Opinion of the Economic and Social Committee on the 'Proposal for a Regulation of the European Parliament and of the Councilon the protection of individuals with regard to the processing of personal data by the institutions and bodies of the Community and on the free movement of such data'
Date: 1999-12-08
Institutions: European Economic and Social Committee
Subjects: EU control, data processing, disclosure of information, personal data, protection of privacy

C 51/48

EN

Official Journal of the European Communities

23.2.2000

Opinion of the Economic and Social Committee on the ‘Proposal for a Regulation of the European
Parliament and of the Councilon the protection of individuals with regard to the processing of
personal data by the institutions and bodies of the Community and on the free movement of
such data’

(2000/C 51/13)

On 29 September 1999 the Council decided to consult the Economic and Social Committee, under
Article 262 of the Treaty establishing the European Community, on the above-mentioned proposal.

The Section for Employment, Social Affairs and Citizenship, which was responsible for preparing the
Committee’s work on the subject, adopted its opinion on 12 November 1999 (rapporteur working alone:
Mr Retureau).

At its 368th plenary session (meeting of 8 December 1999), the Economic and Social Committee adopted
the following opinion with 117 votes in favour and two abstentions.

1. Legal basis, content and scope of the proposal

1.5.
The present proposal for a regulation is designed to
attain this twin objective (rather later than the application date
provided for in the EU Treaty).

1.1.
The legal basis and reasons for the proposal for a
regulation are clearly explained. The purpose is to apply
Directive 95/46/EC (1) of 24/10/1995 to the processing and
transmission of personal data by European Community bodies
and institutions.

1.2.
Community institutions and bodies, and the Com-
mission in particular, handle personal data as part of their
everyday work. The Commission exchanges personal data with
Member States in implementing the common agricultural
policy and the Structural Funds, in administering the customs
union and in pursuing other Community policies.

1.3. When Directive 95/46/EC was adopted, the Com-
mission and the Council undertook to comply with it and
called upon the other Community institutions and bodies to
do likewise (public declaration issued on 24 October 1995).
In practice, the Directive has already been applied in the
Community institutions since that date.

Since the Amsterdam Treaty came into effect, the
1.4.
Treaty establishing the European Community contains a
specific provision, Article 286, providing that from 1 January
1999 Community institutions and bodies set up by the EC
Treaty must apply the Community rules on the protection of
personal data set out essentially in Directive 95/46/EC and
Directive 97/66/EC (2). It also provides for the application of
these rules to be monitored by an independent supervisory
body, set up in accordance with the procedure referred to in
Article 251. This is the most important innovation in the
proposal for a regulation.

(1) OJ L 281, 23.11.1995, p. 31.
(2) OJ L 24, 30.1.1998, p. 1.

However, some key questions are difficult to assess in

1.6.
the proposal as it now stands.

1.7.
For example, with regard to defining the Community
institutions and bodies concerned by the regulation: looking at
the list provided in an annex to the proposal, Europol
is
evidently excluded from the proposed provisions. What is the
situation, for example, with the IT network of Schengen and
its own supervisory authority: should they remain separated,
or could they not be merged? The same considerations apply
to the other third-pillar bodies.

Another important point is that although officials and
1.8.
other people employed by Community bodies and institutions
are covered by the proposal, the link between the proposed
provisions and the Staff Regulations of the European Union
officials is not very apparent (although involvement of the
Staff Committees is provided for in an annex). Have staff
representatives been consulted? Processing of personal data
relating to staff should surely be subject to separate special
provisions to protect
the privacy and rights of people
employed by the Communities as effectively as possible,
starting at the moment when the application form is completed
and continuing throughout the person’s career or for the
length of the contract and whenever it is renewed.

1.9.
Finally, the proposal covers only individuals, reflecting
the limitations of the 1995 directive, which excludes de facto
or de jure legal persons, who are however affected by collection
and processing of data. Nevertheless, we would point out that
legal persons are affected by the 1995 directive in so far as
they handle or hold personal data relating to natural persons.
The present proposal concerns only the handling and trans-
mission by the Community institutions of data that may relate
to natural or legal persons, whereas the safeguards envisaged
apply only to natural persons.

23.2.2000

EN

Official Journal of the European Communities

C 51/49

2. General comments

2.1.
The Council, which naturally has every right to set a
deadline for the submission of opinions, has set a very early
deadline for the ESC to present this opinion on a proposal for
a regulation that is complex and important because it concerns
the protection of human rights in relation to the processing
and transmission of personal data.

The Committee would have liked more time so that
2.1.1.
it could participate more closely in a legislative process based
on co-decision that affects many of the members of economic
and social organisations which it represents.

2.2.

The Committee has already issued an opinion(1) on:

a)

two Council proposals for a Directive concerning:

— protection of individuals in relation to the processing

of personal data

— protection of personal data and privacy in the context

of public digital telecommunications networks;

b) and a proposal for a Council Decision in the field of

information security.

2.3.
The general principles regarding the processing of
personal data and essential guarantees to protect individual
rights and the right to privacy that were set out by the
Committee in the above opinion are still valid and relevant to
the present proposal for a regulation. They comply with
Council of Europe Convention No. 108 (2), which should be
used to help evaluate the proposal
for a regulation in
conjunction with legislation and practice in the Member States
and with the 1995 Directive.

2.3.1.
The Committee urges the Council to refer to the
principles and proposals set out in its 1991 opinion and the
present opinion, and to take them fully into consideration in
order to improve on the 1995 Directive as far as possible, with
due regard to the constraints imposed by the legal basis, and
at least to bear them in mind when re-examining the Directive
for possible revision by 2001.

2.3.2.
The Committee believes that the Community insti-
tutions and bodies must offer maximum protection and

(1) Rapporteur: Mr Salmon, opinion published in OJ C 159,

17.6.1991, p. 38

(2) Council of Europe (ETS No. 108) Conventionfor the protection of
individuals with regard to the automatic processing of personal
data. All
the current Member States have now ratified this
convention; most of the applicant countries have not.

guarantees when processing personal data, on the basis of the
most advanced international standards and national legislation
and the best practices in the Member States. The aim should
be to set an example and to promote harmonised progress,
especially since the proposal concerns not only the processing
but also the free movement of data and of the information
obtained from processing it both within and outside the EU.

The rapid growth in information and communication
2.4.
technologies, the improved facilities for long-term storage of
data on different media, the growing sophistication of pro-
cessing and interconnection techniques, and the development
of information transmission and access systems make it all the
more necessary to improve protection and guarantees for the
people concerned, while respecting the principle of free data
movement.

However,

2.4.1.
these technological developments also
provide new ways of protecting against unauthorised access,
ensuring secure transmission and safeguarding privacy and the
exercise of individual rights, including people’s right to access,
correct and oppose the use or transmission of data relating to
them. First and foremost, it is the state-of-the-art that should
be taken into consideration rather then the cost, unless the
cost of introducing new techniques is disproportionately high
in relation to the level of security to be provided.

2.4.2.
Protecting people’s rights and providing them with
guarantees must be an integral part of the process of designing
instruments and methods for collecting, processing, using and
transmitting data; any person involved at these various levels,
from data collection to final use, must meet strict competence
and confidentiality requirements, and if any of these are
breached, sufficiently deterrent penalties must be imposed.
The proposal essentially makes provisions along these lines,
and the Committee considers it to offer considerable protection
overall, providing guarantees and possibilities for administrat-
ive and legal access and appeal that are generally satisfactory.

Progress has been made since the 1995 Directive,
2.4.3.
e.g. regarding the right of access to data, and the transposition
provisions are precise and clear, e.g. the definition of sensitive
data and data that may not be handled, the exact definition of
what constitutes an ‘adequate’
level of protection for the
transmission of data to countries or bodies not covered by the
1995 Directive, the inclusion of all possible forms of data
processing, or the establishment of independent supervisory
bodies in each of the Community institutions and bodies
(permitting a priori monitoring of rights and freedoms and of
privacy, which provides better protection than a posteriori
monitoring).

C 51/50

EN

Official Journal of the European Communities

23.2.2000

2.4.4.
Certain provisions should nevertheless be improved,
although the Committee is aware that the Commission’s
the 1995
proposal may not overstep the framework of
Directive, of which the Committee has already highlighted
certain shortcomings. For instance, there should be specific
protective provisions for legal persons, or even entities without
legal personality, e.g. with regard to confidentiality and respect
for corporate image in the case of companies. Such protection
should be provided at all events, and measures should be taken
to find the right ways of achieving it. The proposed provisions
on the independent supervisory bodies, over which the Council
and European Parliament have complete legislative power
should also be improved.

tackled separately, with separate monitoring standards and
bodies, albeit on the basis of common principles. Such
protection must also be introduced in the sphere of judicial
cooperation, where it is not yet envisaged. This would also
mean attaching additional protocols to the above agreements.

Thus on the basis of these general comments and
2.9.
bearing in mind all the new factors and developments that
have taken place since its previous opinion, the Committee,
while noting that there have been many positive and interesting
initiatives, would like to make some more precise and detailed
suggestions and recommendations, given in the order of the
proposal’s chapters and annexes.

2.5.
The Committee thinks that all the measures envisaged,
from data collection to data processing and transmission,
should relate to purposes strictly defined and checked before-
hand that must meet the lawfulness criteria correctly set out in
the proposal, and should be essential to the activities of the
institutions and bodies responsible.

2.6.
The Committee thinks there should be a separate
chapter devoted to protection of the personal data and privacy
of staff employed by Community institutions and organs. This
chapter should at least give the future European Supervisor the
power, after consultation with staff organisations, to stipulate
questions that should not be asked at the time of recruitment
(e.g. on health), to prevent women being asked whether they
are pregnant, and to specify what each individual dossier may
contain. It would be a good idea here to refer to the ILO’s code
of practice on protection of workers’ personal data and ILO
Recommendation No. 171 on Occupational Health Services
(1985).

2.7. With regard to the Community institutions and bodies
concerned, the Committee notes that the proposal effectively
covers the whole Community sphere, and it therefore agrees
with the interpretation of Treaty Article 286, i.e. that the
proposal applies to all the institutions. A restrictive interpret-
ation, which for instance excluded Euratom or the ECSC from
the scope of the proposal, would have been absurd and
contrary to the objectives pursued.

2.8.
However, given the gradual incorporation of the third
pillar (which is not covered by the 1995 Directive) into the
Community system and the need for a horizontal instrument
for data collected, processed and transmitted in the framework
of judicial and police cooperation, the Committee suggests
that the remit of the European Data Protection Supervisor be
broadened to immediately include the Schengen information
system and to gradually include all the third-pillar agreements
in which data protection is currently seen as an issue to be

3. Specific comments and recommendations

3.1.
Article 2 (c), Definitions. The filing system is defined
as a ‘structured set of personal data’. Data does not have to be
structured in order to be processed and used; it would thus be
enough to refer to ‘a set of personal or individual data’.

3.2.
Article 4 (d), Data quality. Every reasonable step
must be taken to ensure that data which are inaccurate or
incomplete, having regard to the purposes for which they were
collected ...This should read ‘every possible step’.

3.2.1.
Article 5 (d), Lawfulness of processing. The Com-
mittee agrees with the lawfulness criteria, but thinks that the
proposal should refer to ‘informed consent’ here.

3.3.
Article 6, Further processing. When processing is
carried out for other than the original purpose, those con-
cerned should be informed in advance of this possibility when
the data is collected or when the new decision is taken.

3.4.

Article 9, Transfer of personal data.

3.4.1.
Paragraphs 1 to 4: when data is to be transmitted to
people or bodies that are not subject to Directive 95/46/EC or
to a country that has not ratified Council of Europe Convention
No. 108, measures should be taken in advance to ensure that
the level of protection is equivalent, not
‘adequate’
(although this is the wording of the Directive). The Committee
notes, however, that the practical provisions for ensuring
matching levels are highly protective.

just

3.4.2.
Paragraphs 5 and 6: the European Data Protection
Supervisor (EDPS) should be informed in advance of cases
where there has been a derogation, so that objections can be
raised if necessary.

23.2.2000

EN

Official Journal of the European Communities

C 51/51

3.5.
Article 10(1), Prohibited processing. The wording goes
further than that of Article 6 of Council of Europe Convention
No. 108, except with respect to data on criminal convictions,
which is treated more restrictively in Article 10(5) (though
processing of such data is not absolutely prohibited). The
Committee would prefer a more detailed wording, as follows:
‘The processing of personal data revealing racial or ethnic
origin, political opinion, religious or philosophical beliefs, and
more generally any belief or opinion not defined as criminal
under international
law, trade-union membership, and the
processing of data concerning health, genetic heritage, or sex
life, shall be prohibited.’ Although genetic heritage can be
understood as an aspect of health, the wording on prohibited
processing should no doubt be reviewed if the Directive is
amended.

3.6.
Article 17, Notification to third parties. The possibility
of exemption from the requirement to notify changes or
blocking is too vague and too broad in scope.

10 % in more exceptional cases), and the means placed at their
disposal, seem limited. These officers must be given sufficient
freedom and flexibility to carry out their tasks properly, and
they must be provided with appropriate staff and equipment
as required.

Article 28, Prior checking by the European Data

3.9.
Protection Supervisor (EDPS).

The principle that should be laid down is that any
3.9.1.
data processing likely to jeopardise in a specific way the rights
and freedoms of those concerned must be subject to prior
checking by the Supervisor. The existence or application of
‘sensitive’ processing operations must be carefully considered
in advance by an independent authority. Provision is made for
this in the proposal, for it is a fundamental safeguard.

3.7.
Article 23(1), Security of processing. The person
responsible for processing must ensure the highest possible
level of security during data processing and transmission, in
accordance with the state of the art and provided the cost is
not disproportionate to the level of security which must be
provided.

However, some types of data processing should be
3.9.2.
added to the proposed list, and at all events the EDPS should
check in advance situations such as:

— data-processing involving innovative application of exist-

ing technologies;

Article 25, Data Protection Officer and Annexes I and

— the additional points proposed by the ESC in Article 10;

3.8.
II:

The main question concerns the independence and
3.8.1.
qualifications of the people appointed by the Community
institutions and bodies to actually collect, process and transmit
personal data.

— data-processing affecting the police, security, criminal law,
immigration and the residence of people from outside the
Community (e.g. provision of visas, length of stay);

— processing that uses identifiers of general application;

3.8.2.
The provisions of the proposal protect these people
from any undue pressure exerted by the appointing bodies,
which are also the bodies to which they are answerable and
subordinate.

— interlinking of files with distinct purposes;

— processing of data collected for other purposes;

3.8.3.
These people must be explicitly released from this
subordinate relationship as far as their data protection tasks
are concerned, and must be answerable only to the European
Data Protection Supervisor (1). Their data protection tasks
should not be evaluated or assessed by their hierarchical
superiors, nor should they have a negative effect on their
career in the event of conflict with those superiors on data
protection issues. Their term in office should be longer to
provide a better guarantee of their independence and provide
them with security and a long-term perspective.

— data-processing conditions that violate the principles of

personal protection;

— processing that uses or requires data to be transmitted

beyond EU frontiers;

— mandatory statistical surveys and surveys relating to whole

sectors of the population and professions.

3.8.4.
The estimated proportion of working time the people
appointed will spend on data protection tasks (5 % in general,

(1) As stipulated, for example, in ILO Convention No. 81 on Labour

Inspection.

Article 32, Security of internal telecommunications
3.10.
networks, end of paragraph 1. The Committee recommends
that the sentence be changed as follows: ‘Having regard to the
state of the art, technological development and, possibly, the
this is disproportionate to the objectives
related cost,
pursued, these measures shall ensure, and continue to ensure,
a level of security appropriate to the risk presented.’

if

C 51/52

EN

Official Journal of the European Communities

23.2.2000

3.11. Supervisory authority

Article 38, The EDPS. Paragraph 1 should specify
3.11.1.
that an independent supervisory authority is to be established.

3.11.2.
Article 39, Appointment. The proposal provides
for the EPDS to be appointed ‘by common accord’ by the
Commission, Council and European Parliament for a term of
four years. The EPDS may also be reappointed, but
the
proposal does not stipulate how many times this may be done.

The Committee again points to the need for an
3.11.3.
independent EPDS, who should therefore not be appointed by
bodies such as the Council and Commission that regularly
process personal data or ask for personal data to be processed,
and circulate or transmit such data. As with the Ombudsman,
it would seem more appropriate and more practical from a
technical point of view for the EDPS to be appointed by the
European Parliament in consultation with the Commission
and the Council. A considerably longer (possibly double the
length provided for in the proposal), but non-renewable,
term-of-office could provide an additional guarantee of inde-
pendence.

The tasks of the EDPS are particularly demanding
3.11.4.
and diverse, and the budgetary provisions in the annexes
to the proposal seem somewhat modest considering the
requirements of the post.

Brussels, 8 December 1999.

3.11.5.
The Committee considers it absolutely necessary
for the future supervisor to have adequate means and a
sufficient number of highly qualified staff.

4. Conclusions

4.1.
The Committee would have liked to examine in more
detail all the provisions submitted to it in this proposal for a
regulation that is so critical to the protection of personal rights
and freedoms within the Community administration.

4.2.
This project represents an enormous task that must
be acclaimed for the important safeguards it provides. Its
limitations largely reflect those of the 1995 Directive. Although
it recognises the progress in the proposal as it stands, the ESC
nevertheless presents general and specific comments in this
opinion to the Council, the European Parliament and the
Commission in the hope that its contribution will make it
possible to strengthen the guarantees of freedoms and rights
enjoyed by people within and outside the Community.

4.3.
On the basis of the planned review in 2001 of how the
Directive is being implemented and in accordance with the
specific revision proposals that will then be presented to it
for consideration, the Committee will make detailed and
exhaustive proposals on the nature and scope of the changes
that it would like to see made to the current text.

The President

of the Economic and Social Committee

Beatrice RANGONI MACHIAVELLI