Opinion of the European Data Protection Supervisor on the proposal for a Regulation of the European Parliament and of the Council on Community statistics on public health and health and safety at work (COM(2007) 46 final)
Date: 2007-09-05
Institutions: European Data Protection Supervisor
Subjects: EU statistics, European Data Protection Supervisor, Eurostat, data protection, data transmission, occupational health, occupational safety, opinion (EU), personal data, public health

7.12.2007

EN

Official Journal of the European Union

C 295/1

I

(Resolutions, recommendations and opinions)

OPINIONS

EUROPEAN DATA PROTECTION SUPERVISOR

Opinion of the European Data Protection Supervisor on the proposal for a Regulation of the
European Parliament and of the Council on Community statistics on public health and health and
safety at work (COM(2007) 46 final)

(2007/C 295/01)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Com-
munity, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the
European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament
and of the Council of 24 October 1995 on the protection of
individuals with regard to the processing of personal data and
on the free movement of such data (1),

2.

Having regard to Regulation (EC) No 45/2001 of the European
Parliament and of the Council of 18 December 2000 on the
protection of
individuals with regard to the processing of
personal data by the Community institutions and bodies and on
the free movement of such data (2), and in particular
its
Article 41,

Having regard to the request for an opinion in accordance with
Article 28(2) of Regulation (EC) No 45/2001 received on
12 February 2007 from the European Commission,

Article 28(2) of Regulation (EC) No 45/2001, the EDPS
welcomes the explicit reference to this consultation in the
preamble of
in the language used by the
Commission (‘After consulting the European Data Protection
Supervisor’), which is a consistent and standardized way of
referring to EDPS Opinions.

the Proposal,

It is the first time that the EDPS has been directly consulted
on a proposal for a Regulation in the field of Community
statistics. However, there have been several acts adopted on
this general subject before the appointment of the EDPS.
This consultative opinion follows the contacts between the
EDPS secretariat and the services of the relevant DG of the
Commission (Eurostat) as well as a meeting held in the
premises of Eurostat, in the framework of the EDPS inven-
tory exercise 2007.

The proposal in its context

HAS ADOPTED THE FOLLOWING OPINION:

Consultation of the EDPS

1. The proposal for a Regulation of the European Parliament
the Council on Community statistics on public
and of
health and health and safety at work (hereinafter
‘the
proposal’) was sent by the Commission to the EDPS for
consultation, in accordance with Article 28(2) of Regulation
(EC) No 45/2001. In view of the mandatory character of

(1) OJ L 281, 23.11.1995, p. 31.
(2) OJ L 8, 12.1.2001, p. 1.

3. The proposal's goal is to give a consolidated and firm basis
for collections already implemented or for which metho-
dology is currently being developed or implementation
prepared, through providing a basic legal act in the areas of
public health and health and safety at work statistics.
Indeed, it is clear to the EDPS that the current proposal
refers to existing practices and fulfils the need of a legal
background to these practices. The domains covered by the
proposal relate to ongoing activities and developments
carried out together with the Member States in the relevant
groups of
the European Statistical Office (hereinafter
‘Eurostat’) or, in the area of public health, of the Partnership
on public health statistics.

C 295/2

EN

Official Journal of the European Union

7.12.2007

4. As stated in the proposal, it aims at establishing the frame-
work for all current and foreseeable activities in the field of
Public health and Health and Safety at Work statistics
carried out by the European Statistical System (i.e. Eurostat),
the national statistical
institutes and all other national
authorities responsible for the provision of official statistics
in these areas. It is understood that the proposal
is not
aimed at policy developments for these two fields, which
are carried out respectively under Articles 152 and 137 of
the Treaty. The proposed regulation sets
the general
principles and describes the main contents of the related
data collection in its Annexes I to V for the 5 domains
and
concerned, namely
health determinants, health care, causes of death, accidents
at work as well as occupational diseases and other work-
related health problems and illnesses.

on health

statistics

status

5. The EDPS notes that several initiatives (Council Resolution,
Decision, Commission Communication, Action Plan) (1)
called for the development of specific legislation in the
statistical field which would improve the quality, compar-
ability and accessibility of data on health status using the
Community Statistical Programme. Moreover,
the EDPS
understands that a common statistical data collection on
the Systems of Health Accounts has been recently imple-
mented together with the Organisation for Economic
Cooperation and Development
(OECD) and the United
Nations (through the World Health Organisation (WHO).

the

five

years Community

6. The need for a legal basis has emerged because until now
statistical data collections were carried out on the basis of
‘gentlemen's agreements’ with the Member States in the
Statistical
framework of
Programmes (from 2003 till 2007) and its annual compo-
nents. Decision No 1786/2002/EC of
the European
Parliament and of
the Council of 23 September 2002
adopting a programme of Community action in the field of
public health (2003-2008) (2) stated that
the statistical
element of the information system on public health is to be
in collaboration with Member States, using as
developed,
necessary
to
statistical
the Community
promote synergy and avoid duplication. In particular, in the
area of public health statistics, the developments and imple-
mentations in the three strands (causes of deaths, health
care and health interview surveys, disability and morbidity)
are steered and organised according to a partnership struc-
ture between Eurostat, together with leading countries and
Member States. The proposal also presents a great interest
in that there is a need for a high standard statistical infor-
mation system for assessing achievements of policies and
developing and monitoring further actions in both areas of
public health and health and safety at work. This proposal
will also enable Member States to benefit from improved
planning in terms of time and from clearer requirements
for the requisite data standards.

programme

7. The EDPS is pleased to see that an impact assessment has
been carried out by the Commission, proposing different
alternatives regarding the development of statistics in the
areas of public health and health and safety at work, whose

(1) As explained in the recitals of the Proposal.
(2) OJ L 271, 9.10.2002, p. 1.

current proposal for a Regulation is one of those alterna-
tives (3). The EDPS also agrees with the fact that a Regu-
lation is the legal instrument most appropriate for statistical
actions which require detailed and uniformed application
throughout the Community.

8. Article 285 of

the Treaty establishing the European
Community lays down the legal basis of statistical activities
requirements
at European level. This Article sets out
relating to the production of Community statistics and, as
underlined in its paragraph 2,
to
[standard of] impartiality, reliability, objectivity, scientific inde-
pendence, cost-effectiveness and statistical confidentiality’. This
Article implies that measures for the production of statistics
are of exclusive competence at Community level.

requires ‘conform[ity]

is

9. The production of Community statistics is governed by the
rules set out in Council Regulation (EC) No 322/97 of
17 February 1997 (4) on Community Statistics, as amended
the European
by Regulation (EC) No 1882/2003 of
Parliament and of the Council (5). Besides, statistical confi-
dentiality
guaranteed through Council Regulation
(Euratom, EEC) No 1588/90 of 11 June 1990 on the trans-
mission of data subject to statistical confidentiality to the
Statistical Office of the European Communities (6) and by
Commission Regulation (EC) No 831/2002 of 17 May
2002 implementing Council Regulation (EC) No 322/97 on
Community Statistics, concerning access to confidential
data for scientific purposes (7). Moreover, the proposal also
refers to Commission Decision 97/281/EC (8) of 21 April
1997 on the role of Eurostat as regards the production of
Community statistics.

10. Finally,

the EDPS is also aware that a proposal of

the
European Parliament and of the Council on European statis-
tics will be presented by the Commission in autumn 2007,
according to the agenda planning of the Commission (9).
This Regulation will have an impact on the protection of
individual's rights and freedoms with regard to the proces-
sing of personal data in the field of statistics. This Regu-
lation will develop and harmonise the general legal frame-
work and the impact of this Regulation on the current
analysis can not be ignored. The EDPS will follow the devel-
opments regarding this text and issue a reaction,
in the
light of his consultative role, based on his inventory.

(3) A second alternative was to continue to develop statistics in the areas of
public health and health and safety at work using ‘gentlemen agree-
ments’ with the Member States and a third and last alternative was to
develop and adopt various proposals for Regulations EC concerning
either public health statistics and health and safety at work separately or
each domain and related statistical tool separately.

(4) OJ L 52, 22.2.1997, p. 1.
(5) OJ L 284, 31.10.2003, p. 1.
(6) OJ L 151, 15.6.1990, p. 1.
(7) OJ L 133, 18.5.2002, p. 7.
(8) OJ L 112, 29.4.1997, p. 56.
(9) Proposal for a Regulation of the European Parliament and of the

Council on European Statistics —2007/ESTAT/023.

7.12.2007

EN

Official Journal of the European Union

C 295/3

11. Moreover,

following the meeting held in the Eurostat
premises, the EDPS and Eurostat will conduct a common
review of the processing operations put in place in Eurostat
statistical
when dealing with individual
purposes. This review will be conducted in parallel to the
intervention of the EDPS regarding the proposal for a Regu-
lation on European statistics.

records

for

The relevant data protection legal framework

12. Recitals 11 and 12 of the proposal state that the present
Regulation (proposal) ensures full respect for the right to
the protection of personal data as provided for in Article 8
of
the European
Union and that the Directive 95/46/EC and Regulation (EC)
No 45/2001 shall apply in the context of the Regulation.

the Charter of Fundamental Rights of

13. Directive 95/46/EC (further the Directive) and Regulation
(EC) No 45/2001 (further Regulation (EC) No 45/2001)
consider data concerning health as special categories of
data whose processing should in principle be prohibited.
However, they allow the processing of personal data on
health for reasons of substantial public interest subject to
provision of appropriate safeguards. According to the
proposal, the substantial public interest is constituted by
‘the statistical requirements to which Community action in the
field of public health, national strategies for the development of
high-quality, accessible and sustainable health care and Com-
munity strategy on health and safety at work give rise, as well as
requirements arising in connection with structural
indicators,
sustainable development
indicators and European Community
health indicators and other sets of indicators which it is necessary
to develop for the purpose of monitoring Community and national
political actions and strategies in the areas of public health and
health and safety at work’ (1).
It is necessary, however, to
provide specific and suitable safeguards so as to protect the
individuals. The
fundamental rights and the privacy of
Commission considers that Regulations (EC) No 322/97
and (Euratom, EEC) No 1588/90 provide the appropriate
safeguards for the protection of individuals in the case of
the production of Community statistics on public health
and health and safety at work.

Data Protection and Statistical Confidentiality

14. The proposal underlines the importance of statistical confi-
dentiality of data received by Eurostat. This concept of
confidential data has to be analysed in the light of the
notion of personal data, as defined by Directive 95/46/EC.

(1) Recital 12 of the Proposal.

15. The definition of personal data contained in Article 2(a) of
Directive 95/46/EC reads as follows:
‘Personal data shall
mean any information relating to an identified or identifiable
natural person (“data subject”); an identifiable person is one who
can be identified, directly or indirectly, in particular by reference to
an identification number or to one or more factors specific to his
physical, physiological, mental, economic, cultural or social iden-
tity’. Moreover, recital 26 of the Directive states: ‘whereas, to
determine whether a person is identifiable, account should be
taken of all the means likely reasonably to be used either by the
controller or by any other person to identify the said person’. The
Article 29 Working Party recently issued an opinion (2) on
the concept of personal data, analysing its four main
components (‘any information’,
‘identified or
identifiable’, ‘natural person’).

‘relating to’,

16. Statistical confidentiality is defined by Article 13 or Regu-
lation (EC) No 322/97 as follows: ‘Data used by the national
authorities and the community authority for the production of
Community statistics shall be considered confidential when they
allow statistical units to be identified, either directly or indirectly,
thereby disclosing individual information. To determine whether a
statistical unit (3) is identifiable, account shall be taken of all the
means that might reasonably be used by a third party to identify
the said statistical unit. By derogation, data taken from sources
which are available to the public and remain available to the
public at the national authorities according to national legislation,
shall not be considered confidential’. The concept of reasonable-
ness is applied to the protection of confidentiality. This
recognises the fact that, although all reasonable measures
must be taken to prevent disclosure, absolute protection of
data would prevent the production of virtually all outputs.

17. The two definitions have similarities in their wordings, in
that they use similar vocabulary. It seems obvious to the
EDPS that Article 13 of Regulation (EC) No 322/97 has
been written with Directive 95/46/EC in mind. However, it
is also important to underline that the (almost) similar defi-
nitions are related to two different concepts and that they
cover two different terms that should not be mistaken,
‘confidentiality’ on one side and ‘personal data’ on the other
side. For instance, the definition of confidentiality also deals
with non natural/physical persons, while the notion of
personal data relates exclusively to natural persons. More-
over, the definition of confidentiality, unlike the notion of
personal data, excludes data taken from sources which are
available to the public and remain available to the public.

(2) Article 29 Working Party, Opinion 4/2007 on the concept of personal
data, adopted 20 June 2007, available on the website of the Working
Party.

(3) A statistical unit is defined in Regulation (EEC) No 1588/90 as a basic
unit covered by statistical data transmitted to the SOEC (i.e. Eurostat).

C 295/4

EN

Official Journal of the European Union

7.12.2007

Therefore, some data which may not be considered as
confidential anymore from a statistical point of view could
still be considered as personal data from a data protection
point of view.

No 322/97, and the metadata, required by this Regulation
and measures
to the Commission
in accordance with the existing Community
(Eurostat)
to statistical
provisions on transmission of data subject
confidentiality.

implementing it,

18. The same analysis occurs with the notion of anonymity.
the notion of
Although,
from a data protection view,
anonymity would cover data that are no longer identifiable
(see recital 26 of the Directive), from a statistical point of
view, anonymous data are data for which no direct identifi-
cation is possible. This definition implies that indirect iden-
tification of data would still qualify these data as anon-
ymous, from a statistical point of view.

it

is

the

that

guidelines

important

19. Moreover, the EDPS is aware that statistical data which are
being processed will mainly be indirectly identifiable data.
Therefore,
and
methodologies which are developed by Eurostat regarding
should explicitly
confidential data
the protection of
mention the treatments from a data protection point of
view. It is therefore the opinion of the EDPS that, in order
to avoid possible misunderstandings when using these
notions, the context and legal framework in which these
notions are being used should be always clearly and
precisely defined.

20. This is also important in the sense that the current legal
framework enables access to anonymised microdata avail-
able at Eurostat only for scientific purposes. The release of
the data sets to researchers is governed by Regulation (EC)
No 831/2002 (1) and (EC) No 1104/2006 (2). According to
this text, access to confidential data shall mean either access
on the premises of the Community authority or release of
anonymised microdata. Therefore, these anonymised data,
understood from a statistical point of view, might still allow
indirect identification of statistical units. In this case, any
transfer of data relating to identifiable individuals for scien-
tific purposes would be a transfer of personal data and
should therefore comply with the relevant Articles of Direc-
tive 95/46/EC on transfer of data.

Transmission, dissemination and publication of statistical
data

21. From a data protection point of view, the cornerstone of
the proposal
is Article 6. It foresees that Member States
shall transmit the microdata or, depending on the domain
and subject concerned, the aggregated data, including confi-
dential data as defined by Article 13 of Regulation (EC)

(1) Commission Regulation (EC) No 831/2002 of 17 May 2002 imple-
menting Council Regulation (EC) No 322/97 on Community Statistics,
concerning access to confidential data for scientific purposes.

(2) Commission Regulation (EC) No 1104/2006 of 18 July 2006
amending Regulation (EC) No 831/2002 implementing Council Regu-
lation (EC) No 322/97 on Community Statistics, concerning access to
confidential data for scientific purposes.

22. Therefore,

the proposal deals with the transmission of
specific categories of health related data from Member
States to Eurostat. Three categories of data are concerned:
microdata, aggregated data and metadata. From a statistical
point of view, microdata consist of
individual statistical
records relating to single statistical units. The manual on
‘protection of confidential data in Eurostat’ (3) states that an
increasing number of Eurostat units are working with
microdata, which are divided in two sub-categories:

(a) Directly

those
identifiable microdata, which are
individual data which include the name and/or address,
and/or some other publicly known or available identi-
fier — such as identifying number, which allow the
microdata record to be linked to an individual. Direct
identifiers are normally removed from microdata trans-
mitted to Eurostat by national statistical authorities.

(b) Indirectly identifiable microdata which are those indivi-
dual data which do not contain directly identifying
information, but which do contain enough information
to allow the statistical unit to be identified (with reason-
able certainty) with the expenditure of a reasonable
amount of time, money and effort.

The EDPS believes that the data which are more likely to
contain personal data are the microdata.

23. Indeed, the metadata and aggregated data usually carry less
possibilities of identifying a statistical unit. Metadata rather
describe the context in which data are gathered and used
for the statistical tasks to be performed and aggregated data
typically relate to broad classes, groups, or categories, so
that it is not possible to distinguish the properties of indivi-
duals within those classes, groups, or categories. They
would normally not be personal data, depending on the
domain and subject concerned.

24. As to the microdata covered by the proposal, Article 1
describes the subject matter of the proposal. The Article
foresees that statistics have to be provided ‘in the form of a
minimum data set’ and is further developed within the five
annexes of the proposal (as underlined by Article 2 of the
proposal). These annexes cover the different domains in
which Eurostat intends to request Member States to supply

(3) Manual on Protection of Confidential data in Eurostat, December

2004.

7.12.2007

EN

Official Journal of the European Union

C 295/5

statistics and establish the minimum data set, which are
required for Community action in the field of public health.
From the analysis of the annexes by the EDPS, it is possible
that some of the minimum data set required may imply the
processing of personal data. Regarding the processing
operations of these data entering Eurostat and which are
provided by Member States, it is also important to assess
the applicability of Regulation (EC) No 45/2001. During
the common review which the EDPS will conduct with the
Eurostat services, an in-depth analysis of the minimum data
set required for each processing operations and an analysis
of the processing operations implemented in Eurostat will
be carried out, in order to determine whether any notifica-
tions should be submitted for prior checking (see below
points 27 and 28). This review should also ensure that
appropriate safeguards are put in place in the use which is
made of the data.

25. Regarding transfer of data, the EDPS wants to stress that
any transfer of personal data from Eurostat outside the
European Union should comply with the relevant Articles
of Regulation (EC) No 45/2001 on transfer of data to third
countries (Article 9). Indeed, the proposal, in its recital 8,
underlines the cooperation of Eurostat with the United
Nations (through the World Health Organisation (WHO)
and the International Labour Organisation (ILO)) as well as
with the Organisation for Economic Cooperation and
Development (OECD). It is also underlined that a common
statistical data collection on the Systems of Health Accounts
has been recently implemented together with the OECD
and the WHO. The EDPS welcomes such cooperation,
when it takes the form of cooperation on methods of work
and methodology in certain domains, but stresses that if
transfers of statistical data which could be considered as
personal data themselves are foreseen, they should comply
with the conditions imposed by the Regulation.

26. As regards conservation periods for statistical purposes, the
first collections of data about health determinants by
Eurostat took place more than 10 years ago. Article 4(e) of
Regulation (EC) No 45/2001 states that ‘personal data must
be kept in a form which permits identification of data subjects for
no longer than is necessary for the purposes for which the data
were collected or for which they are further processed. The Com-
munity institution or body shall
lay down that personal data
which are to be stored for longer periods for historical, statistical
or scientific use should be kept either in anonymous form only or,
if that is not possible, only with the identity of the data subjects
encrypted.
the data shall not be used for any
purpose other than for historical, statistical or scientific purposes’.
The EDPS understands the interests and needs to keep
statistical
statistical
through
methodologies evolve and research based on longer periods
may be conducted. There is no general limitation set in the
proposal regarding the conservation period of data by
Eurostat. The EDPS generally believes that the standard on

In any event,

information

time,

as

of

by

data

implemented

confidentiality
Eurostat
regarding the protection of confidential data is high and
that
the protection for microdata is ensured. However,
this is without prejudice to any analysis made through
prior-check, where the EDPS would detect deficiencies.
Therefore,
it is only on a case by case basis that such
evaluation should be made.

Prior checking

in the context of

27. As already underlined, the proposal states that Member
States compile data concerning public health and health
and safety at work. The sources are thus national. There-
fore,
the proposal, personal data will
usually be processed by competent national authorities, and
will
laws imple-
menting Directive 95/46/EC. However, Eurostat will further
In this case, this processing will be
process these data.
subject
the
current legal framework on data protection provides for a
harmonized level of protection throughout the EU.

to Regulation (EC) No 45/2001. Therefore,

thus fall within the scope of national

28. In this

context, Article 27(1) of Regulation (EC)
No 45/2001 has to be taken into account. It subjects to
prior checking by the EDPS processing operations likely to
present specific risks to the rights and freedoms of data
subjects by virtue of
their scope or their
their nature,
purposes. Article 27(2) of the Regulation contains a list of
processing operations likely to present specific risks in the
above sense, among them health related personal data
In as much as microdata might be
(Article 27(2)(a)).
personal data related to health, their processing will be
subject to prior checking by the EDPS. Where this proces-
sing has already started in the past, such a prior check
might also be conducted on an ex-post basis.

Conclusion

The EDPS welcomes the proposal for a Regulation on Com-
munity statistics on public health and health and safety at work.
This Regulation would give a firm basis to the existing practices
of gathering and evaluating Community statistical data. Ulti-
mately, it would lead to the production of meaningful statistics
in the field.

However, the EDPS would like to stress the following points:

— the guidelines and methodology which are developed on the
basis of the Regulation should take into account and where
necessary specifically address the differences between Data
Protection and Statistical Confidentiality as well as the
notions which are specific to each area,

— if transfers of personal data to third countries are foreseen,
they should comply with Article 9 of Regulation (EC)
No 45/2001,

C 295/6

EN

Official Journal of the European Union

7.12.2007

— the conservation periods of statistical data are based on well
developed standards of confidentiality. These standards are
without prejudice of analysis which should be conducted on
a case by case basis,

— a common review of the processes put in place in Eurostat
when dealing with individual records for statistical purposes
should be conducted and may lead to the need for prior-
the
checking. This common review should consist of
analysis of the minimum data set required for each proces-

sing operations and an analysis of the processing operations
implemented in Eurostat.

Done at Brussels, 5 September 2007.

Peter HUSTINX

European Data Protection Supervisor