Opinion of the European Data Protection Supervisor on the Proposal for a Council Regulation on jurisdiction, applicable law, recognition and enforcement of decisions and cooperation in matters relating to maintenance obligations (COM(2005) 649 final)
Date: 2006-05-15
Institutions: European Data Protection Supervisor
Subjects: cross-frontier data flow, data processing, disclosure of information, divorce, family law, judicial cooperation in criminal matters in the EU, maintenance obligation, personal data, protection of privacy

C 242/20

EN

Official Journal of the European Union

7.10.2006

EUROPEAN DATA PROTECTION SUPERVISOR

Opinion of the European Data Protection Supervisor on the Proposal for a Council Regulation on
jurisdiction, applicable law, recognition and enforcement of decisions and cooperation in matters
relating to maintenance obligations (COM(2005) 649 final)

(2006/C 242/14)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Com-
munity, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the
European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parlia-
ment and of the Council of 24 October 1995 on the protection
of individuals with regard to the processing of personal data
and on the free movement of such data,

Having regard to Regulation (EC) No 45/2001 of the European
Parliament and of the Council of 18 December 2000 on the
protection of
individuals with regard to the processing of
personal data by the Community institutions and bodies and
on the free movement of such data, and in particular its Article
41,

Having regard to the request for an opinion in accordance with
Article 28 (2) of Regulation No 45/2001 received on 29 March
2006 from the Commission;

HAS ADOPTED THE FOLLOWING OPINION:

I. Introduction

Consultation of the EDPS

1. The proposal

for a Council Regulation on jurisdiction,
applicable law, recognition and enforcement of decisions
and cooperation in matters relating to maintenance obliga-
tions was sent by the Commission to the EDPS by letter
dated 29 March 2006. According to the EDPS, the present
opinion should be mentioned in the preamble of the Regu-
lation.

The proposal in its context

will be limited to the provisions having an impact on
personal data protection, in particular those relating to the
cooperation and the exchange of information making it
possible to locate the debtor and to evaluate his assets and
those pertaining to creditor (chapter VIII and Annex V).

3. In particular, the proposal envisages the designation of
national central authorities to facilitate the recovery of
maintenance claims through the exchange of relevant
information. The EDPS agrees that exchange of personal
data shall be allowed to the extent it is necessary to locate
debtors and evaluate their assets and incomes, while fully
stemming from Directive
respecting the requirements
95/46/EC, on the protection of individuals with regard to
the processing of personal data (Recital 21). Therefore, the
EDPS welcomes the reference (Recital 22) to the respect
for private and family life, and the protection of personal
data, as laid down by Articles 7 and 8 of the Charter of
Fundamental Rights of the European Union.

4. In particular,

the proposal

lays down a mechanism of
exchange of information about the debtor and the creditor
of maintenance obligations, with a view to facilitating the
establishment and the recovery of maintenance claims. For
this purpose, central national authorities will be designated
in order to handle requests of
information lodged by
national judicial authorities (of other Member States) and
collect personal data from different national administra-
tions and authorities in order to fulfil these requests. The
usual procedure will be as follows: a creditor will lodge an
application through a court; the national central authority,
upon request of the Court, will send an application to the
central authorities of the requested Member State (through
a specific form contained in Annex V); the latter central
authorities will gather the requested information and will
reply to the requesting central authority, which will then
provide the information to the requesting court.

2. The EDPS welcomes this proposal, to the extent it aims at
recovery of cross-border maintenance
facilitating the
claims within the EU. The proposal has a wide scope, since
it addresses matters related to jurisdiction, applicable law,
recognition, enforcement and cooperation. This opinion

5. The EDPS in this opinion will promote the respect for the
fundamental right to protection of personal data, while
ensuring efficiency of the proposed mechanisms aimed at
facilitating the
recovery of cross-border maintenance
claims.

7.10.2006

EN

Official Journal of the European Union

C 242/21

6. In this perspective, it is first of all necessary to analyse the
context of the proposal, by analysing the relevant specifici-
ties of maintenance obligations. Indeed, first of all mainte-
nance obligations are very complex, since they embrace a
variety of situations: claims may relate to children,
to
spouses or divorced spouses, and even to parents or grand-
parents. Furthermore, maintenance claims are based on
ongoing and dynamic situations, and they can be managed
both by private and public parties (1).

11. The EDPS considers that the Commission, when assessing
the various policy options, should consider specifically and
in greater detail — both in its preliminary impact assess-
ment study and in the development of the proposal — the
impact on the protection of personal data of each of the
possible options and the possible safeguards. In particular,
with regard to this proposal, it is essential that the provi-
sions regulating the activity of
the central authorities
precisely circumscribe their tasks and clearly define the
functioning of the system.

7. This complexity, which is confirmed by the Commission's
Impact Assessment (2), increases if one considers the huge
differences in this field between the 25 Member States.
Indeed, substantive and procedural laws differ broadly in
matters relating to the establishment of maintenance obli-
gations, their assessment and duration, the investigatory
powers of the courts, etc.

8. The diversity of maintenance obligations

already
reflected in some provisions of the proposal. For instance,
Recital 11 and Article 4(4) specifically refer to mainte-
nance obligations in respect of a minor child, while Recital
17 and Article 15 make a difference between obligations
in respect of children, vulnerable adults, spouse and ex-
spouses and other kinds of maintenance obligations.

is

9. The aforementioned considerations shall be duly taken into
account also when addressing issues relating to protection
of personal data, in particular when assessing the propor-
tionality of the exchange of information. Indeed, different
kinds of maintenance obligations may entail different
powers of national courts to request information, and may
also determine which kind of personal data may be
processed and exchanged in a specific case. This is even
more important if one considers that the present proposal
does not aim at harmonizing Member States' national laws
on maintenance obligations.

The choice of a centralised system

10. As already mentioned, the proposal envisages a system
whereby information is exchanged indirectly through the
national central authorities rather than directly by the
courts. This choice is not neutral from a data protection
point of view and should be adequately justified. Indeed,
the additional transfers of information between courts and
central authorities, as well as the temporary storage of
information by the latter authorities will increase the risks
for the protection of personal data.

(1) A reference to maintenance obligations paid by public authorities

can be found in Article 16 of the proposal.

(2) Commission Staff Working Document — Impact Assessment, of 15

December 2005, pages 4-5.

II. The relations with current data protection legal frame-

work

12. The EDPS notes that the current proposal should not only
take into account the complexity of national provisions on
maintenance obligations, but
should also ensure full
compliance with existing national legislation on protection
of personal data, adopted pursuant to Directive 95/46/EC.

lays down the access by national
13. Indeed, the proposal
central authorities
to personal data held by different
national administrations and authorities. These personal
data — that have been collected by different authorities for
purposes other than the recovery of maintenance claims
— will be gathered by national central authorities and then
transmitted to the requesting judicial authority of a
Member State through the designated central authority of
the latter. From a data protection point of view, this raises
different kinds of issues: the change in the purpose of
processing, the legal grounds for processing by national
central authorities, and the definition of the data protec-
tion rules applicable to further processing by judicial
authorities.

Change in the purpose of processing

14. One of the basic principles of the protection of personal
data is the purpose limitation principle. Indeed, according
to this principle personal data must be ‘collected for speci-
fied, explicit and legitimate purposes and not
further
processed in a way incompatible with those purposes’
(Article 6(1) of Directive 95/46/EC).

15. However, the change in the purpose for which personal
data are processed could be justified by virtue of Article 13
of Directive 95/46/EC, which lays down some exemptions
to this general principle. In particular, Article 13(1), letter
f) — exercise of official authority — or letter g) — the
protection of the data subjects or of the rights and free-
doms of others — could justify in this case an exception
to the purpose limitation principle and could allow these
national administrations and authorities to transmit the
requested personal data to the national central authority.

C 242/22

EN

Official Journal of the European Union

7.10.2006

that either

16. Nonetheless, Article 13 of the aforementioned directive
requires that these exceptions shall be necessary and based
on legislative measures. This means
the
proposed regulation — by virtue of its direct applicability
— shall be considered to be sufficient to meet the require-
ments of Article 13, or Member States will have to adopt
specific legislation. In any case, the EDPS strongly recom-
mends that the proposal lays down an explicit and clear
obligation for relevant national administrations and autho-
rities to provide national central authorities with requested
information. This would ensure that the transmission of
personal data by national administrations
to national
central authorities would be clearly necessary for compli-
ance with a legal obligation to which relevant national
administrations are subject, and thus based on Article 7(c)
of Directive 95/46/EC.

basic principles can be accepted. Furthermore, the Court
laid down a list of criteria that are relevant also with
regard to this proposal. In particular, the Court ruled that
interference with private life, such as those exceptions to
data protection principles that are based on a public
interest objective, should be proportionate, necessary, laid
down by law and foreseeable.

20. The EDPS notes that it would be highly desirable to expli-
citly clarify the full applicability of data protection rules
stemming from Directive 95/46/EC. This could be done by
adding a specific paragraph to Article 48, which currently
addresses the relations and possible conflicts with other
community instruments, but does not mention Directive
95/46/EC.

Legal grounds for processing of personal data by national central
authorities

The legal basis of the proposal

21. The proposed legal basis gives the occasion to reiterate
some remarks already made in previous opinions (2).

17. Similar considerations shall be made in relation to the
legal grounds on which the processing of personal data by
national central authorities is based. Indeed, designating or
setting up these authorities according to the proposal will
entail that they will collect, organize and further transmit
personal data.

22. Firstly, the legal basis allows the Council to decide to
transfer this area from unanimity to the co-decision proce-
dure. Here again, the EDPS expresses his preference for the
latter procedure, which can better guarantee a full involve-
ment of all institutions and that the fundamental right to
personal data protection is fully taken into account.

18. The processing of personal data by national central autho-
rities could be based on Article 7(c) or (e) of Directive
95/46/EC, since this processing would be necessary for
compliance with the legal obligations (laid down by the
proposal) to which national central authorities are subject
or the performance of a public task entrusted to them.

23. Secondly, in this area the Court of Justice, according to
Article 68 TEU, still has limited powers, especially with
regard to preliminary rulings. This requires even more
clarity in the drafting of the provisions of this proposal,
also in relation to issues concerning the protection of
personal data, with a view to ensuring a uniform applica-
tion of the proposed regulation.

Processing by judicial authorities and applicability of Directive
95/46/EC

19. As far as further processing by judicial authorities is
concerned, the legal basis of the regulation shall be taken
into account. Indeed, Articles 61 and 67 TEC have been
brought within the scope of the EC Treaty by the Treaty of
Amsterdam. This means that the scope of application of
Directive 95/46/EC, which excludes
falling
outside Community law, covers this area only since the
Treaty of Amsterdam entered into force. Therefore, since
this area was not covered by the directive when it was
adopted, it is likely that not all Member States have fully
implemented data protection rules with regard to the activ-
ities of civil judicial authorities: harmonisation of national
DP law,
is far from being
complete. Meanwhile, the Court of Justice confirmed in the
Österreichischer Rundfunk case (1), that Directive 95/46/EC
has a wide scope and that only specific exceptions to its

in particular in this field,

activities

(1) Judgement of 20 May 2003 in Joined Cases C-465/00, C-138/01

and C-139/01.

Possible future exchanges of personal data with third countries

24. The current proposal does not provide for exchanges of
personal data with third countries, but international coop-
eration is explicitly envisaged in the explanatory memor-
andum. In this context, it is noteworthy to mention the
ongoing negotiations for a new comprehensive Convention
of
the Hague Conference on Private International Law
concerning international recovery of maintenance.

likely to lay down mechanisms

25. It goes without saying that this international cooperation
is
for exchanges of
personal data with third countries. In this regard, the EDPS
would like to stress again that these exchanges should be
allowed only if the third country ensures an adequate level
of protection of personal data or if the transfer falls within
the scope of one of the derogations laid down by Directive
95/46/EC.

(2) Opinion on data retention of 26 September 2005, point 42;
Opinion on Data Protection in Third Pillar of 19 December 2005,
point 11; Opinion on Schengen Information System II of 19
October 2005, paragraph 9.

7.10.2006

EN

Official Journal of the European Union

C 242/23

III. Purpose limitation

26. In the context of this proposal, specific attention shall be

paid to the basic principle of purpose limitation.

27. Indeed, while central national authorities and national
courts shall be allowed to carry out their tasks properly, by
processing relevant information for the purpose of facili-
tating the enforcement of maintenance claims, this infor-
mation shall not be used for incompatible purposes.

28. In the current

text,

the definition and limitation of

purposes is dealt with by Articles 44 and 46.

29. Article 44 lays down the specific purposes for which infor-
mation shall be provided by national administrations and
authorities to the relevant central authorities: to locate the
debtor; to evaluate the debtor's assets; to identify the debt-
or's employer and to identify the bank accounts of the
debtor.

locating the debtor

30. The EDPS stresses that a complete and precise definition of
the purposes for which personal data are processed is
essential. In this perspective, the purpose of ‘locating the
debtor’ shall be better defined. Indeed, for the purpose of
maintenance obligations,
shall be
construed as referring to a location with a certain degree
of stability (i.e., residence, centre of interests, domicile,
place of work) — as specified in Annex V, which refers to
debtor's address — rather than the location of the debtor
in a specific moment
for example,
temporary location obtained through geolocalisation or
GPRS data). The use of the latter data shall be excluded. In
addition, a clarification in the concept of location would
also help circumscribing the kinds of personal data that
might be processed according to this proposal (see further,
points 35-37).

in time (such as,

31. Furthermore, the EDPS underlines that the proposal also
lays down the possibility of exchanging personal data
relating to the creditor (see Article 41(1)(a)(i)). The EDPS
assumes that this kind of
information is collected and
processed with a view to assess the financial capacity of
the creditor, which may in certain cases be relevant for the
is
evaluation of a maintenance claim.
essential that also the purposes for which data on creditor
are processed are precisely and explicitly defined in the
proposal.

In any event,

it

32. EDPS welcomes Article 46, and in particular its paragraph
2, relating to the further use of information collected by
the provision
the national central authorities.
makes clear that information transmitted by central autho-
rities to courts may be used only by a court and only to
facilitate the recovery of maintenance claims. The possibi-

Indeed,

lity to send this information to the authorities in charge of
the service of documents or to the competent authorities
in charge of the enforcement of a decision is also propor-
tionate.

IV. Necessity and proportionality of personal data

processed

33. According to Directive 95/46/EC, personal data shall be
adequate, relevant and not excessive in relation to the
purposes for which they are collected or further processed
their processing shall be
(Article 6(1)(c)). Furthermore,
necessary, inter alia, for compliance with a legal obligation
or for the performance of a task carried out in the public
interests or in the exercise of official authority (Article 7,
letters c) and e)).

34. On the contrary, the current proposal defines a minimum
amount of information to which central authorities shall
be given access, through a non exhaustive list of national
administration and authorities. Indeed, Article 44(2) states
that information shall include ‘at least’ information held by
the administrations and authorities which are responsible
in Member States for: taxes and duties; social security;
land registers, registration of motor
population registers;
vehicles and central banks.

35. The EDPS stresses the need to define more precisely both
the nature of personal data which can be processed
according to this regulation, as well as the authorities
whose databases can be accessed.

36. First of all, the kinds of personal data that can be accessed
according to the proposed regulation should be limited.
Article 44(2) should provide for a well-defined maximum
— rather than just minimum — limit to the amount of
information that can be accessed. Therefore,
the EDPS
recommends modifying Article 44(2) accordingly, either
by deleting the words ‘at
least’ or by providing other
limitations to the information that can be transmitted
according to the proposed regulation.

In some Member states,

37. A limitation should relate not only to the authorities, but
also to the kinds of data that can be processed. Indeed,
personal data held by the authorities listed in the current
proposal may broadly differ depending on the Member
State.
for instance, population
registers may even contain fingerprints. Furthermore, by
virtue of
the growing interlinking of databases, public
authorities may be considered to ‘hold’ an ever increasing
amount of personal data which are sometimes extracted
from databases controlled by other public authorities or
private parties (1).

(1) See EDPS Opinion on Exchange of information under the principle

of availability of 28 February 2006, points 23-27.

C 242/24

EN

Official Journal of the European Union

7.10.2006

38. Another important concern relates to special categories of
data. Indeed, the current proposal might lead to collection
of sensitive data. For instance,
information provided by
social security institutions may in some cases reveal trade
union affiliation or health conditions. These personal data
are not only sensitive, but are in most cases unnecessary to
facilitate the enforcement of maintenance claims. There-
fore, processing of sensitive data should be in principle
to Article 8 of Directive 95/46/EC.
excluded, pursuant
However, in those cases where the processing of relevant
sensitive data is necessary for reasons of substantial public
interest, exemptions from the general prohibition may be
laid down by national law or by decision of the competent
supervisory authority, subject to the provision of suitable
safeguards (Article 8(4) of Directive 95/46/EC).

39. The current definition of the kinds of personal data that
can be accessed by central authorities is so generic that it
would leave room even for processing of biometrics data,
in those cases where
such as fingerprints or DNA data,
these data are held by the national administrations listed in
Article 44(2). As the EDPS has already pointed out in
other opinions (1), processing of these kinds of data, which
may well be used to locate/identify a person, may entail
specific risks and in certain cases may also reveal sensitive
information about the data subject. Therefore, the EDPS
considers that processing of biometrics data, which for
instance might be considered acceptable for the establish-
ment of a parental relationship, would be disproportionate
for the enforcement of maintenance obligations and there-
fore should not be allowed.

40. Secondly, the principle of proportionality should determine
on a case-by-case basis which personal data should be
concretely processed within the scope of the potentially
available information. Indeed, national central authorities
and courts should be allowed to process personal data
only to the extent that this is necessary in the specific case
to facilitate the enforcement of maintenance obligations (2).

41. Therefore,

the EDPS would recommend stressing this
proportionality test by substituting in Article 44(1) the
words ‘information that can facilitate’ with ‘information
necessary to facilitate in a specific case’.

procedure, while other personal data can be requested only
on the basis of a decision given in matters relating to
maintenance obligations.

to the fact

43. The EDPS would also like to draw the attention of the
legislator
the
proposed regulation is not confined to recovery of mainte-
nance claims for children, but extends also to maintenance
claims by spouses or divorced spouses, and to maintenance
of parents or grandparents.

that, as already mentioned,

44. With regard to this, the EDPS underlines that each kind of
maintenance obligation may require a different balance of
interests and thus determine to what extent processing of
personal data is proportionate in a specific case.

V. Proportionality in storage periods

45. According to Article 6(e) of Directive 95/46/EC, personal
data shall be kept for no longer than it is necessary for the
purposes
further
processed. Therefore, proportionality is the basic principle
also when it comes to assess the period of time during
which personal data are stored.

for which they were

collected or

46. As far as storage by central authorities is concerned, the
EDPS welcomes Article 46(1), according to which informa-
tion is deleted after having forwarded it to the court.

47. With regard to storage by competent authorities in charge
of the service of documents or the enforcement of a deci-
the words
sion (Article 46(2)), the EDPS suggests that
‘made use of it’ be substituted with a reference to the time
necessary for
the tasks
connected to the purposes for which information was
collected.

relevant authorities

to fulfil

42. In other provisions,

the principle of proportionality is
already duly taken into account. An example is given by
Article 45, according to which a court may at any
moment request
i.e.
information which is strictly necessary to start a judicial

information to locate the debtor,

(1) Opinion on Schengen Information System II of 19 October 2005,
paragraph 4.1; Opinion on Visa Information System of 23 March
2005, paragraph 3.4.

(2) This is also the case of personal data provided by the requesting
court with a view to identifying the debtor concerned, as laid down
at point 4.1 of Annex V. For example, the provision of address of
debtor's family members shall be strictly limited, on a case by case
basis and depending on the kind of maintenance obligation
concerned.

48. Also with regard to storage by judicial authorities, the
EDPS argues that information shall be available for as long
as it is necessary for the purpose for which it was collected
or it is further processed. Indeed, in the case of mainte-
nance obligations, information in some cases is likely to be
needed for quite a long period of time, in order for the
judge to be able to periodically reassess both the subsis-
tence of the legal grounds for granting the maintenance
obligations and properly quantify these obligations. Indeed,
according to the information provided by the Commission,
in the EU a maintenance claim is paid for 8 years on
average (3).

(3) See Commission Staff Working Document — Impact Assessment, of

15 December 2005, p. 10.

7.10.2006

EN

Official Journal of the European Union

C 242/25

49. For these reasons, the EDPS prefers a flexible but propor-
tionate storage period rather than a rigid a priori limitation
of the storage period to one year (as currently proposed by
Article 46(3)), which can prove in certain cases too short
for the envisaged purposes of the processing. Therefore,
the EDPS proposes to delete the maximum storage period
of one year:
judicial authorities should be allowed to
process personal data for as long as it is necessary in order
the relevant maintenance
to facilitate the recovery of
claim.

VI. Information to debtor and creditor

50. The obligation to provide information to the data subject
reflects one of
the basic principles of data protection,
enshrined in Articles 10 and 11 of Directive 95/46/EC.
Furthermore, in this case information to data subjects is
even more important since the proposal establishes a
mechanism whereby personal data are collected and used
for different purposes, and are further transferred and
processed through a network that includes national admin-
istrations, different national central authorities and national
courts. Therefore, the EDPS stresses the needs for a timely,
comprehensive and detailed information notice, which
would properly inform the data subject about all
the
various transfers and processing operations to which his/
her personal data are subject.

51. In this perspective, the EDPS welcomes the obligation to
provide information to the debtor laid down by Article 47
of the proposal. However, a timeframe to provide informa-
tion should be added to Article 47. Furthermore, the EDPS
notes that it is essential that adequate information is also
provided to the creditor, in case personal data concerning
him/her are exchanged.

52. The exception, according to which the notification to the
debtor might be postponed when it might prejudice the
effective recovery of a maintenance claim, is proportionate,
also in consideration of the maximum length of postpone-
ment (no more than 60 days) laid down by Article 47.

53. A last remark concerns Annex V, which contains the appli-
cation form for the transmission of information. This form
currently presents the provision of information to debtor
as a choice to be made by ticking the appropriate box. On
the contrary,
information shall be
presented as a default option and a specific action (i.e.
ticking the ‘do not inform’ box) should be required only in
those exceptional cases in which information cannot be
temporarily provided.

the provision of

VII. Conclusions

54. The EDPS welcomes this proposal, to the extent it aims at
recovery of cross-border maintenance

facilitating the

recommends

claims within the EU. The proposal has a wide scope and
shall be considered in its specific context. In particular, the
EDPS
the
complexity and variety of maintenance obligations, the
broad differences in Member States laws in this domain,
and the obligations on protection of personal data stem-
ming from Directive 95/46/EC.

account

taking

duly

into

the functioning of

55. Furthermore, the EDPS considers essential to clarify some
the system, such as the
aspects of
change in the purpose for which personal data are
processed, the legal grounds for processing by national
central authorities, and the definition of the data protec-
tion rules applicable to further processing by judicial
authorities. In particular, the proposal should ensure that
transfers of personal data from national administrations to
national central authorities and processing by the latter
authorities and national courts are carried out only when
they are necessary, clearly defined, and based on legislative
measures, according to the criteria laid down by data
protection rules and complemented by the case law of the
Court of Justice.

56. The EDPS also invites the legislator to specifically address

the following substantive points:

— Purpose limitation. A complete and precise definition of
the purposes for which personal data are processed is
essential. Also the purposes for which data on creditor
are processed should be precisely and explicitly defined
in the proposal

— Necessity and proportionality of personal data processed.
There is a need to define more precisely both the
nature of personal data which can be processed
according to this regulation, as well as the authorities
whose databases can be accessed. A limitation should
relate not only to the authorities, but also to the kinds
of data that can be processed. The proposal should
ensure that national central authorities and courts
should be allowed to process personal data only to the
extent that this is necessary in the specific case to facili-
tate
enforcement of maintenance obligations.
Furthermore, each kind of maintenance obligation may
require a different balance of interests and thus deter-
mine to what extent processing of personal data is
proportionate in a specific case.

the

— Special categories of data. Processing of sensitive data for
the purpose of enforcing maintenance obligations
should be in principle excluded, unless it is carried out
in compliance with Article 8 of Directive 95/46/EC.
Processing of biometrics data for the enforcement of
maintenance obligations would be disproportionate
and therefore should not be allowed.

C 242/26

EN

Official Journal of the European Union

7.10.2006

— Storage periods. EDPS prefers a flexible but propor-
tionate storage period rather than rigid a priori limita-
tion to a definite period of time, which can prove in
certain cases too short for the envisaged purposes of
the processing.

— Information to creditor and debtor. A timely, comprehen-
sive and detailed information notice should properly
inform the data subject about all the various transfers
and processing operations to which his/her personal
data are subject. It is essential that adequate informa-

tion is also provided to the creditor, in case personal
data concerning him/her are exchanged.

Done at Brussels on 15 May 2006

Peter HUSTINX

European Data Protection Supervisor