Opinion of the European Data Protection Supervisor on the Amended Proposal for a Regulation of the European Parliament and of the Council on mutual administrative assistance for the protection of the financial interests of the European Community against fraud and any other illegal activities
Date: 2006-12-12
Institutions: European Data Protection Supervisor
Subjects: administrative cooperation, data protection, exchange of information, fraud, fraud against the EU, personal data

28.4.2007

EN

Official Journal of the European Union

C 94/1

I

(Resolutions, recommendations, guidelines and opinions)

OPINIONS

EUROPEAN DATA PROTECTION SUPERVISOR

Opinion of the European Data Protection Supervisor on the Amended Proposal for a Regulation of
the European Parliament and of the Council on mutual administrative assistance for the protection
of the financial interests of the European Community against fraud and any other illegal activities

(2007/C 94/01)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Com-
munity, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the
European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament
and of the Council of 24 October 1995 on the protection of
individuals with regard to the processing of personal data and
on the free movement of such data (1),

Having regard to Regulation (EC) No 45/2001 of the European
Parliament and of the Council of 18 December 2000 on the
protection of
individuals with regard to the processing of
personal data by the Community institutions and bodies and on
the free movement of such data (2), and in particular its Article
41,

Having regard to the request for an opinion in accordance with
Article 28 (2) of Regulation (EC) No 45/2001 received on 19
September 2006 from the Commission;

European Antifraud Office (‘OLAF’), as a coordinator and facili-
tator of the above mentioned procedures.

The Amended Proposal was sent by the Commission to the
European Data Protection Supervisor (‘EDPS’) for advice as fore-
seen in Article 28 (2) of Regulation (EC) No 45/2001 of 18
December 2000 on the protection of individuals with regard to
the processing of personal data by the Community institutions
and bodies and on the free movement of such data (hereinafter
‘Regulation (EC) No 45/2001’). Prior to that, the advice of the
EDPS was also sought regarding the same Proposal in its first
version, as adopted by the Commission. This request led to the
adoption in October 2004 of a first EDPS Opinion on the
Proposal for a Regulation as adopted by the Commission (3).
The letter received from the Commission on 19 September
2006 is therefore a new request for additional advice on the
Amended Proposal, which the EDPS is pleased to meet, in par-
ticular taking into account that the initial proposal has been
modified during the legislative process towards its adoption. In
fact, consultation of the EDPS is necessary ex Article 28.2 each
time that the Commission adopts a new proposal.

HAS ADOPTED THE FOLLOWING OPINION:

II. MAIN COMMENTS

I. INTRODUCTION

II.1. Data Protection Issues Deferred to Implementing

Legislation

The Amended Proposal for a Regulation on mutual administra-
tive assistance for the protection of the financial interests of the
EC against fraud and any other illegal activities (hereinafter
‘Amended Proposal’) sets forth communication and assistance
procedures between the Commission and Member States in
order to protect the Community financial interests. Such proce-
dures
include mutual administrative assistance as well as
exchange of information. In this context, the Amended Proposal
establishes the role of the Commission, particularly through the

interests,

the Community financial

In setting forth communication and administrative procedures
to protect
the Amended
Proposal does not include new rules on data protection nor
exceptions to the existing data protection framework, namely
Directive 95/46/EC and Regulation (EC) No 45/2001. Instead,
the Amended Proposal confirms the application of such legisla-
tion and in some areas calls for implementing regulations that
will address data protection issues.

(1) OJ L 281, 23.11.1995, p. 31.
(2) OJ L 8, 12.1.2001, p. 1.

(3) OJ C 301, 7.12.2004, p. 4.

C 94/2

EN

Official Journal of the European Union

28.4.2007

The EDPS considers that in this context such an approach is
satisfactory insofar as it preserves the data protection standards
contained in Directive 95/46/EC and in Regulation (EC) No
45/2001 in the framework of the communication and adminis-
trative procedures, including exchanges of information created
by the Amended Proposal. The EDPS would have reason for
concern should such standards have been lowered.

At the same time, the EDPS is aware that with such an approach
the real debate on data protection issues is postponed to a later
stage, i.e., to the drafting of implementing regulations. For this
reason, the EDPS notes that the protection of personal data in
setting forth communication and administrative procedures will
have to be carefully considered in the process of drafting imple-
menting legislation. The EDPS therefore welcomes the inclusion
in the Amended Proposal of the obligation to consult him on
the drafting of such implementing legislation, particularly as
regards access to data on value added tax stored in Member
States by the Commission ex Article 11 of
the Amended
Proposal, the provision of information concerning operations or
transactions in the case of spontaneous assistance ex Article
12.4 and the exchanges of information and mutual assistance
regarding other irregularities ex Article 23 of
the Amended
proposal. In fact, consultation of the EDPS is necessary not only
regarding legislative proposals ex Article 28.2 of Regulation (EC)
No 45/2001 but also regarding administrative measures of a
similar nature relating to the processing of personal data invol-
ving a Community institution or body alone or jointly with
others ex Article 28.1 of Regulation (EC) No 45/2001.

II.2. Effect on the Protection of Personal Data: Clarification

of Article 17.1

Although the Amended Proposal as described above does not
contain new rules on the protection of personal data in the
context of the information exchanges that it sets forth, some of
its articles indirectly have an effect on data protection, which in
the following cases would appear to be positive. For example,
the obligation that falls upon Member States to designate the
competent authorities for the purposes of the Regulation and
communicate these to the Commission may contribute to limit
the exchange of information exclusively to competent authori-
ties and not to others. The EDPS also welcomes that requests
for assistance and information are to be accompanied by a brief
statement of the facts known to the applicant authority as this
may contribute to the restriction of the amount of data relevant
to satisfy the need for information.

On the contrary, the EDPS notes that at least in one case, the
Amended Proposal contains a provision which may have a nega-
tive effect as far as the protection of personal data is concerned.
This is Article 17 of the Amended Proposal which was formerly
Article 18 of the Proposal as adopted by the Commission. Point
4 of the EDPS Opinion of 2004 noted that Article 18 (1)

the legislator, however,

second paragraph should not affect the rights of data subjects to
have access to their personal data. The EDPS assumes that this
is the intention of
in the current
language, this is not entirely clear. For this reason, the EDPS
suggests adding the following sentence at the end of Article
‘This shall not affect the rights of data
17.1., second paragraph:
subjects to have access to personal data relating to them, in accordance
with Directive 95/46 and Regulation 45/2001’.

II.3. Proposal for Alternative Language

The EDPS welcomes the fact that the Amended Proposal takes
into account some of the remarks made by the EDPS in his
opinion of 2004. For example, in view of the mandatory char-
acter of Article 28 (2) of Regulation (EC) No 45/2001, the
EDPS welcomes the explicit reference in the Amended Proposal
to this consultation exercise. However, the EDPS considers that
this reference should be made in the Preamble of the Proposal,
at the end of the ‘Having regard to …’. This is the approach
the European
followed by the Proposal
Parliament and of the Council amending Regulation (EC) No.
1073/1999 concerning investigations conducted by OLAF.
Furthermore, the EDPS suggests replacing the current language
by the following:
‘After consulting the European Data Protection
Supervisor’, in line with standard practice.

for a Regulation of

III. CONCLUSION

The EDPS considers that on the whole the Amended Proposal
maintains the level of protection of personal data contained in
the EU data protection framework, namely Directive 95/46/EC
and Regulation (EC) No 45/2001.

Nevertheless, the EDPS notes that whether such standards of
data protection will indeed be maintained will depend on the
specific content of
implementing legislation for which the
Amended Proposal creates a legal basis. Since implementing
legislation will be crucial for the protection of personal data in
this context, the EDPS particularly welcomes the inclusion in
the Amended Proposal of the obligation to consult him on the
drafting of such implementing legislation.

In summary, besides the clarification of Article 17.1 suggested
under section II.2, and the amendment proposed under section
II.3 in accordance with the existing rules on consultation, the
EDPS is satisfied with the content of the Amended Proposal and
does not see the need for additional changes to it.

Done at Brussels on 13 November 2006

Peter HUSTINX

European Data Protection Supervisor