Opinion of the European Data Protection Supervisor on the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 1073/1999 concerning investigations conducted by the European Anti-Fraud Office (OLAF)
Date: 2007-04-26
Institutions: European Data Protection Supervisor
Subjects: European Anti-fraud Office, corruption, drafting of EU law, fraud, fraud against the EU, law relating to information, personal data, protection of privacy

26.4.2007

EN

Official Journal of the European Union

C 91/1

I

(Resolutions, recommendations, guidelines and opinions)

OPINIONS

EUROPEAN DATA PROTECTION SUPERVISOR

Opinion of the European Data Protection Supervisor on the Proposal for a Regulation of the Euro-
pean Parliament and of the Council amending Regulation (EC) No 1073/1999 concerning investiga-
tions conducted by the European Anti-Fraud Office (OLAF)

(2007/C 91/01)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995
on the protection of individuals with regard to the processing of personal data and on the free movement of
such data (1),

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18
December 2000 on the protection of individuals with regard to the processing of personal data by the Com-
munity institutions and bodies and on the free movement of such data (2), and in particular its Article 41,

Having regard to the request for an opinion in accordance with Article 28 (2) of Regulation (EC) No
45/2001 received on 15 September 2006 from the Commission;

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTION

1. The Proposal for a Regulation amending Regulation (EC) No 1073/1999 of the European Parliament
and the Council of 25 May 1999 concerning investigations conducted by OLAF (3) (hereinafter ‘the
Proposal’) contains revisions to most of the articles of Regulation (EC) No 1073/1999 (4). This Regu-
lation sets forth the operational rules to be followed by those involved in OLAF investigations and, as
such, it constitutes the legal basis for OLAF's operational activities.

Consultation with the EDPS

2. The Proposal was sent by the Commission to the EDPS on 15 September 2006. The EDPS understands
this communication as a request to advise Community institutions and bodies, as foreseen in Article
28(2) of Regulation (EC) No 45/2001 of 18 December 2000 on the protection of individuals with
regard to the processing of personal data by the Community institutions and bodies and on the free
movement of such data (hereinafter Regulation (EC) No 45/2001). In view of the mandatory character
of Article 28(2) of Regulation (EC) No 45/2001, the EDPS welcomes the explicit reference to this
consultation in the preamble of the Proposal.

(1) OJ L 281, 23.11.1995, p. 31.
(2) OJ L 8, 12.1.2001, p. 1.
(3) OJ L 136, 31.5.1999, p. 1.
(4) The Proposal amends articles 3,4,5,6,7,8,9,10,11,12,13,14, and 15.

C 91/2

EN

Official Journal of the European Union

26.4.2007

3. The comments made in this Opinion apply mutatis mutandis to the Proposal for a Council Regulation
amending Council Regulation (Euratom) No 1074/1999 of 25 May 1999 concerning investigations
conducted by the European Anti-Fraud Office (OLAF) (1).

The Importance of the Proposal and the EDPS Advice

4. The EDPS deems it important to deliver an opinion on this Proposal in the light of its impact on indivi-
duals' rights to data protection and privacy. Taking into account that the Proposal sets forth new rules
to be followed by OLAF to conduct investigations of alleged illegal activities, it is essential to ensure
that in doing so, the data protection and privacy rights of the persons implicated in such investigations,
suspected infringers and also staff members and other individuals who provide information to OLAF,
are properly guaranteed. This is even more important given the particularly sensitive type of informa-
tion that OLAF may potentially collect, which includes data relating to suspected offences, offences,
criminal convictions, health data as well as information that would serve to exclude individuals from a
right, benefit or contract insofar as such information represents a particular risk to the rights and free-
doms of the data subjects.

Main Elements of the Proposal and Initial Comments

5. The proposed amendments to Regulation (EC) No 1073/1999 respond to different goals and objec-
tives (2). For example, some amendments aim at improving the effectiveness and efficiency of OLAF
investigations, for example, to ensure that OLAF's powers of investigation cover economic operators in
Member States receiving Community funds. Others intend to facilitate the exchange of information
about suspected wrongdoings between OLAF and the various institutions concerned, at both EU and
level. (3) Finally, some of the proposed amendments seek to guarantee the rights of the
national
persons implicated in an investigation, including their right to data protection and privacy and make
procedural guarantees stronger.

6. The EDPS agrees with the significance of the goals and objectives pursued by the proposed amend-
ments and, to this extent, he welcomes the Proposal. The EDPS particularly values the procedural guar-
antees afforded to individuals under the Proposal. This is particularly true regarding the possibility of
suspected individuals to request an opinion from the Review Adviser as to whether the procedural guar-
antees were respected during the investigation. The EDPS is also pleased with the amendments that aim
to provide more information to whistleblowers and informers. From the perspective of the protection
of individuals' rights to the protection of their personal data and privacy, the EDPS considers that on
the whole the Proposal contains improvements vis-à-vis the current situation. For example, the EDPS
welcomes the recognition of the application of several data protection rights during the investigations
such as the right of the suspected person to be informed of the investigation and have his/her views
known.

7. However, despite the overall positive impression, the EDPS considers that from the point of view of the
protection of personal data, the Proposal could be further improved, without jeopardising the objectives
that it pursues. In particular, the EDPS is concerned that the Proposal may be deemed as a lex specialis
regulating the processing of personal data collected in the scope of OLAF investigations, which would
take precedent over the application of the general data protection framework contained in Regulation
(EC) No 45/2001. This is particularly worrisome considering that the data protection standards
contained in the Proposal are lower than those contained in Regulation (EC) No 45/2001, and this
without any apparent justification.

8. In order to avoid this outcome, the following section provides an analysis of the Proposal which, on
the one hand, describes its shortcomings and, on the other hand, suggests specific ways to address
them. Obviously, the scope of this analysis is limited to the provisions having an impact on personal
data protection, particularly Article 1, section (5), (6) and (7) pursuant to which Articles 7a, 8 and 8a
are added or amended.

(1) OJ L 136, 31.5.1999, p. 8.
(2) Some of the problems that the Proposal seeks to solve were raised in the past by the Court of Auditors the European Parlia-

ment and OLAF's own evaluation of the Office's activities.

(3) The Proposal lays down a set of measures to ensure that the information flows in all directions: from OLAF to institutions

and Member States and vice-versa.

26.4.2007

EN

Official Journal of the European Union

C 91/3

II. ANALYSIS OF THE PROPOSAL

II.1. Article by Article Examination of the Proposal

II.1.a. Data Quality Principle

9. The data quality principle, which is recognised in Article 4 of Regulation (EC) No 45/2001, encom-
passes various specific aspects. In particular, pursuant to this principle, personal data must be accurate,
it must conform to the objective reality and it must also be complete and updated. Second, data must
not be excessive and it must be adequate so that there is a link between the information and the
purpose for which it is intended to be used. The Proposal
incorporates the data quality principle
through Article 1, section (1) pursuant to which Article 7a1 is added which requires OLAF to seek
evidence for and against the person concerned.

10. The EDPS welcomes the inclusion of the obligation to seek evidence for and against the person
concerned because it affects the accuracy and the completeness of the data being processed, thus
contributing to the compliance with the principle of data quality, and hence increasing the overall data
protection safeguards in the context of OLAF investigations.

II.1.b. Right of Information

11. Pursuant to this right, those who collect personal data are required to inform individuals to whom the
data refers of the fact that their data are being collected and processed. Individuals are further entitled
to be informed of, inter alia, the purposes of the processing, the recipients of the data and the specific
rights that individuals, as data subjects, are entitled to. The obligation to give information about the
processing of one's data is to ensure the fairness of the processing of individual's personal information
and is, at the same time, an indispensable safeguard for the rights of individuals. The Proposal recog-
nises this right in Article 1, section (1) pursuant to which Article 7a2, first paragraph is added and
Article 1, section (7) pursuant to which Article 8a is added.

12. The EDPS welcomes the inclusion of Articles 7a.2 first paragraph and 8a, insofar as they contribute to
the respect for the data protection right of information set forth in Article 11 and 12 of Regulation
(EC) No 45/2001, in the specific context of investigations performed by OLAF.

13. In addition to setting forth the right to be informed of the processing of one's personal information,
Articles 11 and 12, which apply respectively to the situations where information on an individual is
collected directly from that individual or from third parties, lay down the information that must neces-
sarily be given to individuals so that they are in a position to have accurate and full information about
the existence of a processing operation that concerns them. This information includes among others
the purposes for which the data will be used, potential recipients of the data and the existence of the
right of access to the data.

14. Unfortunately neither Article 7a2 first paragraph nor Article 8a contain similar information require-
ments as Article 11 and 12 of Regulation (EC) No 45/2001, thus failing to specify what information is
to be given to individuals in order to ensure the fairness of the processing. The EDPS considers that
Articles 7a2 first paragraph and 8a should be consistent with Articles 11 and 12 of Regulation (EC)
No 45/2001. To this end, the EDPS suggests including in Articles 7a2 first paragraph and 8a an
express reference to the application of Articles 11 and 12 of Regulation (EC) No 45/2001.

15. The EDPS considers that failure to include a reference to Articles 11 and 12 will create an unclear legal
situation. Indeed, the Proposal would create a legal framework regulating the right of information in
the context of OLAF investigations that would differ from the general framework set forth by Articles
11 and 12 of Regulation (EC) No 45/2001. Unfortunately, such a framework would provide less data
protection safeguards than the general one. The EDPS fails to see any reason to justify this unfortunate
outcome.

C 91/4

EN

Official Journal of the European Union

26.4.2007

16. Articles 7a2 and 8a second paragraph of the Proposal foresee an exception to their application if
giving the information would prejudice the performance of the investigation. Pursuant to the exception,
the Director General of OLAF is entitled to defer the fulfilment of the obligation to ask the person
implicated to make his views known.

17. The EDPS notes that the possibility of limiting the provision of information in certain specific cases is in
line with Article 20 of Regulation (EC) No 45/2001 which provides for certain restrictions to this
right, including when doing so is necessary to safeguard (i) the prevention and investigation of criminal
offences, (ii) economic or financial interest of a Member State or of the European Communities, as well
as (iii) the protection of the data subject or of the right and freedoms of others.

18. The EDPS notes that under Article 20 of Regulation (EC) No 45/2001, the limitation to the right of
information is accompanied by various data protection safeguards. In particular, Article 20.3 establishes
that if a restriction is imposed, the data subject shall be informed of the principal reasons and on his
or her right to have recourse to the European Data Protection Supervisor. Providing such information
may be deferred if providing the information would harm the investigation.

in the context of OLAF investigations,

19. However, in the Proposal the provisions that set forth restrictions to the right of information are not
accompanied by the data protection safeguards foreseen in Article 20 of Regulation (EC) No 45/2001.
Thus,
limitations to the right of information are provided
without the safeguards that would apply under the general data protection framework, which the EDPS
finds inappropriate. To resolve this situation the EDPS suggests that the limitation to the right of infor-
mation of Articles 7a2 second paragraph and 8a be linked to the guarantees of Article 20 Regulation
(EC) No 45/2001.

II.1.c. Right of Access

20. The right of access gives individuals the possibility to learn whether and what type of information
relating to them is being processed. The Proposal recognises this right in Article 1, section (1) pursuant
to which Articles 7a2, second paragraph and 7a3 are added.

21. The above amendments, i.e. Articles 7a2, second paragraph and 7a3 set up the right of the individual
suspected of wrongdoing to be informed on all matters concerning him. More specifically, they estab-
lish how this right will be exercised in the context of OLAF investigations. Firstly, it will be provided on
completion of an investigation, i.e. at the end of the investigation. Secondly, it will be provided through a
summary of the matters regarding the individual. In addition, access will also be provided through a
record of the interview with the suspected individual.

22. The EDPS welcomes the inclusion of Articles 7a2 second paragraph and 7a3 insofar as they specify in
the context of OLAF investigations the data protection right of access set forth by Article 13 of Regu-
lation (EC) No 45/2001. However, the EDPS considers that there is room for improvement in the way
this right is recognised in the Proposal. The EDPS is concerned that the right of access, as drafted in
the Proposal, is inferior to the same right under Regulation (EC) No 45/2001.

23. Under Regulation (EC) No 45/2001 as a matter of general principle, individuals are entitled to exercise
the right of access to their personal data, unless one of the specific situations of Article 20 of Regu-
lation (EC) No 45/2001, referred above, justifying a restriction to such right, arise. In such a case,
access can be restricted until the circumstances change.

24. The EDPS observes that the Proposal does not recognise the application of the right of access as a
matter of general principle. Instead, the Proposal foresees the application of the right of access in certain
procedural stages and in respect to certain documents. To some extent, it can be said that under the Proposal,
the right of access has both temporal and material limitations.

25. Indeed under Article 7a2 second paragraph access can be obtained only on completion of an investigation,
when the individual is given a summary of the matters that concern him/her and when an interview
with the individual and OLAF has taken place and a record of an interview has been drafted. Outside
these two stages of the procedure, as a general rule, there is no access to personal
information.
Regarding the material to which access is granted, the EDPS sees that under the Proposal, access is only
possible regarding the summary of the matters concerning the individual and the record of the inter-
view ex Article 7a2 second paragraph and Article 7a.3 respectively. Access does not apply to any other
information that may be held about the individual, such as copies of documents, e-mails, telephone
records, etc.

26.4.2007

EN

Official Journal of the European Union

C 91/5

26. The EDPS agrees with the Proposal that access to personal information is relevant in the two proce-
dural steps and regarding the two documents specified by the Proposal and welcomes the Proposal's
recognition of such right in these circumstances. However, the EDPS considers that as a matter of
general principle, the Proposal should also recognise the existence of a right of access beyond the two
cases explicitly mentioned by the Proposal.

27. The EDPS is aware that there may be some opposition to the idea of recognising the right of access, as
a general rule, in the course of an investigation. However, the EDPS recalls that if in certain investiga-
tion cases there is a need to safeguard the confidentiality of the investigation, pursuant to Article 20 of
Regulation (EC) No 45/2001, OLAF will be able to defer access. Indeed, OLAF can rely on Article 20
to defer access for example in order to safeguard the prevention and investigation of criminal and
other offences. Thus, granting the right of access as a matter of general principle does not prevent ad
hoc limitations to such rights, when the reasons outlined above occur.

28. In light of the above, and in order to ensure that an effective right of access in the course of an investi-
gation exists which also recognises potential limitations to it, the EDPS suggests adding in the Proposal
a clear reference to the individual's right of access to their personal data contained in OLAF's investiga-
tion file. In particular, the EDPS considers that a paragraph along the following lines should be inserted
between the first and second paragraph of Article 7a.2: ‘Any person implicated in an investigation has the
right to access personal data related to him/her which are gathered in the course of the investigation. Such right(s)
may be subject to the limitations foreseen in Article 20 of Regulation (EC) No 45/2001’.

29. This paragraph would set forth, as a general principle, the application of the right of access. As a result,
not only consistency would be achieved but also individuals concerned by OLAF investigations would
not be subject to a less benevolent regime as far as access to personal data is concerned.

II.1.d. Right of Rectification

30. The right of access is a prius to the right of rectification. Once individuals have had the opportunity to
access their data and verify the accuracy and the lawfulness of the processing, the right of rectification
enables them to require rectification of any incomplete or inaccurate information.

31. Under the Proposal, the right of rectification is regulated together with the right of access. Both Article
1, section (1) pursuant to which Articles 7a2 second paragraph and 7a3 are added refer to the possibi-
lity of the suspected infringer to have his views known.

32. The EDPS notes that, stricto sensu, the Proposal does not provide for a right to rectify as such. Instead,
the Proposal provides for a right to ‘have the views known’ and ‘approve or add observations’ (in both
instances regarding personal information). The EDPS considers that such privileges are equivalent to the
right of rectification and that they are in line with Article 14 of Regulation (EC) No 45/2001 which
sets forth the legal framework for the right to rectify inaccurate information. The EDPS considers that
in the context of OLAF investigations it is not possible to provide individuals with the possibility to
simply ‘rectify’ the information that they deem as incomplete or inaccurate, obviously because in many
cases, ascertaining whether the information is inaccurate will be the subject of the investigation. This is
why in this context the right of rectification can be provided, as the Proposal does, by allowing the
individual to have his views known and by allowing him to provide comments regarding the personal
information at stake.

33. In addition to the above, the EDPS considers that the same comments made above regarding the way
the Proposal regulates the right of access, apply mutatis mutandis to the right of rectification. Indeed,
under the Proposal, the right of rectification has the same shortcomings that were described above
regarding the right of access: the Proposal does not recognise the right to rectify as a matter of general
principle. Instead, the right of rectification is unduly confined to the summary of the allegations and
the report that follows an interview.

34. The EDPS considers that the Proposal should recognise the right of rectification as a general right, not
like a partial one. To this end, the EDPS suggests inserting a provision in the proposal recognising the
application of the right of rectification. In particular, after the sentence ‘Any person implicated in an
investigation has at any time the right to access personal data related to him/her gathered in the course
of the investigation’ the following should be added: ‘and to make his views known on whether the personal
data are inaccurate or incomplete’ . The EDPS recalls that by applying Article 20 of Regulation (EC) No
45/2001, OLAF may still be able to limit the right of rectification in order to safeguard the prevention,
investigation, detection and prosecution of criminal offences.

C 91/6

EN

Official Journal of the European Union

26.4.2007

35. Article 7a2, 3rd paragraph foresees the possibility of excluding the application of the right of access
and rectification. As it was mentioned regarding the limitation to the right of information, such limita-
tions should be accompanied by the safeguards that apply in the context of Article 20 of Regulation
(EC) No 45/2001. To this end, the EDPS suggests that the limitation of the application of such rights
under the Proposal is linked to an express reference to Article 20.

II.1.e. Exchanges of Personal Information

36. The Proposal provides for exchanges of personal data within the European Institutions and with
Member States authorities. In fact, one of the goals of the Proposal is to enhance the exchange of infor-
mation among OLAF and authorities at both EU and Member State levels.

37. In this regard, the EDPS would like to stress that these exchanges should be allowed only to the extent
that is necessary to the specific case in order to meet the goals pursued by the investigation. Further-
more, in accordance with Article 7 of Regulation (EC) No 45/2001, the EDPS reminds that the reci-
pient of the data shall process them only for the purposes for which they were transmitted.

38. The Proposal does not provide for exchanges of personal data with third countries, or for international
cooperation. However, in this context, one may assume that such cooperation may take place. In this
regard, the EDPS would like to stress that these exchanges should be allowed only if the third country
ensures an adequate level of protection of personal data or if the transfer falls within the scope of one
of the derogations laid down by Article 9.6 of Regulation (EC) No 45/2001. Furthermore, the EDPS
recalls that the same rules apply regarding the exchanges of information between OLAF and EU institu-
tions and bodies that are not Community bodies such as EUROPOL or EUROJUST. In such cases, the
EDPS hopes that appropriate legislation will be passed recognising the adequacy of the data protection
framework that governs such institutions, which would facilitate the transfers of information to them
ex Article 9.2 of Regulation (EC) No 45/2001. Alternatively, new legislation could be passed deeming
their data protection regime as equivalent to that of Community bodies and institutions, ex Article 7 of
Regulation (EC) No 45/2001, which would also have the effect of removing the restriction to transfer
data to such institutions.

II.1.f. Compliance with Regulation (EC) No 45/2001

39. The Proposal has amended Article 8.3 to include an express reference to the application of Regulation
(EC) No 45/2001. The EDPS welcomes the amendment of Article 8(3), insofar as it confirms that
whenever the Proposal does not specify how the data protection requirements apply in the context of
OLAF investigations, the Regulation (EC) No 45/2001 will apply as default.

40. However, the EDPS considers that Article 8.3 on its own, i.e. without the amendments suggested in
this Opinion, is not sufficient to ensure a level of protection of personal data at least equal to that
provided under Regulation (EC) No 45/2001. Article 8.3 by itself is not enough because it could be
understood that it is only relevant whenever the Proposal does not specify how the data protection
requirements apply in the context of OLAF investigations. However, when the Proposal does specify
how the data protection requirements apply and in doing so lays down a less protective data protection
regime, then such unsatisfactory regime could be considered to take precedent over the general data
protection embodied in Regulation (EC) No 45/2001. The specific amendments suggested above for
concrete references to Regulation 45/2001 aim to avoid such risks of interpretation

III. ADDITIONAL CONSIDERATIONS

III.1. Protection of Whistleblowers

41. The EDPS fully agrees with the Proposal that for the sake of greater transparency it is necessary to
ensure an adequate degree of information for whistleblowers, and welcomes the obligation in the
Proposal to provide informers with information as to whether or not to open an investigation.

26.4.2007

EN

Official Journal of the European Union

C 91/7

42. The EDPS recommends the respect for the confidentiality of the identity of whistleblowers during
OLAF investigations and in the later stages. To this end, the EDPS is of the view that it would be appro-
priate for this Proposal to include a new paragraph guaranteeing the confidentiality of whistleblowers.
The present guarantees (Commission Communication SEC/2004/151/2) do not seem enough from a
legal point of view. The EDPS notes that such provision would be in line with the Opinion of the
Article 29 Data Protection Working Party that deals with the application of EU data protection rules to
internal whistleblowing schemes (1).

IV. CONCLUSIONS AND RECOMMENDATIONS

43. The EDPS welcomes this Proposal insofar as it makes more explicit the procedural guarantees of indivi-

duals concerned by OLAF investigations, including the protection of personal data of such individuals.

44. From the perspective of the protection of individuals' rights to the protection of their personal data
and privacy, the EDPS considers that for the most part the Proposal contains improvements vis-à-vis
the current legal framework. Examples of improvements include Articles 7a2 first paragraph and 8a as
they contribute to the respect of the right of information and Articles 7a2 second paragraph and 7a.3
which confirm the application of the partial right of access and rectification in the context of OLAF inves-
tigations.

45. In addition, the EDPS welcomes the Proposal's recognition that Regulation (EC) No 45/2001 applies to
all data processing activities carried out in the context of OLAF investigations, as it will contribute to
ensuring a consistent and homogeneous application of the rules regarding the protection of individuals'
fundamental rights and freedoms with regard to the processing of personal information.

46. Although the EDPS is appreciative of the amendments aimed at boosting procedural and data protec-
tion rights outlined above, he is concerned by the fact that most of the proposed amendments do not
reach the minimum data protection standards contained in Regulation (EC) No 45/2001. The EDPS is
concerned that if the Proposal could be deemed to take precedent over the application of the general
data protection framework contained in Regulation (EC) No 45/2001, this would entail an unacceptable
watering down of the data protection standards in the context of OLAF investigations. In the EDPS's
opinion this is particularly worrisome in the light of the sensitive nature of the type of data that may
be collected in the framework of OLAF investigations. In order to avoid this outcome, the EDPS
requests the Community legislator to take into account the following issues and make the related
amendments in the Proposal in order to address them:

47. Shortcomings regarding the right of information in the context of OLAF investigations:

Providing information to individuals to ensure fair processing constitutes an indispensable safeguard
which should not be unduly compromised, as the Proposal does. To avoid it, the Proposal should be
amended as follows:

(i) Articles 7a2 first paragraph and 8a should include an explicit reference to Articles 11 and 12 of

Regulation (EC) No 45/2001 in order to ensure fair processing.

(ii) The limitation to the right of information of Articles 7a2 first paragraph and 8a second paragraph

should be linked to the safeguards of Article 20 Regulation (EC) No 45/2001.

48. Shortcomings regarding the right of access in the context of OLAF investigations:

Providing access to personal information so that individuals can learn whether data concerning them is
being processed constitutes a basic pillar for the respect of the personal data. To ensure effective access
rights, the Proposal should be amended as follows:

(i) A new provision should be added recognising as a general principle the right of access to personal
information gathered in the context of OLAF investigations which could be inserted between the
first and second paragraph of Article 7a.2. Such a provision could read as follows. Such a provision
could read as follows ‘Any person implicated in an investigation has the right to access personal data related
to him/her which are gathered in the course of the investigation. Such right(s) may be subject to the limitations
foreseen in Article 20 of Regulation (EC) No 45/2001’.

(1) Opinion 1/2006 on the application of EU data protection rules to internal whistleblowing schemes in the fields of
accounting, internal accounting controls, auditing matters, fight against bribery, banking and financial crime (00195/06/
EN WP 117).

C 91/8

EN

Official Journal of the European Union

26.4.2007

49. Shortcomings regarding the right of rectification in the context of OLAF investigations:

The right to rectify inaccurate or incomplete information is a natural consequence of the right of
access to personal information, and as such, it constitutes a cornerstone of the protection of the right
to personal data. Restrictions to the right of rectification should only be provided to the extent that
they are permitted under Regulation (EC) No 45/2001. The Proposal contains additional restrictions
that should be avoided as follows:

(i) A provision should be added stating that suspected individuals have a general right to have their
views known regarding any piece of information that referred to them, except if an exception ex
Article 20 of Regulation (EC) No 45/2001 applies. In particular, after having stated that any person
implicated in an investigation has ‘at any time the right to access personal data related to him/her
gathered in the course of the investigation’, it should be added that an individual has the subsequent
right ‘to make his views known on whether the personal data is inaccurate or incomplete’ .

(ii) The EDPS suggests that the limitation to the right of access and rectification foreseen in Article

7a2, 3rd paragraph be linked to the guarantees of Article 20 Regulation (EC) No 45/2001.

50. In addition to the above, the EDPS is of the view that it would be appropriate for this Proposal to

include a new paragraph guaranteeing the confidentiality of whistleblowers.

Done at Brussels on 27 October 2006

Peter HUSTINX

European Data Protection Supervisor