WRITTEN QUESTION P-2893/03 by Ole Krarup (GUE/NGL) to the Commission. Violation of the data protection rules.
Date: 2003-09-23
Institutions: European Parliament, Provisional data
Subjects: United States, data processing, data protection, data transmission, fundamental rights, personal data, public safety

20.3.2004

EN

Official Journal of the European Union

C 70 E/157

2. With regard to the Honourable Member’s questions on both the transposition and implementation of
Community law in Greece in matters relating to safety and the prevention of accidents at work, it should
be noted that the Directives must be transposed by the Member States and it is their responsibility to
ensure adequate control and monitoring of the national provisions transposing Community Directives on
the health and safety of workers at work (cf. Article 4 of Directive 89/391/EEC on the introduction of
measures to encourage improvements in the safety and health of workers at work (3)). Accordingly, it is for
the Greek authorities, in this case the labour inspectorates, to ensure that these measures are correctly and
effectively applied.

However, if the Commission had firm evidence of a general failure to implement national law transposing
the Community Directives,
in particular those under
Article 226.

it could make use of

the Treaty provisions,

Greece has notified the Commission of its measures to transpose the Directives on health and safety at
work. However, following a complaint which may expose a general failure to implement Greek law
transposing the Community Directives on the health and safety of workers, the Commission has sent the
Greek Government a letter of formal notice regarding implementation of Directive 89/391/EEC and is now
awaiting the Greek authorities’ response.

(1) COM(2002) 118 final, of 11.03.2002.
(2) European Statistics on Accidents at Work.
(3) OJ L 183, 29.6.1989, p. 1.

(2004/C 70 E/164)

WRITTEN QUESTION P-2893/03

by Ole Krarup (GUE/NGL) to the Commission

(23 September 2003)

Subject: Violation of the data protection rules

Would the Commission tell us exactly what parts of the European rules on data protection are being
violated due to the demands from the USA regarding transfer of personal data by airlines in connection
with transatlantic flights?

Would the Commission tell us when and how that will be brought to an end?

Answer given by Mr Bolkestein on behalf of the Commission

(6 November 2003)

It should be noted, first, that the data protection directive 95/46/CE (1) does not apply to processing
operations concerning public security, defence, State security and the activities of the State in areas of
criminal
law, such as the processing of personal data carried out directly by the police. Where the
processing of personal data does fall within its scope, as in the case of the processing of passenger name
records by airlines and computer reservation systems, the data protection directive imposes on Member
States the obligation to adopt implementing legislation that must include a number of rules. These include
the principles that personal data must be processed fairly and lawfully, and that the transfer of personal
data to a third country may take place only if the third country in question ensures an adequate level of
protection. ‘Adequate’ protection means that a number of data protection principles of substance are in
place, and that sufficient mechanisms exist in the country of destination to ensure that those principles are
complied with. The Directive provides a number of exceptions, for example it is also possible to transfer
the data when this is legally required on important public interest grounds. Such legal obligation may arise
from national
instruments may also allow
exceptions to be made to restrict the scope of some of the obligations and rights provided for in the
in particular the principle that data should be used for purposes compatible with those for
Directive,
which they were collected. In those cases it is required that legislative measures are adopted, and that such
a restriction constitutes a necessary measure to safeguard important public interests, such as national
security, public security, prevention, investigation detection and prosecution of criminal offences, or to
safeguard a monitoring,
regulatory function connected, even occasionally, with the
aforementioned safeguard measures.

legislation or from an international agreement. These legal

inspection or

C 70 E/158

Official Journal of the European Union

EN

20.3.2004

When allowing United States’ authorities to access the whole passenger information records of all
passengers flying to and from the United States in the current conditions, airlines must respect national
legislation adopted pursuant to those provisions of the Directive, and may be subject to enforcement
action by national data protection supervisory authorities in Member States for failure to respect these
provisions.

As stated in the intervention of the Member of the Commission in charge of the Internal Market of
9 September 2003 before the Parliament’s Committee on Citizen’s Freedoms and Rights, Justice and Home
Affairs (LIBE Committee), the Commission is negotiating with the United States authorities in order to
obtain improvements in the way personal data will be processed in the United States, with the aim of
allowing the Commission to adopt a formal decision under Article 25 paragraph 6 of the Data Protection
Directive recognising the protection offered as ‘adequate’.

Efforts to obtain improvements focus currently on four major issues, namely:

1.

2.

Purpose limitation: so far, the United States has refused to limit its use of Passenger Name Record
(PNR) data to the fight against terrorism, but want to cover also ‘other serious criminal offences’;

Scope of data required: the United States requires 39 different PNR elements, which seems to go
beyond what is necessary for or proportionate to the purpose;

3. The data storage periods which are too long (seven years); and

4. The fact that United States’ undertakings are insufficiently legally binding (cid:1) since the available extra-
judicial redress mechanisms are not fully independent, we must insist that rights are actionable before
United States’ courts.

An adequacy decision will only be possible if the United States is ready to improve significantly its
‘undertakings’. In the absence of an adequacy finding, a bilateral international agreement might provide an
appropriate framework to ensure legal security for the data transfers, but this too could only be concluded
on the basis of a significant improvement of the present United States undertakings as regards the
protection of the data transferred.

The Commission has informed the United States side that it is necessary to find a solution by December
2003 and the United States side has agreed to this timetable.

(1) Directive 95/46/EC of the Parliament and of the Council of 24 October 1995 on the protection of individuals with

regard to the processing of personal data and on the free movement of such data, OJ L 281, 23.11.1995.

(2004/C 70 E/165)

WRITTEN QUESTION E-2894/03

by Konstantinos Hatzidakis (PPE-DE) to the Commission

Subject: Work experience programme (STAGE) in Greece

(29 September 2003)

The data processing and communications work experience programme for unemployed graduates
(STAGE), introduced in 2002 in the ‘information society’ operational programme of the third Community
Support Framework in Greece, was presented by the Greek Government as a particularly successful
venture, reportedly providing full financial support for as many as 4 100 jobless for the duration of the
programme (nine months). However, there have been complaints that the programme, which has been in
operation for a number of years does not entitle participants to employment stamps and is not recognised
by the Higher National Council for the Selection of Public Service Personnel (ASEP) as previous work
it does not entitle those who successfully complete the
experience or employment. Furthermore,
programme to an OAED (Manpower Employment Organisation) professional training certificate, despite
the fact that this is the body responsible for organising the programme.

Does the Commission not consider that the trainees in question are being treated unfairly and that it
reflects badly on the programme itself? Will it make representations to the Greek authorities accordingly?