Executive summary of the Opinion of the European Data Protection Supervisor on the ‘Open-Data Package’ of the European Commission including a proposal for a directive amending Directive 2003/98/EC on reuse of public sector information (PSI), a Communication on Open Data and Commission Decision 2011/833/EU on the reuse of Commission documents
Date: 2012-11-01
Institutions: European Data Protection Supervisor
Subjects: access to EU information, data collection, dissemination of EU information, information system, official document, personal data








C_2012335EN.01000801.xml










1.11.2012   


EN


Official Journal of the European Union


C 335/8





Executive summary of the Opinion of the European Data Protection Supervisor on the ‘Open-Data Package’ of the European Commission including a proposal for a directive amending Directive 2003/98/EC on reuse of public sector information (PSI), a Communication on Open Data and Commission Decision 2011/833/EU on the reuse of Commission documents
(The full text of this Opinion can be found in English, French and German on the EDPS website: http://www.edps.europa.eu)
2012/C 335/06
1.   Introduction

1.1.   Background







1.


On 12 December 2011, the Commission adopted a proposal for a directive amending Directive 2003/98/EC on reuse of public sector information (PSI) (the ‘proposal’) (1). The proposal is part of the ‘Open-Data Package’, which also includes two other documents adopted on the same day: (i) a Commission Communication entitled ‘Open data — An engine for innovation, growth and transparent governance’ (the ‘Communication’) (2) and (ii) a Commission Decision on the reuse of Commission documents (the ‘Decision’) (3).










2.


The EDPS has not been consulted as required by Article 28(2) of Regulation (EC) No 45/2001. This is regrettable in view of the large amount of personal data potentially concerned by this initiative. This Opinion is therefore based on Article 41(2) of the same Regulation. The EDPS recommends that a reference to this Opinion be included in the preamble of the instrument adopted.




1.2.   Objectives and scope of the proposal and the Decision; focus of the EDPS Opinion







3.


The objective of the proposal is to update and amend the existing text of Directive 2003/98/EC on re-use of public sector information (the ‘PSI Directive’).










4.


The PSI Directive aims at facilitating the reuse of public sector information throughout the European Union by harmonising the basic conditions for reuse and removing barriers to reuse in the internal market. The PSI Directive contains provisions on non-discrimination, charging, exclusive arrangements, transparency, licensing and practical tools to facilitate the discovery and reuse of public documents (4).










5.


One of the key novel policy objectives of the proposal, as described in Section 5.1 of the Communication, is the objective to introduce the ‘principle that all public information that is not explicitly covered by one of the exceptions is reusable for both commercial and non-commercial purposes’ (5). In particular, the proposed amendment to Article 3(1) of the PSI Directive specifically requires Member States to ensure that ‘existing documents’ held by public sector bodies of the Member States shall be ‘reusable for commercial and non-commercial purposes’.










6.


Other relevant new provisions of the proposal include, subject to some exceptions, the limitation on the amounts that can be charged by the public sector for the information reused to ‘marginal costs incurred for their reproduction and dissemination’ (revised Article 6(1)). Further, the proposal also expands the scope of the PSI Directive to include libraries, archives, museums and university libraries.










7.


The objective of the Decision is to establish the rules applicable to the Commission for the reuse of its own documents.










8.


This Opinion focuses, in Sections 2 and 3, on the proposal itself while Section 4 briefly comments on the Decision. Section 2 provides a general overview of the data protection concerns relating to open data, with challenges and considerations that serve as important points of reference and determine, to a large part, the approach that the EDPS takes in his more specific recommendations in Section 3.




5.   Conclusions







72.


The reuse of PSI that contains personal data may bring significant benefits, but also entails considerable risks to the protection of personal data. In light of these risks, the EDPS recommends that the proposal should more clearly define in what situations and subject to what safeguards information containing personal data may be required to be made available for reuse. In particular, the proposal should:






—


establish more clearly the scope of applicability of the PSI Directive to personal data (Section 3.1),










—


require that an assessment be carried out by the public sector body concerned before any PSI containing personal data may be made available for reuse (Section 3.1),










—


where appropriate, require that data be fully or partially anonymised and license conditions specifically prohibit re-identification of individuals and the reuse of personal data for purposes that may individually affect the data subjects (Sections 3.2 and 3.3),










—


require that the terms of the licence to reuse PSI include a data protection clause, whenever personal data are processed (Section 3.3),










—


where necessary considering the risks to the protection of personal data, require applicants to demonstrate (via a data protection impact assessment or otherwise) that any risks to the protection of personal data are adequately addressed and that the applicant will process data in compliance with applicable data protection law (Section 3.3,










—


clarify that reuse can be made contingent upon the purpose for which reuse is made, in derogation from the general rule allowing reuse for any commercial and non-commercial purposes (Section 3.3).














73.


In addition, the EDPS suggests:






—


to consider allowing costs of pre-processing (such as digitalisation), anonymisation and aggregation to be charged to license-holders where appropriate (Section 3.5), and










—


that the Commission develops further guidance, focusing on anonymisation and licensing and consult the WP29 in this regard (Section 3.6).









Done at Brussels, 18 April 2012.

Peter HUSTINX

European Data Protection Supervisor





(1)  COM(2011) 877 final.

(2)  COM(2011) 882 final.

(3)  2011/833/EU.

(4)  See Explanatory Memorandum to the proposal, Section 1.

(5)  See also Section 3.2, paragraph 6 of the Explanatory Memorandum to the proposal which calls for action at Union level to ‘guarantee’ that ‘reuse is allowed for valuable core public sector data across Member States’; and Section 5, heading ‘Legislative amendments’, item (iii) of the Executive Summary of the Impact Assessment, which calls for ‘amending the general principle to make accessible documents reusable’.