Amended proposal for a EUROPEAN PARLIAMENT AND COUNCIL DIRECTIVE on the protection of individuals with regard to the processing of personal data and on the free movement of such data
Date: 1995-07-18
Institutions: European Commission
Subjects: confidentiality, cross-frontier data flow, disclosure of information, fundamental rights, personal data, protection of privacy

COMMISSION OF THE EUROPEAN  COMMUNITIES 

Brussels,  18.07.1995 
COM(95) 375 final-COD287 

OPINION  OF THE  COMMISSION 
pursuant  to  Article  189 b (2) (d) of the EC Treaty, 
on  the European  Parliament's  amendments 
to the Council's  common  position  regarding  the 

proposal  for  a 
EUROPEAN  PARLIAMENT  AND COUNCIL  DIRECTIVE 

on the protection of individuals with regard to the processing of 
personal data and on the free movement of such data 

AMENDING THE PROPOSAL  OF THE  COMMISSION 
pursuant to Article  189 a (2) of the EC Treaty 

>slra§slIP 

mm 

•£83» 

/••.••£5$fe 

1. BACKGROUND 

(a)  On  27 July  1990  the  Commission  presented  to  the  Council  a  proposal  for  a 

Directive (COM(90) 314 final - SYN 287).l 

(b)  On 24 April  1991 the Economic and Social Committee delivered its opinion ^ 

(c)  On  11 March  1992 Parliament  delivered  its opinion (first  reading) and adopted  a 
resolution  endorsing  the  Commission  proposal,  subject  to  a  large  number  of 
amendments. 

(d)  On  15 October  1992  the  Commission  adopted  an  amended  proposal  for  a 
Directive  pursuant  to  Article  149(3)  of  the  EEC Treaty  (COM(92)422 final -
SYN 287)  4 

(e)  On 20 February  1995 the Council adopted a common position. 

(f)  On  24 February  1995 the  Commission  transmitted  to  Parliament  its  opinion  on 

this common position (SEC(95) 303 final - COD 287). 

(g)  On  15 June 1995  Parliament  approved  (second  reading)  seven  amendments  to 

the common position. 

2.  PURPOSE OF THE COMMISSION PROPOSAL 

The proposal  for  a Directive  seeks to facilitate  the free movement  of data within the 
Community  by  affording  individuals  a  high  level  of  protection  with  regard  to  the 
processing of personal data.  Harmonization  of the relevant  national laws has proved 
necessary  because  of  the  wide  divergences  between  them  and  of  data-exchange 
requirements imposed by completion of the internal market. 

The  White Paper  "Growth,  competitiveness,  employment"  and  the  Bangemann 
group's report  "Europe and the global information  society" underscored  the need  for 
the Directive  as a regulatory measure within the clear,  stable legal framework that is 
essential if the information  society is to develop along lines acceptable to the citizens 
of Europe. 

The  proposal  for  a Directive  lays down  common  ground  rules for  the  protection  of 
individual rights with regard to the processing of personal data. 

The  high-level  protection  is  afforded  through  the  obligations  imposed  on  data 
controllers (for example, public authorities, enterprises and associations) and through 
the rights conferred  on the individuals whose data are processed. 

The  obligations  on  controllers  relate,  for  example,  to  the  quality  of  the  data -  the 
processing  of  which  must  meet  a  specific  and  legitimate  purpose -  to  security 
requirements and to the notification  of such processing to an independent  supervisory 
authority to be set up by the Member States. 

OJNoC277, 5.11.1990, p. 3. 
OJNoC159, 17.6.1991, p. 38. 
OJ No C 94, 13.4.1992, p. 76; OJ Annex, Debates of the European Parliament, No 3/416, p.  133. 
OJ No C 311, 27.11.1992, p. 30. 
OJNoC93, 13.4.1995, p. 1. 

2 

The  right  to  be  informed  under  certain  circumstances  about  the  processing  of  data 
relating to them, the right  of access to  such data and the right to  ask for  them to be 
corrected  if they  are inaccurate  and  even  to  object  to  their  processing  are the  main 
rights conferred  on individuals by the proposal. 

3.  COMMISSION OPINION ON PARLIAMENT'S AMENDMENTS 

1.  The  seven  amendments  put  forward  by  Parliament  are  acceptable  to  the 

Commission. 

2.  Five  of  them,  which  relate  to  the  substance  of  the  proposal,  make  useful 

clarifications to the text. 

Amendment  No  1  incorporates  into  the  41st  recital  a  specific  reference  to 
business  confidentiality  as  grounds  for  possibly  limiting  an  individual's  right  to 
know the logic involved in the automatic processing of data concerning him. 

Amendment  No 3  provides  in  Article 2(d)  for  the  possibility  that  for  a  single 
processing  operation  a number of parties may jointly determine the  purpose and 
means of the processing to be carried out. 

It  follows  from  this  that,  in  such  a  case,  each  of  the  co-controllers  must  be 
considered  as being constrained by the obligations imposed by the directive so as 
to protect the natural persons about whom the data are processed. 

Amendment No 4 is intended to  make it clear in Article 3(2) that  the processing 
of  personal  data  carried  out  for  the  "economic  well-being  of  the  State"  is 
excluded  from  the  scope  of  the  Directive  where  that  operation  relates  to 
questions of State security. 

In order to do this, amendment No 4 adopts the wording used in the  13th recital 
of the common position. 

Amendment  No 5  incorporates  into  Article 9  a  clarification  to  the  effect  that 
Member States will have to provide for exemptions or derogations  "only" if they 
are necessary to reconcile the right to privacy with the  rules governing freedom 
of expression. 

Amendment No 6 is designed to clarify the point that transfers which are "legally 
required"  on  important  public interest  grounds  escape  application  of the  normal 
rule  that  the  third  country  of  destination  must  ensure  an  adequate  level  of 
protection to enable such transfers to take place. 

Although  it  is  not  specified  in  certain  language  versions  of  the  text,  it  seems 
evident that  such a transfer  could only be considered  as legally required  where a 
legal  act  of  a  public  authority  applies,  notably  a  law  passed  by  the  national 
parliament.  On the contrary a simple contractual  agreement  could  not  serve as a 
basis for such a transfer. 

3.  The remaining two amendments concern the Commission's implementing powers. 

Amendment No 2 introduces a reference to the "modus vivendi" agreed between 
Parliament, the Council and the Commission on 20 December  1994. 

Amendment No 7 is designed to replace the Ilia regulatory committee with a lib 
management committee. 

A  management  committee  is  fully  consistent  with  the  nature  of  the  powers 
conferred  on the committee by the Council common position.  Those powers are 
limited  to  transfers  to  third  countries:  they  cover  the  appraisal,  based  on  the 
criteria  set  out  in Article 25(2),  of whether  or  not  there  is an adequate  level  of 
protection  in  third  countries  (Article 25(3)  and  (6))  and  the  adoption  of 
appropriate  measures  to  authorize  transfers  to  third  countries  not  having  an 
adequate level of protection (Article 26(3) and (4)). 

It  should  also be pointed  out  that  there  is no  major  difference  between  the  Ilia 
committee  and  the  lib  committee  in  terms  of  powers  available  to  the 
Commission.  The difference  between the two procedures is essentially formal: in 
one case (Ilia), the Council decides on the basis of a Commission proposal, while 
in  the  other  (lib)  it  amends  a  decision  which  has  already  been  taken  by  the 
Commission  but  whose  effects  are  suspended.  However,  the  lib  procedure  is 
quicker  since  it  obviates the  need  for  a new procedure  within the  Commission: 
the  Commission's  decision  simply  takes  effect  once  the  period  allowed  the 
Council has expired. 

The Commission very much hopes that the Council will also be convinced by this 
procedural efficiency  aspect of the matter, which is important for the decisions to 
be taken. 

Amended proposal for a 

t. 

EUROPEAN PARLIAMENT AND COUNCIL DIRECTIVE 

on the protection of individuals with regard to the 
processing of personal data and on 
the free movement of such data 

(presented by the Commission pursuant to 
Article 189a(2) of the EC Treaty) 

Common position of the Council 

Amended Commission proposal 

Recital 41 

logic 

Whereas  any  person  must  be  able  to 
exercise the right of access to data relating 
to him which are being processed,  in order 
to  verify  in  particular  the  accuracy  of the 
data  and  the lawfulness  of the  processing; 
whereas,  for  the same reasons,  every  data 
subject  must  also  have  the  right  to  know 
the  automatic 
the 
processing of data concerning him, at least 
in the case of automated decisions  referred 
to in Article  15(1); whereas this right must 
not  adversely  affect  intellectual  property 
and  in  particular  the  copyright  protecting 
the software;  whereas these considerations 
must  not,  however,  result  in  the  data 
subject being refused  all information; 

involved 

in 

logic 

involved 

Whereas  any  person  must  be  able  to 
exercise the right of access to data relating 
to him which are being processed,  in order 
to  verify  in particular  the  accuracy  of  the 
data and  the lawfulness  of the  processing; 
whereas,  for  the same reasons,  every  data 
subject  must  also  have  the  right  to  know 
the  automatic 
the 
processing of data concerning him, at least 
in the case of automated  decisions referred 
to in Article  15(1); whereas this right must 
business 
not 
confidentiality  or  intellectual  property  and 
in  particular  the  copyright  protecting  the 
software;  whereas  these  considerations 
must  not,  however,  result  in  the  data 
subject being refused  all information; 

adversely 

affect 

in 

Common position of the Council 

Amended Commission proposal 

Recital 66a (new) 

between 

Whereas  an  agreement  on  a  "modus 
European 
the 
vivendi" 
Parliament, 
the 
and 
the  Council 
Commission  concerning  the  implementing 
measures  for  acts  adopted  in  accordance 
with  the  procedure  laid  down  in  Article 
189B of the EC Treaty was reached on 20 
December  1994. 

Common position of the Council 

Amended Commission proposal 

Article 2(d) 

d)  "controller"  shall  mean  the  natural  or 
legal  person,  public  authority,  agency 
or  any  other  body  which  determines 
the  purposes  and  means  of 
the 
processing  of  personal  data.  Where 
the purposes and  means of processing 
are  determined  by  national  or 
Community  laws  or  regulations,  the 
controller  or  the  specific  criteria  for 
his nomination may be designated by a 
national or Community law; 

d)  "controller"  shall  mean  the  natural  or 
legal  person,  public  authority,  agency 
or  any  other  body  which  alone  or 
jointly  with  others  determines  the 
purposes and means of the  processing 
of personal  data.  Where  the  purposes 
and  means  of 
are 
determined by national or  Community 
laws  or  regulations,  the  controller  or 
the specific  criteria for  his nomination 
may  be  designated  by  a  national  or 
Community law; 

processing 

Common position of the Council 

Amended Commission proposal 

Article 3(2), first indent 

in the course of an activity which falls  -
outside the  scope  of Community  law, 
such as those provided for by Titles V 
and  VI  of  the  Treaty  on  European 
Union  and  in  any  case  to  processing 
operations  concerning  public security, 
defence,  State  security  (including  the 
economic well-being of the State) and 
the  activities  of  the  State  in  areas  of 
criminal law; 

in the course of an activity which falls 
outside the  scope of Community  law, 
such as those provided for by Titles V 
and  VI  of  the  Treaty  on  European 
Union  and  in  any  case  to  processing 
operations  concerning public security, 
defence,  State  security  (including  the 
economic  well-being  of  the  State 
is 
when  the  processing  operation 
bound  up  with  questions  of  State 
security) and the activities of the State 
in areas of criminal law; 

Common position of the Council 

Amended Commission proposal 

Article 9 

shall 

shall 

States 

States 

for  Member 
the  exemptions  or  derogations 

for 
Member 
provide 
the 
exemptions  or  derogations  from 
provisions of this Chapter, Chapter IV and  provisions of this Chapter, Chapter IV and 
Chapter  VI for  the processing  of personal  Chapter  VI for  the processing  of  personal 
data  carried  out  solely  for  journalistic  data  carried  out  solely  for  journalistic 
purposes  or  the  purpose  of  artistic  or  purposes  or  the  purpose  of  artistic  or 
literary  expression  which  prove  necessary 
they  are 
to  reconcile  the  right  to  privacy  with  the  necessary to  reconcile the right to  privacy 
the  rules  governing  freedom  of 
rules governing freedom  of expression. 

literary  expression  only 

provide 
from 

if 

with 
expression. 

10 

Common  position  of the  Council 

Amended Commission  proposal 

Article 26(1) (4) 

4) 

the transfer  is necessary  on important  4) 
public  interest  grounds,  or  for  the 
establishment,  exercise  or  defence  of 
legal claims, or 

the  transfer  is  necessary  or  legally 
required  on  important  public  interest 
grounds,  or  for  the  establishment, 
exercise or defence of legal claims, or 

tt 

Common position of the Council 

Amended Commission proposal 

Article 31(2), third, fourth and fifth subparagraphs 

The Commission  shall adopt the measures 
envisaged  if  they  are  in  accordance  with 
the opinion of the committee. 

the  opinion  of 

If  the  measures  envisaged  are  not  in 
the 
accordance  with 
committee or if no opinion is delivered the 
Commission  shall,  without  delay,  submit 
to  the  Council  a  proposal  relating  to  the 
measures  to  be  taken.  The  Council  shall 
act by a qualified  majority. 

The  Commission  shall  adopt  measures 
which  shall  apply  immediately.  However, 
if  these  measures  are  not  in  accordance 
with  the  opinion  of  the  committee,  they 
shall be communicated  by the Commission 
to the Council forthwith.  In that event: 

The Commission  shall defer  application of 
the  measures  which  it  has  decided  for  a 
period  of  three  months  from  the  date  of 
such communication. 

If within three months  of the referral  to  it 
the  Council  has  not  acted,  the  proposed 
measures 
the 
Commission 

shall  be  adopted  by 

The  Council,  acting  by  a  qualified 
majority,  may  take  a  different  decision 
within  the  time  limit  referred  to  in  the 
previous subparagraph. 

12 

ISSN 0254-1475 

COM(95) 375  final 

DOCUMENTS 

EN 

08  16 

Catalogue number  : CB-C0-95-397-EN-C 

ISBN 92-77-92142-0 

Office for Official Publications of the European Communities 

L-2985 Luxembourg