Opinion of the European Data Protection Supervisor on: the Modified Proposal for a Council Regulation amending Regulation (EC, Euratom) No 1605/2002 on the Financial Regulation applicable to the general budget of the European Communities (COM(2006) 213 final) and on the Proposal for a Commission Regulation (EC, Euratom) amending Regulation (EC, Euratom) No 2342/2002 laying down detailed rules for the implementation of Council Regulation (EC, Euratom) No 1605/2002 on the Financial Regulation applicable to the general budget of the European Communities (SEC(2006) 866 final)
Date: 2007-04-28
Institutions: European Data Protection Supervisor
Subjects: data processing, data protection, financial management, financial regulation, general budget (EU), implementation of the budget, personal data

C 94/12

EN

Official Journal of the European Union

28.4.2007

Opinion of the European Data Protection Supervisor on: the Modified Proposal for a Council Regu-
lation amending Regulation (EC, Euratom) No 1605/2002 on the Financial Regulation applicable to
the general budget of the European Communities (COM(2006) 213 final) and on the Proposal for a
Commission Regulation (EC, Euratom) amending Regulation (EC, Euratom) No 2342/2002 laying
down detailed rules for the implementation of Council Regulation (EC, Euratom) No 1605/2002 on
the Financial Regulation applicable to the general budget of the European Communities (SEC(2006)
866 final)

(2007/C 94/03)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Com-
munity, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the
European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament
and of the Council of 24 October 1995 on the protection of
individuals with regard to the processing of personal data and
on the free movement of such data (1),

Having regard to Regulation (EC) No 45/2001 of the European
Parliament and of the Council of 18 December 2000 on the
protection of
individuals with regard to the processing of
personal data by the Community institutions and bodies and on
the free movement of such data (2), and in particular its Article
41,

Having regard to the requests for an opinion in accordance with
Article 28 of Regulation (EC) No 45/2001 sent on 18 May
2006 (for the Modified Proposal of the Financial Regulation)
and 4 July 2006 (for the Proposal of the Implementing Rules)
by the Commission;

HAS ADOPTED THE FOLLOWING OPINION

I. INTRODUCTION

1. Council Regulation (EC, Euratom) No 1605/2002 of 25
June 2002 on the Financial Regulation applicable to the
general budget of the European Communities (3) (herein-
after ‘FR’) lays down the legal foundations of the financial
management reform.
In December 2002, after extensive
consultation of the institutions, the Commission adopted
the Implementing Rules of the FR (hereinafter ‘IR’). Both
regulations, which apply to all
institutions, entered into
force on 1 January 2003.

2. The Modified Proposal for a Council Regulation amending
Regulation (EC, Euratom) No 1605/2002 on the Financial
Regulation applicable to the general budget of the European
Communities (4) (hereinafter ‘FR Proposal’) adopted in 2006
is presented in order to fulfil Article 184 of the FR, which
subjects the Financial Regulation to review every three

(1) OJ L 281, 23.11.1995, p. 31.
(2) OJ L 8, 12.1.2001, p. 1.
(3) OJ L 248, 16.9.2002, p. 1.
(4) Doc. COM(2006) 213 Final — 2005/0090 (CNS)

years, or whenever it proves necessary to do so. The main
objective of the FR Proposal
is to improve the efficiency
and transparency of the rules by striking a better balance
between the cost of control and the financial risks at stake
whilst maintaining a high level of protection of the Com-
munity funds. The Modified Proposal of the FR was agreed
via conciliation between the European Parliament and the
Council at the end of November 2006. This Opinion takes
this text into account (5).

3. In order to speed-up the legislative process, the Commis-
sion took the initiative to present a Proposal for a Commis-
sion Regulation (EC, Euratom) amending Regulation (EC,
Euratom) No 2342/2002 laying down detailed rules for the
implementation of Council Regulation (EC, Euratom) No
1605/2002 on the Financial Regulation applicable to the
general budget of the European Communities (6) (herein-
after ‘IR Proposal’). The EDPS is consulted in the framework
of these two proposals.

foreseen, which would include

4. The EDPS considers that an analysis of the proposals is
important because they will affect the way in which some
personal data of individuals, relating to financial activities
are dealt with. One of the main points of the proposals is
that they foresee the set up and operation by the Commis-
sion of a central database, common to all institutions and
bodies, of candidates and tenderers under specific situations
of exclusions in case of fraud and allow the exchange of the
information contained in the database with authorities at
different levels. The EDPS underlines that the central data-
and
base
tenderers who have found themselves in one of the situa-
tions referred to in Articles 93, 94 and 96 (1)(b) and (2)(a)
of the Financial Regulation, already existed prior to the
modification of the Financial Regulation (7). The existing
database relies on the use of warnings of different levels (1,
2, 3, 4, 5a and 5b) according to their impacts on the candi-
dates and tenderers. However, the existing database, devel-
oped at
level by the Commission, has a
broader scope than the one which is foreseen in the Finan-
cial Regulation proposal (covering only warnings of level
5). This central database and other aspects of the proposals
require careful analysis from a data protection point of
view.

institutional

candidates

(5) Article 95(3)(2) has been deleted from the modified proposal, which
means an improvement of the text from a data protection point of
view.

(6) Doc. SEC(2006) 866 Final
(7) For an analysis of the existing situation, see EDPS prior-check opinion
on the EWS of the Commission. 6 December 2006, available at: www.
edps.europa.eu

28.4.2007

EN

Official Journal of the European Union

C 94/13

Consultation with the EDPS

5. The FR and IR Proposals were sent by the Commission to
the EDPS for advice as foreseen in Article 28(2) of Regu-
lation (EC) No 45/2001 of 18 December 2000 on the
protection of individuals with regard to the processing of
personal data by the Community institutions and bodies
and on the free movement of such data (hereinafter ‘Regu-
lation 45/2001’). In view of the mandatory character of
Article 28(2) of Regulation 45/2001, the EDPS welcomes
the explicit reference to this consultation in the preamble of
the proposals.

II. ANALYSIS OF THE PROPOSALS

interests of

the European Union and any other

6. The Commission, responsible for executing the general
funds
budget of
managed by the Communities,
is under an obligation to
counter fraud and any other illegal activities affecting the
financial
the Communities. The FR and IR
proposals set out new obligations on the Commission
concerning the award of contracts and grants to third
parties in the context of management of Community funds.
Taking into account that the proposals set forth rules to be
followed in order to ensure the protection of the Commu-
nities' financial interests, it is essential that in doing so, the
data protection and privacy rights of the persons concerned
are properly guaranteed when personal data are processed.

II.1. Transparency

7. The EDPS recognises that important principles relating to
sound financial management are fostered in the proposals
reinforced. For
and that new ones are introduced or
instance, the EDPS notes that Recital 1 of the FR Proposal
foresees that ‘transparency, in particular, has to be reinforced by
providing for information on beneficiaries of Community funds’.
This principle is developed in Articles 30(3) and 53 of the
FR.

8. These provisions, dealing with the transparency principle,
introduce the publication of beneficiaries of funds deriving
from the budget. The EDPS supports the inclusion of this
principle, with due respect to Directive 95/46/EC and Regu-
lation 45/2001, but wants to underline that a proactive
approach to the rights of the data subjects (8) should be
as personal data will be disclosed. This
respected,

(8) See Articles 11-13 and 18 of Regulation 45/2001. On the notion of a
proactive approach, see: EDPS Background paper: public access to docu-
ments and data protection, 12 July 2005 available at: http://www.edps.
europa.eu/EDPSWEB/edps/lang/en/pid/21

informing the data
proactive approach could consist of
subjects beforehand, at
the time the personal data are
collected, that these data might be made public, and of
ensuring that the data subject's right of access and right to
object are respected. This principle should also apply to the
the
ex post publication of beneficiaries (Article 169 of
Implementing Rules).

II.2. Early Warning System (EWS) central database

9. Article 95 of the FR Proposal stipulates that a central data-
base containing the relevant details of candidates and
tenderers which are in a situation of exclusion referred to in
Articles 93, 94 (9), 96 (1)(b) and (2)(a) shall be set up and
operated by the Commission in compliance with Com-
munity rules on the processing of personal data. As
mentioned in the introduction, this new version of Article
95, stressing the leading role of the Commission, does not
substantially modify the existing practice which has been
used so far (i.e. Article 95 of the FR states that each institu-
tion has its own central database). Indeed, currently the
institutions (10) do not have a separate database but use the
computerised database of the European Commission and
exchange information with the latter (11). This database is
handled according to the procedure foreseen in the
Commission Decision on the Early Warning System
(EWS) (12). The Commission centralises all relevant informa-
tion and plays the role of a central gateway between all
institutions participating in the scheme.

10. Article 95 of the FR Proposal also states that the database
is common to the institutions, executive agencies and
bodies referred to in Article 185 of the FR. In the agreed
version of the Financial Regulation, Article 95 further states
that the authorities of the Member States and third coun-
tries as well as the bodies participating in the implementa-
tion of the budget shall communicate to the competent
authorising officer information on candidates and tenderers
which are in one of the situations referred to in Article 93
judgment which has the force of res judicata).
(1) (e) (i.e.
This information is communicated where the conduct of
the operator concerned was detrimental to the Commu-
nities' financial interests (Article 95(2)). The consequences
those actors will be
attached to the involvements of
analysed below.

(9) Articles 93 and 94 (read together with Article 114(2)) set out an obliga-
tion to exclude third parties from participation in a procurement or
award procedure where they are in one of the situations listed in Article
93 FR or forbid the award of a contract or grant to third parties in a
situation of conflict of interest or misrepresentation in supplying the
information required by the contracting authority as a condition of
participation in a procurement or award procedure.

(10) Article 1 of the FR: for the purposes of the FR, the Economic and
Social Committee, the Committee of the Regions, the Ombudsman
and the European Data Protection Supervisor are to be treated as Com-
munity institutions.

(11) See EDPS Opinion on the prior-check of the EWS of the European

Court of Justice, to be published on our website.

(12) C(2004) 193/3 as modified by corrigendum C(2004)517 and last
modified by the 2006 internal rules, See: http://ec.europa.eu/budget/
library/sound_fin_mgt/ews_decision_en.pdf .

C 94/14

EN

Official Journal of the European Union

28.4.2007

11. The EDPS agrees to the principle of a central database of
candidates and tenderers who have found themselves in one
of the situations referred to in Article 93, 94 and 96 (1)(b)
and (2)(a) in the light of the purposes of data processing
foreseen by the FR. These purposes are to enhance the
effectiveness, improve the protection of the financial inter-
ests of the Communities and ensure circulation of restricted
information concerning third parties.

12. However, although central databases and large scale systems
are becoming more widely used nowadays,
the EDPS
considers that, in each case, the need for such a database
must be properly and carefully assessed and that when such
database is established, specific safeguards have to be imple-
mented in the light of data protection principles. The
reason behind is to avoid any developments which would
unduly affect the protection of personal data. In the view of
the EDPS, any proposal which foresees the creation of a
central repository of personal data has to respect the Euro-
pean data protection regulatory framework and implement
it concretely. For
instance, Articles 4 (data quality), 5
(lawfulness of processing) and 10 (processing of special
categories of data) of Regulation 45/2001 are most relevant
for the processing of personal data by European institu-
tions.

13. Moreover, the EDPS underlines that personal data should be
collected for legitimate purposes (Article 4(1) (b) of Regu-
lation 45/2001). In this context, the EDPS considers that if
it is in the legitimate interests of the institutions and bodies
to set up the system in order to preserve the financial inter-
ests and reputation of the Communities, the introduction
of a warning against a person can have serious adverse
effects for a data subject and for this reason specific safe-
guards must be in place to uphold the data subject's legiti-
mate interests. These safeguards are developed in the
following paragraphs.

15. Moreover,

the IR proposal,

the EDPS suggests that

in
Article 134a, should clarify the categories of entities which
are affected by the database. Article 134a covers third
parties, also called legal entities in the LEF, which are either
natural persons or legal persons. Besides,
the Proposal
anticipates a third category in the sense that the informa-
tion may also include natural persons with powers of repre-
sentation, decision making or control over given legal
persons. Therefore, in the latter case, natural persons are in
the system as far as they have power of representation. In
the present practice, they are included as a new autono-
mous entry in the database. The links and differences
between the legal persons and the natural persons with
powers of representation, decision making or control over
given legal persons should benefit from clarification.

II.2.b. Update of information registered in the database

16. The data quality principle

(Article 4 of Regulation
45/2001) requires data to be adequate, relevant and not
excessive in relation to the purposes for which they are
collected (13). It is clear that the quality of the personal data
can only be ensured if its accuracy is regularly and properly
checked. The procedure currently foreseen in Article 134a
(2) of the IR Proposal is that the Commission shall, via a
secured protocol on a regular basis, provide validated data
contained in the database to persons designated in the first
paragraph of the same article. This proposed timetable is
unclear. The EDPS is aware that alternatives are being
data.
considered,
However, this would not be sufficient. Indeed, in the view
of the EDPS, the update of the central database has to be
frequent, and the frequency must be structured and respect
a precise timetable (monthly or weekly transfers would help
to ensure accuracy and timely update of the data).

permanent provision of

involving

II.2.a. Data subjects concerned

II.2.c. Management and security

14. The EWS database is based on the centrally validated ‘Legal
Entity File’ (hereinafter LEF) and uses the data it contains.
The LEF is a general database, which covers legal persons or
individuals who at any time have (had) contractual and/or
financial dealings with one of the Commission's services:
service providers, staff, experts, beneficiaries of grants.
Article 95 of the FR Proposal only refers to candidates and
tenderers and does not apply to members of staff as they
can not be as well candidates and tenderers. In this respect,
the EDPS suggests clarifying the definition of the candidates
and tenderers in the IR Proposal, so as to avoid confusions
between the entities covered.

17. The central database must be adequately protected. The
management of and respect for an optimal security level for
the central database constitutes a fundamental requirement
for ensuring the adequate protection of personal data stored
in the database and its update. In order to obtain this satis-
factory level of protection, proper safeguards have to be
implemented for handling the potential risks related to the
infrastructure of the system and to the persons involved.

(13) The following information is included in the EWS system: Name and
address of the individual — Type of EWS-warning — Start date — end
date of active warning — Commission service that has requested the
EWS flag to be set.

28.4.2007

EN

Official Journal of the European Union

C 94/15

18. In this respect, the EDPS is of the opinion that a consistent
system for the selection of authorising officers must be put
in place, as to allow adequate protection of the information
stored in the central database and to protect its integrity.
Although Article 134a foresees the selection and definition
of tasks of the authorising officer responsible for requesting
entry in the database and for
receiving validated data
contained in the database, this procedure is only foreseen
for the institutions, executive agencies or bodies referred to
in Article 185 of the FR and implemented for the Commis-
sion in the Commission Decision on the Early Warning
System. There is no specific rule anticipated regarding the
situation of Member States, third countries or international
organisations. This situation may create inconsistency in the
protection of the data which are accessed.

the Member States,

19. The EDPS advises to include provisions in complementary
administrative rules on the way access to data is granted to
the authorities and bodies of
third
countries and international organisation as well as the
amount of data which can be accessed. Indeed, the EDPS
considers important not only to ensure the security of the
information stored in the database but also that the infor-
mation is sent to the relevant and authorized authorities,
and within the authorities, exclusively to the relevant offi-
cers.

II.2.d. Exchange of data

extends

the FR Proposal

20. The EDPS acknowledges the set up of a unique central
access point to the database, which is coordinated by the
the
Commission. Moreover,
current scope of the EWS as it envisages access for more
authorities and bodies than in the previous version. There-
fore, the FR Proposal foresees different situations as far as
access to information is concerned. The situations concern
different authorities and bodies and must be analysed sepa-
rately. From a data protection perspective, the EDPS notes
that this right of access to the database, granted to different
bodies, leads to a transfer of data to each one of the bodies
concerned, despite the fact that the data are stored by the
Commission. Therefore, the analysis must be carried out in
the light of Articles 7, 8 and 9 of Regulation 45/2001
which deal with transfers of data.

21. The FR Proposal makes a distinction between two cases of
transfer of data. The first relates to the transfer of data
within or between Community institutions and bodies. The
second refers to the right of access of the Member States
and third countries or international bodies. For the purpose
of this Opinion, the EDPS makes a separate analysis for the
situation of Member States and the situation of third coun-
tries or international bodies, as these are separately covered
by Regulation 45/2001.

22. The first situation is covered by Article 95, paragraph 1 of
the FR Proposal, which states that the database set up and
operated by the Commission is common to the institutions,
executive agencies and the bodies referred to in Article 185
FR. The EDPS stresses that, when a transfer of personal data
within or between Community institutions or bodies is
foreseen, Article 7 of Regulation 45/2001 is applicable.
Therefore, the EDPS reminds that the recipient of the data
shall process them only for the purposes for which they
were transmitted.

23. The access by Member States, third countries and interna-
tional organisations is covered by the second indent of
Article 95(2) of the FR Proposal. They shall have access to
the information contained in the database and may take it
into account, as appropriate and on their own responsi-
bility, for the award of contracts associated with the imple-
mentation of the budget. Therefore, the Proposal foresees
the automatic access to the database within the framework
of award of contracts associated with the implementation
of the budget.

24. The EDPS underlines that when Member States are recipi-
ents of
the concerned data, Article 8 of Regulation
45/2001 is applicable. This article deals with the transfer of
personal data to recipients, other than Community institu-
In this
tions and bodies, subject to Directive 95/46/EC.
case, it is likely that Article 8 (a) is respected, considering
that the ‘necessity’ of the data for the performance of the
tasks carried out by the recipients is related to the way
chosen by the Commission to implement
the budget.
Furthermore, all those bodies are acting under the national
law implementing Directive 95/46 and are acting for the
purpose of the implementation of European budget.

to national

25. As far as third countries and international organisations are
concerned, Article 9 of Regulation 45/2001 is applic-
able (14). Article 9(1) prohibits the transfer of personal data
than Community institutions and
to recipients, other
bodies, which are not subject
law adopted
pursuant to Directive 95/46/EC, unless an adequate level of
protection is ensured in the country of the recipient or
within the recipient international organisation and the data
are transferred solely to allow tasks covered by the compe-
tence of
to be carried out. Regulation
45/2001 allows for derogations, which cover the situation
of the award of contracts associated with the implementa-
tion of the budget. However, the EDPS underlines that these
exceptions have to be interpreted restrictively. It is prefer-
able to provide for adequate safeguards in the case of struc-
tural
the transfer from the
central database, transfers are structural and therefore the
need for safeguards, such as contractual clauses in the
granting agreement of EU funds, should be laid down in
the Implementing Rules.

In the context of

the controller

transfers.

(14) Article 9 is comparable to Articles 25 and 26 of Directive 95/46/EC

C 94/16

EN

Official Journal of the European Union

28.4.2007

26. Besides, third countries are not only provided with data
from the central database, according to Article 95 of the
FR. Article 134a of the IR also foresees the receiving of
data from third countries and international organisations,
and to this extent they shall certify to the Commission that
information was established and transmitted in accordance
with the rules on the protection of personal data. In this
context, the EDPS underlines the importance of the data
quality principle when international transfers of data take
place. It must be ensured that the provisions of Regulation
45/2001 regarding the accuracy and updating of data,
which are provided to the Commission and recorded in the
database, are respected. Therefore, when agreements for
funding are concluded, it will be important to define the
data which are covered and the warranties attached to their
quality. The need for
these safeguards should also be
included in the Implementing Rules.

II.2.e. Rights of candidates and tenderers

shall benefit

27. Candidates and tenderers which are registered in the central
database
regarding the
management of their personal data in the central database.
These safeguards should notably be found in the data
subject's rights to be informed and to have access to data
relating to them.

from safeguards

28. The right of information is covered by Article 134a(1) (3)
of the IR Proposal. However, the EDPS considers that the
wording of this paragraph should be reviewed and inter-
preted as follows:
‘The institutions, executive agencies,
authorities and bodies referred to in Articles 95(1) and (2)
of the Financial Regulation shall certify to the Commission
that the information was established and transmitted in
accordance with the rules on the protection of personal
data and that
the third party concerned was informed
about the transmission of information’. The EDPS under-
lines that Regulation 45/2001 is applicable to the institu-
tions, executive agencies and bodies but that the national
legislations
implementing Directive 95/46/EC will be
applicable in Member States. However, problems may arise
at national level when a third country does not provide its
citizens with the right to be informed. The EDPS thinks
that the Commission should ensure a mechanism allowing
any candidates or tenderers to be aware of their inclusion
in the central database.

to information (15).

29. Furthermore, the EDPS agrees with a proactive approach of
the right
In the prior-check case
regarding the implementation of the EWS of the Court of
Justice (16), the EDPS welcomes that all third parties are
informed beforehand that their personal data may be used
by the Court not only for internal purposes related to the
procurement process but also communicated to other insti-
tutions in the context of Articles 93 and 94 of the FR with
the purpose of being included in the database of
the
Commission foreseen by Article 95 of the FR. In such cases
a third party has already been informed of the possibility of

(15) See above on the transparency principle.
(16) To be published soon on our website: www.europa.edps.eu

being excluded from the participation in the procurement
process or excluded from the award of a contract, if it is
included in the database of the Commission. In the same
perspective, the EDPS also recognises the efforts made to
provide additional
instance,
recital 36 of the FR Proposal deals with the right of infor-
mation to be provided to unsuccessful tenderers after a
contract has been awarded. As already underlined in this
Opinion, the EDPS proposes that this procedure is followed
in all the concerned institutions, authorities and bodies and
that it is prescribed in the IR Proposal.

information. For

rights of

30. Article 13 of Regulation 45/2001 establishes a right of
access of a data subject to information which is processed
by data controllers. Therefore, in order to implement this
right, it should be stated in the Implementing Rules that
any third party entered in the database has a right of access
to the data regarding him or her and that this right should
not be restricted for reasons other than those mentioned in
Article 20 of Regulation 45/2001. Moreover, the right of
access
approach
closely related to the proactive
mentioned above in the sense that not being aware of the
inclusion in the database notably entails that persons will
not be able to exercise their right of access.

is

II.2.f. Need for prior checking

31. According to Article 27(2)

(b) of Regulation 45/2001,
processing operations intended to evaluate personal aspects
relating to data subjects,
including their ability, efficiency
and conduct, are likely to present specific risks to the rights
of data subjects. Moreover, the same applies when they
contain data relating to processing operations for
the
purpose of excluding individuals from a right, benefit or
contract (Article 27(2) (d)).

32. At the date of adoption of this opinion, both the European
Commission and the European Court of Justice have made
a notification to the EDPS for prior checking of the Early
Warning System based on the existing version of the FR.
As the new version of the FR introduces modifications in
the management of the database with regard to the setting
up and operation of a common database to which Member
States, third countries and international organisations will
have access and to which they will send data, the EDPS
considers it as a substantial change falling under Article 27
of Regulation 45/2001. Therefore, when the Commission
will take the steps to implement the new legal framework,
the EDPS will prior check the system.

III. TIME LIMITS FOR STORAGE AND BUDGETARY

CONTROL

33. Although not covered by the current modifications which
are part of the proposals, the EDPS would like to use this
opportunity to highlight a provision which he dealt with in
previous prior checking cases related to budgetary ques-
tions.

28.4.2007

EN

Official Journal of the European Union

C 94/17

Existing framework

that

34. Article 49 of the present IR on the keeping of supporting
documents by authorising officers provides
‘The
management systems and procedures concerning the keeping
of original supporting documents shall provide for: (…) d)
such documents to be kept for at least five years from the
date on which the European Parliament grants discharge for
the budgetary year to which the documents relate. Docu-
ments relating to operations not definitively closed shall be
kept for longer than provided for in point (d) of the first sub-
paragraph, that is to say, until the end of the year following
that in which the operations are closed’.

35. The principle as concerns the conservation of supporting
documents as established by the IR therefore allows for a
possible conservation period of up to 7 years,
for the
purpose of budgetary discharge of the accounts of the Euro-
pean institutions and bodies.

36. Supporting documents kept by authorising officers may
contain personal data and to this extent the principles on
conservation of personal data as laid down by Regulation
45/2001 on the protection of individuals with regard to the
processing of personal data by the Community institutions
and bodies and on the free movement of such data also
apply.

37. As a general principle, Article 4.1.c of Regulation 45/2001
provides that personal data must be adequate, relevant and
not excessive in relation to the purposes for which they are
collected and/or further processed. Article 4.1.e of the Regu-
lation further provides that personal data may be kept in a
form which permits identification of the data subjects for no
longer than is necessary for the purpose for which the data
were collected or further processed.

38. Article 37 of the Regulation provides for specific rules as
concerns the conservation of traffic and billing data in the
context of internal communication networks. Such networks
are defined in Article 34 as being ‘telecommunications
network or terminal equipment operated under the control
of a Community institution or body’. The article therefore
applies to traffic and billing data collected by internal
networks of the Community institutions or bodies.

39. According to Article 37.1, traffic data which are processed
and stored to establish calls and other connections over the
telecommunications network shall be erased or made anon-
ymous upon termination of the call or other connection.
The principle is therefore to erase data as soon as no longer
necessary for the establishment of the call or connection.

40. Article 37.2 however provides that traffic data (17), as indi-
cated in a list agreed by the EDPS, may be processed for the
including the
purpose of budget and traffic management,
verification of authorised use of
the telecommunications
systems. They must be erased or made anonymous as soon
as possible and in any case no longer than six months after

(17) Billing data are not expressly mentioned in Article 37.2 but can be

implicitly included.

collection, unless they need to be kept for a longer period to
establish, exercise or defend a right in a legal claim pending
before a court. If the period of six months lapses without the
institution of proceedings, the traffic data must be erased or
rendered anonymous. If proceedings have been commenced
the
within that period, such proceedings will
prescriptive period until the end of the proceedings and
further until the end of the prescriptive period allowed for
any appeal or the conclusion of the appeal proceedings as
the case may be. Any conservation of traffic and billing data
beyond these six months can only be justified on the basis of
Article 20.

interrupt

41. Article 20 of Regulation 45/2001 provides that exemptions
and restrictions may be brought to the immediate erasure of
traffic data as provided for in Article 37.1 in certain limited
cases enumerated in the article. Notably traffic data may be
kept if this constitutes a necessary measure to safeguard the
prevention, investigation, detection and prosecution of crim-
inal offences; an important economic or financial interest of
a Member State or of the European Communities, including
monetary, budgetary and taxation matters; or the protection
of the data subject or of the rights and freedoms of others.
Article 20, as an exception to principles of data protection
provided in the Regulation must be interpreted restrictively
and only applies on a case by case basis. Furthermore,
Article 20 only provides for exceptions to the immediate
erasure of traffic data as laid down in Article 37.1 and not to
the limitation of six months as provided for in Article 37.2.
Article 20 cannot therefore serve to justify the conservation
of
traffic data beyond six months for general auditing
purposes as foreseen in Article 49 IR.

Need for review

42. The EDPS therefore recommends that the provisions of the
supporting documents are
the principles

IR on the conservation of
reviewed so as to ensure the respect of
governing the protection of personal data.

43. In order to ensure the respect of these principles, informa-
tion contained in supporting documents must be scrutinized.
Indeed supporting documents contain different
levels of
for budgetary
information: general
discharge, including possible auditing, and detailed informa-
tion which is not as such necessary for budgetary control.

information relevant

44. The general principle should be that if the supporting docu-
ments contain personal data, only that personal data neces-
sary for
the purpose of budgetary discharge may be
processed. As far as possible, those documents which contain
personal data which are not necessary for this purpose
should be deleted. The conservation of relevant data may
only be kept for as long as necessary for the purpose of
budgetary discharge. The period of 5-7 years as established
by Article 49 IR must, in any event, be seen as a maximum
time limit for the conservation of supporting documents.

C 94/18

EN

Official Journal of the European Union

28.4.2007

45. As concerns the conservation of supporting documents
which contain details such as traffic data,
the principle
should be that such traffic data should be deleted as they are
not necessary for the purpose of budgetary discharge. When-
ever supporting documents are set in a layered form, the
lowest level of greatest detail, which may contain traffic data,
is not necessary and should not be kept for the purpose of
budgetary discharge. If the supporting documents are not set
in a layered manner, then partial processing of the informa-
tion contained in the documents should be envisaged,
providing this does not involve a disproportionate effort.

46. To illustrate this point, the EDPS would like to take the
example of budgeting of fixed telephony in the institutions.
As concerns fixed telephony the principle established in
Article 37 implies that traffic data such as number calling,
the number called and the duration of call may be kept for
the purpose of traffic and budget management including the
verification of the authorised use of the communications
system for up to 6 months. Once the authorised use of the
communications tools has been duly verified, any traffic data
should be erased or made anonymous. Should the data need
to be kept
for auditing of costs of communications in
accordance with the IR, no detailed traffic data need be kept.
for budget
The only relevant data which may be kept
purposes relate to the costs of communications revealing no
underlying traffic data (18).

Suggestions for a modified Article 49

47. In order to address this issue of compatibility, the EDPS
suggests adding a paragraph to Article 49 IR which provides:
‘Personal data contained in supporting documents should be deleted
where possible when those data are not necessary for the purpose of
budgetary discharge. In any event Article 37§2 of Regulation (EC)
45/2001 as concerns the conservation of traffic data should be
respected’.

IV. CONCLUSION

The EDPS welcomes to have been consulted on these proposals,
which foresee a sound and more transparent financial manage-
ment of the Community funds. He also welcomes this occasion
to highlight a number of specific aspects of data protection
relating to their implementation, especially in the context of the
Early Warning System.

On the substance, the EDPS recommends the following:

— The insertion in the Implementing Rules of references to a
proactive approach (prior information and feedback infor-
mation) which should be widely applied by all
the
concerned institutions, authorities and bodies in the light of
the transparency principle;

— Specific safeguards in the light of data protection principles
must be implemented when a central database is established;

— The Implementing Rules should clarify, in Article 134a, the
notions of candidates and tenderers as well as the categories
of entities which are affected by the database;

— A precise timeframe regarding the updating of information
contained in the database should be put in place in the
Implementing Rules;

— To avoid inconsistency, a system of selection of authorizing
officers must be put in place among Member States, authori-
ties and bodies; their access to information, as well as the
amount of data which can be accessed according to Article
95(2) should be defined in complementary administrative
rules.

— In the context of transfers of personal data from the central
database,
those transfers are structural and therefore the
need for safeguards such as contractual clauses should be
laid down in the Implementing Rules.

— When data are received from third countries and interna-
tional organisations, it will be important to define the data
which are covered and the warranties attached to their
quality, and the need for these safeguards should thus be
included in the Implementing Rules

— The wording of Article 134a(1)

(3) of the Implementing
Rules should be reviewed so as to refer to the institutions,
executive agencies, authorities and bodies referred to in Arti-
cles 95(1) and (2) of the Financial Regulation;

— Regarding the right of access of candidates and tenderers, a
reference to Article 13 of Regulation 45/2001 should be
included;

— In order to address the issue of compatibility with Article
37 of Regulation 45/2001, the EDPS suggests adding a para-
graph to Article 49 IR;

As to procedure, the EDPS:

— recommends that an explicit reference to this Opinion is

made in the preamble of the Proposal.

— reminds that, as the processing operations foreseen will
introduce substantial changes in the management of
the
database and thus will fall under Article 27 of Regulation
45/2001, the EDPS must prior check the system before it is
implemented.

Done at Brussels on 12 December 2006

Peter HUSTINX

European Data Protection Supervisor

(18) A clear illustration of this can be found in the Opinion of the EDPS on
the TOP 50 procedure of the European Parliament (case 2004-0126)