Opinion of the European Data Protection Supervisor on the proposal for a Regulation of the European Parliament and of the Council on European Statistics (COM(2007) 625 final)
Date: 2008-12-03
Institutions: European Data Protection Supervisor
Subjects: EU statistics, European Data Protection Supervisor, Eurostat, data protection, data transmission, occupational health, occupational safety, opinion (EU), personal data, public health

3.12.2008

EN

Official Journal of the European Union

C 308/1

I

(Resolutions, recommendations and opinions)

OPINIONS

EUROPEAN DATA PROTECTION SUPERVISOR

Opinion of the European Data Protection Supervisor on the proposal for a Regulation of the
European Parliament and of the Council on European Statistics (COM(2007) 625 final)

(2008/C 308/01)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Com-
munity, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the
European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament
and of the Council of 24 October 1995 on the protection of
individuals with regard to the processing of personal data and
on the free movement of such data,

Having regard to Regulation (EC) No 45/2001 of the European
Parliament and of the Council of 18 December 2000 on the
protection of
individuals with regard to the processing of
personal data by the Community institutions and bodies and on
the free movement of such data, and in particular its Article 41,

Having regard to the request for an opinion in accordance with
Article 28(2) of Regulation (EC) No 45/2001 received on
17 October 2007 from the European Commission,

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTION

Consultation of the EDPS

for consultation, in accordance with Article 28(2) of Regu-
lation (EC) No 45/2001, on 17 October 2007. In view of
the mandatory character of Article 28(2) of Regulation (EC)
No 45/2001, the EDPS welcomes the explicit reference to
this consultation in the preamble of the proposal.

2. On 5 September 2007, the EDPS delivered an Opinion on
the proposal for a Regulation of the European Parliament
and of
the Council on Community statistics on public
health and health and safety at work (COM(2007) 46 final)
(hereinafter ‘Opinion on health statistics’) (1). This proposal
had strong ties with the current more general proposal, as
the former was developed against a legal background which
is subject to modifications today. Therefore, as was under-
lined in the opinion on health statistics, under point 10, a
close link exists between these two initiatives.

3. Prior to the adoption of the Opinion on health statistics, a
meeting held between the EDPS and Eurostat representa-
tives led to the conclusion that ‘a common review of
the
processes put in place in Eurostat when dealing with individual
records for statistical purposes should be conducted and may lead
to the need for prior-checking’. It was also decided that ‘this
common review should consist of the analysis of the minimum
data set required for each processing operation and an analysis of
implemented in Eurostat’. Both
the processing operations
the above
elements were included in the conclusion of
mentioned Opinion. The EDPS is
currently working
together with Eurostat's services in order to conduct this
common review (2).

1. The proposal for a Regulation of the European Parliament
and of
the Council on European Statistics (hereinafter
‘the proposal’) was sent by the Commission to the EDPS

(1) OJ C 295, 7.12.2007, p. 1. Available on the EDPS website.
(2) As a possible conclusion of the common review, there may be a need
for prior-checking of individual processing operations, in accordance
with Article 27 of Regulation (EC) No 45/2001.

C 308/2

EN

Official Journal of the European Union

3.12.2008

4. Moreover, on 20 December 2007,

to the LIBE committee of

the EDPS provided
comments
the European
Parliament on the Proposal for a Regulation on Population
and Housing Censuses (3). Although not formally consulted
by the European Commission on the proposal, the EDPS
underlined the relevance of data protection in that context.
He also reiterated his concerns about the crucial importance
of correctly defining the legal framework in which statistical
data are processed and the need for clarifications of certain
definitions.

9. As to the goals of the proposal,

it aims to simplify the
existing legal framework for the production and dissemina-
tion of statistics at European level,
in particular through
consolidating into one single instrument a number of sepa-
rate texts of Community statistical legislation. This existing
legal
the
following legislative acts:

framework to be repealed,

is composed of

— Council Regulation (EC) No 322/97 of 17 February

1997 on Community Statistics (6),

5. Finally, the EDPS, as member of the Article 29 Working
Party, actively participated in the preparation of the opinion
on the concept of personal data (4), which also analyses
certain aspects pertaining to statistical data.

— Council Regulation (Euratom, EEC) No 1588/90 of
11 June 1990 on the transmission of data subject to
statistical confidentiality to the Statistical Office of the
European Communities (7);

The proposal in its context

6. According to the explanatory memorandum, the proposal
aims to revise the existing basic legal framework governing
the production of statistics at European level with a view to
adapting it to the current reality and also to improving it to
meet future developments and challenges. In the view of
the Commission, European Statistics constitute an essential
contribution to building the information capacity required
to sustain EU strategic objectives and the underlying poli-
cies and supporting instruments.

7. Furthermore, the Commission states that there are also calls
for a certain degree of flexibility in the statistical confidenti-
ality regime to allow controlled access to detailed statistical
data without compromising the high level of protection
that confidential statistical data require. The exchange of
confidential data within the European Statistical System
(ESS) and the rules for access to such data for research
purposes are essential elements in this regard and require
modernisation of the current legal requirements.

impartiality,

reliability, objectivity,

8. Article 285 of the Treaty establishing the European Com-
munity lays down the legal basis of statistical activities at
European level. This Article sets out requirements relating
to the production of Community statistics and, as under-
lined in its paragraph 2, requires ‘conform[ity] to [standards
of]
independence,
confidentiality’. The current
cost-effectiveness and statistical
proposal puts forward several modifications to the existing
legal framework, for instance by the improvement of statis-
tical governance or the consolidation of the activities of the
European Statistical System (EES), as well as by the intro-
duction of more flexibility in the current rules on statistical
confidentiality whilst preserving a high level of data
protection (5).

scientific

(3) COM(2007) 69 final.
(4) Article 29 Data Protection Working Party, Opinion No 4/2007 on the
concept of personal data, adopted on 20 June 2007 (WP 136). See espe-
cially examples 17 and 18.

(5) Point 3 of the Explanatory Memorandum.

— Council Decision 89/382/EEC, Euratom of 19 June
1989 establishing a Committee on the Statistical
Programmes of the European Communities (8).

10. The proposal seeks to maintain the implementing measures
set out in Commission Regulation (EC) No 831/2002 of
17 May 2002 implementing Council Regulation (EC)
No 322/97 on Community Statistics concerning access to
confidential data for scientific purposes (9) and Commission
Decision 2004/452/EC of 29 April 2004 laying down a list
of bodies whose researchers may access confidential data
for scientific purposes (10).

11. Moreover, since it is important to ensure close cooperation
and appropriate coordination between the ESS and the
the current
European System of Central Banks (ESCB),
proposal shall apply without prejudice to Council Regu-
lation (EC) No 2533/98 of 23 November 1998 concerning
information by the European
the collection of statistical
Central Bank (11). However, as Eurostat
is undergoing a
the results found
common review of data processing,
should also be applicable to the situation of the ECB.

12. The EDPS will focus his analysis on the elements of the
proposal which may have an impact on the protection of
personal data.

II. ANALYSIS OF THE PROPOSAL

13. Recital 18 states that ‘(t)he right to respect for private and
family life and to the protection of personal data, as set out in
Articles 7 and 8 of the Charter of Fundamental Rights of the
European Union should be ensured’.

(6) OJ L 52, 22.2.1997, p. 1.
(7) OJ L 151, 15.6.1990, p. 1.
(8) OJ L 181, 28.6.1989, p. 47.
(9) OJ L 133, 18.5.2002, p. 7.
(10) OJ L 156, 30.4.2004, p. 1, as corrected by OJ L 202, 7.6.2004, p. 1.
(11) OJ L 318, 27.11.1998, p. 8. See also opinion of the European Central

Bank on the proposal.

3.12.2008

EN

Official Journal of the European Union

C 308/3

ensures

the protection of

14. Moreover, Recital 19 of the proposal states that ‘this Regu-
lation (“proposal”)
individuals as
regards the processing of personal data and specifies, as far as
European Statistics are concerned, the rules laid down in Directive
95/46/EC of the European Parliament and of the Council of
24 October 1995 on the protection of individuals with regard to
the processing of personal data and on the free movement of such
data and in Regulation (EC) No 45/2001 of
the European
Parliament and of the Council of 18 December 2000 on the
protection of individuals with regard to the processing of personal
data by the Community institutions and bodies and on the free
movement of such data’.

15. The EDPS welcomes these two recitals in that they confirm
that data protection is an important element to be consid-
ered when dealing with statistical data. However, the EDPS
would favour,
in Recital 18, the use of a more positive
wording, similar to the one used in Recital 19, therefore
amending it as follows: ‘This Regulation ensures the right …’.

contributions

16. The EDPS also welcomes the development of a ‘European
Approach to Statistics’, as developed in Recitals 12 and 13.
Part of this approach consists in determining the authorities
producing the statistics. Actually, although European statis-
tics are usually based on national data produced by national
they may also be produced from
statistical authorities,
non-published national contributions,
from subsets of
and from European statistical
national
surveys or by harmonised concepts or methods. From a
data protection point of view, it is important to determine
the authority which is in control of the data used in produ-
cing the statistics. Indeed, this body shall bear the responsi-
bilities attached to the status of data controller according to
Directive 95/46/EC,
including in relation to the right of
information, the rights of access and rectification of the
data subjects, and the right to know the recipients of the
data (in this case Eurostat is a recipient of the data), when-
ever these rights are applicable.

Data protection and statistical confidentiality

17. In his Opinion on health statistics, the EDPS analysed the
parallelism between the concept of confidential data and
the one of personal data. He concluded that statistical confi-
dentiality and data protection, although presenting similari-
ties in wordings, cover two different concepts (12). The
EDPS underlined the possibility of confusion between the
two notions and the need to clearly address the differences
between data protection and statistical confidentiality.

18. As regards the statistical principles, the EDPS would like to
specifically address Article 2(1)(e) of the proposal, which
defines the principle of statistical confidentiality. First, the
EDPS sees that, unlike in Regulation (EC) No 322/97, the
expression ‘statistical units’ is being replaced by the one of

(12) See points 14-17 of the Opinion.

‘statistical data subjects’. The definition is further defined in
Article 3(7).

19. The EDPS does not agree with the change of definition, for
the same reason as he underlined in his Opinion on health
statistics the need to clearly understand the differences of
concepts in the respective domains. The concept of ‘data
subject’ is an important notion of Directive 95/46/EC when
defining ‘personal data’ and this notion relates exclusively
to natural persons. However, the definition of statistical
confidentiality relates not only to natural persons, but also
to households, economic operators and other undertakings.
Therefore, the EDPS suggests that the proposal should keep
the notion of statistical units, because,
in this case, both
natural persons and households, economic operators and
other undertakings are covered in a way that does not
create confusion with the data protection legal framework.

Statistical governance

20. The EDPS welcomes the formulation of Article 5, which
foresees the publication of a list of
the other national
authorities designated by Member States on the website of
the Commission (Eurostat). This list will foster transparency
on the authorities competent to provide Eurostat with rele-
vant data on statistical units.

Statistical quality

It

21. Article 10 of the proposal is entirely dedicated to the level
of quality which is expected when statistical data are
produced.
lists quality dimensions which must be
respected. The proposal states that in applying these quality
dimensions, the modalities (sic), structure and periodicity of
quality reports provided for in sectoral legislation shall be
defined by the Commission in accordance with the regula-
tory procedure referred to in Article 27(2) of the same
proposal. The EDPS would like to stress that Article 4 of
Regulation (EC) No 45/2001 defines principles relating to
data quality. The EDPS believes that Eurostat should take
these principles into account when, according to para-
graph 3 of Article 10 of the proposal, it shall assess the
quality of data that Member States transmit to it. Therefore,
the EDPS suggests the following modification to the second
sentence of paragraph 3:
‘The Commission (Eurostat) shall
assess the quality of data transmitted, also in view of data protec-
tion requirements, and publish the reports’.

22. Furthermore, Article 10(2) foresees the application of these
quality dimensions to data covered by sectoral legislation in
specific statistical domains. In the case that such sectoral
legislation would be adopted, Article 10(2) states that the
modalities, structure and periodicity of quality reports

C 308/4

EN

Official Journal of the European Union

3.12.2008

provided for in sectoral legislation shall be defined by the
Commission. The EDPS wants to remind that he expects to
legislation which could be
be consulted on the sectoral
to
adopted on statistics by the Commission in order
analyse its compliance with Regulation (EC) No 45/2001.

Dissemination of European Statistics

23. Regarding dissemination, the EDPS agrees with Article 18
of the proposal allowing dissemination of statistical data
through anonymised records. However, the EDPS would
like to draw the attention to the general concept of
‘anonymisation’.

24. When considering anonymity from a data protection point
of view, account should be taken of the interpretation of
the Article 29 Working Party in its opinion on the concept
of personal data (13).
In its view, based on Directive
95/46/EC, anonymised data is any information relating to a
natural person where the person cannot be identified,
whether by the data controller or by any other person,
taking account of all the means likely reasonably to be used either
by the controller or by any other person to identify that indivi-
dual. Anonymised data would be anonymous data which
previously referred to an identifiable person, no longer
identifiable.

25. In his Opinion on health statistics, the EDPS already under-
lined that although the notion would, from a data protec-
tion point of view, cover data that are no longer identifi-
able, from a statistical point of view, anonymous data are
data for which no direct identification is possible. This defi-
nition implies that the possibility of indirect identification
would still qualify the data concerned as anonymous from
a statistical point of view, but not necessarily from a data
protection point of view.

the EDPS would propose

26. Therefore, in order to avoid any confusion between the two
interpretations,
to amend
Article 18 of the proposal as follows: ‘Individual data may be
disseminated in the form of a public use file consisting of
anonymised records which have been prepared in such a way that
the statistical unit
cannot be identified, either directly or
indirectly, when account is taken of all relevant means that
might reasonably be used by a third party’. This clarification
should avoid any uncertainty regarding the data which may
be made available for public use.

Transmission of confidential data

27. Article 20 sets the general rule on transmission of confi-
dential data between national authorities and between
national authorities and the Commission, as well as sets the
rules on the exchange of confidential data for statistical
purposes between the ESS and the ESCB. Article 20(1) of
the proposal states that these transmissions are necessary
the development, production or dissemination of
for
European Statistics,
justifying the planned transfers. The
EDPS considers that such transfers taking place between
Eurostat and the national authorities and between Eurostat
and the ECB comply with the conditions of necessity
provided for
in Articles 7 and 8 of Regulation (EC)
No 45/2001. Moreover, the EDPS supports the sentence of
Article 20(1) which foresees that ‘any further transmission
must be explicitly authorised by the national authority that
collected the data’. Besides, in its opinion on the proposal,
the ECB (14) suggested some amendments to Article 20 in
order to reflect the legal basis of its competences in proces-
sing statistical data and on the exchange of confidential
data for statistical purposes between the ESS and the ECB.
The EDPS agrees with the drafting modifications of the
proposal made by the ECB.

Access to confidential data for research purposes

28. Although Article 22 introduces the possibility of granting
access to confidential data under certain conditions to be
established, the EDPS would like to remind that the release
of the data sets to researchers is governed by Regulation
(EC) No 831/2002, which is not repealed by the current
proposal (see Recital 29 of the proposal). Therefore, besides
compliance with Regulation (EC) No 45/2001 the specific
rules established in the above mentioned Commission
Regulation regarding access to anonymised microdata for
scientific purposes will have to be taken into consideration
by any modalities, rules and conditions for access estab-
lished by the Commission.

III. CONCLUSION

29. The EDPS welcomes the proposal

for a Regulation on
European statistics. This Regulation would give a firm and
legal basis to the development, production and
general
dissemination of statistics at a European level.

30. However,
points:

the EDPS would like to stress the following

— the EDPS expects to be consulted on the sectoral legisla-
tion which could be adopted on statistics by the
this Regulation,
Commission in order to implement
once it has been adopted,

(13) See footnote 4.

(14) See ECB Opinion (OJ C 291, 5.12.2007, p. 1) — drafting proposals.

3.12.2008

EN

Official Journal of the European Union

C 308/5

— a modification of the wording of Recital 18 should be

implemented,

— the proposed concept of ‘statistical data subject’ should
be reconsidered in order to avoid confusion with data
protection concepts,

— the principle of data quality should be taken into
the

assessment of

quality

consideration in the
Commission,

— the ambiguity of the concept of ‘anonymisation’ of data
should be considered in the context of dissemination of
data.

Done at Brussels, 20 May 2008.

Peter HUSTINX

European Data Protection Supervisor