2004/644/EC: Council Decision of 13 September 2004 adopting implementing rules concerning Regulation (EC) No 45/2001 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data
Date: 2004-09-13
Institutions: Council of the European Union
Subjects: Council of the European Union, data protection, personal data

L 296/16

EN

Official Journal of the European Union

21.9.2004

II

(Acts whose publication is not obligatory)

COUNCIL

COUNCIL DECISION

of 13 September 2004

adopting implementing rules concerning Regulation (EC) No 45/2001 of the European Parliament
and of the Council on the protection of individuals with regard to the processing of personal data
by the Community institutions and bodies and on the free movement of such data

(2004/644/EC)

THE COUNCIL OF THE EUROPEAN UNION,

(4)

Having regard to the Treaty
Community, and in particular Article 286 thereof,

establishing the European

Having regard to Regulation (EC) No 45/2001 of the European
Parliament and of the Council (1), and in particular Article 24(8)
thereof,

Whereas:

(1)

(2)

(3)

sets out

‘Regulation’,

Regulation (EC) No 45/2001, hereinafter referred to as
and rules
the
applicable to all Community institutions and bodies
and provides for the appointment by each Community
institution and Community body of the Data Protection
Officer.

the principles

the Regulation requires that

further
Article 24(8) of
implementing rules
concerning the Data Protection
Officer shall be adopted by each Community institution
or body in accordance with the provisions in the Annex
in particular
thereto. The implementing rules
concern the tasks, duties and powers of
the Data
Protection Officer.

shall

The implementing rules also specify the procedures for
the exercise of rights of the data subjects, as well as for
the fulfilment of obligations of all relevant actors within
the Community institutions or bodies relating to the
processing of personal data.

(1) OJ L 8, 12.1.2001, p. 1.

to Regulation (EC) No 1049/2001 (2),

The implementing rules of the Regulation are without
prejudice
to
Decision 2004/338/EC, Euratom (3), and in particular
Annex II thereto, to Decision 2001/264/EC (4), and in
particular Section VI of Part II of the Annex thereto, as
well as to Decision of the Secretary-General of the Coun-
cil/High Representative
for Common Foreign and
Security Policy of 25 June 2001 (5),

HAS DECIDED AS FOLLOWS:

SECTION 1

GENERAL PROVISIONS

Article 1

Subject matter and scope

This Decision lays down further implementing rules concerning
Regulation (EC) No 45/2001 of the European Parliament and of
the Council (hereinafter referred to as the Regulation) as regards
the Council of the European Union.

(2) Regulation (EC) 1049/2001 of the European Parliament and of the
Council of 30 May 2001 regarding public access to European
Parliament, Council
(OJ L 145,
31.5.2001, p. 43).

and Community documents

(3) Council Decision 2004/338/EC, Euratom of 22 March 2004
adopting the Council's Rules of Procedure (OJ L 106, 15.4.2004,
p. 22).

(4) Council Decision 2001/264/EC of 19 March 2001 adopting the
(OJ L 101, 11.4.2001, p. 1).
amended by Decision 2004/194/EC (OJ L 63,

security regulations

Council's
Decision as
28.2.2004, p. 48).

(5) Decision of the Secretary-General of the Council/High Representative
for Common Foreign and Security Policy of 25 June 2001 on a code
of good administrative behaviour for the General Secretariat of the
Council of the European Union and its staff in their professional
relations with the public (OJ C 189, 5.7.2001, p. 1).

21.9.2004

EN

Official Journal of the European Union

L 296/17

Article 2

Definitions

instructions from the Appointing Authority of the GSC or from
anyone else regarding the internal application of the provisions
of the Regulation or his/her cooperation with the EDPS.

For the purpose of this Decision and without prejudice to the
definitions provided by the Regulation:

a)

the Directorate,

shall mean the institution,
the Division,

‘controller’
the Directorate-
the Unit or any
General,
other organisational entity which alone or
jointly with
others determines the purposes and means of the processing
of personal data, as identified in the notification to be sent
to the Data Protection Officer (hereafter referred to as the
DPO) in accordance with Article 25 of the Regulation;

4.
The evaluation of the performance of the DPO's tasks and
duties shall take place after prior consultation of the EDPS. The
DPO may be dismissed from his/her post only with the consent
of the EDPS, if he/she no longer fulfils the conditions required
for the performance of his/her duties.

5. Without prejudice to the procedure foreseen for his/her
appointment, the DPO shall be informed of all contacts with
external parties relating to the application of the Regulation,
notably with regard to interaction with the EDPS.

b) ‘contact person’ shall mean the administrative assistant(s) of
the Directorate-General or otherwise any staff member
designated in consultation with the DPO by his/her Direc-
torate-General as its representative to deal
in close coop-
eration with the DPO with data protection issues;

6. Without prejudice to the relevant provisions of the Regu-
lation, the DPO and his/her staff shall be subject to the rules
and regulations applicable to officials and other servants of the
European Communities.

c)

‘GSC staff’ shall mean all General Secretariat of the Council
(hereafter referred to as ‘GSC’) officials and any other person
covered by the Staff Regulations of officials of the European
Communities and the Conditions of Employment of other
servants of the European Communities laid down in Regu-
lation (EEC, Euratom, ECSC) No 259/68 (1)
(hereinafter
referred to as the Staff Regulations) or working for the
GSC on
consultants,
contractors, officials seconded by Member States).

contractual

(trainees,

basis

a

SECTION 2

THE DATA PROTECTION OFFICER

Article 3

Appointment and status of the Data Protection Officer

1.
The Deputy Secretary-General of the Council appoints the
DPO and registers him with the European Data Protection
Supervisor (hereafter referred to as EDPS). The DPO is directly
attached to the Deputy Secretary-General of the Council.

The term of office of the DPO shall be three years and is

2.
renewable twice.

3. With respect to the performance of his/her duties, the
DPO shall act in an independent manner and in cooperation
with the EDPS. In particular, the DPO may not receive any

(1) OJ L 56, 4.3.1968, p. 1. Regulation as last amended by Regulation

(EC, Euratom) No 723/2004 (OJ L 124, 27.4.2004, p. 1).

Article 4

Tasks

The DPO shall:

(a) ensure that controllers and data subjects are informed of
their rights and obligations pursuant to the Regulation. In
the discharge of this task, he/she shall in particular establish
information and notification forms,
interested
parties and raise the general awareness of data protection
issues;

consult

(b) respond to requests from the EDPS and, within the sphere
of his/her competence, cooperate with the EDPS at
the
latter's request or on his/her own initiative;

(c) ensure in an independent manner the internal application of

the provisions of the Regulation in the GSC;

(d) keep a Register of the processing operations carried out by
the controllers and grant access to it to any person directly
or indirectly through the EDPS;

(e) notify the EDPS of

the processing operations likely to
present specific risks referred to in Article 27(2) of the
Regulation;

(f)

thus, ensure that
the data
subjects are unlikely to be adversely affected by the
processing operations.

the rights and freedoms of

L 296/18

EN

Official Journal of the European Union

21.9.2004

Article 5

Duties

In addition to the general tasks to be fulfilled, the DPO

1.
shall:

(a) act as an advisor to the Appointing Authority of the GSC
and to controllers on matters concerning the application of
data protection provisions. The DPO may be consulted by
the Appointing Authority, the controllers concerned, the
Staff Committee and by any individual, without going
through the official channels, on any matter concerning
the interpretation or application of the Regulation;

(b) on his/her own initiative or on the initiative of

the
Appointing Authority, the controllers, the Staff Committee
or any individual,
investigate matters and occurrences
directly relating to his or her tasks and which come to
his/her notice,
and report back to the Appointing
Authority or the person who commissioned the investi-
gation. If deemed appropriate, all other parties concerned
should be informed accordingly. If the complainant is an
individual, or in case the complainant acts on behalf of an
individual, the DPO must, to the extent possible, ensure
the Data Subject
the request, unless
confidentiality of
concerned gives his/her unambiguous consent to treat the
request otherwise;

(b) may request legal opinions from the Council Legal Service;

(c) may call on Information Technologies external experts’
services upon prior agreement of the authorising officer in
compliance with Council Regulation (EC, Euratom) No
1605/2002 of 25 June 2002 on the Financial Regulation
applicable to the general budget of the European Commu-
nities (1) and its implementing Rules;

(d) may without prejudice to the EDPS's duties and powers,
propose to the GSC administrative measures and issue
general recommendations on the appropriate application
of the Regulation;

(e) may make, in specific cases, any other recommendation for
improvement of data protection to the GSC

the practical
and/or to all other parties concerned;

(f) may bring to the attention of the Appointing Authority of
the GSC any failure of a staff member to comply with the
obligations under the Regulation and suggest an adminis-
trative investigation being launched in view of the possible
application of Article 49 of the Regulation.

(c) cooperate in the discharge of his/her functions with the
Data Protection Officers of other Community institutions
and bodies,
in particular by exchanging experience and
best practices;

Article 7

Resources

(d) represent

the GSC in all data protection related issues;
without prejudice to Decision 2004/338/EC, Euratom, this
may include the DPO's participation in relevant committees
or for at international level;

(e) submit an annual report on his/her activities to the Deputy
Secretary-General of the Council and make it available to
staff.

2. Without prejudice to Articles 4(b), 5(1)(b), (c) and 15, the
DPO and his or her staff shall not divulge information or
documents which they obtain in the course of their duties.

Article 6

Powers

In performing his or her tasks and duties the DPO:

The DPO shall be provided with adequate staff and resources
necessary to carry out his or her duties.

SECTION 3

RIGHTS AND OBLIGATIONS OF ACTORS IN THE FIELD OF
DATA PROTECTION

Article 8

Appointing Authority

1.
In case of a complaint within the meaning of Article 90 of
the Staff Regulations relating to a violation of the Regulation,
the Appointing Authority shall consult the DPO, who should
deliver his/her opinion in writing no later than 15 days after
receipt of the request. If, after the end of this period, the DPO
has not provided his/her opinion to the Appointing Authority,
it is no longer required. The Appointing Authority shall not be
bound by the DPO's opinion.

(a) shall have access at all

times to the data forming the
subject-matter of processing operations and to all offices,
data-processing installations and data carriers;

2.
The DPO shall be informed whenever an issue is under
consideration which has, or might have, data protection impli-
cations.

(1) OJ L 248, 16.9.2002, p. 1.

21.9.2004

EN

Official Journal of the European Union

L 296/19

Article 9

Controllers

2. Without prejudice to the responsibilities of the controllers,
the contact persons shall:

1.
The controllers are responsible for ensuring that all
processing operations under their control comply with the
Regulation.

2.

In particular, the controllers shall:

(a) give prior notice to the DPO of any processing operation or
set of such operations intended to serve a single purpose or
several related purposes, as well as of any substantial change
of
For processing
operations carried out prior to the entry into force of the
Regulation on 1 February 2001, the controller shall notify it
without delay;

an existing processing operation.

(b) assist the DPO and the EDPS in performing their respective
duties, in particular by giving information in reply to their
requests within 30 days, at the latest;

(c)

technical

appropriate

implement
organisational
measures and give adequate instructions to GSC staff to
the processing and a
ensure both the confidentiality of
level of security appropriate to the risks represented by
the processing;

and

(a) assist the controllers in complying with their obligations;

(b) where appropriate,

facilitate communication between the

DPO and the controllers.

Article 11

GSC staff

1.
In particular, all GSC staff shall contribute to the appli-
cation of the confidentiality and security rules for the processing
of personal data as provided for in Articles 21 and 22 of the
Regulation. No member of the GSC staff with access to personal
data shall process them other than on instructions from the
controller,
or
to
Community law.

by national

required

do so

unless

(d) where appropriate, consult the DPO on the conformity of
processing operations with the Regulation, and in particular
when they have reason to believe that certain processing
operations are incompatible with Articles 4 to 10 of the
the DPO and/or the
Regulation. They may also consult
Information Technologies security experts in Directorate-
General A, the Security Office and Security of Information
(Infosec) Office on issues relating to the confidentiality of
the processing operations and on the security measures
taken pursuant to Article 22 of the Regulation.

Article 10

Contact persons

1. Without prejudice to the responsibilities of the DPO, the
contact person shall:

(a) assist his/her Directorate-General or Unit

in keeping an

inventory of all existing processing of personal data;

(b) assist his/her Directorate-General or Unit in identifying the

respective controllers;

(c) have the right to obtain from the controllers and from staff
adequate and necessary information required for the accom-
plishment of his/her administrative tasks within his/her
Directorate-General or Unit. This shall not
include the
right of access to personal data processed under the respon-
sibility of the controller.

2.
Any member of GSC staff may lodge a complaint with the
the
EDPS regarding an alleged breach of
Regulation governing the processing of personal data, without
acting through official channels, as specified by the Rules set by
the EDPS.

the provisions of

Article 12

Data subjects

Further to the data subjects’ right

1.
to be appropriately
informed about any processing of personal data relating to
themselves, in accordance with Articles 11 and 12 of the Regu-
lation, the data subjects may approach the controller concerned
to exercise their rights according to Articles 13 to 19 of the
Regulation, as specified in Section 5 of this Decision.

2. Without prejudice to any judicial remedy, every data
subject may lodge a complaint with the EDPS if he/she
considers that his/her rights under the Regulation have been
infringed as a result of the processing of his/her personal data
by the Council, as specified by the Rules set by the EDPS.

3.
No one shall suffer prejudice on account of a complaint
lodged with the EDPS or of a matter brought to the attention of
the DPO alleging a breach of the provisions of the Regulation.

L 296/20

EN

Official Journal of the European Union

21.9.2004

SECTION 4

REGISTER OF NOTIFIED PROCESSING OPERATIONS

Article 13

Notification procedure

to the Register

Except where on-line access is granted, applications for
2.
access
in any written form,
are made
including electronically, in one of the languages referred to in
Article 314 of the Treaty and in a sufficiently precise manner to
enable the DPO to identify the concerned processing operations.
An acknowledgement of receipt shall be sent to the applicant
without delay.

1.
The Controller shall notify to the DPO any processing
operation of personal data on the basis of a notification form
made accessible on the GSC's Intranet site (Data Protection). The
notification shall be transmitted to the DPO electronically. A
confirmatory notification shall be sent to the DPO by note
within 10 working days. Upon receipt of
the confirmatory
notification, the DPO shall publish it in the Register.

2.
The notification shall include all information specified in
Article 25(2) of the Regulation. Any change affecting this infor-
mation shall be notified promptly to the DPO.

3.
Further rules and procedures regarding the notification
procedure to be followed by the controllers shall form part of
the general recommendations issued by the DPO.

Article 14

The content and the purpose of the Register

1.
The DPO shall keep a Register of processing operations
performed upon personal data, which shall be set up on the
basis of the notifications received from the controllers.

2.
The Register shall contain at least the information referred
to in Article 25(2)(a) to (g) of the Regulation. However, the
information entered in the Register by the DPO may excep-
tionally be limited when it
is necessary to safeguard the
security of a specific processing operation.

3.
The Register shall serve as an index of the personal data
processing operations conducted at the Council. It shall provide
information to data subjects and facilitate the exercise of their
rights set out in Articles 13 to 19 of the Regulation.

Article 15

Access to the Register

3.
If an application is not sufficiently precise, the DPO shall
ask the applicant to clarify the application and shall assist the
applicant in doing so. In the event of an application relating to
a very large number of processing operations, the DPO may
confer with the applicant informally, with a view to finding a
fair solution.

4.
Any person may request from the DPO a copy of the
information which is available in the Register on any notified
processing operation.

SECTION 5

PROCEDURE FOR DATA SUBJECTS TO EXERCISE THEIR
RIGHTS

Article 16

General provisions

The data subjects’ rights specified in this Section can only
1.
be exercised by the individuals concerned or,
in exceptional
cases, on behalf of the individuals with proper authorisation.
shall be addressed in writing to the controller
Requests
concerned with a copy to the DPO.
If necessary, the DPO
shall assist
in identifying the controller
concerned. The DPO shall make specific forms available.
Controllers shall grant the request only if the form has been
filled in completely and the complainant's identity has been
verified properly. The exercise by data subjects of their rights
shall be free of charge.

the data subject

the application. Unless otherwise provided,

2.
The controller shall send to the applicant an acknowl-
edgement of receipt within five working days from the regis-
the
tration of
controller shall reply to the request at the latest within fifteen
working days from the registration of the request and shall
either give satisfaction or state in writing the reasons for the
total or partial refusal, in particular in cases where the applicant
is not considered as data subject.

Appropriate measures shall be taken by the DPO to
1.
ensure that any person has access to the Register, either
directly or indirectly through the EDPS. In particular, the DPO
shall provide information and assistance to interested persons
on how and where applications for access to the Register can be
made.

In case of irregularities or obvious misuse by the data
3.
subject in exercising his/her rights and where the processing
is alleged to be unlawful by the data subject, the controller
must consult the DPO on the request and/or refer the data
subject to the DPO, who will decide on the eligibility of the
request and the appropriate follow-up to be given.

21.9.2004

EN

Official Journal of the European Union

L 296/21

Any person concerned may consult the DPO with regard
4.
to the exercise of his/her rights in a specific case. Without
prejudice to any judicial remedy, every data subject may lodge
a complaint with the EDPS,
if he/she considers that his/her
rights under the Regulation have been infringed as a result of
the processing of his/her personal data.

Article 21

Notification to third parties

In case of any rectification, blocking or erasure following a
request made by the data subject, he/she may obtain from the
controller the notification to third parties to whom his/her
personal data have been disclosed, unless this proves impossible
or involves a disproportionate effort.

Article 17

Right of access

Article 22

Right to object

constraint,
from the receipt of

to obtain from the
The data subject shall have the right
any time within three
controller, without
months
the information
referred to in points (a) to (d) of Article 13 of the Regulation,
either by consulting these data on the spot, or by receiving a
copy,
including, where appropriate, a copy in an electronic
form, according to the applicant's preference.

the request,

at

Article 18

Right of rectification

Each data subject’s request for the rectification of inaccurate or
incomplete personal data shall specify the data concerned as
well as the rectification to be made. It shall be dealt with by
the controller without delay.

Article 19

Right of blocking

The controller shall treat any request for the blocking of data
under Article 15 of the Regulation without delay. The request
shall specify the data concerned as well as the reasons for
blocking them. The controller shall
inform the data subject
who made the request before the data are unblocked.

Article 20

Right of erasure

shall

request

The data subject may request
the controller to erase data
without delay in case of unlawful processing, particularly
where the provisions of Articles 4 to 10 of the Regulation
have been infringed. The
specify the data
concerned and shall provide the reasons or evidence of the
unlawfulness of the processing.
In automated filing systems,
in principle be ensured by all appropriate
erasure shall
technical means, excluding the possibility of any further
If erasure is not possible for
processing of the erased data.
technical
the
DPO and of
shall proceed to the
immediate blocking of such data.

the controller, after consultation of

the interested person,

reasons,

The data subject may object to the processing of data relating to
him/her and to the disclosure or use of his/her personal data, in
conformity with Article 18 of the Regulation. The request shall
specify the data concerned and shall provide the reasons
the
justifying the request. Where the objection is justified,
processing in question shall no longer involve those data.

Article 23

Automated individual decisions

The data subject is entitled not to be the subject of automated
individual decisions as intended by Article 19 of the Regulation,
unless the decision is explicitly authorised pursuant to national
or Community legislation, or by an EDPS decision safeguarding
the data subject's legitimate interests. In either case, the data
subject shall have the opportunity to make known his or her
point of view in advance and to consult the DPO.

Article 24

Exceptions and restrictions

1.
To the extent that legitimate reasons as specified in Article
20 of the Regulation clearly justify it, the controller may restrict
the rights referred to in Articles 17 to 21 of this Decision.
Except in case of absolute necessity, the controller shall first
consult the DPO, whose opinion shall not bind the Institution.
The controller shall reply to requests relating to the application
of exceptions or restrictions to the exercise of rights without
delay and shall substantiate this decision.

Any person concerned may request the EDPS to apply

2.
Article 47(1)(c) of the Regulation.

SECTION 6

INVESTIGATION PROCEDURE

Article 25

Practical modalities

Requests for an investigation shall be addressed to the
1.
DPO in writing by using a specific form made available by
him/her. In the case of obvious misuse of the right to request
an investigation, for example where the same individual has
made an identical
the DPO is not
request only recently,
obliged to report back to the requester.

L 296/22

EN

Official Journal of the European Union

21.9.2004

send
2. Within 15 days upon receipt,
acknowledgement of receipt to the Appointing Authority or
the person who commissioned the investigation and verify
whether the request is to be treated as confidential.

the DPO shall

request

The DPO shall

3.
from the controller who is
responsible for the data processing operation in question a
written statement on the issue. The controller shall provide
his/her response to the DPO within 15 days. The DPO may
wish to receive complementary information from other parties,
such as the Security Office and Security of Information (Infosec)
Office of
If appropriate, he/she may request an
opinion on the issue from the Council Legal Service. The
DPO shall be provided with the information or opinion
within 30 days.

the GSC.

SECTION 7

FINAL PROVISIONS

Article 26

Effect

This Decision shall take effect on the day following that of its
publication in the Official Journal of the European Union.

Done at Brussels, 13 September 2004.

4.
The DPO shall report back to the Appointing Authority or
the person who made the request no later than three months
following its receipt.

For the Council
The President

B. R. BOT