Source: EURLEX
Language: en
Format: md

##### CCll\MISSION OF THE EUROPEAN CQ1\I\4UNITIES

COM(90) 314 final ~.sYN 287 and 288
Brussels, 13 September 1990

COMMISSION COMMUNICATION
on the protection of Individuals In relation to the processing of
personal data In the Community and Information security

ProP.os.a 1 for a
COUNCIL DIRECTIVE

concerning the protection of individuals

SYN 287

In relation to the processing of personal data

Draft
RESOLUTION OF THE REPRESENTATIVES OF THE GOVERNMENTS OF THE MEMBER

STATES OF THE EUROPEAN COMMUNITIES MEETING WITHIN THE COUNCIL

COMMISSION DECLARATION
on the application to the Institutions and other bodies of the European

Communities of the principles contained In the Council

Directive
concerning the protection ~f
Individuals In relation to the processing of personal data

Pr·oposa I for a
COUNCIL DIRECTIVE

SYN 288

concerning the protection of personal data and privacy In the context
of publ le digital telecommunications networks, In particular the Integrated

services digital network (ISDN) and pub·llc digital mobile networks

Recommendation for a

COUNCIL DECISION .
on the opening of negotiations with a view to the accession of the
European Commun lties to the Counc I I of Europe Convent Ion for the protect Ion

of fndlvlduals with regard to the automatlc.processlng of personal data

Proposal for a
COUNCIL DECISION
In the field of Information security

                                 - 2 

COINIIssl on COINM.In I eat 1 on

on the protection of Individuals In relation

to the processing of personal data In the COmmunity

and Information security

I. INTRODUCTION

1. The Increasingly frequent recourse to the processi.ng

of personal data In every sphere of economic and social activity and the

new data-exchange requirements linked to the strengthening of European

Integration necessitate the Introduction In the Community of measures to

ensure the protection of Individuals In relation to the processing of

personal data and to enhance the security of Information processing In the

context, notably, of the development of open telecommunications networks.

2. At a time when progress In the field of Information technology Is

making lt much easier to process and exchange all sorts of data, the

current position with regard to the protection of Individuals In relation

to such processing In the Community Is characterized by the diversity of

national approaches. In the 1970s, the concern felt about the protection

of IndiVIduals In relation to the processing of personal data led to the

leg.lslatlve process being set In motion In several Member States wJth a

- view to limiting and providing a framework for the use of this kind of

data. At the last count, however, only seven Member States had specific

1 aws In thIs fIe Id. Moreover, a I th'ough theIr obJect·l ves are the same,

                   - 3 

those laws sometimes adopt divergent approaches, for example on the

question of scope (Inclusion or not of manual data fl les, protection or not

of legal persons> or on the question of the preconditions for processing

(extent of the obl lgatlon to notify, provision of Information at the time

of col lectlon, processing of sensitive data).

3. Over and above national provisions and In addition to the

recommendation of the Councl I of the OECD concerning guldel lnes on the

protection of privacy and the cross-border flow o.f personal data of

23 September 1980, the Council of Europe Convention of 28 January 1981 for

the Protection of Individuals with regard to Automatic Processing of

Personal Data Is the only International legal Instrument In this field. How
ever, it Leaves open a large number of options for the Implementation of

the basic principles lt contains, and lt has been ratified by only seven

Member States, of which one still has no domestic legislation.

4. This state of affairs has given cause for concern for some time In the
Community. In a number of resolutions dating back to 1976~ the European

Parliament has voiced Its disquiet and called upon the Commission to

prepare a proposal for a directive harmonizing laws on the protection of

personal data.

5. The Commission, In a recommendation of 29 July 1981, stated that such

protection Is quite fundamental and that lt Is desirable that there should

be an approximated level of protection In all the Member States. lt

recommended the Member States to ratify, before the end of 1982, the

Councl 1 of Europe Convention of 28 January 1981 for the Protection of

Individuals with regard to Automatic Processing of Personal Data. lt

added, however. that "If all the Member States do not within a reasonable

time sign and ratify the Convention, the Commission reserves the right to

propose that the Council adopt an Instrument on the basis of the

EEC Treaty ...

_1_ _OJ No C_ _100._ _3.5.1976,_ _p._ _27;_ _OJ_ No _C 140,_ _5.6.1979,_ _p._ _34;_ _OJ_ _No_ _C_ _87,_

_5._ _4_ . _1982._ _p_  - 39.

                   - 4 

6. The diversity of national approaches and the lack of a system of

protection at Community level are an obstacle to completion of the Internal

market. If the fundamental rights of data subjects, In particular their

right to privacy, are not safeguarded at Community level, the cross-border

flow of data might be Impeded just when lt Is becoming essential to the

activities of business enterprises and research bodies and to collaboration

between Member States' authorities In the frontier-free area provided for

In Article Sa of the Treaty. With this In mind, the Strasbourg European

Council of 8 and 9 December 1989 stressed, In the context of measures to

promote the free movement of persons and People's Europe, the need "to

ensure that the procedures for cooperation between administrations first

ensure the protection of Individuals with regard to the use of personal lzed

data banks".

7. A Community approach towards the protection of Individuals In relation

to the processing of personal data Is also essential to the development of

the data processing Industry and of value-added data communication

services. The speedy Introduction of harmonized provisions concerning the

protection of data and privacy In the context of digital telecommunications

networks Is a key element In the completion of the Internal market In

telecommunications equipment and services.

8. The penetration of data processing Into every sphere of economic and

social activity and the appearance of global communication systems making

lt easier to Integrate various activities also represent a new challenge

which calls for the affording of "protection" commensurate with the risks

Involved In any technical or human fa I lure, whether lt be accidental or

deliberate. Effective Information security Is lndlspenslble If one Is to

ensure effective protection of privacy and preserve the Integrity of the

present wearth of data recorded and transmitted electronically. The

Community pol lcles and programmes for the development of the data

processing and telecommunications Industries and t~e completion of the

Internal market might be seriously undermined If an active polIcy for the

creation, development and promotion of Information security standards Is

not adopted. Since telecommunications nowadays make lt possible to

exchange data worldwide, such a policy must take that dimension Into

account. lt Is, moreover, essential that national Information security

policies do not become an obstacle to the promotion of the harmonious

development of the Community and to relations with third countries.

                             - 5

11. THE PROPOSED APPROACH

9. The proposed approach Is designed to ensure a high level of protection

via a Community system of protection based on a set of complementary

measures.

A. A high level of protection

10. Since the object of national laws In this field Is to protect the

fundamental rights of Individuals, and In particular the right to privacy,

and since the Community has Itself stressed the Importance lt attaches to

fundamental rights, In particular In the third paragraph of the Preamble to

the Single European Act, the action taken by the Community must not have

the effect of reducing the level of protection but, on the contrary, of

ensuring a high level of protection throughout the Community. Through

Community action lt Is possible to guarantee a high level of equivalent

protection In all the Member States of the Community, and In so doing

remove obstacles to the establishment of the Internal market In accordance

with Article 100a.

11. In addition to the approximation, at a high level, of the rights of

Individuals, the launching of an active policy on Information security Is

essential. Information security Is vital not only to Individuals butalso to

trade, Industry and public authorities. The Important thing Is to ensure

effective and practical security of Information held In electronic form

while avoiding the formation of new technical obstacles between

Member st~tes.or vls-i-vls third countries. This requirement calls for the

examination at Community level of the possible needs and options In close

col laboratlon with Industry and the Member States.

B. A global approach

12. In order to establish In the Community a system of protection of

Individuals In relation to the processing of personal data, several

measures covering the various aspects of the matter must be adopted.

                              - 6

13. At the Internal level, besides a framework directive approximating

certain laws, regulations and administrative provisions of the

Member States concerning the protection of Individuals In relation to

the processing of personal data (general directive), which Is the

centrepiece of the protection system, a set of other, complementary

measures Is proposed In order to ensure the fullest possible protection.

Each of the measures proposed Is tailored to a specific situation, but al 1

take as point of departure the same protection principles to be found In

the general directive. A resolution of the representatives of the

Governments of the Member States meeting within the Council and a

Commission declaration are thus designed to make the principles contained

In the directive applicable to data flies which are not covered by lt.

Similarly, a sectoral directive Is necessary In the context of publ le

digital telecommunications networks. Lastly, Information security calls

for a Community action plan.

14. At the external level, the European COmmunity must promote among Its

partners the Introduction of adequate protection measures and support the

efforts of the Council of Europe In this field. lt Is desirable In this

connection that the community should enter Into negotiations with a view to

Its accession to council of Europe convention No 108.

This set of proposals cannot be split up without detracting from the

homogeneity and cohesion of the protection system proposed.

c~ Outline of the proposals

15. The proposal for a general directive la aimed at establ lshlng an

equivalent, high level of protection In all the·uember States of the

Community In order to remove the obstacles to the exchange of data which is

necessary If the Internal market Is to function. To that end, the

principles set forth In the draft proposal for a directive must be

underwritten by the Member States. Those principles relate to the

conditions under which the processing of personal data Is lawful, the

-7                

rights of the data subject (right to Information, right of access, right to

rectification, right of opposition, etc.), the reQuisite data Quality (data

must be accurate, collected fairly, stored for specified and lawful

purposes, etc.) and the setting-up of a Working Party on the Protection of

Personal Data to advise the Commission on data protection Issues. The

draft proposal for a directive covers both the private sector and those

activities of the public sector which fall within the scope of Community

law. Since every Individual will enjoy In each Member State an equivalent,

high level of protection In respect of the processing of personal data, the

Member States will no longer be able to restrict the flow of such data In

the Community on grounds of the protection of the data subject.

16. The draft resolution of the representatives of the Member States of

the European Communities meeting within the COuncil Is designed to extend

the coverage of the principles contained In the general directive to

Include flies held by those parte of the public sector to which lt does not

apply, that Is to say those authorities whose activities are not governed

by Community law. For the sake of consistency. all flies held by public

authorities, even th~se which are not covered by the general directive,

should be subject to the same protection principles. To that end, the

Member States should commit themselves to aettlng In motion the necessary

domestic legislative procedures.

17. The Commission declaration on the aepllcatlon to the Institutions and

other bodies of the Community of the provisions of the general directive Is

an expression of the Commission's wish that the principles contained In the

directive should apply to the Institutions and other bodies of the

Community. lt provides In this respect that the commission will take and

propose the necessary measures. and Indicates that, In the mean time, lt

will apply the directive's provisions to Its own data fl lea.

                   - 8 

18. The proposal for a Council Directive concerning the protection of

personal data and privacy In the context of public digital

telecommunications networks, In particular the Integrated services digital

network (ISDN) and public digital mobile networks supplements the general

directive by applying the general principles of data protection to the

specific requirements of the new telecommunications networks. The

directive seeks to guarantee telecommunications users In all the

Uember States a baste level of protection via measures which must be

Integrated Into the services provided by the new networks. The Council and

the European Parliament have stressed on a number of occasions the

Importance of appropriate measures to ensure the protection of data and

privacy In the light of future developments In telecommunications, and In

particular the ISDN.1 This concern was expressed strongly by the

Uember States' officials In charge of data protection at their annual

meeting In Berlin In August 1989.

19. The recommendation for a Council Decision on the accession of the

European Community to the Council of Europe Convention for the Protection

of Individuals with regard to Automatic Processing of Personal Data le one

of the external aspects of the Community's approach to the protection of

personal data. Accession to the Convention will ensure, In relations

between the Community and the third countries which will be parties

thereto, the protection of data subjects and the cross-border flow of

personal data.

20. The proposal for a Council Decision on the adoption of a two-year

action plan on Information security completes the set of measures for

strengthening the rights of Individuals In relation to the processing of

personal data. Information security, that Is to say the protection of data

stored, processed and transmitted electronically against every kind of

threat (both accidental and deliberate) la esa~ntlal If the rights of

Individuals In relation to the processing of personal data are to be

effectively exercised. Uore generally, lt la a primary requirement from

1 OJ No C 257. 4.10.1988, p. 1; OJ No C 196, 1.8.1989, p. 4; OJ No C 7,

12.1.1987, p. 334; OJ No C 12, 16.1.1989, p. 66; OJ No C 12. 16.1.1989,

p. 69.

                            - 9

the point of view of the protection of property and persons which, In the

context of the deployment of open telecommunications networks, necessitates

the development of a global strategy, concerted action at COmmunity level

on technologies, standards and approval and testing p_rocedures .. and

technological developments -Involving cooperation at the pre-competltlve

research and development stage.

21. The proposed action plan provides for the development of a strategic

framework for Information security, the analysis of security requirements,

the devising of ways of satisfying certain priority needs, the drawing-up

of specifications, standards and validation testa, the Integration of

technological and operational developments In the field of Information

security Into a general strategic framework and the Integration of certain

security functions Into Information systems.

              - 10

PROPOSAL FOR A

COUNCIL DIRECTIVE

CONCERNING THE PROTECTION OF INDIVI6UALS

IN RELAY I ON TO THE PROCESSING OF PERSONAL DATA

SYN 287

                            11_

I. :tnt;ra!not;tm

II. The ree1 tor ;groteqt1m in +:be 0Jmnm1 if!

The c11vars1 ty _ot_ nat;1Qnal 1aws am tbe 1ao1t _ot_ an

equivalent level of proteot1cm

COl1sequenoes for tbe Ccmmm1 ty

#### III. The ~ Moptat

An equivalent level of proteotiaD in tbe Qmmm1 ty

A high level of proteotiaD

!Y. D' B'!'ee1 cm _at_ the pray;1 s1 QD8

PrQpre\1 for & Coupci l Directive

-1.2

SlMMRY

This proposal for a directive la aimed at establishing an equivalent, high

level of protection In all the Member States of the COmmunity In order to

remove the obstacles to the data exchanges that are necessary If the

Internal Market la to function. To that end, the principles set forth In

the draft proposal for a directive must be underwritten by the

Member States. Those principles relate to the conditione under which the

processing of personal data la lawful, the rlghta of the data subject

(right to InforMation, right of acceaa, right to rectification, right of

opposition, etc.), the requlalte data quality (data must be accurate,

collected fairly, stored for specified and lawful purposes, etc.) and the

setting-up of a Working Party on the Protection of Personal Data to advise

the Commlaalon on data protection laauea. The draft proposal for a

directive covers both the private sector and those activities of the public

sector which fall within the scope of COmmunity law. Since every

Individual will enjoy In each Member State an equivalent, high level of

protection In respect of the processing of personal data, the Member States

will no longer be able to restrict the flow of such data In the community

on grounds of the protection of the data subject.

                               - 13

Explanatory memoran~

I. INTRODUCTION

The concern that has been felt for the past fifteen years or so about the

protection of Individuals In relation to the processing of personal data

has arisen as a result both of the opportunlttea afforded by technical

progress In the Information processing field and of the Increasingly

frequent recourse that la being had to personal data processing In a

multitude of spheres. This concern has manifested Itself In a variety of

ways and has led to the legislative process being aet In motion In several

Member States. On the wider International canvas, the COUncil of Europe

Convention of 28 January 1981 for the Protection of Individuals with regard

to Automatic Processing of Personal Data la as yet the only International

legal Instrument In this field. The OECD has laid down guidelines on the

protection of privacy and transborder flows of personal data In a

Recommendation of 23 September 1980, and the UN la In the process of

drawing up Ita own guidelines.

Similar expressions of concern have been voiced In the Community context.

The European Parliament has since 1978 adopted a number of resolutions In

which lt makes clear Ita disQuiet on th.ls Issue and calls upon the

Commission to prepare a proposal for a directive harmonizing personal data

protection lawa.C1)

The Commission,. In a recommendation of 29 July 1981, stated that such

- protection Is QUite fundamental and that lt la desirable that there should

be an approximated level of protection In all the Member States. lt

(1) OJ No C 100, 3.5.1976, p. 27; OJ No C 140, 5.8.1979," p. 34;

OJ No C 87, 5.4.1982, p.39.

-14

recommended the Member States to ratify the Council of Europe Convention

before the end of 1982, adding, however, that "If all the Member States do

not within a reasonable time sign and ratify the Convention, the Commission

reserves the right to propose that the Council adopt an Instrument on the

basis of the EEC Treaty".

The Strasbourg European Council of 8 and 9 December 1989 emphasized, In the

context of measures to promote the free movement of persons and People's

Europe, the need "to ensure that the procedures for cooperation between

administrations first ensure the protection of Individuals with regard to

the use of personalized data banks".

In addition to these pronouncements on the need for general protection, the

feelings of concern have also been translated Into specific or sectoral

Community measures, especially In the field of the new Information

technologies.

In view of the current situation with regard to the processing of personal

data and the requirements of European Integration, a directive aimed at

protecting Individuals In connection with this type of processing Is now

essential.

11. THE NEED FOR PROTECTION IN THE COMMUNITY

The diversity of national laws and the lack of an equivalent level of

protection In the Community

A wide variety of approaches are taken In the Member States towards the

protection of Individuals In relation to personal data: some Member States

have no specific laws In this field, and where they do, the content

differs.

Currently, seven Member States have specific laws ·(Denmark, France,

Germany, Ireland, Luxembourg, the Netherlands and the United Kingdom). Work

Is In progress In certain other Member States.

                           - 15

While the object of these national laws la the same, namely to protect the

data subject, they adopt different approaches owing to the multiplicity of

possible ways of affording such protection. The covering of manual data

flies, the protection of legal persons, the procedures prior to the

creation of flies, the extent of the obligation to notify, the provision of

Information at the time of collection of data, the processing of sensitive

data and transfer to other countries are just some of the questions which

can be approached In different ways. Moreover, technical developments may

Induce countries to react differently and, In so doing, Increase the

diversity.

The abovementloned Council of Europe COnvention has not led to a reduction

In this diversity because, firstly, lt leaves open a large number of

options as far as Implementation of Its basic principles la concerned, and

secondly, lt has been ratified by only seven Member States (Denmark,

France, Germany, Ireland, Luxembourg, Spain and the United Kingdom), of

which one (Spain) still has no domestic legislation. The Commission

recommendation of 29 July 1981 calling on the Member States of the

community to ratify the Convention has not altered matters.

Owing to the diversity of national approaches, the protection of

Individuals In relation to the processing of personal data la not

equivalent In all the Member States, the level of protection varying from

one Member State to another.

Consequences for the Community

In the COmmunity, this state of affairs gives rise to three types of

dlfflcul~y:

- The lack of specific national laws or their deficiencies do not reflect

the Community's commitment to the protection of fundamental rights, as

stressed In the Joint declaration of the European Parliament, the

Council and the Commission on fundamental rights of 5 April 1977 and In

the third paragraph of the preamble to the Single European Act. What la

more, In Community law, the protection of fundamental rights forms an

Integral part of the general principles of law which the court of

Justice of the European Communities la charged to uphold.

-16                     

- Where lt respects the rights of the data subject, the flow of personal

data Is a necessity as far as the establishment and functioning of the

Internal market are concerned. In view of technical developments In

Information processing, notably the Introduction of digital

telecommunications networks In the Community, the cross-border dimension

of data flows Is apparent at three levels:

. Personal data are used at numerous stages of economic activity. The

free movement of goods, persons, services and capital requires that

personal data be transferable between business people Involved In

cross-border activities   
. In the Community Integration process, and In particular In the context

of the abolition of frontiers, cooperation between national

authorities will necessarily Increase, the authorities In one Member

State being called upon to perform tasks which are normally the

responsibility of an authority In another Member State. The flow of

data Is essential to such cooperation. The duty to collaborate or

provide Information, which will be Imposed on authorities by Community

law, requires at the same time that data subjects be fully protected .

. Data exchanges are also necessary for scientific cooperation purposes.

This need to permit data flows between Member States currently comes up

against the differences In national approaches to the question of

protecting Individuals In relation to the processing of personal data.

These differences may Induce a Member State to place barriers In the way

of the free flow of data on grounds of the lack or Inadequacy of

protection In the country of origin or destination.

- These differences could also, In certain circumstances, distort

competition between private operators depending on the constraints to

which they are subject In their country.

Ill. THE APPROACH ADOPTED

An equivalent level of protection In the Community

In order to afford any Individual residing In the Community protection In

connection with the processing of personal data and permit the flow of this

                           - 17

type of data between Member States, an equivalent level of protection must

be established throughout the Community. To that end an approximation of

laws Is necessary. The Commission's programme for 1990 mentions the

protection of data as a priority area In the context of completing the

Internal market.C1)

In this connection, Article 100a of the Treaty provides the appropriate

legal basis Inasmuch as a high level of equivalent protection Is essential

to the creation of the Internal market. The completion and functioning of

the Internal market, which Is described In Article Sa as - •an area without

Internal frontiers In which the free movement of goods, persons, services

and capital Is ensured In accordance with the provisions of this Treaty",

necessitate, for the reasons already given, an approximation of laws In

this field.

In the preparation of this proposal the Commission has taken Into account

the requirements of Article Se of the EEC Treaty and has concluded that no

special provisions or derogatlons seem warranted or Justified at this

stage. Likewise the Commission has studied the question of the high level

of health/safety/environmental and consumer protection required by the

terms of Article 100a(3) of the EEC Treaty.

A high level of protection

The object of national laws In this field being to protect fundamental

rights, and In particular the right to privacy, an approximation of those

laws must seek to guarantee a high level of protection. Apart from the

adjustments Inherent In any approximation of laws, the exercise must not

have the effect of reducing the level of protection already afforded In the

Member States.

The general principles set out In the Council of Europe Convention are a

suitable benchmark as they already constitute a common.basls for the

countries which have ratified the Convention. Thus, while adopting

solutions compatible with those of the Convention, the Directive adds to

those general principles In order to provide a high level of equivalent

protection.

(1) Bull. EC Supplement 1/90, pp. 18, 25 and 27.

-18

A high level of protection requires that the protection guaranteed by the

Directive should have a very wide scope and that every situation In which

the processing of personal data Involves a risk to the data subject should

be covered. The Directive therefore applies to manual as well as automated

flies and to both public-sector and private-sector flies.

The principles contained In the Directive, notably those relating to the

lawfulness of processing, the communication of data to third parties,

notification procedures, the rights of the data subject and data quality,

are designed to ensure a high level of protection by taking as a basis the

various solutions adopted In national laws. Similarly, particular attention

has been paid to the means of ensuring, beyond the usual arrangements for

monitoring the application of Community law, the effective application of

the Directive's provisions. Hence the Inclusion of provisions on

liability and on the setting-up of a Working Party on the Protection of

Personal Data.

The principles contained In the Directive may, If necessary, be

supplemented. The Directive provides In a number of Its articles that

Member States may lay down more specific rules In respect of data flies

that are subject to their law. Additional measures may also be necessary

for the purpose of applying certain general principles to sectors having

special features.

IV. DISCUSSION OF THE PROVISIONS

CHAPTER I

General provisions

Article 1

Object of the Directive

This article provides that the Member States are obliged to ensure the

protection of Individuals In relation to the processing of personal data by

                              - 19                              

applying the Directive's provisions. Since, under the Directive, protection

Is ensured In accordance with the same principles In all the Member States

and Is therefore equivalent, the Member States can no longer restrict, In

the fields covered by the Directive, the flow of data on grounds of the

protection of the data subject. The protection of Individuals and the flow

of data are, however, guaranteed under the Directive only In the fields

covered by lt. Flies held for private purposes or by non-profit-making

bodies cannot, therefore, give rise to the application of this article

Inasmuch as Article 3(2) excludes them from the scope of the Directive.

Article 2

Definitions

This article defines the main concepts used In the Directive. The

definitions are taken from Council of Europe COnvention N• 108 with such

adjustments and clarifications as are necessary to guarantee a high level

of equivalent protection In the Community.

a) .. Personal data ... As In COnvention 108, a broad definition Is adopted In

order to cover all Information which may be linked to an Individual.

Depending on the use to which lt Is put, any Item of data relating to an

Individual, harmless though lt may seem, may be sensitive (e.g. a mere

postal address). In order to avoid a situation In which means of

Indirect Identification make lt possible to circumvent this definition,

lt la stated that an Identifiable Individual Is an Individual who can be

Identified by reference to a number or a similar Identifying particular.

b) .. Depersonalize ... This concept Is designed to permit the exclusion from

the a·cope of certain provisions of the Directive of data which are no

longer Identifiable. An Item of data can be regarded as depersonalized

even If lt could theoretically be reperaonallzed with the help of

disproportionate technical and financial resources.·

c) - Personal data file•. The definition Is based on the criterion of

possibility of access to personal data, either by means of manual

processing where the file consists of a collection of structured data,

or by means of automatic processing which permits the grouping together

of disseminated data or the extraction of data from a complete text

-20                

using a method of consultation which corresponds to that of a file.

The definition therefore covers structured automated and manual flies.

Individual flies, and In particular administrative fl lea, which do not

contain a structured collection of personal data are not covered owing

to the specific and divergent laws governing them In the Member States.

d) "Processing". In listing the principal processing operations, the

definition adapts that given In the Convention to suit the wider scope

of the concept of file. Data combination operations are covered as they

make lt possible to produce new data (e.g. electronic profiles). The

reference to blocking relates to data to which access Is blocked using

more stringent security measures than Is normally the case, but stopping

short of erasure.

e) "Controller of the file". The concept of "controller of the file" as

used In the Convention Is adapted In two respects: firstly, by referring

to Community law In order to cover the case where specific directives

contain substantive provisions on the protection of personal data; and

secondly, by specifying that the person who authorizes consultation,

notably In the event of direct Interrogation, Is the controller of the

f lie.

f) "Supervisory authority". The definition stresses that the authority must

be Independent and refers to Article 28, which specifies the functions

of the supervisory authority.

g) and h) [0] Publlc sectorn and "private sector•. The definitions of public

sector and private sector are justified In the Directive as some of Its

provisions are specific to one or other sector (Chapters 11 and Ill

relating to the lawfulness of personal data processing In the public and

private sectors). These definitions are based on the nature of the

service provided by the body concerned, regardless of Its private or

public status. The body will have to apply the rules specific to the

private· sector or to the public sector according as to whether lt

carries on commercial activities or performs public-service duties.

                              - 21                              

Article 3

Scope

The Directive applies to all flies whose controllers are In the private

sector or the public sector. In the latter case, the performance of

numerous administrative tasks necessitates, by virtue of Community law,

cooperation between authorities In the Member States. The Directive does

not apply, however, to flies In the public sector where the activities of

that sector fall outside the scope of Community law (e.g. the Intelligence

services).

Paragraph 2 provides for two exceptions where Invasions of privacy are

unlikely to occur either because the data are used for private purposes

only, as Is the case with a personal electronic diary, or because the flies

are registers of members of an association whose consent to appear therein

can be presumed from their very membership and the Information contained In

the register Is not transmitted to third parties.

Article _4_

Law applicable

This article specifies the connecting factors which determine the

application In each Member State of the Dlrectlve•s provisions. The choice

of factors In paragraph 1 Is motivated by the desire to avoid a situation

In which the data subject Is completely unprotected owing, mainly, to the

law being circumvented. The factual criterion of the place In which the

file Is located has therefore been adopted. In this connection, each part

of a file which Is geographically dispersed or dlvtded among several Member

States must be treated as a separate file.

The desire to protect the data subJect In the event of relocation Is at the

root of a provision which requires a user consulting a file located In a

third country from a terminal located In a Member State to comply with the

                           - 22                           

Directive's provisions on the lawfulness of processing, the Informing of

the data subject In the event of the communication of data, sensitive data,

data security and liability. Thla requirement la Imposed where such use Is

not simply sporadic.

In view of the ease with which flies can be moved, the temporary removal of

a file from one location to another does not constitute a change of

location. The removal of data storage media must not give rise to the

completion of formalities over and above those which have been gone through

In the country In which the file la normally located.

This article la also designed to avoid any overlapping of applicable laws.

CHAPTER 11

Lawfulness of processing In the public sector

Personal data may be processed only If their processing Is lawful. This

chapter, like Chapter Ill, specifies the circumstances In which processing

Is lawful. The lawfulness may stem from the consent of the data subject,

from a provision of the Directive or of Community law, or from a national

legal Instrument.

Article 5

Principles

This article provides that the creation of a public-sector file and any

other processing of data shall be lawful only If lt Is necessary for the

per(ormance of ~he tasks of the public authority In control of the file.

There are four cases In which data may be processed for a purpose other

than that for which the file was created: If the dat• subject consents; .If

the processing has a legal basis; If, after weighing the Interests

Involved,. lt Is clear that the legitimate Interests of the data subject do

not preclude such change of purpose; and, lastly, In the event of an

Imminent threat to public order or a serious Infringement of the rights of

others.

                                 - 23 

These principles do not concern the specific case of the communication of

data to third parties, which Is dealt with In Article 6.

Article 6

Processing In the public sector having as Its obJect the communication of

personal data.

A specific provision on the communication of data to third parties Is

necessary Inasmuch as this type of processing Involves the greatest risk to

the data subject. The paragraph provides for two cases In which data may be

communicated to third parties, according to whether the recipient Is In the

public sector or the private sector. In the former Instance, communication

must be necessary for the performance of the tasks of the authority

requesting or communicating the data; In the latter, a balancing of

Interests must be carried out In order to determine whether the requester

has a legitimate Interest and whether the Interests of the data subject do

not preva I I.

The Member States are given the opportunity to specify In their law, within

the limits of the two principles set out above, the conditions under which

the communication of data Is lawful. This may consist, for example, In

defining, In respect of certain fields, In what circumstances the Interests

of the data subject prevail.

In order to ensure that the Interests of the data subject are not harmed by

the communication of data to the private sector, a procedure for Informing

the data subject Is laid down. A derogation from this obligation Is

possible, however, .where communication Is authorized by the supervisory

authority. The latter may attach conditions to the derogation or decide to

Inform the data subject Itself.

Article 7

Obligation to notify the supervisory authority

The obligation provided for In this article to notify the supervisory

authority and to have such notification recorded In a register kept by that

,.

                             - 24

authority Is restricted to public-sector flies the data In which might be

communicated. The aim Is to ensure the minimum transparency necessary for

the exercise of the rights of the data subject while reducing the number of

formalities, as these might place a very heavy burden on the supervisory

authority owing to the widely drawn concept of data file. The Uember States

may, however, extend the obligation to notify so as to cover other public
sector flies.

CHAPTER Ill

Lawfulness of processing In the private sector

Article 8

Principles

The lawfulness of the processing of personal data In the private sector may

be based on the consent of the data subject. Such consent must satisfy the

conditions of Articles 12 (Informed consent) and 13 (provision of

Information at the time of collection of data).

In the absence of the consent of the data subject. the lawfulness of the

processing may be based on the existence of a contractual or quasi
contractual relationship between the controller of the file and the data

subject In so far as the processing Is necessary for the performance of the

contract (e.g. processing of orders or Invoicing).

The lawfulness of the processing may also be based on the fact that the

data come from sources generally accessible to the publ le (public telephone

directories) In $0 far as the processing Is Intended solely for

correspondence purposes.

Lastly. the iawfulness of the processing may be based on a balancing of

Interests which reveals that the controller of the fl le has a legitimate

Interest and that the data subject does not have an overriding Interest.

The communication of data Is lawful only If lt Is compatible with the

purpose of the file as notified (Article 11(2)), which has to be adhered to

                              - 25                               

when data are stored (Article 18(1) (b)). When data are communicated, the

controller of the fl le Is obliged, moreover, to Inform the data subject In

the manner prescribed In Articles 9 and 10. Within the limits of the

principles set out above, the Member States may specify In their law the

conditions under which the processing of data Is lawful. This may consist,

for example, In defining, In respeet of certain fields, In what

circumstances the Interests of the data subject prevail.

Article 9

Obligation to Inform the data subject

In order that the data subject might exercise his rights, paragraph 1

requires the controller of the file to Inform the data subject of the

communication of data concerning him. The data subject can thus exercise

his right of access and object to continuation of the processing In

question. There Is no obligation to Inform the data subject where the data

come from sources generally accessible to the public and their processing

Is Intended solely for correspondence purposes.

Article 10

Special exceptions to the obligation to Inform the data subject

This article authorizes Member states to provide In their law that, where

major practical difficulties, overriding legitimate Interests of the

controller of the fl le or a similar Interest of a third party stand In the

way of Informing the data subject, the supervisory authority may, within

- the llm~ts of the law authorizing lt to do so, at the request of the

controller of the file authorize a derogation from the obligation to Inform

the data subject. The supervisory authority may, specify the terms of the

derogation and decide to Inform the data subject Itself.

The case of major practical difficulties covers, for example, data relating

to persons whose home address Is not known.

                              - 26"

Article 11

Obligation to notify the supervisory authority

For the same reasons as those underlying the obligation to notify In the

public sector (Article 7), the obligation to notify In the private sector

does not apply to flies In which the data are not Intended to be

communicated or which come from sources generally accessible to the public.

The notification must be updated If there Is any change In the purpose of

the f lie.

The Information notified must Include that which Is necessary for the

purpose of monitoring compliance with the Directive (at least the name and

address of the controller of the file, the purpose of the file, a

description of the types of data lt contains, the third parties to whom the

data might be communicated and a description of the security measures

taken). The Member States may extend the scope of the obligation to notify.

CHAPTER IV

Rights of data subjects

Article 12

Informed consent

This provision determines under what conditions the data subject's consent

to the processing of data relating to him, both In the public and In the

private sector, Is legally valid.

The data subject's consent to the processing of data relating to him Is an

Important justification for the processing of personal data by the

controller of the file. The concept of Nconsent" as used In Article 12

means "Informed consent". In order to enable the data subject to weigh the

risks and advantages of the Intended processing of data relating to him and

                              - 27                              

to exercise his rights under Article 14 of the Directive (rectlflcalon,

erasure, blocking), the controller of the file has to provide the data

subject with such Information as la relevant to the data subject's

decision, e.g. name and address of the controller of the file, purpose of

the file, data stored In the file, etc.

As to the form of the consent, the Directive does not, for practical

reasons, require that the data subject should give his consent In writing.

The agreement, however, has to be expressly given. The consent of the data

subject has to be specific In that lt has to refer to the processing of

data relating to him by a particular controller of a file and for a certain

purpose or purposes. The agreement must also Indicate the kinds of data

which may be processed, the forms of processing and the potential

recipients In case of transfer to third parties.

Under Article 12(c) the data subject la entitled to withdraw hla consent at

any time. The revocation, however, bears no retroactive effect as

otherwise a previously lawful processing of personal data would be made

Illegal ex post facto.

Article 13

Provision of Information to the data subject at the time of collection of

data

Effective data protection requires that the data subject be kept fully

Informed about the processing of personal data relating to him, not only

once they are stored and processed In a data file but at the stage

preceding their processing, I.e. at the stage of their collection.

lt Is laid down In Article 18(1)(a) that data must be collected fairly and
lawfully. For the purposes of Article 13 this reQulr~ent cover• the

situation where data are obtained from the data subject himself.

The fair and lawful collection of personal data presuppose• that the data

subject makes his decision whether or not to disclose data relating to him

                               - 28 

to the collectors on a reliable factual basis as regards the purpose of the

processing, the Identity of the controller of the file and the question

whether he Is under a legal obligation to disclose the data or whether

disclosure la voluntary. So that he can assert hla rights under Article 14

of the Directive and control effectively the use of data relating to him,

he should also be Informed about his rights of access and rectification

and about recipients of the data.

Article 13(1) of the Directive obliges the Member States to provide In

their domestic data protection laws that the data subject must be.glven

this Information.

The person who collects data will often not be the same as the controller

of the file In which the data will eventually be stored and processed. In

order that he may assert his rights against the latter, lt Is Important

that the data subject should be Informed of his name and address when the

data are collected.

Article 13(2) empowers the Member States to restrict the duty to Inform the

data subject at the time of collection of data on grounds of the existence

of predominant general Interests. Under thla provision, there Is no duty to

supply the Information mentioned In Article 13(1) to the data subject If

the Information prevents the proper discharge of the functions of public

authorities entrusted with monitoring and supervisory duties or the

maintenance of public order.

Article 14

Additional rights of data subjects

Article 14 of the Directive encompasses the rights ~f the data subject vls
- -vla the controller of the file. The purpose of data protection Is to

                              - 29·                               

safeguard the data subject's right to privacy. The rights of that party

vls-l-vls the controller of the file therefore form a fundamental part of

data protection.

Article 1~(1) entitles the data subject to oppose the processing of data

relating to him for legitimate reasons. Legitimate reasons, for the

purposes of this provision, means the lack of a legal justification for

processing personal data, e.g. because the requirement of Chapters 11 and

111 of the Directive as to the permissibility of such processing Is not

fulfilled with regard to a particular processing of data.

Article 14(2) safeguards the data subject against being made the subject of

decisions by public- and private-sector Institutions Involving the

assessment of human conduct on the sole basis of an automatic processing of

personal data forming a data or personality profile of the data subject.

This provision Is designed to protect the Interest of the data subject In

participating In the making of decisions which are of Importance to him.

The use of extensive data profiles of Individuals by powerful public and

private Institutions deprives the Individual of the capacity to Influence

decision-making processes within those Institutions, should decisions be

taken on the sole basis of his - data shadow•.

If he Is to assert effectively his rights to rectification, erasure or

blocking of data vls-l-vls the controller of the file, lt Is essential that

the data subject have access to the data In the file. This Is granted to

him by Article 14(3) and (4). Article 1~(3) grants the data subject the

right to be Informed about the relevant facts relating to the processing of

his personal data by the controller of the file so that he may assert his

rights. to rectification, erasure and blocking and exercise effective
control over the.processlng of data relating to him. Article 1~(~) confers

on the data subject the right to obtain, at reasonable. Intervals and

without excessive delay or expense, confirmation as to whether data on him

are stored In the file and, If so, communication to him of those data In an

Intelligible form.

The provisions of Article 14(3) and (4) leave lt to the Member States to

                   - 30 

decide how such Information Is forwarded to the data subject.

lt Is also left to the domestic law of the Member States to determine the

meaning of the term - reasonable Interval•. Taking Into consideration the

Interests of the data subject and of the controller of the file, the

domestic law of the Member States may provide that the controller of the

file may charge a data subject who exercises his right of access no more

than the actual cost Incurred. The charge must not be excessive.

Article 14(4) allows the Member States to lay down a special rule on the

exercise of the data subject's right of access where medical data are

concerned. To protect the data subject from psychological shock, which In

extreme caaea may lead to suicide, such Information might be provided to

him by a medical expert.

Article 14(5) of the Directive grants the data subject the right to

rectification, erasure or blocking of data If their processing la

.Incompatible with the Directive.

The data subject may exercise the right to rectification If data relating

to him are Incorrect, Incomplete, Inaccurate, misleading or out of date.

The right of the data subject to have data erased or blocked presupposes

that they have been processed In violation of the Directive. Article 14(5)

refers to all provisions of the Directive which regulate the collection,

storage, processing and use of personal data.

The concept of blocking has Its origins In the German Federal Data

Protection Act (paras. 4, 27 and 35: Sperrung). If data are blocked

because they have been collected, stored, processed or used In violation of

the Directive's rules, the controller of the file may still keep them

stored In his file, but he Is prohibited from processing or using them, and

In par·t lcular from connunlcat lng them to third par.t lea. The blocked data

have to be marked In the file to Inform users of the file of the blocking.

The wording of the Directive ("as the case may be•> leaves the precise

shaping of the data subject's rights of erasure, blocking or rectification

with regard to the different situations In which personal data are

processed and used In violation of the Directive to t~e data protection

legislation of the Member States.

                   - 31 

Frequently, data are not only processed by a controller of a file, but

communicated to third parties. If the controller of the file has to

rectify, erase or block data because they are Incorrect or unlawfully

processed or used, lt la In the data subJect's Interest that third parties

to whom such data have been transmitted should be notified of the

rectification, erasure or blocking so that they, too, can rectify, erase or

block the data. This Interest of the data subJect la taken care of by

Article 14(7).

Article 14(8) grants the data subJect the right to have data concerning him

erased from flies which serve marketing and direct-mall advertising

purposes. The data subJect can thus protect himself against unsolicited

direct-mall advertising.

Finally, Article 14(8) obliges the Member States to grant the data subJect

an effective judicial remedy should the controller of the file or another

person Infringe hla rights as set out In Article 14.

Article 15

Exceptions to the data subJect's right of access to public-sector flies

Article 15 authorizes the Member States to restrict the data subJect's

right of access to data flies In order to protect an overriding public

Interest or an Interest of a private Individual eQuivalent to the data

subject's right to privacy where the fllea are held by the public sector.

lt la left to the Member States to decide to what extent they Include In

their domestic data protection legislation exceptions based on Article 15.

However, the excep.tlona set out In thla·provlalon are_ limited to those

necessary for the safeguarding of substantial values In a democratic

society and have to be adopted by a formal statute. The list of lntereata
which justify a restriction of the right of access under Article 15 of the

Directive la exhaustive.

                  - 32 

T.he term "national security" Is to be Interpreted as meaning the protection

of national sovereignty against Internal and external threats.

;'Criminal proceedings" covers the prosecution of crimes which have already

been committed, whereas the concept of .. publ le safety" encompasses al I the

polIcing functions of state organs Including crime prevention. The phrase

"substantial economic and financial Interests of a Member State or of the

European Communities" refers tJ al I economic polIcy measures and means of

financing the pol lcles of a Member State or of the Community, e.g. exchange

controls, foreign trade controls and tax col lectlon. However, only a

substantial Interest of this kind justifies a restriction of the right of

access.

Finally, an Interest of a third party equivalent to the data subject's

r lght of access or the rights and freedoms of others are considered valId

grounds for restricting the right of access. Such Interests Include the

trade secrets of others or the freedom of the press.

If the dat~ subject Is denied access to data relating to him contained in a

fl le because an Interest covered by Article 15(1) Is Involved. the data

protectloP authority, at his reQuest. must carry out the necessary

inspection and checks on the fl te In which the data are stored.

Article 15(3) empowers the Merr•ber States to place limits on tt-te rl~ht of

access to dat~ compl led only temporarl ly for the purpose of extracting

stat 1st I _eel_ ir,format Ion. as su~h operatIons pose only a l"''inl)r - .hreat to tht;

data subj(•ct.

                              - 33                               

Chapter V

Data qual lty

The data protection principles set forth In this Chapter are more far

reaching than Its title suggests: they cover not only the qual lty of data

(Article 18), but alao the procesalng of certain categories of data which

are considered to be particularly sensitive from the point of view of the

Interests of the data subject (Article 17) and the appropriate data

security measures (Article 18).

Article 16

Principles

A·tlcle 16 of the Directive requires the Member States to Incorporate the

basic principles relating to the quality of personal data In their domestic

data protection legislation. These principles are designed to safeguard

the data subJect's right to privacy by placing certain restrictions on the

col lectlon and processing of personal data and on the permissible contents

of personal data fl lea.

Article 16(1)(a) requires that the col lectlon and processing of personal

data should be carried out fairly and lawfully.

This provision covers the processing of personal data as defined In

Article 2(d) as wel I as Its gathering.

Article 16(1)(a)·rules out, say, the use of technical devices hidden from

the data subJect-which serve to obtain data secretly and without his

~nowledge, _for example by wire-tapping, eavesdropping and slml lar methods.

lt also prevents controllers of flies from creating and using clandestine

fl les containing personal data.

                                - 34 

Article 16(1)(b) sets out the principle of - purpose specification•.

According to this principle, personal data may be stored only for

specified, explicit and lawful purposes.

The purpose for which personal data are stored must be specific In that the

aim which the storage and use of the data Is Intended to serve must be

defined and specified In as narrow terms as possible. A general or vague

definition or description of the purpose of a file (e.g., the fl le la

Intended to serve - business purposes•> will not be consonant with the

purpose specification principle as laid down In Article 18(1)(b) ..

The purpose has to be specified before the storage Is effected. Where the

data are collected from the data subject, the purpose should be specified

at the time of collection (cf. Article 13).

Subsequent changes In the purpose of processing are permissible only In 80

far as they are not Incompatible with Its former purpose.

Article 18(1)(b) also requires that the controller of the file should make

the purpose of storage and use of the data explicit. The requirement of

explicitness seeks to prevent personal data from being stored and used for

hidden purposes.

The reQuirement of lawfulness of the purpose of storage and use of personal

data limits the potential purposes which a data file may serve; a fl le may

be created and used only for purposes which are compatible with this

Directive and the domestic law of the Member States. Furthermore, only

such purposes as are relevant to the administrative functions of

controllers of flies In the public sector and the business activities of

controllers of flies In the private sector are lawful. Article 18(1)(b)

states clearly that the purpose specification principle applies not only to

the processing of personal data: the use of such data also has to be

compatible with the purpose of the file.

Article 18(1)(c) provides that the data In a fl le must be adequate,

relevant and not excessive In relation to the purposes for which they are

stored. This principle seeks to ensure that the contents of a file are In

keeping with Its purpose.

                   - 35 

Standing In close relationship with the reaulrements of ~rtlcle 16(1)(b)

and (c) are th~ orovlslons of Article 16(1)(d). Personal data stored In a

file hav~ to he accurate and, If necessary, ~act uo to date. If data are

lnaccuratA or lncomolete In relation to the purpose of the file,

Article 16(1)(d) reaulres that they be erased or rectified.

Article 18(1)(e) deals with time limits for the retention of personal data.

According to this provision, the keeping of data In a form which permits

Identification of the data subject Is allowed only for as long as Is

necessary for the ourposes for which the data are stored.

There may be circumstances however, In which lt Is necessary, e.g. for

statistical purposes, to keep data beyond that time limit. lt Is

essential, In such circumstances, for the protection of the data subject

that th~ link between his name and the data be removed.

Article 16(2) makes lt the duty of the controller of the file to ensure

that the data quality provisions of Article 16(1) are complied with.

Article 17

Special categories of data

lt Is generally accepted that the right to privacy Is endangered, not by

the contents of personal data, but by the context In which the processing

of personal data takes place. However, there la a broad consensus among

the Member States that there are certain categories of data which, by

virtue of their contents- quite Irrespective of the context In which they

are processed- carry the risk of Infringing the data s~bject's right to

pr~vacy. Article 17 of the Directive therefore places strict limits on the

electronic processing and use of sensitive Information. In personal data

flies.

                   - 36 

Article 17 classes as sensitive the fol lowlng categories of data: racial

origin (Including Information on skin colour); pol ltlcal oclnlons,

religious beliefs and philosophical convictions, Including the fact that a

cerson holds no religious belief (these categories encompass Information on

activities of the data subject relating to pol ltlcal, rei lglous or

philosophical convictions); Information on trade-union membershiP;

Information on the data subject's health (Including Information on his

past, present and future state of physical and mental health and

Information on drug and alcohol abuse); Information concerning sexual 1 lfe.

As a general rule, Article 17(1) prohibits the automatic processing of

sensitive data. Exceptions to this rule are processing with the consent of

the data subject, which has to be freely given, express and declared In

writing, and the exception set out In Article 17(2).

According to the latter provision, the Member States may allow the

electronic processing of sensitive data If lt Is reQuired on Important

public Interest grounds. However, such an exception presupposes as a legal

basis the adoption of a formal statute specifying the kinds of sensitive

data which may be processed electronically and the persons who may have

access to the data, and providing appropriate safeguards against abuse and

unauthorized access.

Article 17(3) covers the special case of the storage of Information on

criminal convictions. The storage of such Information Is permitted only In

public-sector data flies.

The scope of Article 17 Is limited to data processed by automated means.

The article does not cover the electronic storage - nd processing of data on

political opinions, religious and philosophical convictions and trade-union

membership where such data are processed by non-profit-making organizations

In accordance with Article 3(2)(b).

                            - 37 

Article 18

Data security

Threats to the data subject's right to privacy do not emanate only from

the controller of the file, who collects, stores, processes and

communicates the Individual's data for his own purposes.

His right to privacy Is also jeopardized If his data are misused by third

parties through unauthorized access to and use of the data.

The first sentence of Article 18(1) requires the Member States to obl lge

the controller of the file to take appropriate organizational and technical

measures to protect the data In a file against the danger of unauthorized

Intrusion by third parties Into a file or accidental loss of data,

Including accidental or unauthorized destruction, unauthorized modification

of or access to data and any other unauthorized processing.

Technical measures of data security Include: safety measures for access to

data processing and storage locations, Identification codes for persons

entitled to enter such locations, Informational safeguards such as the use

of passwords for access to electronically processed fl lea, the enciphering

of data and monitoring of hacking and other unusual activities. Through

organizational measures, the controller of the file adopts certain

procedural steps within the hierarchy of his public authority or business

enterprise, e.g. by establishing authority levels with regard to access to

the data.

The second sentence of Article 18(1) lays down the standard of approprate

data security measures with regard to automated data flies. The measures

have to ensure an appropriate level of security having regard to the state

                             - 38

of the art In the field of data security, the cost of taking those

measures, the nature of the data stored In the file and the assessment of

the potential risks. In order to determine the appropriateness of data

security measures, the controller of the fl le has to take Into

consideration any recommendations on data security and network

lnteroperabl I lty formulated by the Community In accordance with Article 29

of the Directive.

The obligation to take appropriate security measures Is not I lmlted to the

location of the data processing or of the hardware and software used for

the processing. If data transmissions take place between one computer and

another or between a computer and terminals via a telecommunications

network, according to Article 18(2) security measures also have to be taken

with regard to the network In order to guarantee the safe and uninterrupted

transfer of data.

Article 18(3) covers the case of direct access by a remote user to a fl le

via on-line retrieval. The authority of the user to obtain data from the

fl le Is specified In and limited by the contract with the controller of the

fl le. The Directive requires the controller of the fl le to design hardware

and software used for on-line retrieval In such a way that the user's

access remains within the I lmlts of the authorization granted to him by the

controller of the file.

Article 18(4) assigns responslbl llty for compliance with the obl lgatlons

laid down by Article 18(1) to (3). The persons who- de facto or by

contract -control the operations relating to a data fl le are also

responsible for ensuring compl lance with the data security requirements.

Those to whom this rule appl les are, as the case may be, the controller of

the flle,,the user having access via on·-llne data retrieval and data

processing service bureaux performing data processing operations on behalf

of the controller of the fl le.

                            - 39 

Finally, Article 18(5) places a duty of professional secrecy on employees

of the controller of a fl le and other persons who In the course of their

professional activities have access to the personal Information In a file.

These persons are prohibited from communicating the Information to which

they have access to third parties without the authorization of the

controller of the file.

CHAPTER VI

Provisions speclflcal ly relating to certain sectors

Article 19

The Member States may provide for derogatlons from the Directive's

provisions In respect of the press, and the audiovisual media In so far as

they are necessary In order to reconcl le the fundamental rights of

Individuals, notably the right to privacy, with the freedom of Information

and of the press, there being a danger of conflict between the two

categories of fundamental right. The approach adopted lays emphasis on the

obl lgatlon to balance the Interests Involved In the event of a derogation.

This balance may take Into account, among other things. the avallabl 1 lty to

the data subJect of remedies or of a right of reply, the existence of a

code of professional ethics, the limits laid down by the European

Convention on Human Rights and the general principles of law.

Article 20

This article provides that the Member States must encourage the business

circles concerned to draw up codes of conduct or professional ethics so as

to facl 1 ltate the appl lcatlon of the principles of the Directive In certain

sectors.

The Commission wl I I also support such Initiatives and wll I take them Into

account, If necessary, when lt exercises Its rule-making powers or puts

forward new proposals.

                             - 40 

CHAPTER VI I

Llabl I lty and sanctions

Article 21

Llabl I lty

Where damage Is suffered as a result of fa I lure to comply with the

Directive, 1 labl llty rests under this article with the controller of the

fl le, who may be sued by the data subJect for compensation. The concept of

damage covers both physical and non-physical damage. The I lablllty of the

controller of the file for loss, destruction or unauthorized access Is

I lmlted If he can prove that the security reQuirements were complied with.

Artlcle 22

Processing on behalf of the controller of the fl le

The object of this article Is to avoid a situation whereby processing by a

third party on behalf of the controller of the file has the effect of

j
reducing the level of protection enjoyed by the data subject. To that end,

obligations are placed both on the controller of the file and on the third

party carrying out the processing.

Article 23

Sanc~lons

In order to·ensure compl lance with the measures taken pursuant to the

Directive, the Member States are required to lay down· truly dissuasive

sanctions, such as criminal sanctions, bearing In mind, In particular,

that non-compl lance with the data protection prlnclp.les constitutes an

infringement of a fundamental right.

### . ' '·

                                                                                                     - ..

                       - 4r _

CHAPTER V I I I

Transfer of personal data to third countries

Article 24

Principles

This article establ lshes the principle that the transfer of personal data

from a Member State to a third country may take place only If that country

ensures an adequate level of protection. lt Is for the Member States, and,

If necessary, for the Commission, to determine whether a country ensures an

adequate level of protection. The Member States must Inform the Commission

of cases In which an Importing third country does not ensure such a level

of protection. In that event, negotiations may be entered Into between the

Commission and the third country concerned.

The Commission may decide, In the exercise of the Implementing powers

conferred on lt by Article 29, that a country ensures an adequate level of

protection In the I lght of Its domestic law and/or of the International

commitments lt has entered Into. The Councl I of Europe Convention of

28 January 1981 for the Protection of Individuals with regard to Automatic

Processing of Personal Data forms part of the commitments which the

Commission wl I I take Into account. lt may also draw on the expertise of

the Working Party on the Protection of Personal Data In this field.

Article 25

Derogation

If a country does not ensure an adequate level of protection, a derogation

permitting the transfer of data Is possible In respeet of a given export.

The Member State In which the fl le Is located may authorize such a transfer

If the controller of the fl le can guarantee an adequate level of protection

In respect of that export and If neither the other Member States nor the

Commission object. To that end an Information procedure Is provided for,

with a ten-day period In which notice of opposition may be given.

                   - 42 

Where notice of opposition Is given, the Commission may take the

appropriate measures, Including prohibition of the transfer.

CHAPTER IX

Supervisory authorities and the Working Party on the Protection of Personal

Data

Article 26

Supervisory authority

This article provides for the setting-up of a supervisory authority

characterized by Its Independence and by powers of Investigation and

Intervention suited to the performance of the supervisory duties entrusted

to lt. National law must guarantee these two characteristics. The term

"supervisory authority" does not prejudice the adoption of a multiple

Internal structure based on the constitutional system of the Member States.

Article 27

Working Party on the Protection of Personal Data

Owing to the special features of the protection of Individuals In relation

to personal data, this article sets up a working party of an advisory

nature, the Working Party on the Protection of Personal Data. The Working

Party on the Protection of Personal Data Is characterized by Its

Independence and Is composed of representatives of the national supervisory

authorities. The Working Party Is chaired by a representative of the

Commission.

Article 28

Tasks of the Working Party on the Protection of Personal Data

This article sets out the tasks of the Working Party on the Protection of

Personal Data. The Working Party gives the Commission the benefit of Its

                             - 43

knowledge and expertise In the field of the protection of Individuals In

relation to the processing of personal data, thereby contributing to the

uniform appl lcatlon of the national rules adopted pursuant to the

Directive; lt assesses the level of protection In the Community and In

third countries and Informs the Commission thereof; and lt may advise the

Commission on any additional measures that need to be taken.

The Working Party on the Protection of Personal Data may formulate

recommendations which may, If lt so wishes, be transmitted to the

Advisory Committee that Is consulted by the Commission In the exercise of

Its Implementing powers.

An annual report on the situation regarding the protection of personal data

In the Community and In third countries Is drawn up by the Working Party on

the Protection of Personal Data. The report Is transmitted to the

Commission.

CHAPTER X

Rule-making powers of the Commission

Articles 29 and 30

Exercise of rule-making powers

Advisory Committee

Article 29 confers on the Commission powers of execution In respect of the

technical Implementing measures that are necessary as a result of the

extent and technical nature of the personal data processing field.

Since the Directive Is designed to contribute to the completion of the

Internal market, Article 30 provides for the setting-up of an

Advisory Committee to assist the Commission In the exercise of Its

Implementing powers and applies the procedures laid down In the

Councl I Decision of 13 July 1987 laying down the procedures for the

exercise of Implementing powers conferred on the Commission.

                              - 44 

Proposal for a

COUNCIL DIRECTIVE

concerning the protection of individuals
In relation to the processing of personal data

THE COUNCIL OF THE EUROPEAN COMMUNITIES,

SYN 287

Having regard to the Treaty establishing the European Economic Community,

and In particular Articles 100a and 113 thereof,

Having regard to the proposal from the Commlsslon,1

In cooperation with the European Parllament,2

Having regard t~ the opinion of the Economic and Social Commlttee,3

(1) Whereas the obJectives of the Community, as laid down In the Treat~ as

amended by the Single European Act, Include establishing an ever closer

union among the peoples of Europe, fostering closer relations between the

States belonging to the Community, ensuring economic and social progress by

common action to eliminate the barriers which divide Europe, encouraging

the constant Improvement of the I lvlng conditions of Its peoples,

preserving and strengthening peace and liberty and promoting democracy on

the basis of the fundamental rights recognized In the constitutions and

laws of the Member States and In the European Convention for the Protection

of Human Rights and Fundamental Freedoms;

                                - 45 

(2) Whereas the establ lshment and the functioning of an Internal market In

which, In accordance with Article Sa of the Treaty, the free movement of

goods, persons~ services and capital Is ensured reQuire not only that

personal data should be able to flow freely, regardless of the Member States

.;n which they are processed or requested, but also that fundamental

rights should be safeguarded In view of the Increasingly frequent recourse

In the Community to the processing of personal data In the various spheres

of economic and social activity;

(3) Whereas the Internal market comprises an area without frontiers;

whereas, for that reason, the national authorities In the various

Member States are Increasingly being called upon, by virtue of the

operation of Community law, to collaborate and exchange personal data so as

to be able to perform their duties or carry out tasks on behalf of an

authority In another Member State;

(4) Whereas the Increase In scientific and technical cooperation and the

coordinated Introduction of new telecommunications networks In the

Community necessitate and facl I ltate cross-border flows of personal data;

(5) Whereas the difference In levels of protection of privacy In relation

to the processing of personal data afforded In the Member States may

prevent the transmission of such data from the territory of one Member

State to that of another Member State; whereas this difference may

therefore constitute an obstacle to the pursuit of a number of economic

activities at Community level, distort competition and Impede authorities

In the discharge of their responslbl I ltles under Community law~ whereas

this difference In levels of protection Is due to the existence of a wide

variety of national laws, regulations and administrative provisions;

(6) Whereas In order to remove the obstacles to flows of personal data,

the level of protection of privacy In relation to the processing of such

data must be eQuivalent In al I the Member States; whereas to that end lt Is

necessary to approximate the relevant laws;

                           - 46                           

(7) Whereas the object of the national laws on the processing of personal

data la to protect fundamental rights, notably the right to privacy which is

recognized both In Article 8 of the Convention for the Protection of Human

Rights and Fundamental Freedoms and In the general principles of Community

taw; whereas, for that reason, the approximation of those laws must not

result In any lessening of the protection they afford but must. on the

contrary, seek to ensure a high level of protection In the Community;

(8) Whereas the principles underlying the protection of privacy In relation

to the processing of personal data set forth In this Directive may be

supplemented or clarified, In particular as far as certain sectors are

concerned, by specific rules based on those principles;

(9) Whereas the protection principles must apply to all data flies where

the activities of the controller of the file are governed by Community law;

whereas public-sector flies which are not governed by COmmunity law should,

as Is provided for In the resolution of the representatives of the

Governments of the Member States of the European Communities meeting within

the council of ...,be subject to the same protection principles set forth

In national laws; whereas, however, data flies falling exclusively within

the confines of the exercise of a natural person's right to privacy, such

as personal address flies, must be excluded;

(10) Whereas any processing of personal data In the COmmunity should be

carried out In accordance with the law of the Member State In which the

data file la located so that Individuals are not deprived of the protection

to which they are entitled under this Directive; whereas, In this

connection, each part of a data file divided among several Member States

must- be. considered a separate data file and transfer to a non-member

country must not be a bar to such protection;

(11) Whereas any processing of personal data must .be lawful; whereas such

lawfulness must be based on the consent of the data subject or on Community

or nat Iona I I aw;

                    - 47 

(12) Whereas national laws may. under the conditions laid down In this

Directive, specify rules on the lawfulness of processing; whereas,

however, such a possibility cannot serve as a basis for supervision by a

Uember State other than the State In which the data file Is located, the

obligation on the part of the latter to ensure. In accordance with this

Directive, the protection of privacy In relation to the processing of

personal data being sufficient. under Community law, to permit the free

flow of data;

(13) Whereas the procedures of notification, In respect of public- or

private-sector data flies, and provision of Information at the time of

first communication, In respect of private-sector data flies, are designed

to ensure the transparency essential to the exercise by the data subject of

the right of access to data relating to him;

(14) Whereas the data subject must, If his consent Is to be valid and when

data relating to him are collected from him, be given accurate and full

Information;

(15) Whereas the data subject must be able to exercise the right of access

In order to verify the lawfulness of the processing of data relating to him

and their quality;

(16) Whereas, If data are to be processed, they must fulfil certain

requirements; whereas the processing of data which are capable by their

very nature of Infringing the right to privacy must be prohibited unless

the data subject gives hl·s explicit consent; whereas, however. on

Important publl~ Interest grounds, notably In relation to the medical

profession, derogatlons may be granted on the basis of a law laying down

precisely and strictly the conditions governing and limits to the

processing of this type of data;

(17) Whereas the protection of privacy In relation to personal data

requires that appropriate security measures be taken~ both at the level of

design and at that of the techniques of processing, to prevent any
unauthorized processing;

                                - 48 

(18) Whereas as regards the media the Member States may grant derogatlons

from the provisions of this Directive In so far as they are designed to

reconcl le the right to privacy with the freedom of Information and the

right to receive and Impart Information, as guaranteed, in particular, in Article

10 of the Convention for the Protection of Human Rights and Fundamental

Freedoms;

(19) Whereas the Member States must encourage the drawing-up, by the

business circles concerned, of European codes of conduct or professional

ethics relating to certain specific sectors; whereas the Commission wl 11

support such Initiatives and wi I I take them Into account when lt considers

the appropriateness of new, specific measures In respect of certain

sectors;

(20) Whereas, In the event of non-compl lance with this Directive, I labl llty

In any action for damages must rest with the controller of the fl le;

whereas dissuasive sanctions must be appl led In order to ensure effective

protection;

(21) Whereas lt Is also necessary that the transfer of personal data should

be able to take place with third countries having an adequate level of

protection; whereas, In the absence of such protection In third countries,

this Directive provides, In particular, for negotiation procedures with

those countries;

(22) Whereas the principles contained In this Directive sive sLbstance to and

ampl lfy those contained In the Councl I of Europe Convention of 28 January

1981 for the Protection of Individuals with regard to Automatic Processing

of Personal Data;

(23) Whereas the existence In each Member State of an Independent

supervisory authority Is an essential component of the protection of

Individuals In relation to the processing of personal data; wherea~ at

Community level, a Working Party on the Protection of Personal Data,

                              - 49

rust be set LP and re completely Independent In the performance of Its

functions; whereas having regard to Its specific nature lt must advise the

Commission and contribute to the uniform application of the national rules

adopted pursuant to this Directive;

(24) Whereas the adoption of additional measures for applying the

principles set forth In this Directive cal Is for the conferment of

rule-making powers on the Commission and the establ lshment of an Advisory

Committee In accordance with the procedures laid down In Councl I Decision

(1)
87 /373/EEC,

HAS ADOPTED THIS DIRECTIVE:

CHAPTER I

GENERAL PROVISIONS

Article 1

ObJect of the Directive

1. The Member States shal I ensure, In accordance with this Directive, the

protection of the privacy of Individuals In relation to the processing of

personal data contained In data fl les.

2. The Me~ber States shal I neither restrict nor prohibit the free flow of

personal data between Member States for reasons to do with the protection

afforded under paragraph 1.

(1) OJ No L 197, 18.7.1987, p. 33.

                              - 50                               

Article 2

Definitions

For the purposes of this Directive:

(a) "personal data" means any Information relating to an Identified or

Identifiable Individual ("data subject"); an Identifiable Individual

Is notably an Individual who can be ldent~fled by reference to an

Identification number or a slml lar Identifying particular~

(b) "depersonal lze" means modify personal data In such a way that the

Information they contain can no longer be associated with a specific in

diviciJ~l or an individual canable of being detenmined except at the price of an excessive effort

In terms of staff, expenditure and time;

(c) "personal data fl le" (fl le) means any set of personal data, whether

central lzed or geographically dispersed, undergoing automatic

processing or which, although not undergoing automatic processing, are

structured and accessible In an organized col lectlon according to

specific criteria In such a way as to facl lltate their use or

combination;

(d) "processing" means the fol lowlng operations, whether or not performed

by automated means: the recording, storage or combination of data, and

their alteration, use or communication, Including transmission,

~lssemlnatlon, retrieval, blocking and erasur~;

- (e) "cc:mtroller of the file" means the natural or legal person, public

authority~ agency or other body competent under Community law or the

national taw of a Member State to decide what wl I I be the purpose of

the file·, which categories of personal data wll r be stored, which

operations wl 11 be appl led to them and which third parties may have

access to them;

                                - 51                                 

(f) "supervisory authority" means the Independent publ le authority or

other Independent body designated by each Member State In accordance

with Article 26 of this Directive;

(g) "publ le sector" means al I the authorities. organizations and entitles

of a Member State that are governed by public law, with the exception

of those which carry on an Industrial or commercial activity, and

bodies and entitles governed by private law where they take part In

the exercise of official authority;

(h) "private sector" means any natural or legal person or association,

Including public-sector authorities, organizations and entitles In so

far as they carry on an Industrial or commercial activity.

Article 3

Scope

1.The Member States shal I apply this Directive to fl les In the publ le and

private sectors with the exception of flies In the publ le sector where the

activities of that sector do not fall within the scope of Community law.

2. This Directive shall not apply to fl les held by:

(a) an Individual solely for private and personal purposes; or

(b) non-profit-making bodies, notably_ of a political, philosophical,

rel1glous. c~lturaf, trade-union, sporting or l~lsure nature, as part

of their legitimate alms, on condition that they' relate only to those

members and corresponding members who have consented to being Included

therein and that they are not communicated to third parties.

                   - 52 

Article _4_

Law applicable

1. Each Member State shall apply this Directive to:

(a) all flies located In Its territory;

(b) the controller of a file resident In Its territory who uses from Ita

territory a file located In a third country whose law does not provide

an adequate level of protection, unless such use Is only sporadic.

2. Each Member State shall apply Articles 5, 6, 8, 9, 10, 17, 18 and 21 of

this Directive to a user consulting a file located In a third country from

a terminal located In the territory of a Member State, unless such use la

only sporadic.

3. Where a file Is moved temporarily from one Member State to

- another, the latter shall place no obstacle In the way and shall not

require the completion of any formalities over and above those applicable

In the Member State In which the file Is normally located.

                          - 53                          

CHAPTER 11

LAWFULNESS OF PROCESSING IN THE PUBLIC SECTOR

Article 5

Principles

1. SubJect to Article 6, the Member States shall, with respect to flies

In the public sector, provide In their law that:

<a> the creation of a file and any other processing of personal data shall

be lawful In so far as they are necessary for the performance of the

tasks of the public authority In control of the file;

(b) -the processing of data for a purpose other than that for which the

file was created shall be lawful If:

      - the data subJect consents thereto; or

lt Is effected on the basis of Community law, or of a law, or a

measure taken pursuant to a law, of a Member State conforming

with this Directive which authorizes lt and defines the limits

thereto; or

      - the legitimate Interests of the data subject do not preclude
such change of purpose; or

lt Is necessary In order to ward off an Imminent threat to

public order or a serious Infringement of the rights of others.

Article 8

Processing In the public sector having as Its obJect

persona I data 

1. The Member States shall provide In their law that the communication of

personal data contained In the flies of a public-sector entity shall

be lawful only If:

-·54

(a) lt Is necessary for the performance of the tasks of the public-sector

entity communicating or requesting communication of the data; or

(b) lt Is requested by a natural or legal person In the private sector who

Invokes a legitimate Interest, on condition that the Interest of the

data subject does not prevail.

2. Without prejudice to paragraph 1, the Member States may specify the

conditions under which the communication of personal data Is lawful.

3. The Member States shall provide In their law that, In the

circumstances referred to In paragraph 1(b), the controller of the

file shall Inform data subjects of the communication of personal data.

The Member States may provide for the replacing of such provision of

Information by prior authorization by the supervisory authority.

Article 7

Obligation to notify the supervisory authorltl

1. The Member States shall provide In their law that the creation of l

public-sector file the personal data In which might be communicated

shall be notified In advance to the supervisory authority and recorded

In a register kept by that authority. The register shall be freely

available for consultation.

2. The Member States shall specify the Information which must be notified

to the supervisory authority. That Information shall Include at least

the name and address of the controller of the. file, the purpose of the

file, a description of the types of data lt contains, the third

parties to whom the data might be communicated and a description of

the measures taken pursuant to Article 18.

3. The Member States may provide that paragraphs 1 and 2 shall apply to

other public-sector fl les and that consultation of the register may be

restricted for the reasons stated In Article 15(1).

                              - 55                              

CHAPTER Ill

LAWFULNESS OF PROCESSING IN THE PRIVATE SECTOR

Article 8

Principles

1. The Member States shall provide In their law that, without the consent

of the data subject, the recording In a file and any other processing

of personal data shall be lawful only If lt la effected In accordance

with this Directive and If:

<a> the processing. is carr led out under a contract, or In the context of a

CJ,SSi-caltractual relationship of trust, with the data subject and Is

necessary for      - . its d lscharge: or

Cb> the data cane fran sources genera I I y access I b le to the pub I I c and

their processing is Intended solely for correspondence purposes: or

Cc> the-ccntroller of the file Is pursuing a legitimate Interest, on

ca'lditicn that the Interest of the data subject does not preva 11.

2. The Member States shall provide In their law that lt shall be for the
controller of the file to ensure that no communication le Incompatible
with the purpose of the file or Is contrary to public policy. In the

event of on-line consultation, the s ... obligations shall be Incumbent

on the user.

3. Without prejudice to paragraph 1, the Member States may specify the

conditions under which the processing of personal data Is lawful.·

                    - 56 

Article 9

Obligation to lnfor• the data subJect

1. The Member States shall, with respect to the private sector, provide

In their law that at the time of first communication or of the

affording of an opportunity for on-line consultation the controller of

the file shall Inform the data subject accordingly, Indicating also

the purpose of the file, the types of data stored therein and his name

and address.

2. The provision of Information under paragraph 1 shall not be mandatory

In the circumstances referred to In Article 8(1)(b). There shall be

no obligation to Inform where communication la required by law.

3. If the data subject objects to communication or any other processing,

the controller of the file shall cease the processing obJected to

unless he Is authorized by law to carry lt out.

Article 10

Special exceptions to the obligation to Inform the data subJect

If the provision of Information to the data subject provided for In Article

9(1) proves Impossible or Involves a disproportionate effort, or comes up

aga 1 nst the overriding legitimate Interests of the contro 11 er of the f I I e or a

similar Interest of a third party, the Member States may provide In their

law that the supervisory authority may authorize a derogation.

-~

Article 11

Obligation to notify the supervisory authority

1. The Member States shall provide In their law that the controller of

the file shall notify the creation of a personal data file where the

data are Intended to be communicated and do not come from sources

generally accessible to the public. The notification shall be made to

the supervisory authority of the Member State In which the file Is

located or, If lt Is not located In a Member State, to the supervisory

authority of the Member State In which the controller of the file

resides. The controller of the file shall notify to the competent

national authorities any change In the purpose of the file or any

change in his address.

2. The Member States shall specify the Information which must be notified

to the supervisory authority. That Information shall Include at least

the name and address of the controller of the file, the purpose of the

file, a description of the types of data lt contains, the third

parties to whom the data might be communicated and a description of

the measures taken pursuant to Article 18.

3. The Member States may provide that paragraphs 1 and 2 shall apply to

other private-sector flies and that the Information referred to In

paragraph 2 shall be accessible to the public.

-58                

CHAPTER IV

RIGHTS OF DATA SUBJECTS

Article 12

lnforMd consent

Any giving of consent by a data subject to the processing of personal data

relating to him within the meaning of this Directive shall be valid only

If:

(a) the data subject Is supplied with the following Information:

the purposes of the file and the types of data stored;

the type of use and. where appropriate, the recipients of the

personal data contained In the file:

the name and address of the controller of the file;

(b) lt Is specific and express and specifies the types of data, forms of

processing and potential recipients covered by lt;

(c) lt may be withdrawn by the data subject at any time without

retroactive effect.

Article 13

Provision of Information at the time of collection

1. The Member States shall guarantee Individuals from whom personal data

are collected the r lght to be Informed. at least about:

(a) the purposes of the file for which the lnfor~atlon Is Intended;

(b) the obligatory or voluntary nature of their reply to the questions to

which answers are sought;

(c) the consequences If they fall to reply;

(d) the recipients of the Information;

(e) the existence of the right of access to and rectification of the data

relating to them; and

(f). the name and address of the controller of the file.

-59                 

2. Paragraph 1 shal I not apply to the collection of Information where to

Inform the data subject would prevent the exercise of the supervision

and verification functions of a public authority or the maintenance of

pub 11 c order.

Article 14

Additional rights of data subJects

The Member States shall grant a data subject the following rights:

1. To oppose. for legitimate reasons, the processing of personal data

relating to him.

2. Not to be subject to an administrative or private decision Involving

an assessment of his conduct which has as Its sole basis the automatic

processing of personal data defining his profile or personality.

3. To know of the existence of a file and to know Its main purposes and

the Identity and habitual residence, headQuarters or place of business

of the controller of the fl le.

_4._ To obtain at reasonable Intervals and without excessive delay or

expense confirmation of whether personal data relating to him are

stored In a file and communication to him of such data In an

lntell lglble form.

TI)e· f,4pr.hcr State~ may provide that the right of access to medical data may be exercised cr~ly thrc

a doctor.

5. To obtain. as the case may be, rectification, erasure or blocking of

such data If they have been processed In violation of the provisions

of this Directive.

                            - 60

6. To obtain uoon reau~3t and fr~e of charge the erasure of data relating

to him h~ld In fl~o~ used far market rese~rch or advertising purposes.

7. To obtain~ !n the ovent cf the applleatlon of paragraph 5 and If the

dnta h~ve bA~r. ccmmur.lcated to third parties, notification to the

latter of the r8ctlflcatlon, orasure or blocking.

8. To hav~ a Judicial remedy If tha rights guaranteed In this Article are

!nfrlnqed4

Artlcl" 15

Exceetlonft to tha data subJr.u:tta right of acce_ss to p!!bllc-sector flies

1. Th~ Memb~r States may limit by statute the rights provided for In

points 3 and 4 of Article 14 for reasons relating to:

(a} national $ecurlty,

(b) dBfflli"'CA,

(c) crlmln~l proceedings,

(d) oubllc aafety,

(e) a dt~ly e~tahlished· paramount economic and financial Interest of a

~ember State or of the European Communities,

(f) th~ ne~d for the nubile authorities to perform monitoring or

lnsp~ctlon functlor.s, er

(g) en eQuivalent right of another Individual and the rights and freedoms

of others.

2. In the circumstances referred to In paragraph 1, the supervisory

~uthorlty shall be empowered to carry outR at the request of the data

subJect, the nec~ssary checks on the file.

3. The u~mber States may place limits on the data subject's right of

access to data ccmpllod temporarily for the purpose of extracting

statistical Information thArefr~~.

               - M 

CHAPTER V

DATA QUALITY

Article 1S

1. The Member States shall provide that personal data shall be:

(a) collected and processed fairly and lawfully;

(b) stored for specified, explicit and lawful purposes and used In a way

compatible with those purposes;

(c) adequate, relevant and not excessive In relation to the purposes for

which they are stored;

(d) accurate and, If necessary, kept up to date; Inaccurate or Incomplete

data shall be erased or rectified;

(e) kept In a form which permits Identification of the data subjects for

no longer than Is necessary for the purpose for which the data are

stored.

2. lt shall be for the controller of the file to ensure that paragraph 1

Is complied with.

-~

Article 17

Special categories of data

1. The Member States shall prohibit the automatic processing of data revealing

ethnic or racial origin, political opinions,·religious or philosophtcal

beliefs or trade~union·membership, and.of data concerning health or sexual

   - Life, without the express and·written consent, freely given, of the data

subject.

2. The Member States may, on Important public Interest grounds, grant

derogatlons from paragraph 1 on the basis of a law specifying the

types of data which may be stored and the persons who may have access

to the file and providing suitable safeguards against abuse and

unauthorized access.

3. Data concerning criminal convictions shall be held only In public
sector flies.

Article 18

Data security

1. The Member States shall provide In their law that the controller of a

file shall take appropriate technical and organizational measures to

protect personal data stored In the file against accidental or

unauthorized destruction or accidental loss and against unauthorized

access, modification or other processing.

                            - 6-3

such measures sha I I ensure, In respect of automated f 1 lea~ an

appropriate level of security having regard to the state of the art In

this field, the cost of taking the measures, the nature of the data to

be protected and the assessment of the potential risks. To that end,

the controller of the file shall take Into consideration any

recommendations on data security and network lnteroperablllty

formulated by the Commission In accordance with the procedure provided

for In Article 29.

2. Methods guaranteeing adequate security shall be chosen for the

transmission of personal data In a network.

3. In the event of on-line consultation, the hardware and software shall

be designed In such a way that the consultation takes place within the

limits of the authorization granted by the controller of the file.

_4._ - The obllgat Ions referred to In paragraphs 1, 2 and 3 shall - also be

Incumbent on persons who, either de facto or by contract, control the

operations relating to a file.

5. Any person who In the course of his work has access to Information

contained In flies shall not communicate lt to third parties without

the agreement of the controller of the file.

CHAPTER VI

PROVISIONS SPECIFICALLY RELATING TO CERTAIN SECTORS

Article 19

The Member States may grant 1 In respect of the press and the audiovisual

medla,derogatlons from the provisions of this Directive In so far as they

are necessary to reconcile the right to privacy with the rules governing

freedom of Information and of the press.

                            - 64 

Article 20

The Member States shall encourage the business circles concerned to

participate In drawing up European codes of conduct or professional ethics

In respect of certain sectors on the basis of the principles set forth In

this Directive.

CHAPTER VII

LIABILITY AND SANCTIONS

Article 21

Liability

1. The Member States shall provide In their law that any Individual whose

personal data have been stored In a file and who suffers damage as a

result of processing or of any act Incompatible with this Directive

shall be entitled to compensation from the controller of the file.

2. The Member States may provide that the controller of the file shall

not be liable for any damage resulting from the loss or destruction of

data or from unauthorized access If he proves that he has taken

appropriate measures to fulfil the requirements of Articles 18 and 22.

Article 22

Processing on behalf of the controller of the file

1. The Member States shall provide In their law that the controller of

the file must. where processing la carried out on his behalf. ensure

that the necessary security and organizational measures are taken and

choose a person or enterprise who provides sufficient guarantees In

that respect.

-65                 

2. Any person who collects or processes personal data on behalf of the

controller of the file shall fulfil the obligations provided for In

Articles 16 and 18 of this Directive.

3. The contract shall be In writing and shall stipulate, In particular,

that the personal data may be divulged by the person providing the

service or his employees only with the agreement of the controller of

the f 11 e.

Article 23

Sanctions

Each Member State shall make provision In Its law for the application of

dissuasive sanctions In order to ensure compliance with the measures taken

pursuant to this Directive.

CHAPTER V I I I

TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

Article 24

Principles

1. The Member States shall provide In their law that the transfer to a

third country, whether temparary or permanent, of. personal data which

are undergoing processing or which have been gathered with a view to

processing may take place only If that country ensures an adequate

level of protection.

2. The Member States shall Inform the Commission of cases In which an

Importing third country does not ensure an adequate level of

protection.

                             -                             6{S

3. Where the Commission finds, either on the basis of Information

supplied by Member States or on the basis of other Information, that a

third country does not have an adequate level of protection and that

the resulting situation Is likely to harm the Interests of the

Community or of a Member State, lt may enter Into negotiations with a

view to remedying the situation.

4. The COmmission may decide. In accordance with the procedure laid down

In Article 30(2) of this Directive, that a third country ensures an

adequate level of protection by reason of the International.

commitments lt has entered Into or of Its domestic law.

5. Measures taken pursuant to this Article shall be In keeping with the

obligations Incumbent on the COmmunity by virtue of International

agreements, both bilateral and multilateral, governing the protection

of Individuals In relation to the automatic processing of personal

data.

Article 25

Deroqat Ion

1. A Member State may derogate from Article 24(1) In respect of a given

export on submission by the cot:'troller of the file of sufficient proof

that an adequate level of protection will be provided. The

Member State may grant a derogation only after lt has Informed the

Commission and the Member States thereof ~nd In the absence of notice

of opposition given by a Member State or the COmmission within a

pe~lod.of ten days.

2. Where notice of opposition Is given, the commission shall adopt

appr·oprlate measures In accordance with the   - procedure laid down In

Article 30(2).

                   - 67 

CHAPTER IX

SUPERVISORY AUTHORITIES AND WORKING PARTY ON THE PROTECTION OF PERSONAL

DATA

Article 26

SUpervisory authoritY

1. The Member States shall ensure that an Independent competent authority

supervises the protection of personal data. The authority shall

monitor the application of the national measures taken pursuant to

this Directive and perform all the functions that are entrusted to lt

by this Directive.

2. The authority shall have Investigative powers and effective powers of

Intervention against the creation and exploitation of flies which do

not conform with this Dlrectfve. To that end, lt shall have, Inter

alia, the right of access to flies covered by this Directive and shall

be given the power- to gather all the Information necessary for the

performance of Its supervisory duties.

3. Complaints In connection with the protection of Individuals In

relation to personal data may be lodged with the authority by any

Individual.

Article 27·

WOrking Party on the Protection of Personal Data

1. A working Party on the Protection of Personal Data Is hereby set up.

The Working Party, which shall have advisory status and shall act

Independently, shall be composed of representatives of the supervisory

authorities provided for In Article 28 of all the Member States and

shall be chaired by a representative of the COmmission.

-68                

2. The secretariat of the Working Party on the Protection of Personal

Data shall be provided by the Commission's departments.

3. The Working Party on the Protection of Personal Data shall adopt Its

own rules of procedure.

4. The Working Party on the Protection of Personal Data shall examine

questions placed on the agenda by Its chairman, either on his own

Initiative or at the reasoned request of a representative of the

supervisory authorities, concerning the application of the provisions

of Community law on the protection-of personal data.

Article 28

Tasks of the WOrking Party on the Protection of Personal Data

1. The Working Party on the Protection of Personal Data shall:

(a) contribute to the uniform application of the national rules

adopted pursuant to this Directive;

(b) give an opinion on the level of protection In the Community and

In third countries;

(c) advise the Commission on any draft additional or specific

measures to be taken to safeguard the protection of privacy.

2. If the Working Party on the Protection of Personal Data finds that

significant divergences are arising between the laws or practices of

the Member States In relation to the protection of personal data which

_might affec~ the equivalence of protection In the COmmunity, lt shall

Inform the Commission accordingly.

3. The Working Party on the Protection of Personal ~ata may formulate

recommendations on any questions concerning the protection of

lndlvlduals In relation to personal data In the Community. The

recommendations shall be recorded In the minutes and may be

transmitted to the Advisory COmmittee referred to In Article 30. The

Commission shall Inform the Working Party on the Protection of

Personal Data of the action lt has taken In response to the

recommendations.

-69                 

4. The Working Party on the Protection of Personal Data shall draw up an

annual report on the situation regarding the protection of Individuals

In relation to the processing of personal data In the COmmunity and In

third countries, which lt shall transmit to the commission.

. CHAPTER X

RULE-MAKING POWERS OF THE COMMISSION

Article 29

Exercise of rule-maklna powers

The Commission shall, In accordance with the procedure laid down In Article

30(2), adopt such technical measures as are necessary to apply this

Directive to the specific characteristics of certain sectors having regard

to the state of the art In this field and to the codes of conduct.

Article 30

Advisory eo.Mittee

1. The Commission shall be assisted by a committee of an advisory nature com
posed of the representatives of the Member States and-chaired by a repre
sentative of the Commission.

2. The representative of the Commission shall submit·to the committee a draft of

the measures to be taken. The ~lttee shall deliver Ita opinion on

the draft within a time limit which the chairman·may lay down according to

the urgency of the matter, if. necessary by tak-ing

a vote. The opinion shall be recorded In the      - lnutea; in addition,

each Member State shall have the right to ask to trave its position recorded in

the minutes. The Commission shall take the utmost account of the

opinion delivered by the c.ommlttee. lt shall Inform the c.onnlttee of

the manner In which _Its_ opinion has been taken _Into_ account.

                             - 70 

FINAL PROVISIONS

Article 31

1. The Member States shall bring Into force the laws, regulations and

administrative provisions necessary for them to comply with this

Directive by 1 January 1993.

The provisions adopted pursuant to the first subparagraph shall make

express reference to this Directive.

2. The Member States shall communicate to the Commission the texts of the

provisions of national law which they adopt In the field covered by

this Directive.

Article 32

The Commission shall .report to the Council and the European Parliament at

regular Intervals on the Implementation of this Directive, attaching to Its

report, If necessary, suitable proposals for amendments.

Article 33

This Directive Is addressed to the Member States.

Done at Brussels, For the Council

                             - 71                              

PROPOSITION DE DIRECTIVE DU OONSEIL
VISANT AU RAPPROCHEMENT DE CERTAINES DISPOSITIONS

LEGISLATIVES. REGLEWENTAIRES ET ADMINISTRATIVES

DES ETATS MEUBRES
RELATIVES A LA PROTECTION DES PERSONNES

A L • EGARD DU TRA I TEYENT DES DONNEES

A CARACTERE PERSONNEL

1. Llgne budg6talre concern6e (6ventuellement l cr6er) :

A 2511 : Frals de reunions de comlt6s dont la consultation n'est pas un

~16ment obllgatolre de la proe6dure de formation d'actes communautalres.

2. Base ''sale (ou autre>

Article 100 A

3. Proposition de classification en d6pense obllgatolre/non obltgatotre

<avec Justification succlncte en vertu de la declaration commune du 30
Juln 1982) :
non-ob llgato 1 re

4. Description et Justification de l'actlon

4.1. ObJectlfs:- assurer la protection des personnes l 1'6gard des
donn6es i caract~re personnel,
              - permettre la circulation transfrontl,re de donnees l

caract~re personnel dans la Communaut6,
              - permettre le bon fonctlonnement du march6 lnt6rleur.

4.2. Cr6atlon de 2 comites competents en matl,re de protection des

personnes l 1'6gard des donnees l caract•re personnel (Art. 27,30)

personnes concern6es : 1. Pour le Comlte de protection des donnees l

caract,re personnel (Art. 27) :

represe~tants de l'autorlt6 de contr&le de
tous les Etats membres (groupe 4)

2. Pour 1 e _COrn_ 1 t6 consu I tat If (Art. 30.)

representant& des Eta~s membres (groupe 3)

4.3. Un repr6sentant de la Commission pr6slde le Comlt6 de protection

des donn6es i caract,re personnel et le Comlt6 consultatlf.
Le secretariat du Comlt6 de protection des donn6es l caract,re
personnel est assure par les services de la Comm~sslon.

-72 

5. Nature de la d6pense et mode de calcul

5.1. Nature : r6unlons

(frals de participation des membres des 2 Comlt6a)

5.2. Calcul

- Comlt6 de protection des donn6es :
24 membrea (non-gouvernementals) x 3 r6unlons
a 2 jours x 1180 ECU (590 ECU/jour) • 84.960 ECU*

- Comlt6 consultatlf :

24 membres (gouvernemental) x 1 r6unlon a 2 ·Jours x
780 ECU (390 ECU/Jour>  - 18.720 ecu•

e. Incidence flnancl~re de l'actlon sur les cr6dlts d'lnterventlon

6.1. Ech6ancler des cr6dlts d'engagement et de paiement

CE-CP

1993 103.880 ECU
1994 " H

1995 H "
1996 " "
1997 " "

6.2. Part du flnancement communautalre dans le coQt total 1001

7. Observations

1. Le Comlt6 de protection des donn6es 6 caract6re personnel (Art. 27)

11 est lnstltu6 ce Comlt6 6 caract6re consultatlf et lnd6pendant et
est compos6 de repr6sentants de l'autorlt6 de contrble de tout lea
Etats membres, pr6sld6 par un repr6sentant de la Commission.

Ce Comlt6 6tabllt son r6glement lnt6rleur. Le secr6tarlat du Comlt6
est assur6 par lea services de la Commission.

Missions de ce Comlt6 : voir Art.28.

2. Le Comlt6 consultatlf (Art.30) :

11 est lnatltu6 un Comlt6 consultatlf compos6 des repr6sentants des
Etats membres, pr6sld6 par le repr6sentant de la Commission.

La Commission est asslst6e par ce Comlt6 afln de prendre lea
6ventuelles mesures compl6mentalres n6cessalres pour adapter les
dispositions de la directive aux sp6clflclt6s    - de certalnes secteurs.

~~*~~ estimation

...

...                                                - 72a 

                  

FICHE D'INPACT SUR LA CONPETITIVITE ET L'EYPLOI

1. Quelle oat la Juatlflcatlon prlnclpale de la .. sure?

-· Aaauror la protection d•a poraonnea i l',gard des donn6es i caract•r•
per aQnne I •

 - Parmettre la circulation transfrontlire de donn6es i caract•re personnel
dana la Communaut6.

 - Permettre le bon fonct lonnament du - arch6 lnt6r leur·.

11. caract6rlatiQUea dea entreDrlaes concern6es.

La proposition concerne toutea lea entreprlaea qui utlllaent des flchlers
de donn••• i caract•r• personnel quel que aolt leur taille ou leur aecteur
d'actlvlt,.

Ill. Quellea eont lea obligations l~s6ea dlrect ... nt au1 entreprlaea?

Se confor .. r au1 dlapoaltlona appllcablea aux traltementa de donn6ea l
caract•r• peraonnel, notamment celles relatives i la 16gltlmlt6 de ces
traltemente dana le 1ecteur prlv6.

IV. Quellea eont lea obllgatlona ausceptlblea d•&tre l~a6ea lndlrecteMent
au1 entreprlaea via lea autorlt6a localea ?

Aucune.

V. Y a-t-11 dea - aurea ap6clalea pour lea PUE '

Non.

                             - 72b 

VI. Quel eat l'effet pr6vlalble?

a) eur la oa.p6tltlvlt6 del entreprlae• ?

#### .., ......

~.Ji

..  - .. J

~ .. :

.. 

. . .

..... ~
.• J;

... - .~

  - .·:;!

:·.'t'
.· -~'
Le1 r6glel de protectlon.e•appllquent i toutea lea entreprlaes et - ·.··.,'.
611•1neront lea dlatoralona de concurrence ddea i I 'actuelle - --- ··- - . - .:~: - ••• f

 - ·.··.,'.

611•1neront lea dlatoralona de concurrence ddea i I 'actuelle - --- ··- - . - .:~: - ••• f

dleparlt6 dea 16glalatlona natlonalea. En ce qui concerne le~r ~ _.•_ _:t-:_
COIIP6tltlvlt6 lnternatlonale, ta directive pr6volt dea n6go.clatlona·
avec lea paya tlera QUI n•aeaurent paa encore un nlveau de . .- ; ... protect Ion ad6quat. - - - - · - · 

_.•_ _:t-:_

...
.. :~

 - . ~

... ~

b) eur 1'.-plol 7

La direct lve pr6vol t la cr6at Ion d' lnatancea de contr&l.e.

0                                                                                                                                                                                                                                                                                                              -                                                                                                                                                                                                                                                                                                              - .                                                                                                                                                                                                                                                                                                              
- nat Iona lea. - · .. . .. - .· .......... .

- • ~. 1

.;

..

. :.~

.· j
.  - ·:·i

. '.! t
#### . . .~,:

_I_ _...._     - ~ ~:;

.....

   - ',1

_•:-··_

.   -,.:

    - .,.

#### VII. L•• ·partWiree • t • aoclaux ont-111 6t6 cOn.a1t6a aur cette • I propc),lt J .. 1~,-:1· .,. ·. ...

. ' 'w

###### . . . . . . .. . . ~

         - . .
....,  - · ... ':.·

. .
. . . . ~ '·

~ . . . ~ _·.:_ .

. f

Non.

                   - 73 

Draft
RESOLUTION OF THE REPRESENTATIVES OF THE GOVERNMENTS OF THE MEMBER

STATES OF THE EUROPEAN COMMUNITIES MEETING WITHIN THE COUNCIL

THE REPRESENTATIVES OF THE GOVERNMENTS OF THE MEMBER STATES OF THE EUROPEAN

CO~UNITIES MEETING WITHIN THE COUNCIL,

Whereas the Council Directive concerning -the protection of

Individuals In relation to the processing of personal data ensures the

protection of the privacy of Individuals In relation to the processing of

personal data contained In data flies In the private and public sectors,

with the exception of flies In those parte of the public sector which do

not fall within the scope of Community law,

Desirous to facilitate cooperation between the administrations of the

Member States In sectors not falling within the scope of Community law

while affording a high level of protection for the privacy of the persona

affected,

Whereas the principles contained In the Directive give substance to.and amplify

those contained In the Council of Europe COnvention of 28 January 1981 for

the Protection of Individuals with regard to Automatic Processing of

Personal Data,

HEREBY ADOPT THIS RESOLUTION:

The Governments of the Member 5tates undertake to :a·pply the
P r in c i P le s contained i n the C o u n c i l D i re c t i v _t:_ . c o ~ c ern·; n g the
protection of Individuals In relation to the processing of personal data to

those parts of the public sector which do not fall within the scope of

Community law and to set In motion the necessary legislative procedures.

                                - 74                                 

Com.laalon Daclaratlon on the application to the lnatltutlone and other

bodies of the European Communities of the principles contained In the

Council Directive concerning the protection of individuals in relation to

the processing of personal data

1. The Commission considers that the principles contained in the

Directive concerning the protection of individuals in

relation to the procesalng of personal data (Mthe Directive") muat

apply to the Institutions and other bodies of the European communities.

2. To that end, the Commission will, at the earlleat opportunity, take and

p~opose the necessary measures.

3. Pending the taking of such measures. the Commission undertakea to apply

the prlnclplea contained In the Directive to the procesalng of peraonal

data for which lt la responsible.

_4._ The Commission considers that the other institutions of the

Communities must also undertake to apply the prlnclplea contained In the

Directive to the processing of personal data for which they are

responsible.

      - 75 

PROPOSAL FOR A

COUNCIL DIRECfiVE

SYN 288

CONCERNING THE PROTECTION OF PERSONAL DATA AND PRIVACY IN THE

CONTEXT OF PUBLIC llfGITAL TELECOMMUNICATIONS NETWORKS,

IN PARTICULAR THE INTEGRATED SERVICES DIGITAL NETWORK (ISDN) AND

PUBLIC DIGITAL MOBILE NETWORKS

                  - 76 

CONTENTS

A SUMMARY .................................................................................................................... .

B EXPlANATORY MEMORANDUM ....................................................................... 0

I. Introduction .................................................................................................................... 0

IT. The new specific requirements with regard to the

protection of personal data and privacy in the

telecommunications sector ........................................................................................... .

m. The approach proposed: the provisions of the

0

draft Directive ...............................................................................................................

IV. Conclusions ................................................................................................................... 0

0 PROPOSAL FOR A COUNCIL DIRECfiVE CONCERNING THE PROTECI10N OF

PERSONAL DATA AND PRIVACY IN TilE CONTEXT OF PUBLIC DIGITAL

TELECOMMUNICATIONS NETWORKS, IN PARTICUi.AR TilE INTEGRATED

SERVICES DIGITAL NETWORK(ISDN) AND PUBLIC DIGITAL MOBILE

NETWORKS

                      - 77                      

A. SUMMARY

The introduction of public digital telecommunications networks is now fully under-way in

the Community. During the early years of this decade more than 70 % of long distance

transmission, more than 50 % of long distance switching and more than 30 % of local

switching will be digitalised.

The wide-spread introduction of public digital telecommunications networks in the

Community will allow, in particular with the implementation of the Integrated Services

Digital Network (ISDN) and the new digital mobile services, vastly enhanced

telecommunications functions for the general public, but at the same time, will require a

Community-wide common approach for the protection of privacy, personal data and data

security with regard to the specific requirements of the new digital telecommunications

environment.

The Council and the European Parliament have recognised repeatedly the central role of

adequate measures concerning data protection and protection of privacy for the future

development of telecommunications in the European Community. In particular, in its

resolutions of 14 December 1988 on telecommunications, the European Parliament called

for specific measures "to ensure data privacy protection and confidentiality" and reminded

the Commission "of its political responsibility for ensuring that legislative proposals on

opening up telecommunications markets, in the appropriate legal form, are accompanied

by action at Community level relating to the protection of personal data".

In the Community, there is growing attention paid to the impact of digital networks on the

protection of personal data and privacy. In a resolution adopted at Berlin in August 1989,

the data protection commissioners of the Member States called for special attention with

regard to protection of personal data and privacy in the context of ISDN.

The enclosed proposal is intended to meet these specific requ~ements with regard to the

protection of personal data and privacy in the field of the new public digital

telecommunications networks. It is presented in the context of - and complementary to 

the proposals by the Commission for the establishment of a general framework for data

protection in the Community.

Effective protection of personal data and privacy is developing into an essential pre

                    - 78                     

condition for social acceptance of the new digital networks and services. It must be an

essential component of the Community's telecommunications policy which aims at securing

for the European citizen the full benefits of advanced telecommunications services, as the

Community moves towards an environment which will be substantially richer in

information than before.

The enclosed proposal for a Council Directive has been drafted with this global objective in

mind.

                 - 79 

B. EXPLANATORY MEMORANDUM

I. INTRODUCTION

The current wide-spread introduction of public digital telecommunications in
the Community, in particular the implementation of the Integrated Services
Digital Network (ISDN) [1 ] and new djgital mobile servicesl will allow vastly
enhanced telecommunications functions for the general public, but at the same
time, will require a Europe-wid~ common approach for the protection of
privacy, personal data and data security with regard to the specific requirements
of the new digital telecommunications environment.

In its Resolution on the coordinated introduction of the Integrated Services
Digital Network jn the European Community of 12 December 19863, the
European Parliament stated that the "prospective Integrated Services Digital
Network (ISDN), evolving from the telephone network, will offer many
additional services to corporate and private subscribers ... " but called on the
Commission "to submit proposals on a practical approach towards ensuring
within the ISDN now emerging throughout Europe, a consistent level of dataprivacy protection commensurate with the enhanced technical capabilities of
this new network". The European Parliament emphasised this concern further
in a more general r..ontext in its resolutions of 14 December 1988 [4], where it
called for specific measures with regard to the use of telecommunications
networks "to ensure dataMprivacy protection and confidentiality" and reminded
the Commission "of its political re..~ponsibility for ensuring that legislative
proposals on opening up telecommunications markets, in the appropriate legal
form, are accompanied by action at Community level relating to the protection
of personal data ... ".

1 Council Recommendation of 22 December 1986 on the coordinated Introduction of the Integrated Service
Digital Network (ISDN) in the European Community (86/659/EEC).

The ISDN can be considered as a natural evolution of the telephone network. lt will allow via a single acce

using the existing subscriber line, the transmission of voice (telephony), text, data, and Images in the form
multitude of more efficient or new services (for details see CouncA Recommendation 86/659/EEC and
chapter 11.).

   - In accordance with the Council Recommendation, two progress reports on the implementation of ISDN w•

submitted up to now by the Commission (COM(88) 589; COM(90) 123).

2

3

4

Council Recommendation of 25 June 1987 on the coordinated introduction of public pan-European cellula
digital land-based mobite communications in the Community (87 /371 /EEC, OJ N>~ 196, 1? July ~ 98 [7 ] - P·
and Council Directive of 25 June 1987 on the frequency bands to be. reserved for the coordinated mtroduc
of public pan-EuropP,an cellular digital land-based mobile communications in the Comm~nity (87 /3?2/~~c
OJ f\b L196, 17 July 1987, p. 85), and subsequent proposals by the Commission in the f1eld of public dtgtt
mobile communications.

Resolution on Council Recommendation 85/659/EEC, QJ l'bC7, 12 January 1987, P· 334.

Resolution on Posts and Telecommunications, QJ f\bC12, 16 January 1989, p. 69; resolution on the neec
overcome the fragmentation in telecommunications, OJ N:> c 12, 16 January 1989, P· 66.

                     - 80                      

The Council in its resolution of 30 June 1988', by which it adopted the
principles of the Green Paper on the development of the common market for
telecommunications setvices and equipment' and gave its general support to the
objectives of the action programme set out in the communication of9 February
1988 [7 ] defmed as one of the major policy goals "to protect personal data and to
provide for the individual's access, through the communication media, to an
environment significantly richer in information than before".

In its resolution on the strengthening of the coordination for the introduction of
the Integrated Setvices Digital Network (ISDN) in the European Community
up to 1992 [8], the Council specified its concern further with regard to the ISDN
by emphasising as necessary "further discussion at European level regarding
user privacy protection requirements and requirements concerning the security
of communications in the context of features of new setvices, in accordance with
the resolution of the European Parliament of 12 December 1986 on
recommendation 86/659 /EEC".

The representatives of the authorities responsible for data protection in the
Member States adopted at their 11th international conference on 28-31 August
1989 in Berlin a resolution calling for special attention with regard to the
protection of data and privacy in the context of the ISDN.

With the enclosed proposal the Commission is responding to this requirement
for specific Community-wide measures concerning the protection of personal
data and privacy in the context of the implementation of the new public digital
telecommunications networks, in particular the Integrated Setvices Digital
Network and the public digital mobile networks. It takes account of the fact
that there is deep - and justified - concern concerning the immediate impact
of digital networks on the protection of personal data and privacy. The
Commission has also recognised data protection and protection of privacy as an
essential requirement in the context of the future development of an open
network environment in the Community'.

_5_
. CouncU Resolution of 30 June 1988 on the development of the common market for telecommunications

services and equipment up to 1992 (0Jr.t>C257, p. 1). .

6

7

8

_9_

COM(87) 290.

Towards a competitive Community-wide telecommunications market In 1992: Implementing the Green Par
on the development of the common market for telecommunications services and equipment. State of
discussions and proposals by the Commission (COM(88) 48).

OJ NoC196,.. - 1 August 1989, p. 4.

Comn:-on position adopted by the CouncU on 5th February 1990. with a view to adopting a Directive on the
establishment of the internal market for telecommunications services through the implementation of Open
Network Provision (OJ ..... ).

                - 81                

The proposal must be seen against the background of discussions and the
general principles established in Europe with regard to the protection of
personal data through the Convention of the Council of Europe of 1981 for the
Protection of Individuals with regard to Automated Processing of Personal
Data, which has been ratified up to now by seven Member States of the
Community. The proposal is presented in the context of - and complementary
to .. the proposals by the Commission for the establishment of a general
framework for data protection in the Community submitted in parallel, in
particular the draft Council Directive for the approximation of certain laws,
regulations and administrative provisions of the Member States concerning the
protection of individuals in relation to the processing of personal data, the draft
Council Decision concerning the opening of negotiations in view of the
adhesion of the European Economic Community, in the fields of its
competence, to the Convention of the Council of Europe for the Protection of
Individuals with regard to Automated Processing of Personal Data, and the
draft Council Decision concerning the security of information systems ; in
addition, the Commission will develop internal rules with the objective to
guarantee for the individuals concerned a level of protection equivalent to the
principles of the Council Directive mentioned above.

Within this general context, the enclosed Directive is to provide for the specific
provisions required for the approximation of laws, regulations and
administrative provisions in the Community in the field of protection of
personal data and privacy with regard to public fixed and mobile digital
telecommunications networks and the new "intelligent" functions which they
provide.

                        - 82                         

11. THE NEW SPECIFIC REQUIREMENTS WITH REGARD TO THE

PROTECIION OF PERSONAL DATA AND PRIVACY IN THE

IELECOMMUNICA TIONS SECfOR

The "digitalisation" of the public telecommunications networks is now fully
under way in the Community. During the early years of this decade more than
70 % of long distance transmission, more than 50 % of long distance switching
and more than 30 % of local switching will be digitalised.

Digitalisation means the introduction of fully computer-based exchanges and
the processing and transmission of all information transmitted via
telecommunications networks - voice, data and image - in the form of binary
digits [10]       - The "bit-streams" thus generated can be acted upon directly by the
intelligence of computers, both inside the network as well as in the subscriber
terminal. This leads to a new level of quality of service which cannot be
achieved with traditional "analogue" techniques, as well as a large number of
new "intelligent" functions which opens a broad range of new activities via
telecommunications networks. Full "end-to-end" (subscriber-to-subscriber)
digital communication is offered by the evolving Integrated Services Digital
Network and the new public digital mobile communications systems [11]      

With regard to data protection, the introduction of public digital networks has
two major consequences.

On the one hand, the fully computer-based techniques now possible can offer a
substantially higher degree of data security for specific individual requirements,
such as sophisticated encryption techniques.

On the other hand, due to the digital processing of both operational and call
data and the treatment by computer-based exchanges, it could become possible

      - without adequate data protection measures - to store and monitor
systematically specific call-related data, such as origin of call. Such a possibility
was only feasible in traditional analogue-based "non-intelligent" networks by
making a substantial technical effort and therefore was only implemented under
very exceptional circumstances.

At the same time, the new intelligent telecommunications functions, such as
defined by the ISDN "supplementary services" [12], offer substantial additional
service features to the subscriber which will enhance service quality as well as
consumer protection, such as detailed billing. The new functions, however, will
require new specific measures and regulations, if the protection of privacy is to
be guaranteed in the new environment.

to Computers process all information in the form of - binary digits•, I.e. by splitting all information into its
fundamental information elements (bits) with values 0 or 1.

u See Council Recommendations 86/659/EEC and 87/371 /EEC. footnotes 1 and 2 above.

12 See for details Council Recommendation 86/659/EEC, footnote 1.

            - 83 

Therefore, the introduction of digital telecommunications networks in the
Community gives rise, with regard to the protection of personal data, to
substantial specific issues which must be addressed, such as the handling of:

subscriber-related information, increasingly stored in computer-held
subscnber files;

traffic and other operational data;

detailed billing data;

calling-line identification (identification of origin of call);

automatic call forwarding to third parties;

unsolicited messages;

specific technical features for terminal and other equipment which may
be required, in order to provide for adequate protection.

The general provisions for protection of personal data, such as initiated by the
Council of Europe convention and to be established for the Community by the
Commission's initiatives mentioned above, does provide a broad framework,
but does not make provisions to the specific details required for addressing
these issues.

The general provisions concerning the protection of personal data cannot
prevent the current emerKence of divereent le&islation. re&J1lations and
administrative action in the Member States concernina the operation of the
future di&ital networks which could very soon endanger the common market for
both telecommunications services and terminal equipment.

For example, in the field of calling line identification, certain Member States
plan to provide for a case-by-case elimination of the feature by the calling
subscriber. If such an elimination will be realised via a button on the telephone
set, while other operators might decide to provide for the elimination via a code
to be used before dialling a number, it would create problems for the free
circulation of terminal equipment in the Community.

A comparison of the existing national provisions shows considerable
discrepancies concerning both the contents and the nature of the legal
instruments· used. Under these circumstances, a situation of legal uncertainty is
developing in the Community concerning telecommunications networks and
services, which threatens to hinder substantially the transborder offering of
services. 

Without a Directive concerning the specific provisions ~ecessary to implement
the general principles of protection of data and privacy with regard to public
digital fiXed and mobile networks, it would be impossible to prevent divergent
developments in the Community.

                 - 84                 

At the same time, Community-wide provision for effective protection of
personal data and privacy is developing into an essential pre-condition for social
acceptance of the new digital networks and services, as conftrmed by the
Council at its meeting of 7 November 1989 where it concluded with regard to
the social aspects of telecommunications on the need to preserve the protection
of privacy and personal data within a European perspective.

The enclosed proposal for a Council Directive aims at fulfilling these specific
requirements.

               - 85 

m. THE APPROACH PROPOSED: THE PROVISIONS OF THE DRAFr

DIRECTIVE

The global objective of the proposed Directive is to provide throughout the
Community for a basic level of protection of personal data and privacy for the
European citizen, which should be included in the general new digital
telecommunications offering, while referring requirements for enhanced levels
of data security for specific individual cases and applications to the specific
measures to be developed within the framework of the work plan set out in the
Commission's proposal for a Council Decision concerning security in
information systems mentioned above.

The proposed Directive aims at achieving a basic level of protection of the
general subscriber in the new digital environment by emphasising two
fundamental principles:

minimising the risk of abuse by limiting the data processed and stored
in the context of public telecommunications operations to the bare
minimum required for ensuring adequate operation, service quality
and subscriber facilities;

ensuring fully the right of the subscriber to information selfdetermination, both with regard to the telecommunications
organisation providing the services as well as with regard to the second
party in a call connection and any third party which may want to gain
access to the data transmitted or provided in the context of a
transaction via a public telecommunications network.

Given that the most profound impact on the general subscriber by the new
telecommunications environment will be in the field of voice telephony, the
proposed Directive concentrates on this area. However, it provides for a
procedure for the application of the provisions relating to the voice telephone
service to other public digital telecommunications services as applicable, such as
for public data transmission services in the context of ISDN as well as public
packet- and circuit-switched data networks, and other related public
telecommunications services.

Further, given the current state of transition of the public telecommunications
networks in the Community and in particular the fact that certain "Stored
Programme-Controlled" (SPC) Exchanges, while not yet fully digital, do provide
a number of the intelligent functions in question, the proposed Directive
provides for those cases where a Member State has not yet implemented the
Integrated Services· Digital Network or public digital mobile networks, that the
provisions of the Directive will be implemented to the extent that they also
apply to services based on analogue networks. .

With these general principles in mind, the content of the proposed Directive
addresses in particular: the collection, storage and processing of personal data
in the subscriber's ftle; the storage and processing of traffic and billing data, in
particular for the purpose of itemised call statements; the problem of the calling
line identification; access by third parties; unsolicited calls; and the procedures
to be chosen for establishing specific technical standards which may be
required.

The articles of the Directive are briefly explained hereunder:

Articles 1 and 2 describe the overall objectives of the Directive and its

                       - 86                        

agplication to protection of data and privacy in connection with public
telecommunications services in public digital telecommunications networks in
the Community.

Article 3 contains defmitions of important terms in line with the proposal of a
Council Directive on the implementation of Open Network Provision (ONP)
mentioned abovell.

The general principle in Article 4 that the collection, storage and processing of
personal data by a telecommunications organisation is justified for the pur.poses
of the grovision of the intended service only and may not be used without
specific permission by law or without the subscriber's prior recorded consent for
any other purpose is applied in Article _S_ to the establishment of subscriber files.
As set out in the introductory statements to the Directive, such collection,
storage and processing of personal data may in particular not be used to give
telecommunications organisations any undue competitive advantage over other
service providers in competitive fields.

Article 6 enumerates the ri&Jtts of the subscriber concerning his personal data
held by a telecommunications organisation and Article 7 states the princigle of
non-disclosure of such data to third parties without his consent or permission by
law.

Article 8 should guarantee an adeguate level of protection of data against

unauthorised access.

Articles 9 and 10 apply the principle of collection, storage and processing of
personal data as far as required for telecommunications purposes only to billin&
and traffic data. Article 11 intends to protect the privacy of the subscribers in
connection with itemised call statements via the requirement of anonymity of
the called subscriber.

Articles 12 and 13 contain detailed provisions concerning the callin& line
identification. The possibility to eliminate the identification feature should be
made available, because, among other reasons, callers making calls to and from
drug and alcohol rehabilitation centres, family abuse shelters or mental health
services have a legitimate concern that this service feature may compromise
their anonymity; the same applies to suicide and AIDS hot lines.

However, the called subscriber can have a legitimate interest in receiving only
identified calls. In order to guarantee the right of information selfdetermination to both the calling and the called parties, the called subscriber
must therefore have the possibility to limit the acceptance of incoming calls to
those which identify the calling subscriber's number.

Moreover, the telecommunications organisation should provide an override
(blockin&) function against the elimination of the identification feature in case
of malicious calls; the function must also be made available for purposes of
pursuit of criminal offences and for emergency services, in particular the fire

     - brigade, in order to prevent abuse of such services.

Article 14 ensures that the privacy of both the calling and the called subscriber
is also protected in case of the use of the call forwardin& features.

t3 See footnote 9.

                   - 87 

Article 15 should prevent by technical means the contents of telephone calls
being stored andlor disclosed to third parties without advance informing of the
calling subscriber.

Articles 16 and 17 aim at preventing the unauthorized use of the subscribers'
personal data by providers of teleshowing and videotex services in order to
avoid the establishment of consumer proftles as well as at the protection of the
subscriber's privacy against unsolicited messages. such as unwanted advertising
via telecommunications means.

Article 18 is intended to prevent the fact that the introduction of technical
features based on data protection requirements might create undue restrictions
to the free circulation of telecommunications equipment and services in the
Community, by ensuring, where required, the working out of common
European standards for the implementation of specific technical features. In
accordance with the Council Directive on the approximation of the laws of the
Member States concerning telecommunications terminal equipment, including
the mutual recognition of their conformity [14], and Council Decision 87/95 /EEC
of 22 December 1986 on standardisation in the field of information technology
and telecommunications [15], the technical work is to be entrusted to the
appropriate European standardisation bodies, in particular the European
Telecommunications Standards Institute (ETSI) and the CEN/CENELEC.

13

The final provisions in articles 19 to 25 concern the field of application. the
procedures for modifications necessaty to adapt this Directive to new technical
developments and consultation procedures. It is foreseen that a committee
composed of representatives of the authorities responsible for data protection
in the Member States and a committee composed of the representatives of the
Member States shall assist the Commission in the implementation of the
Directive. These committees are proposed to be the committees defmed for
these purposes in the draft Council Directive for the approximation of certain
laws, regulations and administrative provisions of the Member States
concerning the protection of individuals in relation to the processing of personal
data submitted in parallel as mentioned above, but would be specifically
constituted for the purposes of this Directive.

t4 COM(89)289 - SYN 204, 27.7.1989.

t.s OJ NoL~ 7 February 1987, p. 31.

                - 88 

IV. CONCLUSION

Effective Community-wide protection of personal data and privacy is
developing into an essential pre-condition for social acceptance of the new
digital networks and services.

Without a directive concerning the specific provisions necessary to implement
the general principles of protection of personal data and privacy with regard to
the specific requirements of public digital fixed and mobile networks, it will be
impossible to prevent divergent developments in the Community which would
very soon endanger the common market for both telecommunications services
and terminal equipment.

The attached draft Directive is to provide for these specific provisions.

The Council is therefore requested to adopt the attached proposal for a
Directive.

                         - 89 

SYN 288

PROPOSAL FOR A COUNCIL DIRECI1VE CONCERNING THE PROTECfiON OF

PERSONAL DATA AND PRIVACY IN THE CONTEXT OF PUBLIC DIGITAL

TELECOMMUNICATIONS NETWORKS, IN PARTICUlAR THE INTEGRATED

SERVICES DIGITAL NETWORK(ISDN) AND PUBLIC DIGITAL MOBILE

NETWORKS

                            - 90                             

THE COUNCIL OF THE EUROPEAN COMMUNITIES,

Having regard to the Treaty establishing the European Economic Community, and in

particular Article lOOa thereof;

Having regard to the proposal from the Commission•~

In co-operation with the European Parliament [2] ;

Having regard to the opinion of the Economic and Social Committee ~;

t. Whereas £ouncil Directive:... concerning the Rrotection of

individuals in relation to the processing of personal data exhorts MenDer States to

ensure the protection of privacy ;

2. Whereas currently in the European Community new advanced digital public telephone

networks are emerging which give rise to specific requirements concerning the

protection of personal data and privacy of the user ;

3. Whereas this is the case, in particular, with the introciJctioo of the Integrated Services Digital

Network (ISDN) and public digital mobile networks;

2

3

                          - 91 

4. Whereas the Council in its Res o l ut 1.on of 30th June 1988 on the

development of the common market for telecommunications services and equipment

up to 1992 4-. has called for steps to be taken to protect personal data, in order to

create an appropriate environment for the future development of telecommunications

in the Community; whereas the Council has re-emphasized the importance of the

protection of personal data and privacy in its Resolution of 18th July 1989 on the

strengthening of the co-ordination for the introduction of the Integrated Services

Digital Network (ISDN) in the European CommunitY

5 ~

_5._ Whereas the European Parliament has underlined the importance of the protection of

personal data and privacy in telecommunications networks, in particular with regard

to the introduction of the Integrated Services Digital Network (ISDN) [6], ?., [8],

6. Whereas Commission Recommendation 81/679/EEC calls for. the

adoption and ratification by Member States of the Council of Europe Convention for

the protection of individuals with regard to automatic processing of personal data

which spells out general principles for the protection of personal data;

7. \tl'lereas a n.JJber of Member States have adopted and ratified this Convention;

#### 8. Whereas Council Decision ... ? opens negotiations with a view to the accessim of the

European Economic Community, in the fields. in which it is cmpetent, to the Ca"'VE!nticrt of

the Council of Europe for the Protection of Individuals with regard to Automatic

Processing of Personal Data~.

4·
OJ ft) c 257, 4.10.1988, p. 1.

51
Orl\0 c 196;, 1.8.1989, p.4.

6
OJ ftl C 7,·: 12. 1 • 1987, p. 334.
7
OJ. No c 1-2, 16.1.1989, p. 69.

8

OJ No c 12, 16.1.;1989, p. 66.

9
OJ ...

                          - 92                           

9. Where as. Council Directive  - • • _I_ concerning the protection of

individuals in relation to the processing of personal data implements the adoption of

these general principles in the Community _7,

10. Whereas in the case of public digital networks, specific legal, regulatory, and technical

provisions must be made in order to protect personal data and· the privacy of users with

regard to the increasing risks    - connected with the computerized storage and

proce&~ing of personal data in such networks;

11. Whereas Member States are currently developing divergent provisions in this area;

12. Whereas given the obstacles resulting from these divergent legal, regulatory, and

technical provisions concerning the protection of personal data and privacy in the

context of the implementation of public digital telecommunications networks in the

Community, in particular the Integrated Services Digital Network (ISDN) and public

digital mobile networks, the full establishment of a Community-wide market in

telecommunications services and equipment requires the rapid introduction of

harmonised provisions;

13. Whereas this Directive. should determine the extent to which personal data may be

collected, stored and processed in connection with the provision of

telecommunications services;

14. Whereas the collection, storage, and processing of personal data by a

telecommunications organisation is justified for the purposes of the provision ')f the

intended service only and may not be used without specific a.rthori zatia1 by Law or the

'subscriber's prior   - consent for any other,purpose; . whereas such collection,

storage, and processing of personal data maJ. in particula.;;not be used t~ give such

telecommunications organisation any undue competitive advantage over other service

providers;

                            - 93 

15. Whereas this Directive should implement in the telecommunications sector the general

principles concerning .. the subscriber's right to    - inspect the p~rsonal data

stored about him/her, his right ~o .. request the -rectificatioo or _erasure_ of such data, ;

necessary, as well as.    - h~ijs_ .nightl~0:.p:revent non-authorized disclosure of his

personal data;

16. Whereas this Directive must provide for harmonization of the Member States'

ru~es con _c-e_ r n_i n g the protection of privacy in the field of itemized call

statements;

17. Whereas, it is necessary, as regards- the calling line identificatioo, to protect both the

right of the calling party to remain anonymous and the privacy of the called party with

regard to unidentified calls;

18. Whereas safeguards must be provided for the users of teleshopping and videotex

services against unauthorized use of their personal data as well as for the subscribers

in general against intrusion into their privacy hy means of unsolicited calls;

19. Whereas it is n'ecessary to _ensure_ that: the introduc~i·on of technical features

telecommunications equipment for data protection purposes is harmonised in order to

be compatible with the implementation of the internal market of 1992;

20. Whereas the implementation of this Directive with regard to third countries must take

into account the level of protection of personal data and privacy in those countries

as provided for in Council D.irective {_-cpncerning the protection of

   - individuals in relation to the processing of personal data_/;·

- 21. - .c1ereas all 1natters c(]'lceming protecti(]'l. of· persmal data _anl_ pri~acy in the cmtP.xt of Plbl ic.

digital telecommunications networks, which are not cove~ by the pnovisions of this specific

Directive, the Council Directive mentioned above shall apply;

22. Whereas this Directive does not address issues of protection of personal data and

privacy related to -national security;

                   - 94 

23. Whereas it is useful for the preparation of measures intended to implement or modify

this Directive to draw on the experience of the Working Party on the Pr.ot.ection of

Personal~ Data composed of .representati-ves of the supervisor·y authorities of

the Me"mber States, set up by_ Article 27 __ of -~ouncil.Directive

_!.__ ~oncerning.t.ht! protection of __ ind'ividuals in relation to the proces.sing

of personal data_7;

24. Whereas such measures must be prepared with the assistance of the committee

composed of representatives of the Member States set up by Arti'c le 30 .of

Council Directive   - ••• !_-concerning the protectlon of individuals
in relation to the processing·of personal--data    - 7.    

HAS ADO PIED TinS DIREcriVE:

 - 95 

Article 1

1. This Directive provides for .the. harmonisation of the provisions required

to ensure an ~qual level of protection of-privacy in ttle Community and to

provide for the free movement of telecommunications equipment and services

within and between Member States.

2. The Member States shall adopt the necessary specific provisions in order
to guarantee~ the protection of per·sonal data and privacy in the telecom
munications sector in accordance with this Directive.

A[ticle 2

1. Without prejudice to the general pr.ov1s1ons of Council Directive - ••

concerning the protect ion ... of   - individuals in relation to the processing

of personal data, this Directive applies specifically to the collection, storage, and

processing of personal data by telecommunications organizations in connection with

the provision of public telecommunications services in public digital

telecommunications networks in the Community, in particular via the lritegrated

Services Digital Network (ISDN) and public digital mobile networks.

2. In case a Member State has not yet implemented the Integrated Services Digital

Network (ISDN) or public digital mobile networks, the provisions of this Directive will

be implemented to the extent that they also apply to services based on analogue

networks.

                  - 96 

Article 3

For the purposes of this Directive,

1. - "persdrtal Data• means any information relating to an identified or identifiable

individual ;

2. '·telecommunications organization" means a public or private body, to which a

Member State grants special or exclusive rights for the provision of a public

telecommunications network and, where applicable, public telecommunications

services;

3. - ·public telecommunications network" means the public telecommunications

infrastructure which permits the conveyance of signals between defined network

termination points by wire, by microwave, by optical means or by other

electromagnetic means;

4. "public telecommunications service" means a telecommunications service whose

supply Member States have specifically entrusted inter alia to one or more

telecommunications organizations.

Article 4

1. Collection, storage and processing of personal data by a telecommunications

organization is justified for telecommunications purposes only, in particular in order

to establish connections for the transmission of voice, data or image, to produce bills,

. to comp~e directories, and for other legitimate operational purposes, for. example fault

clearance, prevention of misuse of the telecommunications organization's equipment,

or registration of incoming calls in accordance with Article 13( 1 ).

2. The telecommunications organization shall not use such data to set up electronic

profiles of the subscribers or classifications of individual subscribers by category.

                 - 97 

ArticleS

1. Personal data of the subscriber may be collected and stored to the extent necessary to

condude, 'J)erforin, amendg._tenninate the CO'ltract with. the tetecam..nicat~a'lS organizatim.

After termination of the contract the data are to be erased: unless and for so long as

they are required to deal with complaints, to recover charges or to comply with other

obligations imposed by the law of the Member State, in conformity with Community

law.

2. The contents of the information transmitted must not be stored by the

telecommunications organization after the end of the transmission, except where

required by obligations imposed by the law of the Member State, in conformity with

Community law.

Article6

The subscriber is entitled

to obtain at reasonable intetvals and without excessive delay or expense

confirmation of whether personal data relating to him/her are stored as well as

communication to him/her of sucb data in an intelligible form,

to obtain, as the case may be, rectification or erasure of such data if theY have

been processed.: in breach ot tl:le..provisia1S.Y1ich are intJC)Sed by the law      - of the

Member State in conformity with Community law.

-98

Article 7

1. In principle, all personal data processed in connection with telecommunication

networks and services are to be kept confidential.

2. The personal data may not be disclosed outside the services or the network of the

telecommunications organization without specific. authorizati<l"l by law or tne . _

Slbscri'ber's prior calSent. A slbscrieer. shall be ha[d tcfhave given such

"coosent mly where it is gi.ven by    - way of a specific response to a request

by the telecommunications organization. Without the subscriber's prior consent,

these personal data must not be disclosed t~ persons within the

telecommunications organization who are not dealing with the relevant services

provided.

3. The telecommunications organization must not make the provision of its service

dependent upon such consent.

Article 8

1. The telecommunications organization must provide adequate, state-of-the-art

protection of personal data against unauthorized access and use.

2. In case of particular risk of a breach of the security of the netw:>rk, for excirple in the fie

nd>i le radio telephony, the telecai1i'U'licatiCJ:lS orgcni~tim nust infonn the stbscribers

concerning such risk and offer them an end-to-end encryption service.

-w

Article 9

1. Billing data containing the telephone number or identification of the subscriber

station, the address of the subscriber and the type of station, the total number of units

to be charged for the accounting period, the called telephone number, the type and

duration of the ea Us made and/ or the data volume transmitted as well as other

information needed for billing such as advance payment, payment by instalments,

disconnection and reminders, may be stored and processed.

2. Such a general storage of billing data is permissible up to the end of the statutory

period during which the bill may be challenged.

Article 10

1. Traffic data containing the personal data necessary to establish calls, or required for

billing or other operational purposes, such as the telephone number of the calling and

of the called subscriber, the time each call started and finished and the

telecommunications service used by the subscriber, may be collected, stored and

processed as far as this is necessary to provide the telecommunications service

required.

2. The traffic data stored in the switching centres of the telecommunications

organization must be erased after termination of the call unless the data are

anonymised or are required for billing or other legitimate purposes in the meaning of

Article 4.

Article 11

Upon application of the subscriber an itemized call statement may be produced,

containing. among other items, the telephone numbers of the called subscribers

without the last four digits.

                           - 100

Article 12

1. With regard to - communications between subscribers linked to digital exchanges,

the calling subscriber must have the possibility to eliminate via a simple technical

facility the identification of his/her telephone number on the display of the called

subscribers' terminal equipment, or its recording in a storage facility of this terminal,

on a case-by-case basis.

The transmission of the telephone number may also be permanently eliminated by the

telecommunications organization upon application of the calling subscriber.

2. The called subscriber may apply for permanent elimination of the identification of all

incoming calls; he/she must also be able to turn off the display of his/her terminal

equipment, or to eldmitlate the recording in the terminal's storage facility, in order to

prevent the identification of the incoming calls, on a case-by-case basis.

The called subscriber must be able to limit the acceptance of incoming calls to those

which identify the calling subscriber's number.

3. With regard to ~ c ommun; cat; on s - . between a subscriber linked to an analogue

exchange and subscribers linked to digital exchanges, the former subscriber is to be

informed the identification of his/her telephone number and to be offered

the permanent elimination of the feature upon application. This subscriber must also

have the possibility to eliminate the identification on a case-by-case basis.

                           - 101                           

Article 13

1. For a limited period of time, the telecommunications organization may override the

elimination of the calling line identification

a) upon application of a subscriber requesting the tracing of malicious calls. In

this case, the data containing the identification of the calling subscriber will be

stored by the telecommunications organization and be made available upon

request to the public authority charged with the prevention or pursuit of

criminal offences of the Member State concerned;

b) upon specific court order, in order to prevent or pursue serious criminal

offences.

2. A permanent override function must be made available upon request,

a) to organizations recognized by a Member State whi eh answer and deal with

emergency callii, and

b) to fire brigades operated or recognized by a Member State.

3. The telecommunications ~ganisations s~all take the necessary steps to ensure that

the override function is operational on a national and Community-wide basis.

Article 14

1. Calls may be forwarded from the called subscriber to a third party only if this party

has agreed; the third party may limit automatic forwarding to _those calls .tlich identif

calling subscriber's number ; the third party must be informed via a specific signal of

the message that the call has been forwarded.

2. The calling subscriber must be informed automatically during the establishment of the

                  - 102 

connection that the call is being forwarded to a third party.

Article 15

1. If the content of telephone calls is made accessible to third parties via technical

devices, such as loudspeakers or other on-hook equipment, or stored on tape for own

use or use by third parties, provision must be made in order that the parties concerned

are informed via an appropriate procedure of such diffusion or storage before the

diffusion or storage is initiated and for so long as the it continues.

2. Paragraph 1 does not apply in the cases covered by Article 13( 1 ).

Article 16

1. The telecommunications organization must ensure that the telephone number as well

as other personal data of the subscriber, in particular concerning the quantity and. nature

of his/her orders when using a teleshopping service or concerning the information

requested via a videotex service, is stor-ed mly to the extent strictly necessary to supply

the service and is 01ly used _by tteservice provider for purposes authorized by this

subscriber.

2. Subject to the provisions of Article 20, the service provider may not set up electronic
profiles of the subscribers or classifications of individ·~ subscribers by category,
without their prior cmserlt.

                       - 103

Article 17

1. Subscribers who receive unsolicited calls for cd!ertising purposes or for the

purpos_e of   - ~ffering the supply or provision of goods and services may

notify the telecommunications organization conveying such messages that they do not

wish to receive these calls.

2. The telecommunications organization must take the steps necessary to terminate the

transmission of such messages to the subscribers concerned. Furthermore, the

telecommunications organization must keep a list of the notifications in a form

specified and available for inspection by the regulatory authority, in order to prevent

such calls in future.

Article 18

1. In implementing the provisions of this Directive, Member States shall ensure, subject

to paragraphs (2) and (3) of this Article, that no mandatory requirements for specific

technical features are imposed on terminal or other telecommunications equipment

which could impede the placing of equipment on the market and the free circulation

of such equipment in and between Member States.

2. Where provisions can only be implemented by requiring specific technical features,

Member Stat~· shall inforin the Carmissiei'l according to the proced.Jres.provided for
## . by Council Directive 83/189/EEC:1 ° W"tich ·lays dow1 a proced.Jre "tor. the provisioo of

information in the field of technical standards and regulations.

10 .

- OJ t«> L 109, 26.4.1983, p.8.

r ' 't

_I_

                                                                          - ~

                        - 104

3. Where required, the Commission will ensure the· drawing LP of caTIYO"l Europea1

standards for the implementation of specific technical features, in accordance with CCU'lCi l Di rec

five ••••• EEC _ -~ .. tpn the approximation of the laws of the Member States concerning

telecommunications terminal equipment, including the mutual recognition of their

conformi@ [11]
1 [and ] [Council Decision ] [87/95 ] [/EEC ] [of ] [22nd ] [December ] [1986 ] [on ]

standardisation in the field of information technology and telecommunications- [1 ] ~

Article 19

1. The provisions of this Directive relating to the telephone service shall be applied to

other public digital telecommunications services to the extent that these services

present similar risks for the privacy of the user.

2. The measures necessary for the implementation of paragraph 1 -shall ~ aci::pted by the

Commission after consultation of the ~rki~. party referred to in Arti'cte 22 cn::J in

accordance with the procedure laid down in Article 23.

Article 20

To the extent that the full achievement of the objectives of this Directive requires the

application of its provisions to service providers other than telecommunications

organizations, the Commission may· adopt the measures necessary for the application

of this Directive to those service providers after consultation of the ~~«>rking party

referred to in Article 22 and in accordance with the prOcedure laid down in Article 23.

~1 OJ t«l _c._

12
OJ tb L 36,_7.2.1987, p. 31.

                           - 105 

Article 21

The details of the application of this Directive and the modifications necessary to

adapt this Directive to new technical developments shall be determined by the

Commission in accoraance with the procedure laid down in Article 23.

Article 22

I. The working Party on the Protection of Personal Data established according to Article 27

of Council Directive .... _ a pp r ox i mat i n g . certain laws, regulations and

administrative provisions of the Member States concerning the protection of

individuals in relation to the processing of personal data shall carry out the tasks laid dow1

in .Article 28 of the above mentioned Directive also with regard to the data protection

measures which are the suhject of this Directive.

2. .The t,.Orking parcy will be specifically crnstituted for the purposes of this Directive.

Article 23

I. The procedure laid dcw1 in Article 30 of Ca..nci l Directive

approximating certain laws. regulations and administrative provisions of the

Member Stiltes concerning the protection of individuals in relation to the processing

of personal data shall ~ly.

2. The committee established in the framework of tret procedure will·be constituted

specifically for the purposes of this Directive.

-1~

Article 24

1. The Member States shall bring into force the laws, regulations, and administrative

provisions necessary for them to comply with this Diective by 1 January 1993 at the

latest.

The provisions adopted pursuant to the first subparagraph shall make express

reference to this Directive.

2. The Member States shall communicate to the Commission the texts of the provisions

of national law which they adopt in the field covered by this Directive.

Article _2S_

This Directive is addressed to the Member States.

Done at Brussels, For the Council

                           - 107                            

Flea FINANCIERE

PROPOSIDON DE DJJt.!:CIIVE DU CONSEIL CONCERJCAXJ' L\ PROTECilON DES

DOJ\"NEES .A CA:RACIERE PERSONN'EL ET DE _lA_ 'YIE PltME IW8 LE CDNIEX:a: DES ltESEAUX DE

"IELECC>MM1»t~CA.110NS t."UMERIQDa PUBUCS, Er EH PA.Rl'JCIJUER DV ltESEAU Nt7MEIUQVE A

IN'l'EGRA'DON DE SEIMCES ( RNIS ) ET DJ:S U&AVX Mm1E1t1Q01S MOB1LIS PUBLICS.

Eo 1990 : B 7700

En 1.991 et uercices ultmeurs: BS-4010

2. Base teple

   - Article 100 A

3. Prpposjtion de daMffiqtion en dfpense ohligatoire /non qbliptoire

DOD -obJiptoire

4. Dmgjption et justification de !'action:

~.1. Ohjectjfs:- assurer la protection des persoDDes 1f9J"d des dODD6es l CU"aL"tk"e
personoel,

.. permettre la citc:ulatioo tran.sfront:W~re ck dann&s a c::anc:te-e personnel
daDs la Commonaat~

          - pamettre le bon fondiormement du man:M Jat&ieur.

                           - 108 

4.3. Un :-spr&entmt ~e b eo~.qon preside le arcupe de proteaion des donn&s l

'caract~ ~..oc.e.d et le Co.z.it~ ~-: ... .-i!!tatif.;'...e sec;:ftarlts.t du goupe et du Comite de
protcctimt des c:k .. -~.,&:s A euticte.re ~ilnel .~ ~ulJ:ti par 1':3 semees de la
~~on.

_5.1._ Na.ture : rc§unicm.,

(frais de partldpatfon des membres des 2 Cmnit& )

_5.2._ Ca1cnJ.: - Oroupe de protection des dotmees: (d. fiche 5.nandl!re de la directive

g~n&'ale)

24 t.l.~bres ( gouveme.menta.ux ) x 3 r~unlons x 2 jours x 390 ECU /jour =

56.160 ECU     

6.1. Ech!ancier de£ crUit.S d'~cgagement et de paiement

CE-CP

1~93 : 56.163 :ECU

1994 : _56.160_ ..

1995 : 56.160 •

1996 : S6.160 •

1997:56.160-"

_6.2.._ Part du financemcnt c:umnmnauuire daas le c.o!tt total: 100 _9D_

                 - 109 

7. Observations :

1. Le groupe de protection des dona<!es A car.ta:~e personnel (Art. 22 ):

D at mJtitu~ c:e groupe l cantctere amsuJr.!.ti:f et m~dant et est CO~ de
repr&enta.nts de l'autorit~ de contrOle de tous les £tats membres, pr&id~ par un
representant de Ja Commission.

Ce groupe &bUt son r~ement int&i~ur. Le se.cnrariat du graupe es1 ..ur6 par les
services de la Commission.

Missions de ce p-oupe :voir An. _22_

2. Le Camit~ coDSUltadf ( Ait - 23 )

###### n est institu~ un Comft~ c:onsultatif compos~ des repr&ectants des Etats Membres,

pr&id~ par le 1 ept &entant de la ~on.

La Commission est assist~ par c:e Comltt! afin de prendre les brentueDes mesures

co~l&Denta.ires nkessaires pour ac.apter les dispositions de Ja directive aux
~cit& de c.erta.iDs sed.eurs.

- .....

......

                            - 110                            

R~tlon for a Counoll Declalon on the opening of
negotlatiC)IW with a view tot'- acc•aelon of the European ~-unaties to
the Council of EurOPe Convention for the protection of lncllvlduala with
regard to the autout le prOC*aalng of "r80f'Mll data

EX PLAN;\ TORY UEl«lRAM)W:

1. The protection of Individuals with re.gard to the processing of

personal data is both an Individual rlg~t and a necessary
precondition for the development of lnt~rnatlonal trade.

2. The orocasalr.g of personal dat• la Indispensable for International

trade In goods and servlca• and for eloeer collabOration between
countries.

3. The Commission ha$ forwarded to the COUne!i a propOsal for a
Dlrecttva on prcvl~lng Jndlv!duals througncut the Community with a
high 'evftl of protection -~th reQ~rd to the processing of personal
data. This action should be supplemented by Initiatives designed to
guarante• Individuals an eQuivalent level of protection with regard
to th~ $•change _of_ data between the Commanity and non-member
c®ntrtes"

... A ccnver~tion for the protaeth'n of Individuals with regard to
automatic proc$aalng of personal data was concluded in the Council
of Euroue in 1se1. The purpos~ cf tno Convention ts to secure In

the territory of each Party for every Individual, whatever his
nattonailty _or_ restdenee~ respect for his r!ghta and fundamental

fre~d~~s, and ~n p~rt~cular h~~ rlght tQ pr5vacy, with regard to

automatl~ processing of personal data re!•ting to him. This
Convention a~so lays down that a Party shall not, for the sole
purpose of 'th$ prnt~ct I c:.n of pr 1 va.ey ~ or oh I b 1 t or subJect to
special zuthorlsat!on tranaborder flows of personal data going to

the territory of another Party.

5. tn tts Recommendation of 2G JuJy 1981, the Commission Invited
Member States of the ~nlty to ratifY the Council of Europe
Convention for th• protection of Individuals with regard to

automatic procesal~g of personal data. Thla Recom.endatlon also
specifies that ''all tho Member States do not sign and ratify the
Convention within a reasonable tt~. the eom.taalon reserves the

right to propose that the Councl• adopt an Instrument on the basis

   - of the EEC Treaty.

8. Thla Convention haa not yet boen ratified by ail Member States of
the Communlty1. lt Is necessary and desirable for the Community to
acceed to this Convention In order to ensure the protection of
personal data and the transborder exchange·of such data with nonmember countr~as, and.to make the Convention more attractive to

non-member countries wlahlng to exchange data as freely as possible
with the Community.

1. The Convention (STE 108 of 28 January 1981) has been signed by the

following Member States: Belgium, Greece, Ireland, Italy, the
Netherlands and Portugal. lt haa been ratlfled by Denmark, France.
the Federal Republic of Ger•any, Luxembourg, Spain and the United
Klngdoll.

                         - 'ii1 

7. f t ' s t :.us pr o~ef!d that the Comlll e•l on r ~cr,..~nd the Coune 1 ; _to_
authorlz! the Commission to negotiate with tho Council of Europe
and the States th~t are oarty to the Co~ventton for the prot~ct~on
of lndtvtduals with regard to autom•tle processing of p~rsonal data
an additional protocol th1t will enabl• th• Eurooesn ~nttlee to

b~e~~ p~rty to thla convention for the·fl~lda for whleh they are

renponslbie.

a. 4he t.~laslon will condUct these n~gotlatl~~• In eon$u~tatlon with

the representatives of the Member States, in accordance with the

~'recttves annexed to this COmmunication or of auch aa may be

forwarded to lt by the COUncil.

9. The Uem.b•r States of th• Community, all of which are Members of the

Council of Europe, will fully suppOrt CoMMunity action during the

nftgotlatlona for the acceaAion of the Eurooe•n Community whenever

thh.l aueatlon,_rH!on within the Counci-l cf Europe.

Annex: Negotiating directives

/

                            - 112                            

NEGOTIATINQ DIRECTIVES

1. The purpose of the negotiations la to conclude an additional

protocol to allow the CoMmunity to become a contracting party to
the Convention for the fields for which lt la responsible. The
following principles shall be respected:

2. The European Community shall be repre .. nted within the Consultative
eom.lttee set up under Article 18 of the Convention by the
CO..Iaalon of the European COmmunltlea.

After the eom.taalon haa arranged coordination at Community level,

the representative of the European Community shall be given a
number of votes equal to the total nu.ber of votea held by the
national delegation• of the w..ber Statea of the CoMMunity that are
party to the Convention In all queatlona relating to the processing
of personal data In the flelda which are the reaponalblllty of the
COmmunity.

In all other questions, each national delegation shall have one
vote.

3. In order to ensure that the additional protocol allowing the
CommUnity to become a contracting party to the Convention enters

Into force within a reasonable tl .., the CO..Iaalon, supported by
the Member Statea, will propose that an opting out procedure for

Ita adoption be Included In the text of the protocol.

_i_
_!_

/
# _)_

;

            - 113             

PROPOSAL FOR A COUNCIL DECISION

IN THE FIELD OF

**Information Security**

Executive Summary

_Information under its various forms increasingly contributes to individual, corporate and_
_national wealth. The growth and performance_ _of_ _an estimated_ _2/3_ _of_ _the economy relies_ _on_
_manufacturing or services heavily dependent_ _on_ _information technology, telecommunications_
_and broadcasting, and therefore depends critically on the accuracy,_ _security and_
_"trustworthiness"_ _of_ _information. This is_ _of_ _as great importance and interest for individuals as_
_for commerce, industry and public administrations. Correspondingly, the protection_ _of_
_information_ _in_ _all its aspects, here referred to as Information Securityl, has become a central_
_policy issue and a major concern world-wide._

_Major changes have occurred during the last decades. but those ahead may_ _be_ _even greater._
_Desk-top supercomputers, Satellite Direct Broadcasting. Digital Mobile Radio, Integrated_
_Broadband Communications and other new applications_ _of_ _technologies are under development_
_and will provide the means for low-cost, mobile, high performance communication world-wide_
_on_ _an_ _unprecedented scale. The advent_ _of_ _efficient global communication has placed greater_
_emphasis_ _on_ _the need to provide adequate "protection" over levels_ _of_ _service availability,_
_message integrity and privacy commensurate with the expected level_ _of_ _administrative or_
_technical threat._

_The subject is_ _of_ _great importance for socio-economic development_ _of_ _the_ _EuropeaJt_
_Community and the completion_ _of_ _the Internal Market in 1992. A consistent approach at_
_European level should create at the same time an increasing feeling_ _of_ _confidence vis-a-vis_
_the use_ _of_ _new information technology and telecommunication services and help to avoid the_
_formation_ _of_ _new barriers between the individual Member States and with other countries._
_Therefore, there is_ _an_ _urgent need to address requirements and options for action at_
_Community level in close collaboration with sector actors and Member States. Any action must_
_take into account both national and international commercial,_ _legal and technical_
_developments. Because Information Security is involved in the protection not_ _just_ _of_ _property_
_and people. but also_ _of_ _society itself, Member States regard it as a topic which touches upon_
_national sovereignty._

_At the same time. for the Community and its Member States. it is vital that Information_
_Security does not become a constraint to the promotion_ _of_ _harmonious development in the_
_Community and to relations with other countries. As such, development_ _of_ _a harmonised_
_approach to information security must form an integral part_ _of_ _the Community policies related_
_to the strengthening_ _of_ _the European Community socio-economic performances. international_
_competitiveness and the completion_ _of_ _the internal market._

_The key issue is to provide effective and practical security_ _for._ _information held in an_
_electronic form to the general users. administrations and the business community without_
_compromising the interests_ _of_ _the public at large._

1

 - Information Sec:urfty (IS) is concerned with the protection of infonnation stored, processed or
trans.itted in electronic fona, against deliberate and accidental threats. Electronic Information
services need a secure telec:OimU'Iication infrastructure, secure ten~inals (including processors and
data bases) as well as secure usage.

                               - 115

_Action at Community level will need_ _to_ _involve concerted efforts in establishing the required_
_technology, standards, verification and certification procedures and regulations (where_
_required) in the framework_ _of_ _the Community policy making._

_The intention_ _of_ _the Commission is to encourage a debate with the sector actors in the_
_Community_ _on_ _Information Security issues and to develop a consensus_ _on_ _the appropriate steps_ _to_ _be_ _considered. This debate could_ _be_ _initiated_ _on_ _the basis_ _of_ _the statement_ _of_ _issues and_
_lines_ _of_ _action identified in the annex to this note._ _In this debate. and in view_ _of_ _the_
_responsibilities_ _of_ _Member States_ _in_ _this domain. it is_ _of_ _crucial importance that the_
_Community initiative_ _can_ _rely_ _on_ _a close collaboration with senior officials_ _of_ _Member States._

_It is therefore proposed that the Commission shall_ _be_ _assisted by a committee_ _of_ _an_ _advisory_
_nature, composed_ _of_ _representatives_ _of_ _the Member States and chaired by the representative_ _of_
_the Commission. The working_ _of_ _this committee has to reflect the specificities_ _of_ _the domain._
_This committee would_ _be_ _called the Senior Officials_ _Group_ _on_ _Information Security (SOG-_
_IS)._

_The most important issue_ _of_ _protection_ _of_ _personal data is dealt with in a proposal_ _of_
_Directive which is sent in parallel with the present communication._

't\ ?

                              - 116

A~ New ~halltn~~~-~n!l_tb.e~S~tclt!Js.u~ns_l~mk~J\.I!.U_Q)lti~al Imn~.u!

lg..(QD.tt~tion 5ft!!rity

I. The management and use of information supported by Information Technology and
Informatics Services in all spheres of economic, social and political life is pervasive. It
has permitted the integration of activities via a global communications system,
connecting manufar.turing plants, research establishments, data bases .. computer centres,
service provid~rs as well a.s centres of political and economic decision-taking.

2. This increa~ed integration of separate activitie., generates very considerable value-added
in terms of saving~ or increasing efficiency. It is therefore a key-factor in international
competitiveness. However, it also increases the need to protect the justifiable interests
of the individuals, the general public, commerce, industry, operators, services providers
and national administrations.

3. For the service sector to grow, and with it investments in electronic equipment,
telecommunications, hroadc3sting, computer and terminal equipment and a wide range
of telematics applications to take place, a secure European Electronic Information
Environment must be offered. Widespread acceptance and approval by all parties is
important to safeguard legitimate interests and to prevent misuse and abuse of
informatiort. This must be achieved in a way which is both efficient yet adequate for
users under various legal systems. In addition, information security systems must protect
privacy, inte1lectual property, fair competition, national security and other interests.

4. With the introduction of microcomputers, the use of Information Technology,
Telecommunications and Broadcasting has grown beyond the professional domain and
has become a "'consumer activity" with associated "consumer services". Along with this
quantitative change, a very significant qualitative change has occurred:
telecommunications now permits interworking and communication on a global scale.

5. Major chan~es have occurred during the last decades, but those ahead may be even
greater.·-. Desk-top supercomputers, Satellite Direct Broadcasting, Digital Mobile Radio,
Integrated Broadband Communications and other new applications of technologies are
under development and will provide the means for low-cost, mobile, high performance
communication world-wide on an unprecedented scale.

6. The advent of efficient global communication represents a qualitatively and
quantitatively new challenge for the need to provide adequate "protection" over levels of
service availability, message integrity and privacy, commensurate with the expected level
of administrative or technical threat.

7. The growing willingness of industry, government and society as a whole to use
information services has resulted in them becoming an integral part to the basic fabric
of every day life. Command, Communication and Control in general, Process Control in
manufacturing, Transportation, Financial Services, Automated Office systems, etc all
require levels of availability and operational robustness not fully understood in the
original service or component design.

8. New applications will be defined and implemented that may not be achieved within the
present architectural frameworks. A fundamental re-definition of architecture and
performance standards (including the needs to assure conformance) relating to services
and underlying components may be necessary.

                     - 117 

9. New disciplines and supporting organisations/occupations will need to be created to
achieve these higher levels of operational expectations. The major needs will, however,
be driven by cultural not technical changes. The global exploitation of information
services supported by comprehensive telecommunications networks will change the
perception in society of organisational/human relationships. '

10. Increasingly communication will either be through intermediaries, as in various levels of
added-value services supported by IT, or will take place directly after intermediaries
have approved the contact. In such situations trust will need to be explicitly defined in
the context of organisational relationships, authorities/privileges and many
service/product 'quality controls'. Care must be taken in such a society that the rights
of individuals and organisations are fully reflected in legislation and regulatory controls.
In parallel, technologies must be conceived and implemented in a way which meets
security demands.

B. The need for an action at Communitx level in collaboration with Member States
11. With the protection of property, the person, and even society at stake, it is obvious that
information security is an area of major responsibility for the Member States. Both for
defense and the normal functioning of its institutions, each Member State is directly
concerned with security. These national concerns of governments have led, historically,
to a strong long-standing competence in information security, and the exercise of
control over its technology and techniques to prevent the diffusion of sensitive aspects.
Although each user must be responsible for choosing his own security, his choices rely
essentially on guarantees which, in the final analysis, come from public authorities,
through, for example the legal limits they fix.

12. EEC policies and programmes for the development of the Information and
Telecommunication Industries and for the achievement of the Internal Market, may be
seriously impeded unless an active policy is adopted on the initiation, development and
promotion of Information Service Security Standards. For the Community, it is vital
that Information Security does not become a constraint to the promotion of harmonious
development within the Community and to relations with other countries. As such,
development of a harmonised approach to information security must form an integral
part of the Community policies related to the strengthening of the European industry
socio-economic performance and international competitiveness, and to the completion of
the Internal Market.

13. More specifically, it must involve concerted efforts in establishing the required

standards~ verification· and certification procedures, technological developments and
regulations (where required) in the framework of the Community policy· making.
Because of the highly technical nature of the underlying issues, concertation of efforts
implies collaboration of actors at the pre-competitive stage of R&D

14. "Open Standards" adoption by Governments (US/UK GOSIP), by· the western Defense
community (NA TO/NOSI), by the computer and telecommunications industry as well as
network operators (ISO OSI standards) has resulted in greater emphasis on security issues
in information systems, architectures, standards, communications protocols and
component techniques.

                  - 118 

I _5._ Only an estimated 2% of the services which will be available in the Community by the
year 2000 are available today. By then services will typically be able to respond to user
needs and offer a range of integrated features combining voice, data and image in a
flexible manner. The realisation of user requirements for information security such as
data protection, privacy, authentication, authorisation, billing, etc. will correspondingly
be much more difficult to assure. It is for this reason that Information Security and the
related technical features such as integrity need to be systematically developed and
investigated. US Authorities are funding programmes on Trusted Computer Systems,
Open Systems Architectures, protocols and techniques that will accelerate the use of
proprietary security solutions in the international user community. It must be a primary
concern for Member States to be an equal partner in addressing standardisation in this
domain. Following a de facto standardisation would risk creating new technological
dependencies which may seriously impede the international competitiveness of
Community's economies. This implies that the corresponding efforts are made in the
Community as a prerequisite for a constructive interaction with countries outside the
Community, mainly the US.

16. To sum it up, because of their respective responsibilities, both the Community and its
Member States have a strong interest in the key questions:

How will effective specifications and standards for information security be defined
and promulgated?
How will the formal evaluation and certification that products and systems conform
to the security standards (both functionally and in giving assurance) be
implemented?
How will security products and systems be implemented, provided and used?

17. Information security is a typical example of a policy where the principle of _subsidiarity_
may be applied, in view of the inherent complexity of the subject, the involvement of
numerous actors and the necessity to deploy a range of policy tools. An action plan is
essential telling what should be done, by whom and how. On the one hand, the Member
States have to handle these questions; on the other hand, the Community has a strong
interest in working out terms ensuring the compatibility between on one side the
completion of the Internal Market, the achievement of the Citizens' Europe, the
implementation of a telecommunications policy and the competitivity of the European
community electronics and electronic information services industries, and on the other
side the response to the basic requirements of the individuals and the business for
information security. · Therefore, and in order to focus the effort, various types of

  - actions and a procedural structure are proposed below as a basis for further in-depth
studies leading to measures to be taken at the appropriate level.

                                - 119                                 

Proposal for a

COUNCIL DECISION

IN THE FIELD OF

INFORHADON SECURITY

THE COUNCIL OF THE EUROPEAN COMMUNITIES

Having regard to the Treaty establishing the European Economic Community, and in

particular Article 23S thereof,

Having regard to the proposal from the Commission,( I)

Having regard to opinion of the European Parliament,(2)

Having regard to the opinion of the Economic and Social Committee,(3)

Whereas the Community has as its task, by establishing a common market and progressively

approximating the economic policies of the Member States, to promote throughout the

Community a harmonious development of economic activity, a continued and balanced

expansion, increased stability, accelerated raising of the standard of living, and closer

relations of the States belonging to it;

Whereas there information stored, processed and transmitted electronically plays an

increasingly important role in so c ~ at I and economic activities;

Whereas the advent of efficient global communication and the pervasive use of electronic

handling of information emphasises the need for adequate protection;

Whereas the European Parliament has repeatedly stressed the importance of information

security in its deliberations and decisions;

(1) OJ No C - ••

(2) OJ No C .. .

(3) OJ No C .. .

                   - 120 

Whereas the Economic and Social Committee has emphasised the need to address information

security related issues in Community actions, particularly in view of the impact of the

completion of the internal market;

Whereas it is necessary to develop a global strategy for information security in order to

ensure the security of the user on the Community level and avoid the creation of new

technical obstacles to communication;

Whereas the inherent complexity of information security issues calls for subsidiarity,

the active involvement of several sectors and :the conce~ted us~ of several policies;

Whereas actions on national, international and Community level provide a good basis;

Whereas there is a close link between telecarm..nicati·~- sta-dirdisatim, infonnatim

market and RD&T policies and the work already undertaken in these domains by the

European Community;

Whereas it is appropriate to assure the concertation of efforts, by building m existing natimal

and international work and by promoting the cooperation of the principal protagOnists· ealCemed;

whereas it is therefore appropriate to proceed within the framework of a coherent ·acticn plan;

Whereas the responsibility of the Member States in this domain implies a concerted approach

based on a close collaboration with senior officials of the Member States.

HAS DECIDED AS FOLLOWS:

Article 1

l. An action plan in the field of information security (INFOSEC) is adopted for a period

of 24 months starting on [ ].

2. The action plan is designed to develop a global strategy providing the users of

electronically stored, processed or transmitted information with protection of

information systems against accidental or deliberate threats.

3. The action will take into account and s&pport the evolving European and world-wide

standardisation activities in the field.

                                                                                            - ~

'

                     - 121 

Article 2

The action plan, the details of which _are_ set out in the Annex hereto shall compris

the following lines of action:

I. development of an information security strategy framework;

11. analysis of inf~rmation security requirements;

Ill. solutions for immediate and interim needs;

IV. specifications, standardisation and verification of information security;

V. integration of tec~logical and operational developments for infonmation security within _a_

general strategy;

VI. integration of certain security functions in infonmation systems.

Article 3

The action plan shall be irrplemented _by thl:! Commission in collaboration with the

organisations and enterprises concerned and in close association with the Member States.

Article 4

The amount attributed to this action shall be detennined in the ~rse of the arn.Jal bujgetary

P'rocedure.

Article S

. The Commission shall serd to. the- Eurqlean Parl ianent ard the Council a report on the

results of the action within three months of its completion.

Article 6

For the implementation of the action plan, the Commission shaU consult, as necessary, _a_

Senior Officials Group on Information Security (SOGIS>. This group shall consist of\ tw

representatives of each Member State and of the Commission. A CcirmissiO, representative

shall be in the chair~

_('_

,
_.J_

                           - 122                            

The members of the Group may be assisted by experts or advisers depending on the

, nature of the issues under consideration.

The proceedings of the Group shall be confidentiaL The Group shall adopt its own ruies

of procedure. The secretariat shall be provided by the Commission.

Done at Brussels, For the Council

                                   - 123 

ANNEX

Summary of Action Lines

1. Action Line I - Develovment of an Information Security Strategy Framework

1.1 Issue

1. Information security is recognised as a pervasive quality necessary in modern society.
Electronic Information services need a secure telecommunication infrastructure, secure
terminals (including processors and data bases) as well as secure usage. An overall
strategy, considering all aspects of information security, needs to be established,
avoiding a fragmented approach. Any strategy for the security of information processed
in an electronic form must reflect the wish of any society to operate effectively yet
protect itself in a rapidly changing world.

1.2 Objective

2. A strategically oriented framework has to be established to reconcile social, economic
and political objectives with technical, operational and legislative options. The sensitive
balance between different concerns, objectives and constraints has to be found by sector
actors working together in the development of a common perception and agreed strategy.
These are the prerequisites for reconciling interests and needs both in policy making and
in industrial developments.

1.3 Status and trends

3. The situation is characterized by growing awareness of the need to act. However, in the
absence of an initiative to concert the efforts it seems very likely that dispersed efforts
in · various sectors will be taken which create de facto a situation which will be
contradictory, creating progressively more serious legal, social and economic problems.

1.4 Requirements. oPtions and Priorities

4. Such a shared framework would need to address and situate tisk analysis and risk
management concerning the vulnerabilities of information and related services, the
alignment of laws and regulations associated with computer/telecommunications abuse
and misuse, administrative infrastructures including Security Poli"cies and how these may
be effectively implemented by various industries/disciplines, and social and privacy
. concerns (eg the application of identification, authentication and possibly authorization
schemes in a democratic environment).

_5._ Clear guidance is to be provided for the development of physical and logical
architectures for secure distributed information services, standards, guide-lines and
definitions for assured security products and services, pilots and prototypes to establish
the viability of various administrative structures, architectures and standards related to
the needs of specific sectors.

                                 - 124                                 

6. Security Awareness must be created in order to influence the attitude of the users
towards an increased concern about security in IT and telecommunication systems.

2. Action Line 11 - Information Security Requirements

2.1 Issue

7. Information security is the inherent pre-requisite for the protection of privacy,
intellectual property, commercial confidentiality and national security. This leads
inevitably to a difficult balance and sometimes choices, between a commitment to free
trade and a commitment to securing privacy and intellectual property. These choices
and compromises need to be based on a full appreciation of requirements and the impact
of possible information security options to respond to them.

8. User requirements imply information security functionalities interdependent with
technological, operational and regulatory aspects. Therefore~ a systematic investigation of
information security requirements forms an essential part of the development· of
appropriate and effective measures.

2.2 Objective

9. Establishing the nature and characteristics of user requirements and their relation to
information security measures.

2.3 Status and Trends

10. Up to now, no concerted effort has been undertaken to identify the rapidly evolving
and changing requirements of the major actors for Information Security. EC Member
States have identified the requirements for harmonisation of national activities
(especially of the "IT security criteria"). Uniform evaluation criteria and rules for mutual
recognition of evaluation resuits/certifica~es are of major importance.

2.4 Requirements. oPtions and Priorities

11. As a basis for a consistent and transparent treatment of the justified needs of the sector

  - actors it is considered necessary to develop an agreed classification of user requirements
and its relation to information security provision.

12. It is. also considered important to identify requirements for legislation, regulations and
codes of practice in the light of an assessment of trends in service characteristics and
technology, to identify alternative strategies for meeting the objectives by

administ~ative, service, operational and technical prQvisions, and to assess the
effectiveness, user-friendliness and costs of alternative information security option and
strategies for users, service providers and operators.

                                  - 125 

3. Action Line Ill - Solutions for Immediate and Interim Needs

3.1 Issue

13. At present it is possible to protect adequately computers from unauthorised access from
the outside world by "isolation" ie by applying conventional organisational and physical
measures. This applies also to electronic communications within a closed user group
operating on a dedicated network. The situation is very different if the information is
shared between user groups or exchanged via a public, or generally accessible, network.
Neither the technology, terminals and services nor the related standards and procedures
are generally available to provide comparable information security in these cases.

3.2 Objective

14. The objective has to be to provide, at short notice, solutions which can respond to the
most urgent needs of users. These should be conceived as open towards future
requirements and solutions.

3.3 Status and trends

15. Some user groups have developed techniques and procedures for their specific use
responding, in particular, to the need for authentication, integrity, and non-repudiation.
In general magnetic cards or smart cards are being used. Some are using more or less
sophisticated cryptographic techniques. Often this implied the definition of user-group
specific "authorities". However, it is difficult to generalise these techniques and methods
to meet the needs of an open environment.

16. ISO is working on OSI information security (ISO DIS 7498-2) and CCITI in the context
of X400. It is also possible to insert information security segments into the messages.
Authentication, integrity and non-repudiation are being addressed as part of the
messages (EDIF ACT) as well as part of the X400 MHS.

17. Presently, the EDI legal framework is still at the stage of conception. The International
Chamber of Commerce has published uniform rules of conduct for the exchange of
commercial data via telecommunications networks.

18. Several countries (eg FRG, France, the UK and US) have developed or are developing
criteria to evaluate the trustworthiness of IT and telecommunication products and
systems and the corresponding procedures for conducting evaluations. These criteria
have been coordinated with the national manufacturers and will lead to an increasing
number of trusted products and systems starting with simple products. The
establishment of national organisations who will conduct evaluations and offer
certificates will support this trend.

19. Confidentiality provision is considered by most users as less immediately important. In
the future, however, this situation is likely to change as advanced communication
services and in particular mobile services will have become all pervasive.

3.4 Requirements. options and priorities

20. It is essential to develop as soon as possible the procedures, standards, products, and
tools suited to assure information security on public communications networks. A high
priority should be given to authentication, integrity and non-repudiation Pilot projects
should be carried out to establish the validity of the proposed solutions. Solutions to
priority needs on EDI are looked at in the TEDIS programme within the more general
content of this action plan.

                    - 126 

4. Action Line IV - Snecification. standardisation and Verification for Information Security

4.1 Issue

21. Information security requirements are pervasive and as such common specifications and
standards are crucial. The absence of agreed standards and specifications may present a
major barrier to the advance of information-based processes and services throughout the
economy and society. Actions are required to accelerate the development and use of
technology and standards in several related communication and computer network areas
that are of critical importance to users, industry and administrations.

4.2 Objective

22. Efforts are required to provide a means of supporting and performing specific functions
in the general areas of OSI, ONP, ISDN/IBC, network management and network security
for unclassified, but sensitive, information. Inherently related to standardisation and
specification are the techniques and approaches required for verification.

4.3 Status and trends

23. The US, in particular, have taken major initiatives to address information security in the
non-defence domain. In Europe the subject is treated in the context of IT and
Telecommunications standardisation in the context of ETSI and CEN/CENELEC in
preparation of CCIIT and ISO work in the domain.

24. In view of growing concern, the work in the US is rapidly intensifying and both
vendors and service provider are increasing their efforts in this domain. In Europe,
France, the Federal Republic of Germany and the United Kingdom have independently
started similar activities but a common effort corresponding to the US is only evolving
slowly.

4.4 Requirements. options and priorities

25. In information security there is inherently a very close relationship between regulatory,
operational, administrative-and technical aspects. Regulations need to be reflected in
standards and information security provisions need to comply in a verifiable manner to
the standards and regulations. In several aspects regulations require specifications which
go beyond the conventional scope of standardisation, ie include codes of practice.
Requirements for standards and codes of practice are present in all areas of Information
Security, and a distinction has to be made between the protection requirements which
correspond to the security objectives and some of the tech~ical requirements which can
be entrusted to the competent European standard bodies (CEN/CENELEC/ETSI).

26. Specifications and standards must cover the subjects of. Information Security Services
(personal and enterprise authentication, non-repudiation protocols, legally acceptable
electronic proof, authorisation control), Communication Services (image communication
privacy, mobile communications voice and data privacy, data and image data-base
protection, integrated services security), Communication and Security Management
(public/private key system for open network operation, network management protection,
service provider protection) and Certification (information security assurance criteria
and levels, security assurance procedures).

                                - 127                                 

5. Action Line V - Technological and Ooerational Develooments for Information Security

5.1 Issue

27. Systematic investigation and development of the technology to permit economically
viable and operationally satisfactory solutions to a range of present and future
information security requirements is a prerequisite to the development of the services
market and the competitiveness of the European economy as a whole.

28. Any technological developments in information systems security will have to include
both the aspects of computer security and security of communications as most presentday systems are distributed systems, and access to such systems is through
communications services.

5.2 Objective

29. Systematic investigation and development of the technology to permit economically
viable and operationally satisfactory solutions to a range of present and future
information security requirements.

5.3 Requirements. options and Priorities

30. Work on information security would need to address development and implementation
strategies, technologies, and integration and verification.

31. The strategic R&D work would have to cover conceptual models for secure systems
(secure against compromise), functional requirements models, risk models, and
architectures for security.

32. The technology orientated R&D work would have to include user and message
authentication (eg. through voice analysis and electronic signatures), technical interfaces
and protocols for encryption, access control mechanisms, and implementation methods
for provable secure systems.

33. Verification and validation of technical system security and its applicability would be
investigated through integration and verification projects.;

34. In addition to the consolidation and development of security technology, a number of

accqmpanying measures are required concerned with the creation, maintenance and
consistent application of standards, and the validation and certification of IT and
telecommunication products with respect to their security properties, including validation
and certification of methods to design and implement systems. ·

35. The 3rd RDT Community Framework Programme might be used to foster cooperative
projects at precompetitive and prenormative levels.

                               - 128 

6. Action Line VI - Information Security Pro¥isions

6.1 Issue

36. Depending on the exact nature of the Information security features required functions
will need to be incorporated at different parts of the communication systems including
terminals/computers, services, network management to cryptographic devices, smart
cards, public and private keys etc. Some of these can be expected to be embedded in
the hardware or software provided by vendors while others may be part of distributed
systems (eg network management), in the possession of the individual user (eg smart
cards) or provided from a specialised organisation (eg public/private keys).

37. Most of the information security products and services can be expected to be provided
by vendors, service providers or operators. For specific functions, eg the provision of
public/private keys, auditing, authorisation there may be the need to identify and
mandate appropriate organisations.

38. The same applies for certification, evaluation and verification of quality of service
which are functions which need to be addressed by organisations independent of the
interestS of vendors, services providers or operators. These organisations could be
private, governmental, or licensed by government to perform delegated functions.

6.2 Ob iective

39. In order to facilitate a harmonious development of the provision of information security
in the Community for the protection of the public and of business interests it will be
necessary to develop a consistent approach as to the provision of information security.
Where independent organisations will have to be mandated, their functions and
conditions will need to be defined and agreed and where required embedded into the
regulatory framework. The objective would be to come to a clearly defined and agreed
sharing of responsibilities between the different actors on a Community level as a prerequisite for mutual recognition.

6.3 Status and trends

40. At present information security provision is well organised only for specific areas and
limited to addressing the specific needs. The organisation on a European level is mostly
informal and mutual recognition of verification and certification is not yet established
outside closed groups. With the growing importance of information security the need
for defining a consistent approach to information security provision in Europe and
internationally is becoming urgent.

6.4 Reauirements. options and oriorities

41. Because of the number of different actors concerned and the close relations to
regulatory and legislative questions it is particularly .important to pre-agree on the
principles which should govern the provision of information security.

In developing a consistent approach to this question one will need to address the aspects
of identification and specification of functions requiring, by their very nature, the
availability of some independent organisation, (or interworking organisations). This
could include functions such as the administration of a public/private key system;

                            - 129                            

In addition, it is required to identify and specify, at an early stage, the functions which
in the public interest need to be entrusted to independent organisation (or interworking
organisations). This could, for example include auditing, quality assurance, verification,
certification and similar functions;

                  - 130 

FINANCIAL ST A TEMEJ\1

Wormatioa SKvrlty (lNFOSEC)

Preparatory Action

BUDGET BEADING

Subsection B6, Item 1104

l. LEGAL BASE AND PROPOSED CLASSIFICATION

Article [235]

Non compulsory expenditure.

~. DESCRIPTION

CollaboratioD in the development or proposals I.Dd 8C'lions relatiq to ia!ormation
seeuricy u _tu_ as they require or signif'iC2.Dtly benefit from a concened approach
at Commuzdty level. The focus or the work ls 10 relate 10 lbe Deed.s or the
general public, commerce, servi;e providers and adm.inistrations aDd ac1<1re.sses the
requirements for a collaborating approach to teelmoloclcaJ research,
Stllldardlsation and related issues as relevant for the development or a consistent
European approach to ic!orm.ation se:urity with particular nf'erence to the
completion or the internal market in 1992.

ne aoal of the INFOSEC action is to m.t.ke a major CODtri~uticm 10 the obje~ve
of the

_•de-.elop."Mtfl_ _of_ _tZclions_ _to_ _prt1Yidin1_ ~//,cri•~ _11111_ _pi'Gt:dclll_ _seavlry_ _for_
_in/ormmz·un_ _Mid_ _in_ _tm_ _elecrro'lic_ _form_ _to_ w _ReMTIM_ _suers._ _llllmlnistrtlllons_ _tJJtd_
_business_ _COI'I'IInll1llr.v_ _willwul_ _compromlsln:_ _tM_ _lllle1'al_ _of_ _the_ _publit_ _Al_ _ltu,r.•_

The present proposal is the result or the preliminary illvestiptions by experts,
CODSultaticms &Dei OD•&OiD& related work. .

The lcope _o(_ the preparatory actiOD is to foca.s OD

L development or IJ1 iDtormatioD secw:ity .... y £J'I.ID&work
D. mformation security requir~ments
m. 10lutions for immtd.iare &Dd interim aeeds
IV. specific:::n.ioas, studard.isatioc ud veriiadoA or mtonutioc security
V. leC.Uoloaical aod operatioG3l develol)mUD _lor_ Wormatioc security
VI. mtormation security provision.

_4._

              - 131 

JlJSTifiCADON

~velOI'!nen.t or a harmonised appr'lach to lnrormation security must form an
integrt\J part or t~e CommunitY policies related to the completion of the Jntemal

Marke~ stttnathen.i.n& of sociO-$COnomic performance and irnematior~
competitivtme$$. It is vital that Intormation Security does DOt become a
constraint to the promotion of harmcnious c:1evelopmeat in tha Community and to
reladous with other countries. I1\ add.ition, information s~urley sysurms must
J)rotect privacy, intellectual propeey, ra.ir competition, national secaz:ky :.:;1
other ictJ!Te'i!!.

Thr pr~posod ac:;o.a resi)Vnds to an urgeat uted to f'acilimte 1.11d acee~ - :.:.~

emeratcce or aentTally accepted, eff'oc:tive and practicable meaans : ..
information socarlry. ne action wm becef"it from synerz,!es with la-l'i~.i
proil"U!UllC$ in the field of inf'ormation technolopes (ESPRIT) i:ad
telecommanlc:atlons (ltACE) as well as the on-goio& work on telecommDDic:uioos,
sta.ndardisation and informa.tiou market pollcies.

.,.

:.. ~'DICATIVE FINANCIAL PLANNING

...  - ~ _lmplicarloru for expenditure._

_5.0_ .0 Total cost 0\o-et the whole of the expected duration _ot_ 2 years (in MioECL~

From t!le Dudget _':1!_ the Communjtles: 12.0
From the other sec:tots at the natiow level: O.t}

TOTAL 12.0

~ ~. J Mu!ti-•uuuw schedule (~ MioEC'U):

Payment  .A ..,prc::riations

_6_

2

12

1~9!

Commitment
.A,_,,~,mtioDS

12

Th.is e:cpud.it&Je ~o .. -m the Com.mu.a.iry•s ~~ c.o~t:ib~:.Zc:1 to ~ytiQJ·
__ ..,.. ....., ..... _., .... ___ -.... : __ ...... ... - - _ _, ---~rt ~ .... =-',......, .... l..alw s ... ~ev•loP'.'I'ft•!lt ~ ..,....-. or .,.,.., ol!".tl!t"";r.l,. ... .., at:..: .... .......,._..,.,. - ~- .. c,._.., ":h't ~ ..... -. _

!':On.sulta.d~n &.:.d er..a~U.til.&ceat ot eo?:Uensus.

                               - 132 

                                                    

Given the fact that the action is iJ.D3..Deed in Sab~ctioo _6_ of tbe budget devot~d
to Researc:h and Investment expencUture, administrative costs (Committee a.cd
worki.Dg party meetings, coosaltation of exPerts. m.Sions, document 4inri"burioo
or dissem.lnadon or techn.iques, use or data procemn&. telecom.m\nucat!on and
broadcasting equipment) an covered directly by the bndaet item.

The following table fives the indicative breakdown ~r the various cateaories or
expenditwe (in MloECU):

1991 1992

5.0.2 a) 41,123 ~.too

5.0.% b) la '&oraal 1,177 1,900

or which Expcns _0,400_ _0,600_
Other opention.al expenditure             - _0.$00_ _0:115_

Infrastl'Umre _0,050_ _0,100_

I.n!orm.a.tion aDd publication _0.050_ _0.100_

Statutory staff _0.111_ _0.315_

6. FIN~~CIAL lltl.PLICATIONS FOR STAFF ~1> CURRENT AD~tTh"'STR.ATIYE

APPROPRL.t. TIONS

The statutory resear:h nz!f invoh:ed, i.e. S A, J -B, t·C, wiU be entered in the
research staff table llld is p!.id out c·f the appropriations entered onto Item B68104.

The administrative expenditure y.·lll be aovemed by the inttnu.l rules en mia.i ..
budgets decided by the Commi.ssion on _2.2._ :t.iay 1990.

;._

FINANCING OF £XPINDITURE

The appropriatio~ to covn lhe Commu.nity•s contn1N"tion to this project will be
deten:r:linec1 m the context _o{_ the annual buc1setary procedure.

IMPLICAnONS FOR REVENUE

Cootribution or the statutory research staf'f' to tbe retlremeAt scheme uc! the
sickness iDsuruce.

                   - 133 

_9._ TYPE OF CONTROL

.. Adm.iJ:I.istralive control by the Director General for Financial Control u
regards budJet implementation;

     - Control or ach.ievemeDt

SOG-IS

~ntrol by officials or the Commission
audit by the Court a! Aud.i COl'S iD acc:ordance with provisions or the
Treaty;

     - In ~--ordance with Article 2 _c:C_ the ri!Wleial R.eauladous, me 1111 _ot_

appropriatious wlU be subject ro ualyses or oost•eff'ectlveness ud the
ra'isadora or qo&Dtltled abjec:tives will be moDJtored.