Report from the Commission - First Report on the implementation of the Data Protection Directive (95/46/EC)
Date: 2003-05-15
Institutions: European Commission
Subjects: application of EU law, data processing, data protection, impact of information technology, personal data, protection of privacy, single market

COMMISSION OF THE EUROPEAN COMMUNITIES

Brussels, 15.5.2003
COM(2003) 265 final

REPORT FROM THE COMMISSION

First report on the implementation of the Data Protection Directive (95/46/EC)

   
INDEX

1.

2.

3.

4.

5.

6.

7.

The reasons for the report and the open consultation on the Implementation of
directive 95/46/EC ....................................................................................................... 3

The open review process preceding the preparation of this report .............................. 6

The main results of the review ..................................................................................... 7

The main findings of the review in more detail ......................................................... 14

The processing of sound and image data ................................................................... 20

work programme for a better implementation of the data protection directive (2003-
2004) .......................................................................................................................... 22

Conclusion ................................................................................................................. 27

2

1.

THE  REASONS  FOR  THE  REPORT  AND  THE  OPEN  CONSULTATION  ON  THE
IMPLEMENTATION OF DIRECTIVE 95/46/EC

‘The  Commission  shall  report  to  the  Council  and  the  European  Parliament  at
regular  intervals,  starting  not  later  than  three  years  after  the  date  referred  to  in
Article  32  (1),  on  the  implementation  of  this  Directive,  attaching  to  its  report,  if
necessary, suitable proposals for amendments.’ (Article 33 of EC Directive 95/46)

The  present  report  is  the  Commission’s  response  to  the  above  requirement.  The
Commission  has  delayed  its  report  by  18  months  because  the  Member  States  have
been slow to transpose the Directive into national law1.

The  Commission  has  approached  the  preparation  of  this  report  from  a  broad
perspective.  It has  gone beyond the simple examination of the Member States’ acts
of implementation and has conducted in addition an open public debate, encouraging
a  wide  participation  on  the  part  of  stakeholders.  This  approach  is  not  only  in  line
with the Commission’s approach to governance at the European level as set out in its
White Paper of July 20012; it is also justified by first, the specific nature of Directive
95/46  and  second,  the  rapid  pace  of  technological  development  in  the  information
society  and  other  international  developments  which  have  brought  about  significant
changes since the Directive was finalised in 1995.

1.1.

A Directive with very broad impact

Directive  95/46  enshrines  two  of  the  oldest  ambitions  of  the  European  integration
project:  the  achievement  of  an  Internal  Market  (in  this  case  the  free  movement  of
personal  information)  and  the  protection  of  fundamental  rights  and  freedoms  of
individuals. In the Directive, both objectives are equally important.

In  legal  terms,  however,  the  existence  of  the  Directive  rests  on  Internal  Market
grounds. Legislation at the EU level was justified because differences in the way that
Member States approached this issue impeded the free flow of personal data between
the  Member  States3.  Its  legal  base  was  thus  Article  100a  (now  Article  95)  of  the
Treaty.  However,  the  proclamation  of  the  Charter  of  Fundamental  Rights  of  the

1

2

3

The  Commission  decided  in  December  1999  to  take  France,  Germany,  Ireland,  Luxembourg  and  the
Netherlands  to  the  European  Court  of  Justice  for  failure  to  notify  all  the  necessary  measures  to
implement Directive 95/46. In 2001 the Netherlands and Germany notified and the Commission closed
the cases against them. France notified the data protection law of 1978 so that the proceedings for non
notification against that state were dropped. France announced at the same time its intention to pass a
new  law  that  is  not  yet  adopted.  In  the  case  of  Luxembourg,  the  Commission  action  has  led  to  this
Member State being condemned by the Court of Justice for failure to fulfil its obligations. The Directive
was  then  implemented  with  a  new  law  that  entered  into  force  in  2002.  Ireland  notified  a  partial
implementation in 2001; a complete bill has however recently been passed. The implementation status
in Member States is available at:
http://europa.eu.int/comm/internal_market/privacy/law/implementation_en.htm
COM(2001) 428 final http://europa.eu.int/eur-lex/en/com/cnc/2001/com2001_0428en01.pdf
See COM (90) 314 final - SYN 287 AND 288, 13 September 1990, page 4: "The diversity of national
approaches and the lack of a system of protection at Community level are an obstacle to completion of
the internal market. If the fundamental rights of data subjects, in particular their right to privacy, are
not safeguarded at Community level, the cross-border flow of data might be impeded…"

3

                                                
European  Union4  by  the  European  Parliament,  the  Council  and  the  Commission  in
December  2000,  and  in  particular  Article  8  thereof  which  incorporates  the  right  to
data protection, has given added emphasis to the fundamental rights dimension of the
Directive.

Moreover, by its nature, the Directive has a very broad impact. Every individual is a
data  subject and  entities  in  every  sector  of  the  economy  are  data  controllers.  Thus,
even  if  its  legal  justification  is  rather  specific,  its  effects  are  very  wide  and  its
implementation must be examined with that in mind.

1.2.

Developments in  information  technology  and  increased  security  concerns  have
sharpened the debate on data protection

Since the adoption of the Directive in 1995, there has been an exponential growth in
the  number  of  households  and  businesses  connected  to  the  Internet  and  thus  in  the
number of people leaving an increasing amount of personal information of all kinds
on  the  web.  At  the  same  time,  the  means  of  collecting  personal  information  has
become  increasingly  sophisticated  and  less  easily  detectable:  closed  circuit  TV
systems  monitoring  public  places;  spyware  installed  in  PCs  by  web-sites  to  which
they  have  been  connected  which  collect  information  about  users’  browsing  habits,
information  that  the  sites  often  sell  to  others;  or  the  monitoring  of  employees’,
including the use of emails and internet, at the workplace.

This  “data  explosion”  inevitably  raises  the  question  whether  legislation  can  fully
cope  with  some  of  these  challenges,  especially  traditional  legislation  which  has  a
limited geographical field of application, with physical frontiers which the Internet is
rapidly rendering increasingly irrelevant5.

Notably  as  a  response  to  technological  developments,  Directive  97/66/EC  of  the
European  Parliament  and  of  the  Council  of  15  December  1997  concerning  the
processing of personal data and the protection of privacy in the telecommunications
sector6 translated the principles set out in Directive 95/46/EC into specific rules for
the  telecommunications  sector.  Directive  2002/58/EC  on  privacy  and  electronic
communications of 12 July 20027 has recently updated Directive 97/66/EC to reflect
developments  in  the  markets  and  technologies  for  electronic  communications
services, such as the Internet, so as to provide an equal level of protection of personal
data and privacy, regardless of the technologies used.

The  emergence  of  a  knowledge  based  economy  combined  with  technological
progress  and  the  growing  role  attributed  to  human  capital  have  intensified  the

4

5

6

7

http://europa.eu.int/comm/justice_home/unit/charte/index_en.html
The report “Future bottlenecks in the information society” prepared for the Joint Research Centre of the
Commission and the Institute for Prospective Technological Studies in June 2001 concludes that there
are  some  emerging  areas  that  do  not  fit  easily  with  the  provisions  of  the  Directive  and  that  it  may
therefore be necessary to revise it in the future.  At the  same  time,  the  report  notes  that  “although  we
have the Directive implemented in all Member States, there is increasing social anxiety with regard to
the abuse and misuse of personal data within on-line information systems”. Evidence  gathered during
the preparation of this report lends some support to this conclusion.
http://www.jrc.es/FutureBottlenecksStudy.pdf
OJ No L 24, 30.1.1998, p. 1-8
OJ No L 201, 31 July 2002, p. 37-47. Member States have until 31 October 2003 to transpose the new
Directive into national law.

4

                                                
collection of workers’ personal data in the employment context. These developments
gave  rise  to  a  number  of  concerns  and  risks  and  brought  the  issue  of  effective
protection of workers’ personal data into focus. The Commission noted, in its second
stage  consultation  document  addressed  to  the  European  social  partners  in  October
2002, that there is scope for EU legislative action under Article 137 (2) of the Treaty,
aiming  at  improving  working  conditions  by  establishing  a  European  framework  of
principles  and  rules  in  this  field.  The  Commission  is  currently  reflecting  on  the
follow-up to this consultation and intends to decide thereon before the end of 2003.
Such  a  European  framework  would  build  on  the  existing  general  principles  of
Directive  95/46  EC  while  supplementing  and  clarifying  these  principles  in  the
employment context.

As  regards  consumer  credit,  the  Commission  has  set  out,  in  its  proposal  for  a
European  Parliament  and  Council  Directive  on  the  harmonisation  of  laws,
regulations and administrative provisions of the Member States concerning credit for
consumers8,  some  specific  provisions  on  data  protection  aimed  at  further
strengthening the protection of consumers.

At the same time, increased concerns about security, especially following the events
of 11 September 2001, have put civil liberties in general and the rights to privacy and
the protection of personal data in particular under some pressure. This is neither new
nor surprising. The European Court for Human Rights found it necessary to issue the
following  warning  in  1978:  "States  may  not…,  in  the  name  of  the  struggle  against
espionage  and  terrorism,  adopt  whatever  measures  they  deem  appropriate…  the
danger  (is  that)  of  undermining  or  even  destroying  democracy  on  the  ground  of
defending it".9

The  Directive  does  not  of  course  apply  to  the  processing  of  personal  data  in  the
course of so-called "third pillar" activities10 and data protection in these areas is not
therefore covered by this report. The same distinction is however often not made in
Member States laws. This raises a number of questions and problems, which have in
particular  been  highlighted  by  the  European  Parliament  and  which  deserve  further
debate.

8

9

10

COM (2002) 443 final of 11.09.2002
Klass and Others v. Germany judgment of 6 September 1978, Series A no. 28
Article 3.2. first indent excludes from the scope of the Directive "activity  falling outside the scope of
Community  law…  and  in  any  case  processing  operations  concerning  public  security,  defence,  State
security  (including  the  public  well-being  of  the  State  when  the  processing  operations  relate  to  State
security matters) and the activities of the States in areas of criminal law".

5

                                                
2.

THE OPEN REVIEW PROCESS PRECEDING THE PREPARATION OF THIS REPORT

Against  the  above  background,  the  Commission  sought  to  organise  an  open  debate
with the widest possible participation to accompany its review of the implementation
of  the  Directive.  All  interested  parties  -  governments,  institutions,  business  and
consumer associations, even individual companies and citizens - have been given the
opportunity  to  participate  and  express  their  views11.  The  Commission  regards  this
process  as  positive.  It  has  enriched  the  sources  of  information  on  which  the
Commission has drawn for this report and the recommendations for future action that
it makes. It has also confirmed the shift in opinion that had already  been discerned
among data controllers in general12 and representatives of the business community in
particular: data controllers are now constructively engaged in a dialogue about how
to  ensure  the  effective  protection  of  personal  data  in  an  efficient  way,  instead  of
opposing regulation in this field outright.

The  Commission  regrets,  on  the  other  hand,  the  limited  response  of  consumer
organisations to the consultation process.13

This  report  summarises  the  Commission’s  findings  in  the  light  of  the  input  it  has
gathered  and  its  recommendations  for  action.  The  Commission  considers  however
that this can only be regarded as the first step in a longer process.

11

12

13

The  Commission  addressed  questions  to  Member  State  governments  and  separately  to  supervisory
authorities;  commissioned  two  studies  by  academic  experts;  issued  a  general  invitation  to  make
contributions  published  in  the  Official  Journal  and  on  the  Commission’s  web-site;  placed  two
questionnaires on its web-site for over two months, one aimed at data controllers and the other at data
subjects; held an international conference at which a wide range of issues were discussed in six separate
workshops.
Although  this  report  usually  refers  to  data  controllers  as  "Industry"  or  "business  representatives"
(because  they  are  those  that  most  have  contributed  to  the  debates),  public  authorities  carrying  out
activities  within  the  scope  of  Community  law  are  also  data  controllers  and  of  course  the
recommendations and observations contained in this report also concern them.
Only  BEUC,  the  European  Consumer’s  Organisation,  submitted  a  position  paper,  stating  i.al.  that  in
response  to  those  who  have  argued  that  the  Directive  needs  to  be  adapted  to  the  imperatives  of  the
online environment, in their view it is  the  online  environment  that  needs  to  be  adapted  to  ensure  full
respect of the principles of the Directive.

6

                                                
3.

THE MAIN RESULTS OF THE REVIEW

3.1.

For and against the amendment of the directive

The  Commission  considers  that  results  of  the  review  on  balance  militate  against
proposing modifications to the Directive at this stage.

In  the  course  of  the  consultations  conducted,  few  contributors  explicitly  advocated
the  modification  of  the  Directive.  The  most  notable  exception  was  the  detailed
proposals  for  amendments  submitted  jointly  by  Austria,  Sweden,  Finland  and  the
UK14. These proposals for amendments concerned only a small number of provisions
(notably  Article 4 which determines the  applicable law, Article 8 on  sensitive  data,
Article 12 on the right of access, Article 18 on notification and Articles 25 and 26 on
transfers to third countries), leaving most of the provisions and all of the principles of
the Directive untouched. The specific difficulties arising from these and some other
provisions will be looked at in more detail later in this report.

The Commission believes  that  the following  general  considerations  make  it unwise
to make proposals to amend this Directive in the immediate future:

– 

Experience  with  the  implementation  of  the  Directive  is  so  far  very  limited.
Only  few  Member  States  implemented  the  Directive  on  time.  Most  Member
States  only  notified  implementing  measures  to  the  Commission  in  the  years
2000  and  2001,  and  Ireland  has  still  not  notified  its  recent  implementation.
Important  implementation  legislation  is still  pending  in  some  Member  States.
This constitutes an inadequate basis of experience for a proposal for a revised
Directive.

–  Many  of  the  difficulties  that  have  been  identified  during  the  review  can  be
addressed and resolved without amending the Directive. In some cases, where
problems are caused by incorrect implementation of the Directive, they must be
solved by specific modifications of Member State law.  In  others, the margins
of  manoeuvre  allowed  by  the  Directive  permit  closer  co-operation  among
supervisory  authorities  to  achieve  the  convergence  necessary  to  overcome
difficulties arising  from practices  that diverge too widely from Member  State
to  Member  State.  In  any  event,  such  means  are  likely  to  take  effect  more
quickly  than  would  an  amendment  of  the  Directive  and  so  should  be  fully
exploited first.

–  Where amendments have been proposed  by stakeholders, the aim is often  the
reduction of compliance burdens for data controllers. While this is a legitimate
end  in  itself  and  indeed  one  that  the  Commission  espouses,  the  Commission
believes that many of the proposals would also involve a reduction in the level
of  protection  provided  for.  The  Commission  believes  that  any  changes  that
might  in  due  course  be  considered  should  aim  to  maintain  the  same  level  of

14

http://www.lcd.gov.uk/ccpd/dpdamend.htm. The Netherlands adhered to these proposals at a later stage.

7

                                                
protection  and  must  be  consistent  with  the  overall  framework  provided  by
existing international instruments15.

Following discussions with the Member States, the Commission notes its view that a
modification of the  Directive  is neither necessary  nor  desirable  at  present  is  shared
by  a  comfortable  majority  of  Member  States  and  also  of  national  supervisory
authorities.

The Commission considers that some of the issues that have emerged and which are
here only the subject of a preliminary analysis need to be further analysed and may
need  in  due  course  to  be  the  subject  of  a  proposal  to  revise  the  Directive.  Such  a
proposal  would  benefit 
the  Directive’s
from 
implementation which will have been gained in the meantime.

the  greater  experience  of 

Moreover,  as  stated  above,  there  is  considerable  scope  for  improvement  in  the
implementation  of  the  present  Directive  which  is  likely  to  resolve  a  number  of  the
difficulties  identified  during  the  review,  some  of  them  wrongly  attributed  to  the
Directive  itself.  The  Commission’s  attention  has  been  and  will  continue  to  be
focussed in particular on areas where Community law is clearly being breached and
on  areas  where  divergent  interpretations  and/or  practices  are  causing  difficulties  in
the Internal Market.

The Commission also considers as a priority the harmonious application of the rules
relating to the transfer of data to third countries, with a view to facilitating legitimate
transfers and avoiding unnecessary barriers or complexities.

3.2.

Overall assessment of the implementation of the directive in the Member States.
The problem of the divergences between the Member States' legislation.

The Commission’s services have made a thorough analysis of the implementation in
the fifteen Member States on the basis of the information collected. The co-operation
of the Member States and the national supervisory authorities in this regard has been
of great help. The initial results of this analysis are contained in this report and in a
technical  annex  that  will  be  published  separately,  but  the  process  of  collection  of
information  and  analysis  of  the  implementation  in  the  Member  States  will  need  to
continue during 2003.

15

In  the  words  of  Commissioner  Bolkestein  at  the  closing  session  of  the  Conference  on  the
implementation  of  the  Directive:  "There  is  certainly  no  such  thing  as  a  clean  sheet  of  paper  when  it
comes to making policy in the field of data protection (…) In drafting its report the Commission will …
need  to  bear  in  mind  the  broader  legal  and  political  framework,  in  particular  the  principles  of
Convention 108 of the Council of Europe"

8

                                                
RESULTS FROM THE ON-LINE QUESTIONNAIRES

Using Inter-Active Policy Making on-line consultation-tool, the Commission placed
two  questionnaires  on  its  web-site  in  June  and  invited  data  subjects  (public
consultation)  and  data  controllers  (target  group)  to  give  their  views  on  various
aspects  of  data  protection.  By  the  time  the  questionnaires  were  closed,  9156
individuals and 982 data controllers had replied. The full results of the consultations
are available at:

http://europa.eu.int/comm/internal_market/privacy/lawreport/consultation_en.htm

The Commission finds the following results to be of particular interest:

- Although the  Data  Protection  Directive  incorporates  high  standards  of  protection,
most  individuals  (4113  out  of  9156  or  44.9%)  considered  the  level  of  protection  a
minimum.

-  81%  of  individuals  thought  the  level  of  awareness  about  data  protection  was
insufficient, bad or very bad, whereas only 10.3% thought it was sufficient and only
3.46%  thought  it  was  good  or  very  good.  Among  controllers  there  was  an  almost
equally negative view on awareness among citizens: Most of the respondents (30%)
thought  that  citizens'  awareness  about  data  protection  is  insufficient  whilst  only
2.95% thought that the level was very good.

-  There  is  greater  acceptance  of  data  protection  rules  now  among  businesses.  For
example,  69.1%  of  the  respondents  (data  controllers)  considered  data  protection
requirements  necessary  in  our  society  whilst  only  a  2.64%  regarded  them  as
completely unnecessary and needing to be removed.

- A large majority of the data controllers that responded to the questionnaire (62.1%)
did  not  consider  that  responding  to  requests  from  individuals  for  access  to  their
personal data involved an important effort for their organisation. Indeed, most of the
data controllers responding to the questionnaire either did not have figures available
or received fewer than 10 requests during the year 2001.

The Commission recognises that these results cannot be considered representative in
the  way  that  survey  results  based  on  a  scientifically  selected  sample  can.  The
Commission proposes to conduct another survey in 2003, both to test the reliability
of the results of the open questionnaire and to establish a yardstick against which to
measure the evolution of various views or indicators in the future.

9

Late implementation

The  implementation  of  a  Directive  of  this  kind,  that  is  a  Directive  leaving  a
considerable  latitude  to  the  Member  States,  but  also  requiring  them  to  fill  in  a
significant amount of detail, is undoubtedly a complex task. But the serious delays in
implementation  that  occurred  in  most  Member  States  is  the  first  and  main
shortcoming  which  the  Commission  has  the  duty  to  register  as  regards  the
implementation of  the  Directive which  it unequivocally  condemns.  It  has of course
taken the appropriate action under Article 226 of the Treaty, as described above.

Free movement of information secured

Despite  these  delays  and  gaps  in  implementation,  the  Directive  has  fulfilled  its
principal  objective  of  removing  barriers  to  the  free  movement  of  personal  data
between the Member States. In fact, the main difficulty prior to the adoption of the
Directive  arose  because,  while  most  Member  States  had  adopted  data  protection
legislation,  a  small  number  had  not.  By  1995,  only  Italy  and  Greece  did  not  have
such legislation, but these two Member States were among the first to transpose the
Directive, thus removing the main difficulty. Since the adoption of the Directive, no
case  has  been  drawn  to  the  attention  of  the  Commission  in  which  the  transfer  of
personal data between Member States has been blocked or refused on data protection
grounds.

Of course, obstacles to the free circulation of personal data can be more subtle than
blatant  prohibitions  in  the  national  laws  or  blocking  decisions  taken  by  national
supervisory  authorities:  there  might  for  example  be  cases  where  an  unnecessarily
restrictive rule in one Member State limits the internal processing of personal data in
that  Member  State  in  the  first  place  and,  thus  the  exportation  of  the  same  data  to
other Member States. In other words, while the Commission is broadly satisfied with
the impact of the Directive as regards the free movement of information within  the
Community,  further  experience  with  its  implementation  may  produce  evidence  of
problems that need to be tackled16.

High level of protection

As provided for in Recital 10, the aproximation of the national laws pursued by the
Directive  must  seek  to  ensure  a  high  level  of  protection  in  the  Community.  The
Commission believes that this has been achieved. Indeed the Directive itself sets out
some of the highest standards of data protection in the world. However, the results of
the on-line survey suggest that the  perception  of  citizens  at  this  regard  is  different.
This paradox requires further reflection. A preliminary analysis would suggest that at
least part of the problem is attributable to an incomplete application of the rules (see
further section on "enforcement, compliance and awareness")

Other Internal Market policy objectives less well served

The  Commission  takes  a  view  of  the  overall  policy  objectives  to  be  pursued  by
Internal  Market  legislation  that  goes  beyond  mere  free  movement.  This  should
provide a level playing field for economic operators in different Member States; help

16

For example different approaches as regards protection for data of legal persons.

10

                                                
to simplify the regulatory environment in the interests of both good governance and
competitiveness;  and  tend  to  encourage  rather  than  hinder  cross-border  activity
within the EU.

Judged  against  these  criteria,  the  divergences  that  still  mark  the  data  protection
legislation  of  the  Member  States  are  too  great.  This  was  the  prevalent  message
received from the contributors to the review, in particular those representing business
interests, who complained that present disparities prevent multinational organisations
from developing pan-European policies on data protection. The Commission recalls
that  the  ambition  of  a  Directive  is  approximation  and  not  complete  uniformity  and
that,  in  order  to  respect  the  subsidiarity  principle,  the  process  of  approximation
should not go further than is necessary. Nevertheless, it thinks that stakeholders are
right to demand more convergence in legislation and in the way it is applied by the
Member States and the national supervisory authorities in particular.

Some  contributors  to  the  review  proposed  the  amendment  of  the  Directive  to  add
more detail or specification to achieve this convergence. The Commission prefers to
proceed  at  least  initially  by  other  means.  Furthermore,  the  general  nature  of  this
Directive,  i.e.  the  fact  that  it  applies  to  a  large  number  of  sectors  and  contexts,
generally argues against adding more detail or specification.

Divergences in Member States laws call for a range of solutions

Since  the  divergences  between  Member  States'  laws  have  different  causes  and
different consequences, they also call for a range of different solutions.

It is clear that when a Member State has gone beyond the limits of the Directive or
fallen short of its requirements, it creates a divergence that must be remedied by the
modification  of  the  Member  State  law  in  question.  There  are  certain  provisions
which  leave  little  or  no  margin  to  the  Member  States  and  where  divergences  have
nevertheless occurred - see for example "definitions" or closed lists in the Directive
such  as  in  Articles  7  (grounds  for  legitimate  processing),  8.1  (sensitive  data),  10
(information to data subjects), 13 (exceptions), 26 (exceptions as regards transfers to
third countries, etc). This points to non-compliance with Community law. Article 4
(applicable law) has also been badly transposed in a number of cases.

The  Commission  is  of  course  prepared  to  use  its  powers  under  Article  226  of  the
Treaty  to  bring  about  such  changes,  but  it  hopes  that  it  will  not  be  necessary  to
proceed by way of formal action. Bilateral and multilateral discussions will be held
with the Member States with a view to arriving at agreed solutions in line with the
Directive.

Other  divergences  may  be  the  legitimate  result  of  correct  implementation  by  a
Member  State  that  has  taken  a  different  direction  within  the  margin  of  manoeuvre
allowed by the Directive. For the purposes of this report, the Commission considers
the  existence  of  such  differences  only  in  so  far  as  they  have  significant  negative
consequences in the Internal Market or from the "better regulation" point of view, for
example the creation of unjustified administrative burdens for operators.

11

Summing up:

a)

Overall,  a  large  proportion  of  the  divergences  detected  by 
the
Commission’s  services  cannot  be  considered  as  a  violation  of
Community  law  nor  as  having  a  significant  negative  impact  on  the
Internal  Market,  but  when  this  is  the  case,  the  Commission  will  do  the
necessary to remedy the situation;

b) Many of the divergences detected nevertheless do stand in the way  of a
flexible  and  simplified  regulatory  system  and  are  still  therefore  of
concern (see for example the differences in the notification requirements
or the conditions for international transfers).

There  is  a  broad  spectrum  of  possible  actions  to  address  these,  as  indicated  in  the
work programme in section 6. The pursuit of these solutions in the immediate future
does not mean, however, that the Commission excludes the possibility of appropriate
amendment  to  the  Directive  subsequently,  if  the  difficulties  persist.  Closer  co-
operation  among  the  supervisory  authorities  of  the  Member  States  and  a  general
willingness to reduce the negative impact of divergences are therefore to be seen as
one  alternative,  while  amendments  to  the  Directive  reducing  the  amount  of  choice
left to the national legislator and to national supervisory authorities are the other. The
Member States and their supervisory authorities will no doubt prefer the first option
and it is up to them to show that it can work.

Enforcement, compliance and awareness

Before proceeding  to  a  closer  examination  of  some  of  the  problematic  areas  of  the
Directive’s implementation, one other general issue deserves attention, which is that
of the general level of compliance with data protection law in the EU and the related
question of enforcement. Given (or despite) the ubiquitous character of personal data
processing, it is hard to obtain accurate or complete information about its compliance
with  the  law.  The  input  which  the  Commission  received  in  response  to  its  call  for
contributions  did  not  cast  much  new  light  on  this  issue.  Anecdotal  evidence,
however,  combined  with  various  elements  of  “hard”  information  available  to  the
Commission17 suggests the presence of three inter-related phenomena:

– 

– 

– 

An under-resourced enforcement effort and supervisory authorities with a wide
range of tasks, among which enforcement actions have a rather low priority;

Very  patchy  compliance  by  data  controllers,  no  doubt  reluctant  to  undertake
changes in their existing practices to comply with what may seem complex and
burdensome rules, when the risks of getting caught seem low;

An  apparently  low  level  of  knowledge  of  their  rights  among  data  subjects,
which may be at the root of the previous phenomenon.

The  supervisory  authorities  themselves  in  many  Member  States  are  also  concerned
about  this,  in  particular  their  lack  of  resources.  Resource  difficulties  may  affect

17

For  example  the  relatively  small  number  of  individual  complaints  received  by  the  Commission  itself
and the low number of authorisations by national authorities for transfers to third countries notified to
the Commission in accordance with Article 26 (3)

12

                                                
independence.  Independence  in  the  taking  of  decisions  is  a  sine  qua  non  for  the
correct functioning of the system.

This aspect requires further investigation, but if these tendencies are confirmed, they
are  reasons  for  serious  concern  and  reflections  need  to  be  undertaken  between  the
Commission  and  the  Member  States  and  the  supervisory  authorities  to  determine
their causes and design feasible solutions.

The  fact  that  the  three  aspects  are  linked  means  that  addressing  one  of  them
successfully can have positive spill-over on the others. More vigorous and effective
enforcement  will  improve  compliance  with  the  legislation.  Better  compliance  will
result in data controllers providing more and better information to data subjects about
the existence of the processing and their rights under the law, with a beneficial effect
on the level of awareness about data protection among citizens in general.

The candidate countries

In  line  with  the  Copenhagen  criteria,  all  candidate  countries  are  commited  to
transposing  Directive  95/46/EC  by  the  time  of  accession.  To  date,  all  have  passed
legislation  in  this  field,  except  for  Turkey,  where  preparation  of  a  Data  Protection
Act is well under way. In the 10 countries that have signed the Treaties of Accession,
the  legislation  in  place  incorporates  most  of  the  key  elements  of  the  Directive.
However,  further  efforts  are  needed  to  bring  this  legislation  fully  into  line  with  all
provisions of the Directive.

In  this  regard,  the  establishment  of  independent  data  protection  supervisory
authorities  is  of  utmost  importance.  The  independence  of  some  supervisory
authorities  is  exemplary,  whilst  in  other  countries  it  is  clearly  insufficient.  On  the
other hand, all the supervisory authorities lack the necessary resources and some also
the  necessary  powers  to  ensure  effective  implementation  of  data  protection
legislation.

13

4.

THE MAIN FINDINGS OF THE REVIEW IN MORE DETAIL

18

This section looks more closely at and provides more concrete examples of the main
issues which the Commission considers require attention in the light of its review.

4.1.

The need to complete the implementation of the Directive

A full implementation of  the  Directive normally  requires  (besides  the  enactment of
implementing  legislation)  a  second  stage  which  mainly  consists  in  the  review  of
other  legislation  that  may  conflict  with  the  Directive's  requirements  and/or  the
specification  of  certain  general  rules  and  the  provision  of  appropriate  safeguards
where exceptions foreseen by the Directive have been used.

In  general  terms,  this  second  stage  of  the  implementation  has  not  even  started  in
some  Member  States  and  among  those  that  have  started,  some  are  not  very  far
advanced. Several national laws make reference to further clarification being issued,
for example as regards the application of Article 7 (f) (balance of interest clause) but
this has not happened yet.19

Another provision where implementation is often incomplete is Article 8 (2) (b). This
provision  allows  Member  States  to  make  exceptions  from  the  general  rule  that
sensitive data should not be processed, where such processing is necessary to carry
out  the  obligations  and  specific  rights  of  the  controller  in  the  field  of  employment
law,  but  only  subject  to  adequate  safeguards  being  put  in  place.  In  some  Member
States, these requirements are met through specific data protection legislation in the
employment context, which is either quite comprehensive (eg. Finland) or regulates
particular  issues  (eg.  health  legislation  in  Denmark  and  the  Netherlands).  In  other
Member States, the situation is less clear. The provisions containing safeguards have
not  been  adopted  by  all  Member  States.  Where  they  exist,  they  are  often
unsatisfactory.  The  situation  is  similar  as  regards  Article  8  (4)  and  (5)  -  the
processing of sensitive data for reasons of public interest or with regard to criminal
convictions.  The  absence  of  safeguards  means  the  required  level  of  protection  for
individuals  is  not  being  met,  which  should  be  a  matter  of  concern  for  the  Member
States, as it is for the Commission. This will be addressed in particular under Action
1  of  the  work  programme.  Furthermore,  where  personal  data  are  processed  in  a
particular sector or  context, such as in employment,  this  may be addressed through
sectoral Community action20.

18

19

20

Readers should refer to the technical annex for a more complete picture.
Several submissions – see for example that from Clifford Chance - highlighted the importance of this
provision which adds an important element of flexibility to the conditions of “fairness” of processing.
An incomplete or unclear implementation of this provision causes unnecessary rigidity in the regulatory
framework.
Cf., in this regard, point 1.2 supra.

14

                                                
4.2.

The need for a reasonable and flexible interpretation

Many submissions have advocated a reasonable and flexible interpretation of certain
provisions  of  the  Directive21.  A  good  example  is  the  issue  of  sensitive  data22.  It  is
necessary  to  find  an  interpretation  consistent  both  with  the  reinforced  protection
foreseen for this category of data by the Directive and the realities of daily business,
routine processing operations and the effective risks that certain operations pose for
the protection of the fundamental rights and freedoms of individuals.23

Article 12 of the Directive (right of data subjects to have access to information held
about them) is another provision that has prompted calls for a flexible interpretation
in relation to the exercise of the right of access and the possibility of refusals.  It is
argued  that  meeting  access  requests  concerning  data  processed  in  enormous  and
complex  information  networks  could  be  extremely  difficult  and  costly  for  the  data
controller.

The  submission  from  Austria,  Sweden,  Finland  and  the  United  Kingdom  seeks  a
change in the Directive to make clear that if the access request concerns information
extremely difficult to retrieve and clearly excluded from the normal operations of the
controller,  the  data  controller  may  ask  the  data  subject  to  assist  the  organisation  in
searching  for  his  data.24  The  Commission  recalls  that  the  possibility  of  asking  for
such assistance is already in conformity  with the  Directive in its present form. The
Commission  is  not  convinced  that  the  implementation  of  this  provision  of  the
Directive  is  in  fact  posing  serious  practical  problems.  In  any  case,  the  number  of
access requests seems to remain low.25 The Commission considers the interpretations
and  guidance  provided  by  national  supervisory  authorities  so  far  to  be  wholly
reasonable.

Article  5  of  the  Directive  states  that  Member  States  shall,  within  the  limits  of  the
provisions of Chapter II (Articles 6 to 21), determine more precisely the conditions
under  which  the  processing  of  personal  data  is  lawful.  In  this  respect,  the
Commission  notes  the  concerns  expressed  by  Sweden  in  the  framework  of  the
ongoing  review  of  their  legislation  as  regards  the  application  of  data  protection
principles  to  continuous  text  or  sound  and  image  data.  The  Commission  considers
that the aim of simplifying the conditions for data processing where such processing
is not likely to pose any substantial risks to individual's rights can be better met by
making use of the margin of manoeuvre that the Directive provides and in particular
of the possibilities allowed by articles 7 (f), 9, and 13.

4.3.

Promotion and encouragement of Privacy Enhancing Technologies

The  idea  of  Privacy  Enhancing  Technologies  is  to  design  information  and
communication systems and technologies in a way that minimises the collection and

21

22

23

24

25

The  submission  of  the  European  Privacy  Officers  Forum  (EPOF)  is  particularly  interesting  in  this
regard,  for  example  on  the  need  for  a  reasonable  interpretation  of  notions  like  “anonymous  data”  or
“sensitive data”.
The  submission  of  FEDMA,  for  example,  contains  some  practical  examples  of  the  different
interpretations of this notion in Member States such as the United Kingdom, France or Portugal.
The  call  for  a  reasonable  interpretation  can  also  be  found  in  the  suggested  amendment  to  recital  33
submitted by Austria, Finland, Sweden and the United Kingdom.
Such assistance is already foreseen under British and Austrian law.
See figures and responses of data controllers to the on-line questionnaire on this issue above

15

                                                
use  of  personal  data  and  hinders  unlawful  forms  of  processing.  The  Commission
considers  that  the  use  of  appropriate  technological  measures  is  an  essential
complement to legal means and should be an integral part in any efforts to achieve a
sufficient level of privacy protection.

Technological  products  should  be  in  all  cases  developed  in  compliance  with  the
applicable data protection rules. But being in compliance  is only the  first step. The
aim  should  be  to  have  products  that  are  not  only  privacy-compliant  and  privacy-
friendly but if possible also privacy-enhancing26.

During  the  discussions  on  PETs  at  the  Commission’s  2002  conference  on  the
implementation of the Directive, it was pointed out that the use of certain technical
tools  makes  it  impossible  for  controllers  to  comply  with  the  law.  An  additional
problem that emerged is the difficulty  of recognising which products are  genuinely
PETs.  Some  participants  called  for  some  form  of  certification  or  seal  based  on  an
independent  verification  of  the  product.  At  present,  some  systems  presenting
themselves as PETs are not even privacy-compliant.

The key-issue is therefore not only how to create technologies that are really privacy-
enhancing, but how to make sure that these technologies are properly identified and
recognised  as  such  by  the  users.  Certification  schemes  play  a  crucial  role  and  the
Commission will continue to follow developments in this area27.

The  Commission  believes  that  such  schemes  should  indeed  be  encouraged  and
further  developed.  The  objective  is  not  just  better  privacy  practices,  but  also  to
increase transparency  and therefore the trust of users and to  give those investing in
compliance  and  even  enhanced  protection  an  opportunity  to  demonstrate  their
performance in this respect and exploit this to their competitive advantage.

4.4.

Comments on some specific provisions

This  report  only  indicates  the  main  findings  in  each  case.  Details  will  be  made
available in a technical annex to be published separately28.

26

27

28

See in this sense the conclusions of the document WP 37 of the Article 29 Working Party, November
2000:"Privacy  on  the  Internet  -  An  integrated  EU  Approach  to  On-line  Data  Protection".  Privacy-
compliant  products  are  products  developed  in  full  compliance  with  the  Directive,  privacy-friendly
products go one step further by introducing some elements that make the privacy aspects more easily-
accessible to the users like for instance by providing very user-friendly information to the data subject
or  very  easy  ways  of  exercising  their  rights.  Privacy-enhancing  products  are  those  that  have  been
designed  in  a  way  that  aims  at  accomplishing  the  largest  possible  use  of  truly  anonymous  data.
http://europa.eu.int/comm/internal_market/privacy/workingroup/wp2000/wpdocs00_en.htm
For instance in Canada, where the Federal Government became the first national government to make
Privacy  Impact  Assessments  (PIAs)  mandatory  for  all  federal  departments  and  agencies  for  all
programmes  and  services  where  privacy  issues  might  be  inherent.  This  policy  requires  agencies  to
initiate PIAs in the early stages of the design or redesign of a programme or service, so as to influence
the  development  process  and  make  sure  that  privacy  protection  is  a  core  consideration.  The  German
Land of Schleswig-Holstein has introduced a certification scheme involving both the public and private
sector on similar lines.
www.europa.eu.int/comm/privacy

16

                                                
4.4.1.

Article 4: Applicable law

This is one of the most important provisions of the Directive from the perspective of
the  Internal  Market  and  its  correct  implementation  is  crucial  for  the  functioning  of
the  system.  The  implementation  of  this  provision  is  deficient  in  several  cases  with
the  result  that  the  kind  of  conflicts  of  law  this  Article  seeks  to  avoid  could  arise.
Some Member States will have to amend their legislation in this regard.

The provision was one of the most criticised during the review process. Submissions
argued  for  a  country  of  origin  rule  that  would  allow  multinational  organisations  to
operate  with  one  set  of  rules  across  the  EU.  Many  also  argued  that  the  “use  of
equipment”  was  not  an  appropriate  or  workable  criterion  for  determining  the
application of EU law to controllers established outside the EU.

As  regards  the  country  of  origin  rule,  the  Directive  already  allows  for  the
organisation  of  processing  under  a  single  data  controller,  which  means  complying
only with the data protection law of the controller’s country of establishment. This of
course  does  not  apply  where  a  company  has  chosen  to  exercise  its  right  of
establishment in more than one Member State.

As regards the “use of equipment” the Commission is aware that this criterion may
not be easy to operate in practice and that it needs further clarification. Should such
clarification  not  be  sufficient  to  ensure  its  practical  application,  it  might  in  due
course be necessary to propose an amendment creating a different connection factor
in order to determine the applicable law.

The Commission’s priority is, however, to secure the correct implementation by the
Member  States  of  the  existing  provision.  More  experience  with  its  application  and
more  reflection  is  needed,  taking  into  account  technological  developments,  before
any proposal to change Article 4 (1) (c) might be made. Notwithstanding the need for
this  further  reflection,  it  would  be  wrong  to  give  the  impression  that  the  whole  of
Article 4 is contested. On the contrary, large areas of its application are uncontested
and are the subject of unanimous agreement among all data protection authorities and
the Commission.

4.4.2.

Articles 6 and 7: Data quality and criteria for legitimate processing

The  analysis  of  national  legislation  shows  that  the  implementation  of  these
provisions is sometimes unsatisfactory. Article 6 (1)(b) allows further processing for
historical, statistical or scientific purposes, but only when appropriate safeguards are
in  place.  Safeguards  have  not  been  provided  for  in  all  Member  States,  whilst  such
further processing is generally authorised. Some Member States have gone beyond or
fallen short of the list of grounds for legitimate processing in Article 7 and they will
have to amend their legislation. The notion of “unambiguous consent” (Article 7 (a))
in  particular,  as  compared  with  the  notion  of  "explicit  consent"  in  Article  8,  needs
further  clarification  and  more  uniform  interpretation.  It  is  necessary  that  operators
know what constitutes valid consent, in particular in on-line scenarios.

4.4.3.

Articles 10 and 11: Provision of information to data subjects

The  implementation  of  Articles  10  and  11  of  the  Directive  showed  a  number  of
divergences.  To  some  extent  this  is  the  result  of  incorrect  implementation,  for

17

instance when a law stipulates that additional information must always be provided
to the data subject, irrespective of the necessity test the Directive foresees, but also
stems  from  divergent  interpretation  and  practice  by  supervisory  authorities.
Submissions stressed the difficulties for multinational companies operating on a pan-
European level that arise from these divergences29.

4.4.4.

Articles 18 and 19: Notification requirements

Many submissions argue for the need to simplify and approximate the requirements
in  Member  States  as  regards  the  notification  of  processing  operations  by  data
controllers. The Commission shares this view, but recalls that the Directive already
offers  the  Member  States  the  possibility  to  provide  for  wide  exemptions  from
notification in cases where low risk is involved or when the controller has appointed
a data protection official. These exemptions allow for sufficient flexibility while not
affecting the level of protection guaranteed. Regrettably, some Member States have
not availed themselves of these possibilities. However, the Commission agrees that,
in  addition  to  wider  use  of  the  existent  exemptions,  some  further  simplification
would be useful and should be possible without amending the existing Articles.

4.4.5.

Articles 25 and 26: The external dimension.

Divergences  between  Member  States  laws  on  the  implementation  of  these  two
provisions  are  very  broad  indeed.  The  approach  adopted  by  some  Member  States,
where the assessment of the adequacy of protection provided for by the recipient is
supposed  to  be  made  by  the  data  controller,  with  very  limited  control  of  the  data
flows  by the State or  the  national supervisory  authority, does not seem  to meet the
requirement placed on Member States by the first paragraph of Article 25 (1)30.

The approach taken  by  some  other  Member  States,  submitting  all  transfers  to  third
countries to an  administrative  authorisation31,  also  seems  inconsistent  with  Chapter
IV of the Directive, which aims at guaranteeing both adequate protection and flows
of  personal  data  to  third  countries  without  unnecessary  burdens.  Notifications  to
national supervisory authorities may  be  required  under  Article  19,  but  notifications
cannot  be  turned  into  de  facto  authorisations  in  those  cases  where  the  transfer  to  a
third  country  is  clearly  permitted,  either  because  the  recipient  is  a  destination
providing adequate protection as confirmed in a binding Commission decision, or is
a party to the standard contractual clauses approved by the Commission, or because
the  data  controller  declares  that  the  transfer  benefits  from  one  of  the  exceptions
provided for in Article 26 of the Directive. Whilst the data protection authority may
legitimately require the notification of these transfers32, there is no need to authorise
these transfers because they are already authorised by Community law.

29

30

31

32

See for example the views of the EPOF (European Privacy Officers Forum):
http://europa.eu.int/comm/internal_market/privacy/docs/lawreport/paper/epof_en.pdf or the EU
Committee of the American Chamber of Commerce:
http://europa.eu.int/comm/internal_market/privacy/docs/lawreport/paper/amcham_en.pdf
"The Member States shall provide that the transfer to a third country of  personal  data  (….)  may  take
place only if (….) the third country in question ensures an adequate level of protection"
Transfers  benefiting  from  the  exceptions  of  Article  26  (1)  or  even  to  other  Member  States  or  third
countries  declared  adequate  by  the  European  Commission  need  an  authorisation  in  some  Member
States.
To  check,  for  example,  that  the  model  contract  fully  corresponds  with  the  model  approved  by  the
Commission or that the recipient is effectively covered by the adequacy decision.

18

                                                
An overly lax attitude in some Member States – in addition to being in contravention
of the Directive – risks weakening protection in the EU as a whole, because with the
free  movement  guaranteed  by  the  Directive,  data  flows  are  likely  to  switch  to  the
“least  burdensome”  point  of  export.  An  overly  strict  approach,  on  the  other  hand,
would  fail  to  respect  the  legitimate  needs  of  international  trade  and  the  reality  of
global  telecommunications  networks  and  risks  creating  a  gap  between  law  and
practice  which  is  damaging  for  the  credibility  of  the  Directive  and  for  Community
law in general.

Indeed,  international  transfers  appear  to  be  an  area  where  the  lack  of  enforcement
action creates such a gap. National authorities are supposed to notify the Commission
when  they  authorise  transfers  under  Article  26  (2)  of  the  Directive.  Since  the
Directive  came  into  operation  in  1998,  the  Commission  has  received  only  a  very
limited  number  of  such  notifications.  Although  there  are  other  legal  transfer  routes
apart  from  Article  26  (2),  this  number  is  derisory  by  comparison  with  what  might
reasonably  be  expected.  Combined  with  other  evidence  pointing  in  the  same
direction33,  this  suggests  that  many  unauthorised  and  possibly  illegal  transfers  are
being  made  to  destinations  or  recipients  not  guaranteeing  adequate  protection.  Yet
there is little or no sign of enforcement actions by the supervisory authorities.

Transfers requiring authorisation and notification do of course create a considerable
administrative  burden,  both  for  data  exporters  and  for  supervisory  authorities.  It  is
therefore desirable that more use be made of the “block authorisations” provided for
in  Articles  25(6)  and  26(4)  of  the  Directive.  These  have  so  far  produced  only  four
adequacy  findings  for  third  countries  (Hungary,  Switzerland,  Canada,  and  the  US
Safe Harbor34) and two sets of standard contractual clauses, one for transfers to data
controllers  in  third  countries  and  one  for  transfers  to  processors.  More  work  is
needed on the simplification of the conditions for international transfers.

33

34

The report approved by the Spring Conference of Data Protection Authorities in May 2001 showed that
most national supervisory authorities were unable to indicate the number of processing operations that
affected  international  transfer  of  data.  Where  figures  were  available,  they  were  insignificant  (600
transfers from France, 1352 from Spain and 150 from Denmark)
There is also a Commission decision on adequate protection in Argentina close to finalisation.

19

                                                
5.

THE PROCESSING OF SOUND AND IMAGE DATA

During the Directive’s preparation, some people were concerned that it might not be
able  to  cope  with  future  technological  developments.  The  extent  of  such
technological developments was uncertain, but there was concern that a text drafted
mainly with text processing in mind could encounter difficulties when applied to the
processing of sound and  image data.  For this reason,  Article  33  contains  a  specific
reference to sound and image data.

The  Commission  has  based  this  review  on  a  study  carried  out  by  an  external
contractor  to  analyse  the  situation  in  the  Member  States  and  on  contributions  from
the  Member  States  themselves  and  the  national  supervisory  authorities.  The
information received shows that the processing of sound and image data falls within
the scope of all national laws implementing the Directive and that the application of
the Directive to these categories of processing has not been particularly problematic.

In  most  Member  States  the  same  (general)  provisions  apply  to  the  processing  of
sound  and  image  data  as  apply  to  other  personal  data.  Only  two  Member  States
(Germany and Luxembourg) have included specific provisions on the processing of
sound  and  image  in  their  laws  implementing  the  Directive.  Three  Member  States
(Denmark,  Sweden  and  Portugal)  have  special  provisions  on  video  surveillance  in
separate  laws.  Despite  the  doubts  raised  during  the  negotiation  of  the  Directive,
Member States have thus reached the conclusion that the Directive’s ambition to be
technology-neutral is achieved, at least as regards the processing of sound and image
data.

No Member State or other contributor has proposed modifications to the Directive in
this  regard. The  joint  proposals  tabled  by  Austria,  Finland,  Sweden  and  the  United
Kingdom express some concern about the ability of the Directive to cope with certain
technological  developments,  but  do  not  contain  any  concrete  proposals  directly
related to this issue.

One of the workshops of the conference on the implementation of the Directive was
entirely  devoted  to  this  issue.  The  main  topic  was  video  surveillance,  the  issue
(followed  by  biometrics)  that  has  received  most  attention  so  far  from  the  national
supervisory  authorities.  Participants  believed  that  there  has  so  far  been  insufficient
public  debate  about  the  limits  that  needed  to  be  placed  on  the  use  of  video
surveillance  in  order  to  safeguard  certain  rights  and  freedoms  in  a  democratic
society. The Article 29 Working Party has also devoted considerable energies to this
issue and has approved a draft working document which  has  been  published  in  the
data  protection  web-site  of  the  Commission,  inviting  comments  from  interested
parties.

There  is  in  addition  a  number  of  legal  and  practical  issues  resulting  from  the
implementation  of  the  Directive  in  the  Member  States  as  regards  sound  and  image
data  that  create  some  uncertainty  for  operators  called  on  to  comply  with  the
legislation and for individuals entitled to exercise their data protection rights.

There  are  for  instance  uncertainties  as  regards  the  definitions  of  the  Directive,  for
example,  to  what  extent  an  isolated  image  or  a  finger  print  can  be  considered
personal data in those cases where the data controller is unable or extremely unlikely

20

to  identify  an  individual;  or  whether  simple  monitoring  constitutes  a  processing
operation  or  how  to  achieve  a  reasonable  interpretation  of  the  concept  of  sensitive
data. The Commission acknowledges that there are answers to all these questions in
the national legislation transposing the Directive, but considers it necessary that more
guidance is provided. This guidance needs to be realistic and pragmatic if it is to help
improve  compliance  and  should  as  far  as  possible  be  co-ordinated  between  the
Member States. The Commission welcomes the Article 29 Working Party’s work in
this  area  so  far  and  encourages  it  to  continue  to  provide  useful  guidance,  with
appropriate input from interested parties.

21

6.

WORK  PROGRAMME  FOR  A  BETTER  IMPLEMENTATION  OF  THE  DATA  PROTECTION
DIRECTIVE (2003-2004)

The  analysis  of  the  implementation  in  the  Member  States  contained  in  this  report
reveals  problems  which  need  to  be  addressed  if  the  Directive  is  to  have  its  full
intended  effects.  The  work  plan  that  follows  comprises  actions  that  will  take  place
from the adoption of this report until the end of 2004 and will require the joint efforts
of the European Commission, the Member States (including the candidate countries)
and  their  national  supervisory  authorities  and  in  some  cases  also  those  of  data
controllers' representatives.

A  general,  serious  concern  indicated  above  is  that  the  level  of  compliance,
enforcement  and  awareness  appears  not  to  be  at  an  acceptable  level.  As  a  general
action point applicable to all initiatives listed below, the Commission will work with
the  Member  States,  supervisory  authorities  and  interested  parties  to  determine  the
causes of and design feasible solutions for this set of problems.

Commission's initiatives

Action 1 : Discussions with Member States and Data Protection Authorities

During 2003 the Commission services will hold bilateral meetings with the Member
States  with  the  main  purpose  of  discussing  necessary  changes  to  bring  national
legislation fully in line  with  the  requirements  of  the  Directive.  The  involvement  of
the competent data protection authority may be necessary on some issues. The need
for more vigorous enforcement may also be a topic in these bilateral discussions. The
lack of resources allocated to supervisory authorities should also be discussed.

Such meetings may be supplemented by discussions on the incorrect implementation
of  the  Directive  at  the  “package  meetings”  that  are  periodically  organised  with
Member  States  by  the  Secretariat  General  of  the  Commission  and/or  DG  Internal
Market.

Discussions  in  the  Article  29  Working  Party  and  in  the  Article  31  Committee  will
enable certain issues affecting a large number of Member  States  to  be tackled on a
multilateral  basis,  it  being  understood  that  there  can  be  no  question  of  such
discussions leading to a de facto amendment of the Directive. In addition to ad hoc
discussions on specific issues, the Commission proposes that each group devotes one
complete meeting to this subject in the course of 2003.

Action 2 : Association of the candidate countries with efforts to achieve a better
and more uniform implementation of the Directive

This  report  has  focused  almost  entirely  on  the  situation  in  the  15  Member  States.
Before the work plan  has been completed, 10 new Member States will have joined
the  Union.  Representatives  of  the  supervisory  authorities  of  several  candidate
countries have been attending meetings of the Article 29 Working Party since 2002.
From the date of signature of the Treaties of Accession the acceding countries will be
invited to all meetings of both the Working Party and the Article 31 Committee. To
the  extent  reasonably  possible,  bilateral  discussions  and  possibly  peer  reviews  will
also be continued up to and beyond accession, in order to achieve the best possible

22

alignment of the legislation of the new Member States with the Directive and to keep
formal infringement procedures to a minimum.

Action 3 : Improving the notification of all legal acts transposing the Directive
and notifications of authorisations granted under Article 26(2) of the Directive

The  Commission's  services,  in  close  co-operation  with  the  Data  Protection
Authorities and the Member States, will continue with the collection of information
about  the  implementation  of  the  Directive  and  will  in  particular  identify  the  areas
where  there  are  clear  gaps  in  the  implementing  measures  notified  and  seek  the  co-
operation  of  the  Member  States  in  filling  these  gaps  as  quickly  as  possible.  The
Commission will facilitate the exchange of best practice where this might help.

The  Commission will  use its formal  powers  under  Article  226  of  the  Treaty  if  this
co-operative approach (6.1, 6.2 and 6.3) fails to produce the necessary results.

The  Member  States  and  their  supervisory  authorities  also  need  to  put  in  place  the
necessary  arrangements  to  notify  (as  required  by  Article  26(3)  of  the  Directive)
national authorisations for international transfers  granted under Article 26(2)  of the
Directive.  The  Commission  will  discuss  this  with  the  Member  States  and  their
supervisory authorities and ensure the exchange of best practice.

The  Commission  will  create  a  new  page  on  its  web-site35  where  it  will  post  in  a
structured form not only all information collected for the preparation of this report,
but  also  information  about  the  work  to  be  carried  out  under  this  work  plan.  It  will
also  invite  national  supervisory  authorities  to  make  available  for  inclusion  in  this
web-site decisions and recommendations adopted by data protection authorities and
significant  items  of  guidance  issued  by  them,  with  an  emphasis  on  areas  where  a
more even interpretation and application of the law is necessary.

Article 29 Working Party's contribution36

The  Commission  welcomes  the  Working  Party’s  contributions  to  achieving  a  more
uniform  application  of  the  Directive.  It  wishes  to  recall  the  importance  of
transparency  in  this  process  and  encourages  the  efforts  the  Working  Party  is
currently undertaking further to enhance the transparency of its work.

Action 4 : Enforcement

The Commission calls on the Article 29 Working Party to hold periodic discussions
on  the  overall  question  of  better  enforcement.  This  should  inter  alia  lead  to  the
exchange and adoption of best practices. The Working Party should also consider the
launching of sectoral investigations at EU level and the approximation of standards
in  this  regard.  The  aim  of  such  joint  investigations  would  be  to  provide  a  more
accurate picture of the implementation of data protection law in the Community and
make agreed recommendations and practical guidance to the sectors concerned with
a view to improving compliance in the least burdensome ways possible.

35

36

www.europa.eu.int/comm/privacy
This list is without prejudice to the general work programme of the Article 29 Working Party, available
at http://europa.eu.int/comm/internal_market/privacy/docs/wpdocs/2003/wp71_en.pdf

23

                                                
Action 5 : Notification and publicising of processing operations

The  European  Commission  shares  to  a  large  extent the  criticism  expressed  by  data
controllers  during  the  review  concerning  the  divergent  content  of  notification
obligations placed on data controllers. The Commission recommends a wider use of
the  exceptions  and  in  particular  of  the  possibility  foreseen  in  Article  18(2)  of  the
Directive,  that  is  the  appointment  of  a  data  protection  officer  which  creates  an
exemption from notification requirements.

The  Commission  calls  on  the  Article  29  Working  Party  to  contribute  to  a  more
uniform  implementation  of  the  Directive  by  putting  forward  proposals  for  a
substantial simplification of the notification requirements in the Member States and
for  co-operation  mechanisms  to  facilitate  notifications  by  multinational  companies
with establishments in several Member States. These proposals may need to include
proposed amendments to  national  legislation.  The  Commission  is  prepared  itself  to
make proposals  if the  Working  Party is  unable to do so  within  a  reasonable  period
(12 months).

Action 6 : More harmonised information provisions

The  Commission  shares  the  view  that  the  present  patchwork  of  varying  and
overlapping requirements as regards the information that controllers have to provide
to data subjects is unnecessarily burdensome for economic operators, without adding
to the level of protection.

In so far as information requirements placed on data controllers are inconsistent with
the  Directive,  it  is  hoped  that  this  can  be  remedied  expeditiously  through  dialogue
with  the  Member  States  and  corrective  legislative  action  by  them.  In  addition,  the
Commission calls on the Article 29 Working Party to co-operate in the search for a
more uniform interpretation of Article 10.

Action 7 : Simplification of the requirements for international transfers

In parallel to the discussions that are intended to bring about the necessary changes
in Member State law to ensure conformity with the Directive, the Commission calls
on the Article 29 Working Party to use the last report of the international complaint
handling  workshop  as  a  basis  for  further  discussions  with  a  view  to  a  substantial
approximation  of  existing  practices  in  the  Member  States  and  the  simplification  of
the conditions for international data transfers.

The  Commission  itself  intends  to  make  more  extensive  use  of  its  powers  under
Articles 25(6) and 26(4) which provide the best means of simplifying the regulatory
framework  for  economic  operators,  while  ensuring  adequate  protection  for  data
transferred outside the EU.

With the co-operation of the Article 29 Working Party and the Article 31 Committee,
the Commission expects to see progress in four areas:

a)

a  more  extensive  use  of  findings  of  adequate  protection  in  respect  of  third
countries  under  Article  25(6),  while  maintaining  of  course  an  even-handed
approach vis-à-vis third countries in line with the EU’s WTO obligations;

24

b)

c)

d)

further decisions on the basis of Article 26(4) so that economic operators have
a wider choice of standard contractual clauses, to the extent possible based on
clauses submitted by business representatives, for example those submitted by
the International Chamber of Commerce and other business associations;

the role of binding (intra) corporate rules (e.g. internal rules that bind a given
multi-national corporate group doing business in several different jurisdictions,
both  inside  and  outside  the  EU)  in  providing  adequate  safeguards  for  intra-
group transfers of personal data;

the  more  uniform  interpretation  of  Article  26(1)  of  the  Directive  (permitted
exceptions  to  the  adequate  protection  requirement  for  transfers  to  third
countries) and the national provisions implementing it.

All this work should be carried out  with an appropriate  degree of transparency  and
with periodic input from stakeholders.

Other initiatives

Action 8 : Promotion of Privacy Enhancing Technologies

The  Commission  is  already  doing  work  in  the  field  of  privacy-enhancing
technologies,  especially  at  the  research  level,  like  for  instance  the  RAPID37  and
PISA38 projects.

It proposes to organise a technical workshop in 2003 in order to increase awareness
regarding  PETs  and  to  offer  an  opportunity  to  discuss  in  depth  the  measures  that
could be taken to promote the development and use of PETs, such as for instance the
role that seals, certification systems or PIAs39 could play in Europe.

It invites the Working Party to continue discussing the issue of PETs and to reflect
on  possible  measures  the  national  supervisory  authorities  could  take  in  order  to
promote the use of these technologies at national level.

After  the  technical  workshop,  and  taking  on  board  the  input  received,  the
Commission  will  make  further  proposals  for  the  promotion  of  privacy-enhancing
technologies at European level. These proposals will pay special attention to the need
to  encourage  governments  and  public  sector  institutions  to  set  a  good  example  by
using  PETs  in  their  own  processing  operations,  for  instance  in  e-government
applications.

37

38

39

Roadmap for Advanced Research in Privacy and Identity Management
Privacy-Enhancing Intelligent Software Agents
Privacy Impact Assessments

25

                                                
Action 9 : Promotion of self-regulation and European Codes of Conducts

The Commission is disappointed that so few organisations have come  forward with
sectoral  Codes  of  Conduct  for  application  at  Community  level.  It  will  keep  on
encouraging  and  giving  advice  on  (within  the  limits  imposed  by  the  resources
available)  draft  codes  of  conduct  submitted  for  the  consideration  of  the  Article  29
Working Party40. It encourages sectors and interest groups to take a much more pro-
active  role,  as  it  believes  that  self-regulation,  and  in  particular  codes  of  conduct
should play an important role in the future development of data protection in the EU
and outside, not least in order to avoid excessively detailed legislation.

To the same end, the Commission expressed, in its consultation document addressed
to  the  European  social  partners  on  personal  data  protection  in  the  employment
context,  its  strong  hope  that  they  will  engage  in  negotiations  with  a  view  to
concluding  a  European  agreement  in  this  field.  The  Commission  regrets  that  the
social partners did not agree to negotiate on this issue and hopes that the avenue of
collective agreements in this field will be further explored.

Action 10 : Awareness raising

The  Commission  intends  to  launch  a  Eurobarometer  survey  along  the  lines  of  the
questions  contained  in  the  on-line  consultation  carried  out  in  2002.  It  hopes  that
some data protection authorities will be associated with this initiative and that there
will  be  joint  efforts  to  make  data  protection  issues  the  subject  of  public  debate.  It
encourages  Member  States  to  devote  more  resources  in  awareness  raising,  in
particular via the budgets of the national supervisory authorities.

40

The Article 29 Working Party is considering at the moment the following submissions: Code of conduct
on  direct  marketing  submitted  by  FEDMA;  Code  of  conduct  on  the  processing  of  personal  data  by
executive search consultants (head-hunters) submitted by AESC and Code of conduct on pan-European
calling  line  identification  submitted  by  ETP.  A  previous  request  from  IATA  did  not  fulfil  the
requirements for a code of conduct under Article 27 of the Directive but received a positive comment
from 
its  opinion  WP  49  adopted  on  13  September  2001.
http://europa.eu.int/comm/internal_market/privacy/docs/wpdocs/2001/wp49en.pdf

the  Article  29  Working  on 

26

                                                
7.

CONCLUSION

This  report  constitutes  a  first  step  in  the  analysis  of  information  concerning  the
implementation of Directive 95/46/EC and the identification of the actions necessary
to  address  the  main  problems  that  have  emerged.  The  Commission  hopes  that  this
analysis  will  help  governments,  data  protection  authorities  and  operators  to  clarify
what needs to be done to achieve a better application of the Directive in the EU, with
more vigorous enforcement, better compliance and greater awareness of their rights
and obligations among data subjects and data controllers.

The  Commission  expects  that,  where  necessary,  Member  States  will  amend  their
legislation  to  achieve  compliance  with  the  provisions  of  the  Directive  and  provide
supervisory authorities with sufficient resources. The Commission also expects that
Member States and supervisory authorities will make all reasonable efforts to create
an environment in which data  controllers –  and not least those operating on  a  pan-
European  level  and/or  international  level  –  can  conform  with  their  obligations  in  a
less complex and burdensome way and to avoid imposing requirements that could be
dropped without  any detrimental  effects for  the high level  of  protection  guaranteed
by the Directive.

The  Commission  encourages  citizens  to  make  use  of  the  rights  conferred  by  the
legislation  and  data  controllers  to  take  all  necessary  steps  to  guarantee  compliance
with  the  legislation.  The  Commission  will  closely  monitor  further  technological
developments  and  the  results  of  the  work  programme  contained  in  this  report  and
make proposals for further follow-up  towards the  end of 2004, by which  time  both
the Commission and the Member States will have the benefit of  considerably more
experience than at present with the implementation of the Directive.

27