Opinion of the European Data Protection Supervisor on the Commission Decision of 12 December 2007 concerning the implementation of the Internal Market Information System (IMI) as regards the protection of personal data (2008/49/EC)
Date: 2008-10-25
Institutions: European Data Protection Supervisor
Subjects: data processing, data protection, information system, personal data, single market

25.10.2008

EN

Official Journal of the European Union

C 270/1

I

(Resolutions, recommendations and opinions)

OPINIONS

EUROPEAN DATA PROTECTION SUPERVISOR

Opinion of the European Data Protection Supervisor on the Commission Decision of 12 December
2007 concerning the implementation of the Internal Market Information System (IMI) as regards
the protection of personal data (2008/49/EC)

(2008/C 270/01)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Com-
munity, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the
European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament
and of the Council of 24 October 1995 on the protection of
individuals with regard to the processing of personal data and
on the free movement of such data, and

Having regard to Regulation (EC) No 45/2001 of the European
Parliament and of the Council of 18 December 2000 on the
protection of
individuals with regard to the processing of
personal data by the Community institutions and bodies and on
the free movement of such data, and in particular its Article 41,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION

The Internal Market Information System

1. The Internal Market Information System (‘IMI’) is an infor-
mation technology tool that allows competent authorities
in Member States to exchange information with each other
in the implementation of the Internal Market legislation.
IMI is funded under the ‘IDABC’ programme (Interoperable
to public
Delivery of European eGovernment Services
administrations, businesses and citizens) (1).

(1) See point 12 of this Opinion.

2. IMI is designed as a general system to support multiple
areas of internal market legislation and it is envisaged that
its use will be expanded to support a number of legislative
areas in the future. Initially, IMI will be used to support the
mutual assistance provisions of Directive 2005/36/EC
(‘Professional Qualifications Directive’) (2). From December
2009, IMI will also be used to support the administrative
cooperation provisions of Directive 2006/123/EC (‘Services
Directive’) (3).

The Opinion of the Article 29 Data Protection Working
Party and the involvement of the EDPS

3. During the spring of 2007,

the European Commission
requested the Opinion of the Article 29 Data Protection
Working Party (‘WP29’) to review the data protection impli-
cations of IMI. The WP29 issued its Opinion on the data
protection aspects of IMI on 20 September 2007 (4). The
Opinion of the WP29 supported the Commission's plans to
adopt a decision regulating the data protection aspects of
IMI, and give a more specific legal basis to the exchange of
data within IMI.

4. The EDPS welcomes that

the
Opinion of the WP29 prior to drafting the IMI Decision.
The EDPS actively participated in the work of the subgroup

the Commission sought

(2) Directive 2005/36/EC of the European Parliament and of the Council
of 7 September 2005 on the recognition of professional qualifications
(OJ L 255, 30.9.2005, p. 22).

(3) Directive 2006/123/EC of the European Parliament and of the Council
of 12 December 2006 on services in the internal market (OJ L 376,
27.12.2006, p. 36).

(4) WP29 Opinion No 7/2007 on data protection issues related to the

Internal Market Information System (IMI), WP140.

C 270/2

EN

Official Journal of the European Union

25.10.2008

dealing with IMI and supports the conclusions of
the
Opinion of the WP29. He also welcomes that the Commis-
sion informally consulted the EDPS prior to the adoption
of the IMI Decision. This gave the opportunity to already
provide for suggestions prior to the adoption, which was
particularly needed since the procedure concerned a deci-
sion by the Commission itself, not a Proposal by the
Commission followed by a legislative procedure involving
the Council and the European Parliament.

at

the

same

ensures

transparency, while

information exchanges in the future.

(ii)
time;
(iii) allowing flexibility for the case if IMI will be used for
additional
It also
ensures that no information exchange can be carried out
through IMI without (i) having an appropriate legal basis in
specific internal market legislation allowing or mandating
information exchange; and (ii) including a reference to that
legal basis in the annex to the IMI Decision.

Commission Decision 2008/49/EC

5. On 12 December 2007, the Commission adopted its Deci-
sion 2008/49/EC concerning the implementation of
the
Internal Market Information System (IMI) as regards the
protection of personal data (‘IMI Decision’). The Decision
took into account some of the recommendations made by
the EDPS and the WP29. It furthermore specified the legal
basis.

Main concerns regarding the IMI Decision

10. The EDPS, however, is not satisfied with (i) the choice of
the legal basis of the IMI Decision which means that the
IMI Decision is now based on uncertain legal grounds (see
Section 2 of this Opinion); and (ii) the fact that a number
of necessary provisions regulating in detail the data protec-
tion aspects of IMI are not incorporated into the document
(see Section 3 of the Opinion).

Overall views of the EDPS on IMI

6. The overall views of the EDPS on IMI are positive. The
EDPS supports the aims of the Commission in establishing
an electronic system for the exchange of information and
regulating its data protection aspects. Such a streamlined
system may not only enhance efficiency of cooperation, but
may also help to ensure compliance with applicable data
protection laws. It may do so by providing a clear frame-
work on what information can be exchanged, with whom,
and under what conditions.

7. Nevertheless, establishment of

the centralized electronic
system also creates certain risks. These include, most
importantly, that more data might be shared and more
broadly than strictly necessary for the purposes of efficient
cooperation, and that data, including potentially outdated
and inaccurate data, might remain in the electronic system
longer than necessary. The security of a database accessible
in 27 Member States is also a sensitive issue, as the system
is only as safe as the weakest link in the network permits it
to be.

it

8. Therefore,

is very important

that data protection
concerns should be addressed in a legally binding Com-
munity act, as fully and unambiguously as possible.

Clear demarcation of the scope of IMI

9. The EDPS welcomes that the Commission clearly defines
and delimitates the scope of IMI, with an annex listing the
relevant Community acts on the basis of which information
can be exchanged. These currently include only the
Professional Qualifications Directive and the Services Direc-
tive; however, the scope of IMI is expected to be extended
in the future. When new legislation is adopted which
provides for information exchange using IMI, the annex will
be updated simultaneously. The EDPS welcomes this tech-
IMI; and
nique as it

(i) clearly delimits the scope of

11. Regrettably,

including,

in practice,

the solution adopted by the
Commission means that contrary to the expectations of the
EDPS and the WP29,
the IMI Decision does not now
comprehensively regulate all major data protection aspects
importantly, the manner in which the
of IMI,
joint controllers share responsibility regarding notice provi-
sion and provide rights of access to data subjects, or the
specific, practical issues of proportionality. The EDPS also
regrets
the
Commission to publish the predefined questions and data
fields on its website, which would increase transparency
and legal certainty.

there is no specific requirement

that

for

2. LEGAL BASIS OF THE IMI DECISION

The IDABC-Decision

12. The legal basis of the IMI Decision, as laid down in the
decision itself,
is Decision 2004/387/EC of the European
Parliament and of the Council of 21 April 2004 on the
interoperable delivery of pan-European eGovernment
services to public administrations, businesses and citizens
(‘IDABC-Decision’) (1), and in particular Article 4 thereof.

(‘EC Treaty’):

Trans-European

13. The IDABC-Decision itself is an instrument in the frame-
work of Title XV of the Treaty Establishing the European
Community
networks.
Article 154 of the EC Treaty provides that the Community
shall contribute to the establishment and development of
trans-European networks in the areas of transport, telecom-
munications and energy infrastructures. Such action shall
aim at promoting the interconnection and interoperability
of national networks as well as access to such networks.
Article 155 lists the measures the Community can adopt in
this framework. These are (i) guidelines; (ii) any measures
that may prove necessary to ensure the interoperability of
the networks, in particular in the field of technical standar-
disation;
(iii) as well as the support of projects. The
IDABC-Decision is based on Article 156(1), dealing with
the procedure of adoption.

(1) OJ L 144, 30.4.2004, as corrected by OJ L 181, 18.5.2004, p. 25.

25.10.2008

EN

Official Journal of the European Union

C 270/3

14. Article 4 of the IDABC-Decision states inter alia that the
Community shall implement projects of common interest.
Those projects must be included in a rolling work
programme and the implementation must be in accordance
with the principles of Article 6 and 7 of the IDABC-Deci-
sion. Those principles mainly encourage a wide participa-
tion, foresee a solid and impartial procedure and provide
for a technical standardisation. They also aim at ensuring
the economic reliability and feasibility of projects.

in relation to data protection requirements. The EDPS
understands from Recital 7 that the IMI Decision is meant
as a specification of the general Community framework of
data protection under Directive 95/46/EC and Regulation
(EC) No 45/2001. It specifically deals with the definition of
controllers and their responsibilities, data retention periods
and the rights of data subjects. The IMI Decision, thus,
deals with limitations/specifications of fundamental rights
and it aims at specifying subjective rights of citizens.

The Services Directive and the Professional Qualifications
Directive

15. As explained earlier,

the Internal
Market Information System shall be used for the exchange
of personal data in the context of two directives:

in the initial period,

— the Services Directive, and

— the Professional Qualifications Directive.

16. Article 34(1) of the Services Directive provides for a specific
legal basis for the establishment of an electronic system for
the exchange of information between Member States, as an
accompanying measure for the purposes of the Directive.
Article 34(1) reads: ‘The Commission, in cooperation with
Member States, shall establish an electronic system for the
exchange of information between Member States, taking
into account existing information systems’.

17. The Professional Qualifications Directive does not foresee a
specific electronic system for the exchange of information
but clearly requires information to be exchanged under
its provisions. Relevant provisions mandating
several of
information exchange include Article 56 of the Directive,
requiring the competent authorities of the Member States
to work in close cooperation and to provide mutual assis-
tance in order to facilitate application of the Directive. The
second paragraph of Article 56 provides that certain sensi-
tive information is processed while respecting data protec-
tion legislation. Further, Article 8 also specifically provides
that competent authorities of the host Member State may
ask competent authorities of the Member State of establish-
ment to provide any information relevant to the legality of
the service provider's establishment and his good conduct,
as well as the absence of any disciplinary or criminal sanc-
tions of a professional nature. Finally, Article 51(2) provides
that in the event of justified doubts, the host Member State
may require from the competent authorities of a Member
State confirmation of the authenticity of the attestations
and evidence of formal qualifications and training.

The need for a proper legal basis for the provisions on data
protection

18. The protection of personal data is recognised as a funda-
mental right in Article 8 of the Charter of Fundamental
Rights of the Union and in the case law on the basis of
Article 8 of the European Convention on Human Rights
(‘ECHR’).

20. Based on the case-law under the ECHR, there should be no
doubt about the legal status of provisions restricting funda-
mental rights. Those provisions must be laid down in a
legal instrument, on the basis of the EC Treaty, which can
be invoked before a judge. If not, the result would be legal
uncertainty for the data subject since he cannot rely on the
fact that he can invoke the rules before a Court.

21. The issue of

legal certainty is even more eminent since
under the system of the EC Treaty it will be primarily the
national judges who will have discretion to decide which
value they attach to the IMI Decision. This might lead to
different outcomes in different Member states and even
within one Member State. This legal uncertainty is not
acceptable.

22. The absence of (security about) a legal remedy would be in
any event contrary to Article 6 of the ECHR which provides
for the right of a fair trial, and the case law on this Article.
In such a situation, the Community would not fulfil its obli-
the Treaty on the European
gations under Article 6 of
Union (‘TEU’), which requires the Union to respect funda-
mental rights, as guaranteed by the ECHR.

Imperfections of the legal basis chosen

23. The EDPS is deeply concerned that by choosing Article 4 of
the IDABC-Decision as the legal basis of the decision, the
drafters of the Commission Decision may not have met the
test of legal certainty outlined above. The EDPS lists below
the following elements, which may raise doubts about the
adequacy of the choice of the legal basis of the IMI Deci-
sion:

— the

framework of Title XV of

the EC Treaty,
Trans-European Networks. Under this framework the
European Community can contribute to establishing
these networks, in order to make the European citizen
profit from better, safer and cheaper transport, telecom-
munications and energy (1). It is uncertain whether this
framework is also meant for networks between public
authorities, needed for the implementation of legislative
acts as is the case of IMI,

— the measures foreseen in Title XV of

the EC Treaty
(Article 155). As said before, these consist of (i) guide-
lines;
(ii) any measures that may prove necessary to
ensure the interoperability of the networks, in particular
in the field of technical standardisation; (iii) as well as
the support of projects. Although the Article is not
entirely clear — ‘any measures’ can mean anything —

19. According to its Article 1, the IMI Decision specifies the
functions, rights and obligations of IMI actors and IMI users

(1) See Commission White Paper on Growth, Competitiveness and

Employment (COM(93) 700 final).

C 270/4

EN

Official Journal of the European Union

25.10.2008

this list of possible measures suggests that the objectives
of Title XV will be achieved primarily by non legislative
measures. The EDPS emphasises that in this context the
term ‘any measures’ refers in particular to technical
standardisation,

— Article 4 of the IDABC-Decision aims to implement
projects of common interest specified in the rolling
work programme. On the basis of
this Work
Programme, the IMI-system was set up and financed.
However, the EDPS is not convinced that Article 4 can
be used as a legal basis for rules on data protection,
binding on the IMI actors and providing for subjective
rights to citizens,

— Article 6 and 7 of the IDABC-Decision — referred to in
Article 4 — set out principles for the implementation
of projects of common interest. These principles deal
with participation, the procedure and technical standar-
disation, as well as the economic reliability and feasi-
bility of projects. They have nothing to do with princi-
ples of data protection, nor with other comparable prin-
ciples of public law,

for

the

— the procedure of the IDABC-Decision: According to the
30th Recital of
the decision implementing measures
should be adopted in accordance with Council Decision
1999/468/EC of 28 June 1999 laying down the proce-
dures
implementing powers
conferred on the Commission (1). This requires involve-
ment of a ‘comitology’-committee with representatives
of the Member States. The Recitals of the IMI-Decision
do not refer to any involvement of such a committee.
To our knowledge, such a committee has not been
involved,

exercise of

— another specific point

the IMI Decision is
is that
addressed to the Member States. For this reason and
despite the references in the IMI Decision to Regulation
(EC) No 45/2001 and the mentioning of the Commis-
sion in Article 6 as an IMI actor, the IMI Decision
cannot relate to the processing of personal data by the
Commission itself.

Possible solutions to remedy the imperfections of the legal
basis chosen

24. The IMI Decision needs a solid legal basis, for the reasons
mentioned above. There are serious doubts whether the
legal basis of the IMI Decision fulfils the requirement of
legal certainty. The EDPS recommends that the Commission
reconsiders this legal basis and seeks solutions to remedy
the imperfections of the legal basis chosen, with a possible
consequence of replacing the IMI Decision by a legal instru-
ment that fulfils the requirement of legal certainty.

25. In this context, the most appropriate solution might be the
possibility of adopting a separate legal instrument for the
IMI-system, by the Council and the European Parliament,
similar to the Schengen Information System, the Visa Infor-
mation System and other large-scale IT databases.

(1) OJ L 184, 29.12.2006, p. 23.

26. The EDPS suggests analysing this option. This separate legal
instrument could then deal with the functions, rights and
obligations of IMI-actors and IMI-users in relation to data
protection requirements (the subject matter defined in the
IMI Decision) and also with other requirements relating to
the establishment and functioning of the IMI-system.

far as

internal market

instruments. As

27. A second option could be finding a legal basis in the
different
the
IMI Decision applies to the exchange of personal data in
the context of the Services Directive, it should further be
this directive itself — in particular,
analysed whether
Article 34 — could provide for the necessary legal basis. As
far as the IMI Decision applies to the exchange of personal
data in the context of the Professional Qualifications Direc-
tive, a similar approach could work as well: a specific and
clear legal basis may also be created, by amending the
Directive itself.

28. As for further internal market legislation that may, in the
future, require information exchanges among competent
authorities in Member States, a specific legal basis may at
each time be adopted in such specific new legislation.

3. OBSERVATIONS ON THE CONTENT OF THE IMI-DECISION

29. In this Section of the Opinion, the EDPS discusses the
provisions regulating the data protection aspects of IMI, as
they are included in the IMI-Decision. The suggestions of
the EDPS could be included in a new legal
instrument
replacing the IMI-decision as proposed above. However, in
the absence of such a new instrument
the suggestions
could be included in the IMI-Decision itself, after amending
this decision.

30. In addition, some of the suggestions can already now be
applied in practice by the IMI-actors, without amending the
decision. The EDPS expects the Commission to take the
recommendations provided in this Opinion on board at
level, as far as they relate to
least on the operational
activities of the Commission as IMI-actor, and thus subject
to the supervision of the EDPS.

Article 2 — Pre-defined data fields:

transparency and

proportionality

31. The EDPS welcomes that the Commission published on the
IMI website the first set of pre-defined questions and other
data fields. These relate to information exchanges under the
Professional Qualifications Directive.

32. To make this good practice a clear obligation on the
Commission, and thus ensure and further improve transpar-
instrument for
ency, the EDPS recommends that a legal
IMI provides for an obligation for the Commission to
publish the pre-defined questions and other data fields on
the IMI website.

25.10.2008

EN

Official Journal of the European Union

C 270/5

33. As regards proportionality, a legal

IMI
should specify that the pre-defined questions and other data
fields must be adequate, relevant, and not excessive. In addi-
tion, the EDPS has two specific recommendations regarding
proportionality:

instrument

for

— a clear specification that IMI is not intended to be routi-
nely used to do background checks on migrant profes-
sionals and service providers but only in case applicable
legislation allows it and where there are reasonable
doubts (i) as to the authenticity of
the information
provided by the migrant service provider to the Compe-
tent Authority in the host Member State or (ii) as to
his/her eligibility to establishment or exercise of his/her
profession in the host Member State,

— in order to minimize unnecessary transmission of sensi-
tive but not always relevant data, a provision laying
down that whenever no actual criminal record informa-
tion is strictly necessary to be transferred, pre-defined
questions and answers in the IMI interface should not
include a request for criminal records and should be
phrased differently, in such a way to minimize sharing
sensitive data. For example, a host country's Competent
Authority may be satisfied with knowing that a migrant
lawyer is legally registered and in good standing with
his home bar association, and does not need to know
whether he has a road traffic offence on his criminal
record, if that does not prevent him from working as a
lawyer in his home country.

Article 3 — Joint control and allocation of responsibilities

34. The allocation of

responsibilities

in Article 3 of

the
and ambiguous. The EDPS
IMI Decision is unclear
acknowledges that it may not be feasible to specifically
designate in the IMI Decision every single processing opera-
tion and allocate responsibility for each to the Commission
or to a particular Competent Authority in a particular
Member State. However, at least with respect to the most
important data protection obligations of a controller, some
guidance should have been given in the IMI Decision.

(newly inserted) paragraphs, as discussed under
headings below.

the

Notice to data subjects

36. The EDPS recommends that a new paragraph should be
inserted into a legal instrument for IMI to allocate responsi-
bilities for notice provision among the joint controllers
following a ‘layered’ approach. In particular, the text should
specify the following:

a

provide

comprehensive

— first, the Commission, on its webpage dedicated to IMI,
should
privacy notice
including all items required under Articles 10 and 11 of
Regulation (EC) No 45/2001 in a clear and simple
language. The EDPS recommends that the notice should
not only cover the limited processing operations of the
to data it has access to
Commission with respect
(personal data of IMI users) but also provide a general
notice with regard to the
information exchanges
between Competent Authorities in the different Member
States, which is the purpose of the database,

— second, and in addition, each Competent Authority
should provide a privacy notice on its webpage. The
privacy notice should include reference and link to the
Commission's privacy notice and further details specific
to that particular authority or Member State. Any
country-specific limitations on the rights of access or
information must, for example, be set forth on these
notices. Notice provision may be coordinated by the
single liaison office among the Competent Authorities
within a specific country,

— third, and finally, at the latest at the time of uploading
personal data, and unless a restriction may be applied,
notice should also be given to data subjects directly, by
means other than the privacy notice on the website. A
recommended approach may be to include a brief refer-
ence to the IMI and a link to the relevant privacy
in any correspondence that
notices on the Internet
Competent Authorities exchange with the data subject
(usually the migrant service provider or professional).

35. In particular, the EDPS recommends that a legal instrument

for IMI specifies that:

Rights of access, objection, and rectification

— each Competent Authority and IMI coordinator is a
to its own data processing

controller with respect
activities as a user of the system,

37. The EDPS also recommends that a new paragraph should

be inserted, in order to:

— the Commission is not a user, but the operator of the
system, and it is responsible, first and foremost, for the
technical operation, maintenance, and ensuring the
overall security of the system, and that

— specify to whom data subjects should address their
access request, objection, or request for rectification,

— specify which Competent Authority will be competent

to decide about those requests, and

— the IMI actors share responsibilities with respect

to
notice provision, and provision of right of access, objec-
tions, and rectifications in the manner outlined in the

— set forth a procedure in case the data subject submits
his/her request to an IMI actor which is not competent
in deciding about those requests.

C 270/6

EN

Official Journal of the European Union

25.10.2008

38. Furthermore,

it should be specified that the Commission
can only provide access to data to which the Commission
itself has legitimate access. Therefore, the Commission will
not be under an obligation to provide access to exchange of
information between Competent Authorities.
If a data
subject nevertheless turns to the Commission with such a
request, the Commission needs to direct the data subjects,
without undue delay, to the authorities which have access
to the information and advise the data subject accordingly.

within 10 working days in any event whether or not the
other Competent Authority in the information exchange
would like to keep the information on IMI. However, there
should be an automated mechanism to notify this other
Competent Authority, so that it would not loose the data
and could, if it wished so, download or print the informa-
tion and store it for its own purposes outside IMI and
subject to its own data protection rules. A ten day notice
period appears reasonable both as a minimum and as a
maximum timeline set. The Commission should only be
able to delete information before this ten day deadline if
both authorities confirm their wish for deletion.

Article 4 — Retention of personal data of data subjects of
the information exchanges

Security measures

39. Article 4(1) of the IMI Decision provides for a data storage
period of six months as of the ‘formal closure’ of an infor-
mation exchange.

40. The EDPS understands that Competent Authorities may
need some flexibility in retaining data due to the fact that
beyond the initial question and answer,
there may be
regarding the same case between
follow-up questions
Competent Authorities. Indeed, during the preparation of
the Opinion of the WP29, the Commission explained that
the administrative procedures in the framework of which
information exchanges may be necessary are usually
completed within a couple of months and the six months
retention period was designed to allow flexibility for any
unexpected delays.

41. With that said, and based on the explanations of

the
Commission, the EDPS doubts whether there is a legitimate
reason to keep the data in IMI for another six months after
the formal closure of an information exchange. Therefore,
the EDPS recommends that the six months deadline for
automatic deletion should start as of the date when the
requesting authority first contacts its counterpart in any
specific information exchange.
Indeed, a better approach
would be to set the automatic deletion date according to
the different
(always
counting the deadlines from the start of the exchange). For
example, whereas a six months retention period may be
appropriate for information exchanges under the Profes-
it may not necessarily be
sional Qualifications Directive,
adequate for other information exchanges in future internal
market legislation.

information exchanges

types of

44. The EDPS also recommends

security
measures, whether taken by the Commission or by the
Competent Authorities, should be taken in accordance with
best practices in Member States.

specifying that

Joint supervision

45. As the information exchanges under the IMI are subject to
multiple national data protection laws and the supervision
of multiple national data protection authorities (in addition
to the applicability of Regulation (EC) No 45/2001 and the
supervisory authority of the EDPS to certain aspects of the
processing operations), the EDPS recommends that a legal
instrument for IMI should also provide clear provisions
facilitating joint supervision of
IMI by the various data
protection authorities involved. The joint supervision could
be modelled in the same way as has been done in the legal
instruments on the establishment, operation and use of the
second generation Schengen Information System (SIS II) (1).

4. CONCLUSIONS

46. The EDPS supports the aims of the Commission in estab-
lishing an electronic system for the exchange of informa-
tion and regulating its data protection aspects.

47. The IMI Decision needs a solid legal basis, for the reasons
mentioned above. The EDPS recommends that the Commis-
sion reconsiders its choice of legal basis and seeks solutions
to remedy the imperfections of the legal basis chosen, with
the possible consequence of replacing the IMI Decision by a
legal
legal
certainty.

the requirement of

instrument

fulfils

that

42. The EDPS also adds that should his recommendations not
be taken into account, at the very least, it should be clari-
fied what is meant by ‘formal closure’ of an information
exchange. In particular,
it must be ensured that no data
could remain in the database longer than necessary simply
due to the fact of a competent authority failing to ‘close the
case’.

43. Further, the EDPS recommends that in the second para-
graph of Article 4, the logic of deletion-retention should be
reversed. The Commission should honour deletion requests

48. As an ultimately most sound solution, the EDPS suggests
analysing the possibility of adopting a separate legal instru-
ment for the IMI-system, at the level of the Council and the
European Parliament, similar to the Schengen Information
large-scale
System, Visa Information System and other
IT databases.

(1) See Articles 44-46 of Regulation (EC) No 1987/2006 of the European
Parliament and of the Council of 20 December 2006 on the establish-
ment, operation and use of the second generation Schengen Informa-
tion System (SIS II) (OJ L 381, 28.12.2006, p. 4) and Articles 60-62 of
Council Decision 2007/533/JHA of 12 June 2007 on the establish-
ment, operation and use of the second generation Schengen Informa-
tion System (SIS II) (OJ L 205, 7.8.2007, p. 63).

25.10.2008

EN

Official Journal of the European Union

C 270/7

49. Alternatively, it could be analysed whether Article 34 of the
Services Directive and similar provisions yet to be adopted
with respect
legislation could
provide for the necessary legal basis.

to other internal market

50. Additionally, the Opinion provides for a number of sugges-
tions on the provisions regulating the data protection
aspects of IMI, to be included in a new legal instrument
in the
replacing the IMI Decision as proposed above or,
absence of such a new instrument to be included in the
IMI Decision itself, after amending this decision.

51. Many of the suggestions can already now be applied in
practice by the IMI-actors, without amending the Decision.
The EDPS expects the Commission to take the recommen-
dations provided in this Opinion on board to the extent

possible, at least on the operational
relate to activities of the Commission as IMI-actor.

level, as far as they

52. These recommendations relate to transparency and propor-
tionality,
joint control and allocation of responsibilities,
notice to data subjects, rights of access, objection, and recti-
fication, data retention, security measures and joint supervi-
sion.

Done at Brussels, 22 February 2008.

Peter HUSTINX

European Data Protection Supervisor