Source: EURLEX
Language: en
Format: md

>slra§slIP

_**mm**_

## **_•£83»_**

**/••.••£5$fe**

**COMMISSION OF THE EUROPEAN COMMUNITIES**

Brussels, 18.07.1995
**COM(95)** **375** **final-COD287**

OPINION OF THE COMMISSION

pursuant to Article 189 b (2) (d) of the EC Treaty,

on the European Parliament's amendments
to the Council's common position regarding the

proposal for a
EUROPEAN PARLIAMENT AND COUNCIL DIRECTIVE

**on the protection of individuals with regard to the processing of**
**personal data and on the free movement of such data**

AMENDING THE PROPOSAL OF THE COMMISSION

pursuant to Article 189 a (2) of the EC Treaty

###### **`1. BACKGROUND`**

(a) On 27 July 1990 the Commission presented to the Council a proposal for a
Directive (COM(90) 314 final - SYN 287). _[l ]_

(b) On 24 April 1991 the Economic and Social Committee delivered its opinion ^

(c) On 11 March 1992 Parliament delivered its opinion (first reading) and adopted a
resolution endorsing the Commission proposal, subject to a large number of
amendments.

(d) On 15 October 1992 the Commission adopted an amended proposal for a
Directive pursuant to Article 149(3) of the EEC Treaty (COM(92)422 final SYN 287) [ 4 ]

(e) On 20 February 1995 the Council adopted a common position.

(f) On 24 February 1995 the Commission transmitted to Parliament its opinion on
this common position (SEC(95) 303 final - COD 287).

(g) On 15 June 1995 Parliament approved (second reading) seven amendments to
the common position.

**2.** **PURPOSE OF THE COMMISSION PROPOSAL**

The proposal for a Directive seeks to facilitate the free movement of data within the
Community by affording individuals a high level of protection with regard to the
processing of personal data. Harmonization of the relevant national laws has proved
necessary because of the wide divergences between them and of data-exchange
requirements imposed by completion of the internal market.

The White Paper "Growth, competitiveness, employment" and the Bangemann
group's report "Europe and the global information society" underscored the need for
the Directive as a regulatory measure within the clear, stable legal framework that is
essential if the information society is to develop along lines acceptable to the citizens
of Europe.

The proposal for a Directive lays down common ground rules for the protection of
individual rights with regard to the processing of personal data.

The high-level protection is afforded through the obligations imposed on data
controllers (for example, public authorities, enterprises and associations) and through
the rights conferred on the individuals whose data are processed.

The obligations on controllers relate, for example, to the quality of the data - the
processing of which must meet a specific and legitimate purpose - to security
requirements and to the notification of such processing to an independent supervisory
authority to be set up by the Member States.

OJNoC277, 5.11.1990, p. 3.
OJNoC159, 17.6.1991, p. 38.
OJ No C 94, 13.4.1992, p. 76; OJ Annex, Debates of the European Parliament, No 3/416, p. 133.
OJ No C 311, 27.11.1992, p. 30.
OJNoC93, 13.4.1995, p. 1.

2

The right to be informed under certain circumstances about the processing of data
relating to them, the right of access to such data and the right to ask for them to be
corrected if they are inaccurate and even to object to their processing are the main
rights conferred on individuals by the proposal.

**3.** **COMMISSION OPINION ON PARLIAMENT'S AMENDMENTS**

1. The seven amendments put forward by Parliament are acceptable to the
Commission.

2. Five of them, which relate to the substance of the proposal, make useful
clarifications to the text.

Amendment No 1 incorporates into the 41st recital a specific reference to
business confidentiality as grounds for possibly limiting an individual's right to
know the logic involved in the automatic processing of data concerning him.

Amendment No 3 provides in Article 2(d) for the possibility that for a single
processing operation a number of parties may jointly determine the purpose and
means of the processing to be carried out.

It follows from this that, in such a case, each of the co-controllers must be
considered as being constrained by the obligations imposed by the directive so as
to protect the natural persons about whom the data are processed.

Amendment No 4 is intended to make it clear in Article 3(2) that the processing
of personal data carried out for the "economic well-being of the State" is
excluded from the scope of the Directive where that operation relates to
questions of State security.

In order to do this, amendment No 4 adopts the wording used in the 13th recital
of the common position.

Amendment No 5 incorporates into Article 9 a clarification to the effect that
Member States will have to provide for exemptions or derogations "only" if they
are necessary to reconcile the right to privacy with the rules governing freedom
of expression.

Amendment No 6 is designed to clarify the point that transfers which are "legally
required" on important public interest grounds escape application of the normal
rule that the third country of destination must ensure an adequate level of
protection to enable such transfers to take place.

Although it is not specified in certain language versions of the text, it seems
evident that such a transfer could only be considered as legally required where a
legal act of a public authority applies, notably a law passed by the national
parliament. On the contrary a simple contractual agreement could not serve as a
basis for such a transfer.

3. The remaining two amendments concern the Commission's implementing powers.

Amendment No 2 introduces a reference to the "modus vivendi" agreed between
Parliament, the Council and the Commission on 20 December 1994.

Amendment No 7 is designed to replace the Ilia regulatory committee with a lib
management committee.

A management committee is fully consistent with the nature of the powers
conferred on the committee by the Council common position. Those powers are
limited to transfers to third countries: they cover the appraisal, based on the
criteria set out in Article 25(2), of whether or not there is an adequate level of
protection in third countries **(Article 25(3) and** (6)) and the adoption of
appropriate measures to authorize transfers to third countries not having an
adequate level of protection **(Article 26(3) and** (4)).

It should also be pointed out that there is no major difference between the Ilia
committee and the lib committee in terms of powers available to the
Commission. The difference between the two procedures is essentially formal: in
one case (Ilia), the Council decides on the basis of a Commission proposal, while
in the other (lib) it amends a decision which has already been taken by the
Commission but whose effects are suspended. However, the lib procedure is
quicker since it obviates the need for a new procedure within the Commission:
the Commission's decision simply takes effect once the period allowed the
Council has expired.

The Commission very much hopes that the Council will also be convinced by this
procedural efficiency aspect of the matter, which is important for the decisions to
be taken.

**Amended proposal for a**

**t.**

**EUROPEAN PARLIAMENT AND COUNCIL DIRECTIVE**

**on the protection of individuals with regard to the**

**processing of personal data and on**

**the free movement of** **such** **data**

**(presented** **by the Commission pursuant to**
**Article 189a(2) of the EC Treaty)**

**Common position of** **the** **Council** **Amended Commission proposal**

Recital 41

Whereas any person must be able to
exercise the right of access to data relating
to him which are being processed, in order
to verify in particular the accuracy of the
data and the lawfulness of the processing;
whereas, for the same reasons, every data
subject must also have the right to know
the logic involved in the automatic
processing of data concerning him, at least
in the case of automated decisions referred
to in Article 15(1); whereas this right must
not adversely affect intellectual property
and in particular the copyright protecting
the software; whereas these considerations
must not, however, result in the data
subject being refused all information;

Whereas any person must be able to
exercise the right of access to data relating
to him which are being processed, in order
to verify in particular the accuracy of the
data and the lawfulness of the processing;
whereas, for the same reasons, every data
subject must also have the right to know
the logic involved in the automatic
processing of data concerning him, at least
in the case of automated decisions referred
to in Article 15(1); whereas this right must
not adversely affect business
confidentiality or intellectual property and
in particular the copyright protecting the
software; whereas these considerations
must not, however, result in the data
subject being refused all information;

**Common position of** **the** **Council** **Amended Commission proposal**

Recital 66a (new)

Whereas an agreement on a "modus
vivendi" between the European
Parliament, the Council and the
Commission concerning the implementing
measures for acts adopted in accordance
with the procedure laid down in Article
189B of the EC Treaty was reached on 20
December 1994.

**Common position of the Council** **Amended Commission proposal**

Article 2(d)

d) "controller" shall mean the natural or
legal person, public authority, agency
or any other body which determines
the purposes and means of the
processing of personal data. Where
the purposes and means of processing
are determined by national or
Community laws or regulations, the
controller or the specific criteria for
his nomination may be designated by a
national or Community law;

d) "controller" shall mean the natural or
legal person, public authority, agency
or any other body which alone or
jointly with others determines the
purposes and means of the processing
of personal data. Where the purposes
and means of processing are
determined by national or Community
laws or regulations, the controller or
the specific criteria for his nomination
may be designated by a national or
Community law;

**Common position of the Council** **Amended Commission proposal**

Article 3(2), first indent

in the course of an activity which falls outside the scope of Community law,
such as those provided for by Titles V
and VI of the Treaty on European
Union and in any case to processing
operations concerning public security,
defence, State security (including the
economic well-being of the State) and
the activities of the State in areas of

criminal law;

in the course of an activity which falls
outside the scope of Community law,
such as those provided for by Titles V
and VI of the Treaty on European
Union and in any case to processing
operations concerning public security,
defence, State security (including the
economic well-being of the State
when the processing operation is
bound up with questions of State
security) and the activities of the State
in areas of criminal law;

**Common position of** **the** **Council** **Amended Commission proposal**

Article 9

Member States shall provide for Member States shall provide for
exemptions or derogations from the exemptions or derogations from the
provisions of this Chapter, Chapter IV and provisions of this Chapter, Chapter IV and
Chapter VI for the processing of personal Chapter VI for the processing of personal
data carried out solely for journalistic data carried out solely for journalistic
purposes or the purpose of artistic or purposes or the purpose of artistic or
literary expression which prove necessary literary expression only if they are
to reconcile the right to privacy with the necessary to reconcile the right to privacy
rules governing freedom of expression. with the rules governing freedom of
expression.

**10**

Common position of _the_ Council **Amended** Commission proposal

Article 26(1) (4)

4) the transfer is necessary on important 4) the transfer is necessary or legally

public interest grounds, or for the required on important public interest
establishment, exercise or defence of grounds, or for the establishment,
legal claims, or exercise or defence of legal claims, or

**tt**

**Common position of the Council** **Amended Commission proposal**

Article 31(2), third, fourth and fifth subparagraphs

The Commission shall adopt the measures
envisaged if they are in accordance with
the opinion of the committee.

If the measures envisaged are not in
accordance with the opinion of the
committee or if no opinion is delivered the
Commission shall, without delay, submit
to the Council a proposal relating to the
measures to be taken. The Council shall
act by a qualified majority.

If within three months of the referral to it
the Council has not acted, the proposed
measures shall be adopted by the
Commission

The Commission shall adopt measures
which shall apply immediately. However,
if these measures are not in accordance
with the opinion of the committee, they
shall be communicated by the Commission
to the Council forthwith. In that event:

The Commission shall defer application of
the measures which it has decided for a
period of three months from the date of
such communication.

The Council, acting by a qualified
majority, may take a different decision
within the time limit referred to in the
previous subparagraph.

**12**

##### **ISSN 0254-1475**

### **COM(95) 375 final**

# **DOCUMENTS**

#### **EN 08 16** **Catalogue number : CB-C0-95-397-EN-C** **ISBN 92-77-92142-0**

**Office for Official Publications of** **the European** **Communities**

**L-2985** **Luxembourg**