into 

negotiations with a view to 

remedying the situation. 

- 107 -

4. The commission may decide, in 

5. The Commission may decide, in 

accordance with the procedure laid 

accordance with the procedure laid 

down in Article 30 (2) of this 

down in Article 34(2) that a third 

Directive, that a third country 

country ensures an adequate level 

ensures an adequate level of 

of protection by reason of the 

protection by reason of the 

international commitments it has 

international commitments it has 

entered into or of its domestic 

entered into or of its domestic 

law. 

law. 

5. Measures taken pursuant to this 

6. Measures taken pursuant to this 

Article shall be in keeping with 

Article shall be in keeping with 

the obligations incumbent on the 

the obligations incumbent on the 

Community by virtue of 

Community by  virtue of 

international agreements, both 

international agreements, both 

bilateral and multilateral, 

governing the protection of 

bilateral and multilateral, 

governing the protection of 

individuals in relation to the 

persons with regard to the 

automatic processing of personal 

automatic processing of personal 

data. 

data. 

- 108 -

Article 25 

Derogation 

Article 27 

Particular measures 

1. A Member State may derogate from 

1. Subject to the second subparagraph 

Article 24 (1) in respect of a 

of Article 26(1), a Member State 

given export on submission by the 

may authorize a transfer or 

conroller of the file of 

category of transfers of personal 

sufficient proof that an adequate 

data to a third country which does 

level of protection will be 

not ensure an adequate level of 

provided. The Member State may 

protection where the controller 

grant a derogation only after it 

adduces sufficient justification 

has informed the Commission and 

in particular in the form of 

the Member States thereof and in 

appropriate contractual provisions 

the absence of notice of 

guaranteeing, especially, the 

opposition given by a Member State 

effective exercise of data 

or the Commission within a period 

subjects' rights. 

of 10 days. 

2. Where notice of opposition is 

2. The Member State shall inform the 

given, the Commission shall adopt 

Commission and the other Member 

appropriate measures in accordance 

States in good time of its 

with the procedure laid down in 

proposal to grant authorization. 

Article 30 (2) 

3. If a Member State or the 

Commission objects before the 

authorization takes effect, the 

Commission shall take appropriate 

measures in accordance with the 

procedure laid down in 

Article 34(2) . 

- 109 -

CHAPTER V 

CODES OF CONDUCT 

Article 28 

National codes 

1. Member states may provide that 

codes of conduct drawn up by trade 

associations may make additional 

provision for the special features 

of particular sectors, subject to 

the national measures taken under 

this Directive. 

2. The draft codes shall be reviewed 

by the national supervisory 

authority, which shall ascertain 

whether or not they are justified 

and the representativeness of the 

organizations which prepared them. 

The authority shall seek the views 

of data subjects or their 

representatives. 

3. Member States shall ensure the 

official publication of codes 

which have been the subject of a 

favourable opinion on the part of 

the supervisory authority. 

- 110 -

4. Any extension or amendment of the 

codes shall be subject to 

identical procedures. 

Article 29 

Community codes 

1. Member States and the Commission 

shall encourage the trade 

associations concerned to 

participate in drawing up 

Community codes of conduct 

intended to contribute to the 

proper application of this 

Directive in the light of the 

specific characteristics of each 

sector. 

2. The Commission may, for the 

purposes of information, publish 

codes of conduct in the Official 

Journal of the European 

Communities, together with the 

opinion of the Working Party 

provided for in Article 31 on the 

content of the codes and the 

representativeness at Community 

level of the organizations which 

prepared them. The Working Party 

shall seek the views of data 

subjects or their representatives. 

- Ill -

CHAPTER IX 

CHAPTER VI 

SUPERVISORY AUTHORITIES AND 

SUPERVISORY AUTHORITY AND 

NORKING PARTY ON THE PROTECTION 

WORKING PARTY ON THE 

OF PERSONAL DATA 

PROTECTION OF INDIVIDUALS 

WITH REGARD TO THE 

PROCESSING OF PERSONAL DATA 

Article 26 

Article 30 

Supervisory authority 

Supervisory authority 

1. The Member States shall ensure 

1. Each Member State shall designate 

that an independent competent 

an independent public authority to 

authority supervises the 

supervise the protection of 

protection of personal data. The 

personal data. The authority shall 

authority shall monitor the 

be responsible for monitoring the 

application of the national 

application of the national 

measures taken pursuant to this 

provisions adopted pursuant to 

Directive and perform all the 

this Directive and for performing 

functions that are entrusted to it 

all the functions entrusted to it 

by this Directive. 

by this Directive.  Each 

Member State may designate more 

than one supervisory authority. 

- 112 -

2. The authority shall have 

2. Each supervisory authority shall 

investigative powers and effective 

have : 

powers of intervention against the 

- investigative powers including 

creation and exploitation of files 

the right of access to data 

which do not conform with this 

forming the subject-matter of 

Directive. To that end, it shall 

processing operations covered by 

have inter alia the right of 

this Directive and the right to 

access to files covered by this 

collect all the information 

Directive and shall be given the 

necessary for the performance of 

power to gather all the 

its supervisory duties; 

information necessary for the 

- effective powers of intervention 

performance of its supervisory 

such as ordering the blocking or 

duties . 

erasure of data, a temporary or 

definitive ban on processing or 

the destruction of data 

material, or warning the 

controller; 

- the power to bring an action 

before the courts where it finds 

that the national provisions 

implementing this Directive have 

been infringed. 

3. Complaints in connection with the 

3. Each supervisory authority shall 

protection of individuals in 

relation to personal data may be 

lodged with the authority by  any 

individual. 

hear complaints lodged by any 

person concerning the protection 

of persons with regard to the 

processing of  personal data. The 

person concerned shall be informed 

of the outcome of the complaint. 

4. Each supervisory authority shall 

produce an annual report.  The 

report shall be made public. 

- 113 -

5. Member States' authorities shall 

cooperate with one another to the 

extent necessary for  the 

performance of their supervisory 

duties, inter alia by exchanging 

useful information or exercising 

their powers of investigation or 

intervention. 

6. Member States shall provide that 

the supervisory authority, its 

members and its staff are to be 

subject to a duty of confidence. 

Article 27 

Article 31 

Working Party on the Protection 

Working Party on the Protection 

of Personal Data 

of Individuals with regard to 

the Processing of Personal Data 

1. A  Working Party on the Portection 

1. A Working Party on the Protection 

of Personal Data is hereby set up. 

of Individuals with regard to the 

The Working Party, which shall 

Processing of Personal Data, 

have advisory status and shall act 

hereinafter referred to as "the 

independently, shall be composed 

Working Party", is hereby set up. 

of reprc.^ntatives of the 

The Working Party, which shall 

supervisory authorities provided 

have advisory status, shall act 

for in Article 26 of all the 

independently. It shall be 

Member States and shall be chaired 

composed of representatives of the 

by a representative of the 

supervisory authorities provided 

Commission. 

for in Article 30 and of a 

representative of the Commission. 

- 114 -

Where a Member State designates 

more than one supervisory 

authority, those authorities shall 

appoint joint representatives who, 

within the Working Party, shall 

have the same rights and 

obligations as the other 

representatives of the other 

authorities. 

2. The Working Party shall elect its 

chairman.  The chairman's term of 

office shall be two years.  His 

appointment shall be renewable. 

The secretariat of the Working 

3. The Working Party's secretariat 

Party on the Protection of 

shall be provided by the 

Personal Data shall be provided by 

Commission. 

the Commission's departments. 

The Working Party on the 

4. The Working Party shall adopt its 

Protection of Personal Data shall 

own rules of procedure. 

adopt its own rules of procedure. 

The Working Party on the 

5. The Working Party shall consider 

Protection of Personal Data shall 

items placed on its agenda by its 

examine questions placed on the 

chairman, either on his own 

agenda by its chairman, either on 

initiative or at the reasoned 

his own initiative or at the 

request of a representative of the 

reasoned request of a 

supervisory authorities, or at the 

representative of the supervisory 

Commission's request. 

authorities, concerning the 

application of the provisions of 

Community law on the protection of 

personal data. 

- 115 -

Article 2 8 

Article 32 

Tasks of the Working Party on 

Tasks of the Working Party 

the Protection of Personal Data 

1. The Working Party on the 

1. The Working Party shall: 

Protection of Personal Data shall: 

(a) contribute to the uniform 

(a) contribute to the uniform 

application of the national rules 

application of the national 

adopted pursuant to this 

measures taken under this 

Directive ; 

Directive; 

(b) give an opinion on the level of 

(b) give an opinion on the level of 

protection in the Community and 

protection in the Community and 

in third countries; 

in third countries; 

(c) advise the Commission on any 

(c) advise the Commission on any 

draft additional or specific 

proposed amendment of this 

measures to be taken to safeguard 

Directive, on any additional or 

the protection of privacy. 

specific measures to safeguard 

the rights and freedoms of 

natural persons and on any other 

proposed measures affecting such 

rights and freedoms; 

(d) give an opinion on codes of 

conduct drawn up at Community 

level. 

- 116 -

If the Working Party on the 

2. If the Working Party finds that 

Protection of Personal Data finds 

serious divergences are arising 

that significant divergences are 

between the laws or practices of 

arising between the laws or 

Member States concerning the 

practices of the Member States in 

protection of persons with regard 

relation to the protection of 

to the processing of personal data 

personal data which might affect 

and that those divergences might 

the equivalence of protection in 

affect the equivalence of 

the Community, it shall inform the 

protection in the Community, it 

Commission accordingly. 

shall inform the Commission 

accordingly. 

The Working Party on the 

3. The Working Party may, on its own 

Protection of Personal Data may 

initiative, make recommendations 

formulate recommendations on any 

on all matters relating to the 

questions concerning the 

protection of persons with regard 

protection of individuals in 

to the processing of personal data 

relation to personal data in the 

in the Community. 

Community. The recommendations 

shall be recorded in the minutes 

and may be transmitted to the 

Advisory Committee referred to in 

Article 30. The Commission shall 

inform the Working Party on the 

Protection of Personal Data of the 

action it has taken in response to 

the recommendations. 

4. The Working Party's opinions and 

recommendations shall be recorded 

in its minutes and shall be 

transmitted to the Commission; 

they may also be transmitted to 

the advisory committee referred to 

in Article 34. 

- 117 -

5. The Commission shall inform the 

Working Party of the action it has 

taken in response to its opinions 

and recommendations.  It shall do 

so in a report which shall also be 

transmitted to the European 

Parliament and to the Council. 

The report shall be made public. 

4. The Working Party on the 

6. The Working Party shall draw up an 

Protection of Personal Data shall 

annual report on the situation 

draw up an annual report on the 

regarding the protection of 

situation regarding the protection 

natural persons with regard to the 

of individuals in relation to the 

processing of personal data in the 

processing of personal data in the 

Community and in third countries, 

Community and in third countries, 

which it shall transmit to the 

which it shall transmit to the 

Commission, the European 

Commission. 

Parliament and the Council.  The 

report shall be made public. 

- 118 -

CHAPTER Χ 

CHAPTER VII 

RULE-MAKING POWERS OF THE COMMISSION 

RULE-MAKING POWERS OF THE COMMISSION 

Article 29 

Article 33 

Exercise of rule-making powers 

Exercise of rule-making powers 

The Commission shall, in accordance 

The Commission shall, in accordance 

with the procedure laid down in 

with the procedure laid down in 

Article 30 (2), adopt such technical 

Article 34(2), adopt such technical 

measures as are necessary to apply 

measures as are necessary to apply 

this Directive to the specific 

this Directive to the specific 

characteristics of certain sectors 

characteristics of particular sectors 

having regard to the state of the art 

or classes of processing, and the 

in this field and to the codes of 

measures necessary to ensure the 

conduct. 

consistent application of this 

Directive. 

Article 30 

Advisory Committee 

Article 34 

Advisory Committee 

1. The Commission shall be assisted 

1. The Commission shall be assisted 

by a Committee of an advisory 

by a committee of an advisory 

nature composed of the 

representatives of the Member 

States and chaired by a 

representative of the Commission. 

nature composed of the 

representatives of the 

Member States and chaired by a 

representative of the Commission. 

- 119 -

2. The representative of the 

2. The representative of the 

Commission shall submit to the 

Commission shall submit to the 

Committee of draft of the measures 

committee a draft of the measures 

to be taken. The Committee shall 

to be taken.  The committee shall 

deliver its opinion on the draft 

deliver its opinion on the draft 

within a time limit which the 

within a time limit which the 

chairman may lay down according to 

chairman may lay down according to 

the urgency of the matter, if 

the urgency of the matter, if 

necessary by taking a vote. The 

necessary by taking a vote. 

opinion shall be recorded in the 

minutes; in addition, each Member 

The opinion shall be recorded in 

State shall have the right to ask 

the minutes; in addition each 

to have its position recorded in 

Member State shall have the right 

the minutes. The Commission shall 

to ask to have its position 

take the utmost account of the 

recorded in the minutes. 

opinion delivered by the 

Committee. It shall inform the 

The Commission shall take the 

Committee of the manner in which 

utmost account of the opinion 

its opinion has been taken into 

delivered by the committee.  It 

account. 

shall inform the committee of the 

manner in which its opinion has 

been taken into account. 

- 120 -

FINAL PROVISIONS 

FINAL PROVISIONS 

Article 31 

Article 35 

1. The Member States shall bring into 

1. Member States shall bring into 

force the laws, regulations and 

force the laws, regulations and 

administrative provisions 

administrative provisions 

necessary for them to comply with 

necessary to comply with this 

this Directive by 1 January 1993. 

Directive by 1 July 1994. 

The provisions adopted pursuant to 

When Member States adopt these 

the first subparagraph shall make 

provisions, these shall contain a 

express reference to this Directive. 

reference to this Directive or 

shall be accompanied by such 

reference at the time of their 

official publication.  The 

procedure for such reference shall 

be adopted by Member States. 

2. Member States shall set a date 

after which processing operations 

which began before 1 July 1994 

must be compatible with the 

national provisions adopted 

pursuant to this Directive; the 

date set may be no later than 

3 0 June 1997. 

- 121 -

2. The Member States shall 

3. Member States shall communicate to 

communicate to the Commission the 

the Commission the texts of the 

texts of the provisions of 

provisions of national law which 

national law which they adopt in 

they adopt in the field covered by 

the field covered by this 

this Directive. 

Directive. 

Article 32 

Article 36 

The Commission shall report to the 

The commission shall report to the 

Council and the European Parliament 

Council and the European Parliament 

at regular intervals on the 

at regular intervals on the 

implementation of this Directive, 

implementation of this Directive, 

attaching to its report, if 

attaching to its report, if 

necessary, suitable proposals for 

necessary, suitable proposals for 

amendments. 

amendments.  The report shall be made 

public. 

Article 33 

Article 37 

This Directive is addressed to the 

This Directive is addressed to the 

Member States. 

Member States. 

Done at Brussels, 

For the Council 

Done at Brussels, 

For the Council 

The President 

- 122 -

FINANCIAL STATEMENT 

Section 1:  Financial implications 

1.  Title of operation: 

Amended  proposal  for  a  Council  Directive  on 
the protection of  individúale with regard  to 
the  processing  of  personal  data  and  on  the 
free movement of such data 

2.  Budget headings involved 

- 

A 2510:  Expenditure  on  meetings  of  committees whose  consultation is 
compulsory  in  the  procedure  for  drafting  Community 
legislation. 

A 2511:  Expenditure  on meetings  of  committees  whose  consultation is 
not  compulsory  in  the  procedure  for  drafting  Community 
legislation. 

Titles Al and A2: Staff and operating expenditure 

3.  Legal basis 

Article 100a of the EEC Treaty 

4.  Description of operation: 

Objectives : -  to permit the proper functioning of the internal market 
by  ensuring  the free  movement  of  personal data  within 
the Commun ity; 

-  to ensure the  protection of individuals with  regard to 

personal data. 

Setting-up of two bodies responsible for the protection of individuals 
with regard to personal data (Articles 31 and 34). 

Persons concerned: 

1. In the case of  the Working  Party  on the  Protection of  Individuals 
with  regard  to  the  Processing  of  Personal  Data  (Article 31) : 
representatives  of  the  supervisory  authorities  of  all  the 
Member States (Group 4). 

2. In 

the 

case 

of 

the 

Advisory 

Committee  (Article 34): 

representatives of the Member States (Group 3). 

- 123 -

The Advisory  Committee will  be chaired  by  a representative  of the 
Commission.  The chairman of the Working Party on the Protection of 
Personal  Data  will  be  a  member  elected  for  two  years.  The 
secretariat of  the Advisory  Committee  and  of the  Working Party  on 
the  Protection  of  individuals  with  regard  to  the  Processing  of 
Personal Data will be provided by the Commission. 

5.  Classification of expenditure 

5.1  Non-compulsory 

5.2  Non-differentiated 

6.  Type of expenditure 

- 

Costs incurred  by members  attending meetings of  the Working Party and 
the Advisory Committee; 

- 

staff costs. 

7.  Financial impact on appropriations for operations 

None 

8.  What  anti-fraud  measures  are  planned  in  the  proposal  for  the 
operation? 

None 

Section 2:  Administrative expenditure (part A of the budget) 

1.  Will  the  proposed  operation  involve  an  increase  in  the  number  of 

Commission staff?  Yes:  two C-grade officials. 

These  posts  will  be  obtained  either  as  part  of  the  allocation  of 
resources decided  by the Commission on the basis  of future budgets or 
by internal redeployment. 

2.  Amount of expenditure involved: 

Secretariat :  around ECU 120 000 a year charged to the various budget 

headings in Titles Al and A2 (two C officials). 

- 

Meetings of bodies: 

*  Working Party  on the  Protection of  Individuals with  regard to  the 

Processing of Personal Data: 

24 members (non-governmental) χ 4 meetings of 2 days: 

- 124 -

travel expenses:  ECU 526.61 χ 24 χ 4 

= ECU 50 555 

-  allowance for 

travelling time:  ECU 105.40 χ 24 χ 4 
daily expenses: 

= ECU 10 118 
ECU 105.40 χ 24 χ 4 χ 2 = ECU 20 236 

ECU 80 909 

* Advisory Committee 

24 members (governmental) χ 2 meetings of 2 days: 

- travel expenses  : ECU 526.61 χ 24 χ 2 = ECU 25 277 

Rounded total for a full year: 

ECU 120 000 
- secretariat 
- Working Party 
ECU  81 000 
- Advisory Committee  ECU  25 000 

TOTAL ECU 226 000 

Section 3;  Elements of cost-effectiveness analysis 

1.  objective and coherence with financial programming 

Two bodies are to be set up which will be authorized to meet as from 1994. 
They  will  be  included  in  the  list  of  committees  for  the  1994  financial 
programming. 

The  timetable  for  commitment  and  payment  appropriations  (non-compulsory, 
non-differentiated) is as follows: 

Commitment  appropriations  -  Payment  appropriations 

1994 
1995 
1996 
1997 
1998 

ECU 226 000 
ECU 226 000 
ECU 226  000 
ECU 226 000 
ECU 226 000 

The appropriations  are to  be obtained  from the  various  headings of  part A 
under the general budgetary procedure. 

2.  Grounds for the operation 

(a)  The Working Party  on the Protection of Individuals with regard to the 

Processing of Personal Data (Article 31) 

This Working Party has advisory status and will act independently.  It 
will be  composed of  representatives of the  supervisory authorities  o 
all the Member States. 

- 125 -

It  will  adopt  its  own  rules  of  procedure.  The  Working  Party's 
secretariat will be provided by the Commission. 

Tasks  of  the  Working  Party:  see  Article 32.  It  will  advise  the 
Commission on any proposed  additional measures by  giving a completely 
independent  opinion  (a  fundamental  principle  in  the  protection  of 
privacy). 

3.  Monitoring and evaluation of the operation 

3.1  Indicators :  analysis  of  the  annual  report  presented  by  the  Working 

Party pursuant to Article 32(6). 

3.2  Details and frequency:  each year on the basis of the  above-mentioned 

report to be presented by the Working Party. 

3.3  The  main  factors  of  uncertainty  will  concern  the  difficulties  of 
harmonizing the different  approaches and degrees of  experience in the 
Member States.  These differences stem from various factors, e.g. of a 
cultural or technical nature. 

- 126 -

IMPACT ASSESSMENT FORM 

THE IMPACT OF THE PROPOSAL ON BUSINESS AND ON OTHER 
BODIES CONCERNED, WITH SPECIAL REFERENCE TO SMALL AND 
MEDIUM-SIZED ENTERPRISES (SMES) 

Title of proposal : Amended  proposal  for  a  Council  Directive  on  the 
protection of individuals with regard to the processing 
of personal data and on the free movement of such data 

Reference number: 

THE PROPOSAL 

1.  Taking  account  of  the  principle  of  subsidiarity,  why  is  Community 

legislation necessary in this area and what are its main aims? 

Flows of  personal data  between bodies  operating  in the various  spheres of 
economic  and  social  activity  in  the  Member States  and  the  processing  of 
such  data  by  those  bodies  are  expanding  rapidly  precisely  because  of  the 
completion of the internal market: 

- 

flows between private or public enterprises; 
flows between units which are legally part of the same enterprise; 
flows  between  national  administrations  required  to  provide  mutual 
assistance under various community instruments; 
flows to medical research centres, etc. 

The major  differences that exist  between national  laws (it being borne  in 
mind  that  four  Member States  still  have  no  specific  laws  on  data 
protection:  Belgium, Greece, Italy and Spain) give rise to: 

obstacles  to the  free movement of  personal data,  particularly  in the 
case of  flows to a  Member State with no specific  laws on the matter, 
given  that  the  aim  of  legislation  in  this  area  is  to  protect 
fundamental  rights  and  freedoms,  particularly  the  privacy  of 

individuals ; 

distortions  in  competition  between  businesses  in  the  Community,  in 
that some are  subject to protective legislation  while others are  not, 
depending on the Member State in which they are established. 

Moreover,  the  introduction  of  rules  on  data  protection  is  likely  t 
encourage  the  development  of  the  information  market  through  the  legal 
certainty that these rules provide for the bodies concerned. 

- 127 -

Action  by  the  Community  is  therefore  of  fundamental  importance.  It must 
take the form of an approximation of national  laws.  The Council of Europe 
Convention of 2 8 January 19 81 for the protection of individuals with regard 
to  automatic  processing  of  personal  data,  the  only  instrument  of 
international  law  in this  area,  leaves  open  a wide  range  of  options  for 
applying the  principles that  it sets out  and does  not, therefore, allow a 
sufficient degree of harmonization for the internal market. 

THI;  IMPACT  ON  BUSINESS,  PUBLIC  AUTHORITIES  AND  OTHER  BODIES,  INCLUDING 
FOUNDATIONS AND ASSOCIATIONS 

2.  who will be affected by the proposal? 

The  proposal covers, regardless  of  size or  sector of  activity, all  public 
and  private  enterprises,  public  administrations  whose  activities  are 
governed  by  Community  law,  and  foundations  and  non-profit-making 
associations in so far as such bodies process  personal data (management of 
suppliers  and  customers,  personnel  management,  management  of  members  or 
correspondents  of  associations  and  foundations,  processing  by  bodies  of 
data  on  persons  under  their  administration,  provision  of  information  on 
individuals). 

However, as the consultations referred to in point 6 have shown, the areas 
of industry which will be particularly concerned by the application of this 
Directive are businesses  and bodies in the service sector whose activities 
are  aimed  at  individuals  and  are  based  on the  processing  of  information: 
direct  marketing  companies,  financial  institutions,  insurance  companies, 
credit-rating agencies. 

3.  What will business have to do to comply with the proposal? 

Businesses  will  have  to  introduce  decision-making  and  organizational 
procedures  that,  depending  on  the  structure  and  size  of  the  concern, 
involve the head  of data  processing and  organization, the department using 
such  technologies,  the  legal  service  and  the  head  of  the  organization. 
Where  new  ways  of  processing  personal  data  are  being  designed  the 
organization must, prior to the investment stage: 

- 

check that the proposed forms of data processing are lawful; 

- 

specify  the  information  to  be  given  to  data  subjects.  Such 
information  could  be  provided  on  the  occasion  of  the  usual contacts 
between the  person  in charge of  processing (controller) and  the data 
subjects ; 

provide  for  the  technical  and  organizational  measures  necessary  to 
guarantee the security of data and processing; 

- 128 -

make sure  of the  notification procedure  applicable.  After collecting 
the  necessary  elements  of  information, the  controller  will  establish 
that  no  notification  is  necessary,  will  carry  out  a  simplified 
formality or will make up a file. 

The controller must  also ensure that a procedure is in place to handle any 
requests  for  right of  access  by  data subjects  to data  concerning them  as 
well  as  possible  complaints,  and  take  steps  to  monitor  the  proper 
functioning of security measures. 

These  tasks  are  to  be  carried  out  in  the  course  of  new  processing 
operations  and can  therefore be  planned in  line with  progress in  devising 
the technical processing procedures. 

In  the  case  of  processing  operations  carried  out  before  the  entry  into 
force  of  national  provisions  taken  in  pursuance  of  the  Directive,  such 
tasks  may  be  planned  over  a  period  of  three  years,  as  laid  down  in  the 
Directive. 

In  the  case  of  bodies  established  in  Member States  which  already  have 
legislation  in  this  area,  the  measures  required  by  the  Directive  do  not 
differ in nature from those already implemented. 

In the case  of  bodies established  in  Member States which do  not have  such 
legislation,  methods  must  be  devised  although  the  competent  supervisory 
authorities may be  a great help during the launch phase (advice, simplified 
notification procedure for certain processing operations, etc.). 

4.  What economic effects is the proposal likely to have? 

Protection  of  individual  privacy,  as  guaranteed  by  the  Directive,  will 
increase  social  acceptance  of  the  use  of  the  various  ways  of  processing 
personal  data  and  hence  acceptance  of  their  development,  this  being  a 
factor which will promote growth and job creation in the private and public 
sectors. 

Moreover,  these  rules  on  protection  are  such  as  to  eliminate  the 
distortions  of  competition  arising  from  the  present  differences  between 
national  laws.  As  regards  international  competitiveness,  the  Directive 
provides  for  negotiations  with  third  countries  which  are  still  unable  to 
guarantee an adequate level of protection. 

5.  Does  the  proposal  contain  measures  to take  account  of  the  specific 

situation of small and medium-sized firms? 

No.  However,  it  is  reasonable  to  assume  that  most  processing  operations 
carried out by SMEs will fall into those categories which, depending on the 
system  proposed,  could  be  exempted  from  the  notification  requirement  or 
could  benefit  from  a  simplified  procedure  (with  completion  of  these 
formalities  not  involving  more  than  a  few  hours'  work) .  Moreover,  the 
Directive  does not  provide  for  any  fee for  the completion of  notification 
formalities. 

- 129 -

CONSULTATION 

6.  List the  organizations  which  have  been  consulted  about  the  proposal 

and outline their main views 

(a)  Interested  parties  were consulted  primarily  through  the  Economic  and 
Social  Committee,  which  gave  a  favourable  opinion  on  the  proposal 
(OJ No C 159  of  17 June 1991,  p. 38),  and  through  the  Committee  on 
Commerce  and  Distribution  (CCD)  and  the  Consumers  Consultative 
Committee. 

(b)  As  regards  the  amended  proposal,  direct  corcacts  were  held,  at  the 
initiative  of  the  Commission  departments  or  business  interests 
concerned, with  European  business  associations with  regard  to either 
the  horizontal  nature  of  the  proposal  (UNICE)  or  the  sectors  most 
affected,  including  the  Banking  Federation, CELD,  FEWITA, GEDIS, the 
European 
CHANGE 
Direct 
(non-profit-making  bodies),  the  European  Society  for  Opinion  and 
Marketing Research, ACT, EPC, ENPA, CAEJ, EBU and FAEP (for the press 
and audiovisual aspects). 

Marketing, 

Federation 

EAT, 

for 

The main points raised by the business associations concerning the original 
proposal were: 

- 

proposal too detailed; 

predominance  of  the  data  subject's  consent  as  a  condition  for  the 
processing of personal data; 

- 

exclusion  of  any  possibility  of  computerized  decision  and  the 
preparation of profiles; 

onerous  and  inappropriate  obligations  with  regard  to  informing  the 
data subject and notifying the supervisory authorities; 

impossibility  of  conducting  international  trade  with  third  countries 
not guaranteeing an adequate level of protection; 

- 

risk  to  freedom  of  expression  if  some  Member States  do  not  proceed 
with the derogations  necessary to reconcile the rules on the exercise 
of that freedom with those on the protection of privacy. 

The  amended  proposal  has  attempted  to  clarify  or  adapt  the  text  where 
necessary  while  continuing  to  pursue  the  objective  of  a  high  level  of 
protection, without which free movement would not be possible. 

130  -

ISSN 0254-1475 

CO M (92) 422 final 

DOCUMENTS 

EN 

on 

Catalogue number : CB-CO-92-437-EN-C 

ISBN 92-77-47942-6 

Office for Official Publications of the European Communities 
L-2985 Luxembourg