CELEX: 51990PC0314(01)
Language: en
Date: 1990-09-13
Title: PROPOSAL FOR A COUNCIL DIRECTIVE CONCERNING THE PROTECTION OF INDIVIDUALS IN RELATION TO THE PROCESSING OF PERSONAL DATA

5. 11. 90                                Official Journal of the European Communities                                 No C 277/3
              Proposal for a Council Directive concerning the protection of individuals in relation to the
                                                    processing of personal data
                                                 COM(90) 314 final — SYN 287
                                        (Submitted by the Commission on 27 July 1990)
                                                           (90/C 277/03)
THE COUNCIL OF THE EUROPEAN COMMUNITIES,                             (4) Whereas the increase in scientific and technical
                                                                         cooperation and the coordinated introduction of new
                                                                         telecommunications networks in the Community
Having regard to the Treaty establishing the European                    necessitate and facilitate cross-border flows of
Economic Community, and in particular Articles 100A and                  personal data;
 113 thereof,
Having regard to the proposal from the Commission,                   (5) Whereas the difference in levels of protection of
                                                                         privacy in relation to the processing of personal data
                                                                         afforded in the Member States may prevent the
In cooperation with the European Parliament,                             transmission of such data from the territory of one
                                                                         Member State to that of another Member State;
                                                                         whereas this difference may therefore constitute an
Having regard to the opinion of the Economic and Social                  obstacle to the pursuit of a number of economic
Committee,                                                               activities at Community level, distort competition and
                                                                         impede authorities in the discharge of their res-
                                                                         ponsibilities under Community law; whereas this
(1)  Whereas the objectives of the Community, as laid                    difference in levels of protection is due to the existence
     down in the Treaty, as amended by the Single                        of a wide variety of national laws, regulations and
     European Act, include establishing an ever closer                   administrative provisions;
     union among the peoples of Europe, fostering closer
     relations between the States belonging to the Com-
     munity, ensuring economic and social progress by
     common action to eliminate the barriers which divide            (6) Whereas, in order to remove the obstacles to flows of
     Europe, encouraging the constant improvement of the                 personal data, the level of protection of privacy in
     living conditions of its peoples, preserving and                    relation to the processing of such data must be
     strengthening peace and liberty and promoting                       equivalent in all the Member States; whereas to that
     democracy on the basis of the fundamental rights                    end it is necessary to approximate the relevant laws;
     recognized in the constitutions and laws of the
     Member States and in the European Convention for
     the Protection of Human Rights and Fundamental
                                                                     (7) Whereas the object of the national laws on the
     Freedoms;
                                                                         processing of personal data is to protect fundamental
                                                                         rights, notably the right to privacy which is recognized
                                                                         both in Article 8 of the Convention for the Protection
(2)  Whereas the establishment and the functioning of an                 of Human Rights and Fundamental Freedoms and in
     internal market in which, in accordance with Ar-                    the general principles of Community law; whereas,
     ticle 8a of the Treaty, the free movement of goods,                 for that reason, the approximation of those laws must
     persons, services and capital is ensured require not                not result in any lessening of the protection they afford
     only that personal data should be able to flow freely,              but must, on the contrary, seek to ensure a high level of
     regardless of the Member States in which they are                   protection in the Community;
     processed or requested, but also that fundamental
     rights should be safeguarded in view of the increas-
     ingly frequent recourse in the Community to the
     processing of personal data in the various spheres of           (8) Whereas the principles underlying the protection of
     economic and social activity;                                       privacy in relation to the processing of personal data
                                                                         set forth in this Directive may be supplemented or
                                                                         clarified, in particular as far as certain sectors are
(3)  Whereas the internal market comprises an area                       concerned, by specific rules based on those principles;
     without frontiers; whereas, for that reason, the
     national authorities in the various Member States are
     increasingly being called upon, by virtue of the
     operation of Community law, to collaborate and                  (9) Whereas the protection principles must apply to all
     exchange personal data so as to be able to perform                  data files where the activities of the controller of the
     their duties or carry out tasks on behalf of an authority           file are governed by Community law; whereas public-
     in another Member State;                                            sector files which are not governed by Community law
 ---pagebreak---   No C 277/4                              Official Journal of the European Communities                                    5. 11. 90
        should, as is provided for in the resolution of the           (16) Whereas, if data are to be processed, they must fulfil
       representatives of the Governments of the Member                     certain requirements; whereas the processing of data
       States of the European Communities meeting within                    which are capable by their very nature of infringing
       the Council of ..., be subject to the same protection                the right to privacy must be prohibited unless the data
       principles set forth in national laws; whereas,                      subject gives his explicit consent; whereas, however,
       however, data files falling exclusively within the                   on important public interest grounds, notably in
       confines of the exercise of a natural person's right to              relation to the medical profession, derogations may be
       privacy, such as personal address files, must be                     granted on the basis of a law laying down precisely
       excluded;                                                            and strictly the conditions governing and limits to the
                                                                            processing of this type of data;
 (10) Whereas any processing of personal data in the                 (17) Whereas the protection of privacy in relation to
       Community should be carried out in accordance with                  personal data requires that appropriate security
       the law of the Member State in which the data file is               measures be taken, both at the level of design and at
       located so that individuals are not deprived of the                 that of the techniques of processing, to prevent any
       protection to which they are entitled under this                    unauthorized processing;
       Directive; whereas, in this connection, each part of a
       data file divided among several Member States must
       be considered a separate data file and transfer to a          (18) Whereas, as regards the media, the Member States
       non-member country must not be a bar to such                        may grant derogations from the provisions of this
       protection;                                                         Directive in so far as they are designed to reconcile the
                                                                           right to privacy with the freedom of information and
                                                                           the right to receive and impart information, as
                                                                           guaranteed, in particular, in Article 10 of the Conven-
 (11) Whereas any processing of personal data must be                      tion for the Protection of Human Rights and
       lawful; whereas such lawfulness must be based on the                Fundamental Freedoms;
       consent of the data subject or on Community or
      national law;
                                                                     (19) Whereas the Member States must encourage the
                                                                           drawing-up, by the business circles concerned, of
                                                                           European codes of conduct or professional ethics
(12) Whereas national laws may, under the conditions laid                  relating to certain specific sectors; whereas the
      down in this Directive, specify rules on the lawfulness              Commission will support such initiatives and will take
      of processing; whereas, however, such a possibility                  them into account when it considers the appropriate-
      cannot serve as a basis for supervision by a Member                  ness of new, specific measures in respect of certain
      State other than the State in which the data file is                 sectors;
      located, the obligation on the part of the latter to
      ensure, in accordance with this Directive, the
      protection of privacy in relation to the processing of        (20) Whereas, in the event of non-compliance with this
      personal data being sufficient, under Community law,                 Directive, liability in any action for damages must rest
      to permit the free flow of data;                                     with the controller of the file; whereas dissuasive
                                                                           sanctions must be applied in order to ensure effective
                                                                          protection;
(13) Whereas the procedures of notification, in respect of
      public or private sector data files, and provision of         (21) Whereas it is also necessary that the transfer of
      information at the time of first communication, in                  personal data should be able to take place with third
      respect of private sector data files, are designed to               countries having an adequate level of protection;
      ensure the transparency essential to the exercise by the            whereas, in the absence of such protection in third
      data subject of the right of access to data relating to             countries, this Directive provides, in particular, for
      him;                                                                negotiation procedures with those countries;
                                                                    (22) Whereas the principles contained in this Directive give
(14) Whereas the data subject must, if his consent is to be               substance to and amplify those contained in the
      valid and when data relating to him are collected from              Council of Europe Convention of 28 January 1981 for
      him, be given accurate and full information;                        the protection of individuals with regard to automatic
                                                                          processing of personal data;
(15) Whereas the data subject must be able to exercise the          (23) Whereas the existence in each Member State of an
      right of access in order to verify the lawfulness of the            independent supervisory authority is an essential
      processing of data relating to him and their quality;               component of the protection of individuals in relation
 ---pagebreak--- 5. 11. 90                                Official Journal of the European Communities                                  No C 277/5
      to the processing of personal data; whereas, at                   going automatic processing or which, although not
      Community level, a Working Party on the Protection                undergoing automatic processing, are structured and
      of Personal Data must be set up and be completely                 accessible in an organized collection according to
      independent in the performance of its functions;                  specific criteria in such a way as to facilitate their use or
      whereas having regard to its specific nature it must              combination;
      advise the Commission and contribute to the uniform
      application of the national rules adopted pursuant to
      this Directive;                                               (d) 'processing' means the following operations, whether or
                                                                        not performed by automated means: the recording,
                                                                        storage or combination of data, and their alteration, use
(24) Whereas the adoption of additional measures for
                                                                        or communication, including transmission, dissemi-
      applying the principles set forth in this Directive calls
                                                                        nation, retrieval, blocking and erasure;
      for the conferment of rule-making powers on the
      Commission and the establishment of an Advisory
      Committee in accordance with the procedures laid              (e) 'controller of the file' means the natural or legal person,
      down in Council Decision 87/373/EEC (*),                          public authority, agency or other body competent under
                                                                        Community law or the national law of a Member State
                                                                        to decide what will be the purpose of the file, which
HAS ADOPTED THIS DIRECTIVE:                                             categories of personal data will be stored, which
                                                                        operations will be applied to them and which third
                                                                        parties may have access to them;
                           CHAPTER I
                                                                    (f) 'supervisory authority' means the independent public
                   GENERAL PROVISIONS                                   authority or other independent body designated by each
                                                                        Member State in accordance with Article 26 of this
                             Article 1                                  Directive;
                   Object of the Directive
                                                                    (g) 'public sector' means all the authorities, organizations
1. The Member States shall ensure, in accordance with                   and entities of a Member State that are governed by
this Directive, the protection of the privacy of individuals in         public law, with the exception of those which carry on
relation to the processing of personal data contained in                an industrial or commercial activity, and bodies and
data files.                                                             entities governed by private law where they take part in
                                                                        the exercise of official authority;
2. The Member States shall neither restrict nor prohibit
the free flow of personal data between Member States for            (h) 'private sector' means any natural or legal person or
reasons to do with the protection afforded under                        association, including public sector authorities, organi-
paragraph 1.                                                            zations and entities in so far as they carry on an
                                                                        industrial or commercial activity.
                             Article 2
                                                                                                 Article 3
                           Definitions
For the purposes of this Directive:                                                               Scope
(a) 'personal data' means any information relating to an
                                                                    1. The Member States shall apply this Directive to files in
    identified or identifiable individual ('data subject'); an
                                                                    the public and private sectors with the exception of files in
    identifiable individual is notably an individual who can
                                                                    the public sector where the activities of that sector do not
    be identified by reference to an identification number or
                                                                    fall within the scope of Community law.
    a similar identifying particular;
(b) 'depersonalize' means modify personal data in such a            2.    This Directive shall not apply to files held by:
    way that the information they contain can no longer be
    associated with a specific individual or an individual
    capable of being determined except at the price of an           (a) an individual solely for private and personal purposes;
    excessive effort in terms of staff, expenditure and time;           or
(c) 'personal data file' (file) means any set of personal data,     (b) non-profit-making bodies, notably of a political,
    whether centralized or geographically dispersed, under-             philosophical, religious, cultural, trade union, sporting
                                                                        or leisure nature, as part of their legitimate aims, on
                                                                        condition that they relate only to those members and
(i) OJ No L 197, 18. 7. 1987, p. 33.                                    corresponding members who have consented to being
 ---pagebreak--- No C 277/6                                 Official Journal of the European Communities                                    5. 11. 90
    included therein and that they are not communicated to                — it is necessary in order to ward off an imminent
    third parties.                                                             threat to public order or a serious infringement of
                                                                               the rights of others.
                             Article 4
                                                                                                  Article 6
                        Law applicable
                                                                        Processing in the public sector having as its object the
 1.  Each Member State shall apply this Directive to:                                communication of personal data
(a) all files located in its territory;                               1. The Member States shall provide in their law that the
                                                                      communication of personal data contained in the files of a
(b) the controller of a file resident in its territory who uses       public sector entity shall be lawful only if:
    from its territory a file located in a third country whose
    law does not provide an adequate level of protection,
                                                                      (a) it is necessary for the performance of the tasks of the
    unless such use is only sporadic.
                                                                          public sector entity communicating or requesting
                                                                          communication of the data; or
2. Each Member State shall apply Articles 5, 6, 8, 9, 10,
17, 18 and 21 of this Directive to a user consulting a file
located in a third country from a terminal located in the             (b) it is requested by a natural or legal person in the private
territory of a Member State, unless such use is only                      sector who invokes a legitimate interest, on condition
sporadic.                                                                 that the interest of the data subject does not prevail.
3. Where a file is moved temporarily from one Member                 2. Without prejudice to paragraph 1, the Member States
State to another, the latter shall place no obstacle in the way      may specify the conditions under which the communi-
and shall not require the completion of any formalities over         cation of personal data is lawful.
and above those applicable in the Member State in which
the file is normally located.
                                                                     3. The Member States shall provide in their law that, in
                                                                     the circumstances referred to in paragraph 1 (b), the
                                                                     controller of the file shall inform data subjects of the
                                                                     communication of personal data. The Member States may
                          CHAPTER II                                 provide for the replacing of such provision of information
                                                                     by prior authorization by the supervisory authority.
 LAWFULNESS OF PROCESSING IN THE PUBLIC SECTOR
                            Article 5
                            Principles                                                           Article 7
1. Subject to Article 6, the Member States shall, with                        Obligation to notify the supervisory authority
respect to files in the public sector, provide in their law
that:
                                                                      1. The Member States shall provide in their law that the
                                                                     creation of a public sector file, the personal data in which
(a) the creation of a file and any other processing of               might be communicated, shall be notified in advance to the
    personal data shall be lawful in so far as they are              supervisory authority and recorded in a register kept by
    necessary for the performance of the tasks of the public         that authority. The register shall be freely available for
    authority in control of the file;                                consultation.
(b) the processing of data for a purpose other than that for
                                                                     2. The Member States shall specify the information
    which the file was created shall be lawful if:
                                                                     which must be notified to the supervisory authority. That
                                                                     information shall include at least the name and address of
    — the data subject consents thereto, or                          the controller of the file, the purpose of the file, a
                                                                     description of the types of data it contains, the third parties
    — it is effected on the basis of Community law, or of a          to whom the data might be communicated and a
        law, or a measure taken pursuant to a law, of a              description of the measures taken pursuant to Article 18.
        Member State conforming with this Directive which
        authorizes it and defines the limits thereto, or             3. The Member States may provide that paragraphs 1
                                                                     and 2 shall apply to other public sector files and that
    — the legitimate interests of the data subject do not            consultation of the register may be restricted for the
        preclude such change of purpose, or                          reasons stated in Article 15 (1).
 ---pagebreak--- 5. 11. 90                                 Official Journal of the European Communities                                 No C 277/7
                           CHAPTER III                                                            Article 10
               LAWFULNESS OF PROCESSING
                  IN THE PRIVATE SECTOR                                            Spedal exceptions to the  obligation
                                                                                         to inform the data subject
                             Article 8
                            Principles                               If the provision of information to the data subject provided
                                                                     for in Article 9 (1) proves impossible or involves a
1. The Member States shall provide in their law that,                disproportionate effort, or comes up against the overriding
without the consent of the data subject, the recording in a          legitimate interests of the controller of the file or a similar
file and any other processing of personal data shall be              interest of a third party, the Member States may provide in
lawful only if it is effected in accordance with this Directive      their law that the supervisory authority may authorize a
and if:                                                              derogation.
(a) the processing is carried out under a contract, or in the
                                                                                                  Article 11
    context of a quasi-contractual relationship of trust,
    with the data subject and is necessary for its discharge;
    or                                                                      Obligation to notify the supervisory authority
(b) the data come from sources generally accessible to the           1. The Member States shall provide in their law that the
    public and their processing is intended solely for               controller of the file shall notify the creation of a personal
    correspondence purposes; or                                      data file where the data are intended to be communicated
                                                                     and do not come from sources generally accessible to the
(c) the controller of the file is pursuing a legitimate interest,    public. The notification shall be made to the supervisory
    on condition that the interest of the data subject does          authority of the Member State in which the file is located
    not prevail.                                                     or, if it is not located in a Member State, to the supervisory
                                                                     authority of the Member State in which the controller of
                                                                     the file resides. The controller of the file shall notify to the
2. The Member States shall provide in their law that it              competent national authorities any change in the purpose
shall be for the controller of the file to ensure that no            of the file or any change in his address.
communication is incompatible with the purpose of the file
or is contrary to public policy. In the event of on-line
consultation, the same obligations shall be incumbent on             2. The Member States shall specify the information
                                                                     which must be notified to the supervisory authority. That
the user.
                                                                     information shall include at least the name and address of
                                                                     the controller of the file, the purpose of the file, a
3. Without prejudice to paragraph 1, the Member States               description of the types of data it contains, the third parties
may specify the conditions under which the processing of             to whom the data might be communicated and a
personal data is lawful.                                             description of the measures taken pursuant to Article 18.
                                                                     3. The Member States may provide that paragraphs 1
                             Article 9                               and 2 shall apply to other private sector files and that the
                                                                     information referred to in paragraph 2 shall be accessible
                                                                     to the public.
            Obligation to inform the data subject
 1. The Member States shall, with respect to the private
sector, provide in their law that at the time of first
                                                                                                CHAPTER IV
communication or of the affording of an opportunity for
on-line consultation the controller of the file shall inform                            RIGHTS OF DATA SUBJECTS
the data subject accordingly, indicating also the purpose of
the file, the types of data stored therein and his name and                                       Article 12
address.
                                                                                              Informed consent
2. The provision of information under paragraph 1 shall
                                                                     Any giving of consent by a data subject to the processing of
not be mandatory in the circumstances referred to in
                                                                     personal data relating to him within the meaning of this
Article 8 (1) (b). There shall be no obligation to inform
                                                                     Directive shall be valid only if:
where communication is required by law.
                                                                      (a) the data subject is supplied with the following
3. If the data subject objects to communication or any
                                                                          information:
other processing, the controller of the file shall cease the
processing objected to unless he is authorized by law to
carry it out.                                                             — the purposes of the file and the types of data stored,
 ---pagebreak--- No C 277/8                                Official Journal of the European Communities                                     5. 11. 90
    — the type of use and, where appropriate, the recipients         3. To know of the existence of a file and to know its main
         of the personal data contained in the file,                      purposes and the identity and habitual residence,
                                                                          headquarters or place of business of the controller of the
                                                                          file.
    — the name and address of the controller of the file;
                                                                     4. To obtain at reasonable intervals and without excessive
(b) it is specific and express and specifies the types of data,           delay or expense confirmation of whether personal data
    forms of processing and potential recipients covered by               relating to him are stored in a file and communication to
    it;                                                                   him of such data in an intelligible form.
(c) it may be withdrawn by the data subject at any time                   The Member States may provide that the right of access
    without retroactive effect.                                           to medical data may be exercised only through a doctor.
                                                                     5. To obtain, as the case may be, rectification, erasure or
                            Article 13                                    blocking of such data if they have been processed in
                                                                          violation of the provisions of this Directive.
     Provision of information at the time of collection
                                                                     6. To obtain upon request and free of charge the erasure of
                                                                          data relating to him held in files used for market
1. The Member States shall guarantee individuals from                     research or advertising purposes.
whom personal data are collected the right to be informed
at least about:
                                                                     7. To obtain, in the event of the application of paragraph 5
                                                                          and if the data have been communicated to third parties,
(a) the purposes of the file for which the information is                 notification to the latter of the rectification, erasure or
    intended;                                                             blocking.
(b) the obligatory or voluntary nature of their reply to the         8. To have a judicial remedy if the rights guaranteed in this
    questions to which answers are sought;                               Article are infringed,
(c) the consequences if they fail to reply;                                                      Article 15
(d) the recipients of the information;                                            Exceptions to the data subject's right
                                                                                      of access to public sector files
(e) the existence of the right of access to and rectification of
    the data relating to them; and                                   1. The Member States may limit by statute the rights
                                                                    provided for in points 3 and 4 of Article 14 for reasons
(f) the name and address of the controller of the file.             relating t o :
                                                                     (a) national security;
2. Paragraph 1 shall not apply to the collection of
information where to inform the data subject would
prevent the exercise of the supervision and verification             (b) defence;
functions of a public authority or the maintenance of public
order.                                                               (c) criminal proceedings;
                                                                     (d) public safety;
                            Article 14
                                                                     (e) a duly established paramount economic and financial
                                                                         interest of a Member State or of the European
               Additional rights of data subjects
                                                                          Communities;
The Member States shall grant a data subject the following           (f) the need for the public authorities to perform monitor-
rights:                                                                  ing or inspection functions; or
1. To oppose, for legitimate reasons, the processing of              (g) an equivalent right of another individual and the rights
    personal data relating to him.                                        and freedoms of others.
2. Not to be subject to an administrative or private                 2. In the circumstances referred to in paragraph 1, the
    decision involving an assessment of his conduct which            supervisory authority shall be empowered to carry out, at
    has as its sole basis the automatic processing of personal       the request of the data subject, the necessary checks on the
    data defining his profile or personality.                        file.
 ---pagebreak--- 5. 11. 90                                Official Journal of the European Communities                                No C 277/9
3. The Member States may place limits on the data                                              Article 18
subject's right of access to data compiled temporarily for
the purpose of extracting statistical information therefrom.
                                                                                             Data security
                                                                    1. The Member States shall provide in their law that the
                                                                    controller of a file shall take appropriate technical and
                          CHAPTER V                                 organizational measures to protect personal data stored in
                                                                    the file against accidental or unauthorized destruction or
                       DATA QUALITY
                                                                    accidental loss and against unauthorized access, modifi-
                                                                    cation or other processing.
                           Article 16
                           Principles
                                                                    Such measures shall ensure, in respect of automated files,
                                                                    an appropriate level of security having regard to the state of
1. The Member States shall provide that personal data               the art in this field, the cost of taking the measures, the
shall be:                                                           nature of the data to be protected and the assessment of the
                                                                    potential risks. To that end, the controller of the file shall
                                                                    take into consideration any recommendations on data
(a) collected and processed fairly and lawfully;                    security and network interoperability formulated by the
                                                                    Commission in accordance with the procedure provided
                                                                    for in Article 29.
(b) stored for specified, explicit and lawful purposes and
     used in a way compatible with those purposes;
                                                                    2. Methods guaranteeing adequate security shall be
                                                                    chosen for the transmission of personal data in a network.
(c) adequate, relevant and not excessive in relation to the
     purposes for which they are stored;
                                                                    3. In the event of on-line consultation, the hardware and
                                                                    software shall be designed in such a way that the
(d) accurate and, if necessary, kept up to date; inaccurate or      consultation takes place within the limits of the author-
     incomplete data shall be erased or rectified;                  ization granted by the controller of the file.
 (e) kept in a form which permits identification of the data        4. The obligations referred to in paragraphs 1, 2 and 3
     subjects for no longer than is necessary for the purpose       shall also be incumbent on persons who, either de facto or
     for which the data are stored.                                 by contract, control the operations relating to a file.
2. It shall be for the controller of the file to ensure that        5. Any person who in the course of his work has access to
paragraph 1 is complied with.                                       information contained in files shall not communicate it to
                                                                    third parties without the agreement of the controller of the
                                                                    file.
                           Article 17
                   Special categories of data                                                CHAPTER VI
                                                                              PROVISIONS SPECIFICALLY RELATING
 1. The Member States shall prohibit the automatic                                     TO CERTAIN SECTORS
 processing of data revealing ethnic or racial origin, political                               Article 19
 opinions, religious or philosophical beliefs or trade union
 membership, and of data concerning health or sexual life,
 without the express and written consent, freely given, of the      The Member States may grant, in respect of the press and
 data subject.                                                      the audiovisual media, derogations from the provisions of
                                                                    this Directive in so far as they are necessary to reconcile the
                                                                    right to privacy with the rules governing freedom of
 2. The Member States may, on important public interest              information and of the press.
 grounds, grant derogations from paragraph 1 on the basis
 of a law specifying the types of data which may be stored
 and the persons who may have access to the file and
 providing suitable safeguards against abuse and unauthor-                                     Article 20
 ized access.
 3. Data concerning criminal convictions shall be held               The Member States shall encourage the business circles
 only in public sector files.                                        concerned to participate in drawing up European codes of
 ---pagebreak--- No C 277/10                               Official Journal of the European Communities                                  5. 11. 90
conduct or professional ethics in respect of certain sectors                                CHAPTER VIII
on the basis of the principles set forth in this Directive.
                                                                                   TRANSFER OF PERSONAL DATA
                                                                                        TO THIRD COUNTRIES
                                                                                               Article 24
                                                                                               Principles
                          CHAPTER VII
                 LIABILITY AND SANCTIONS
                                                                     1. The Member States shall provide in their law that the
                                                                     transfer to a third country, whether temporary or
                            Article 21
                                                                     permanent, of personal data which are undergoing
                             Liability                               processing or which have been gathered with a view to
                                                                     processing may take place only if that country ensures an
                                                                     adequate level of protection.
1. The Member States shall provide in their law that any
individual whose personal data have been stored in a file
and who suffers damage as a result of processing or of any           2. The Member States shall inform the Commission of
act incompatible with this Directive shall be entitled to            cases in which an importing third country does not ensure
compensation from the controller of the file.                        an adequate level of protection.
2. The Member States may provide that the controller of              3. Where the Commission finds, either on the basis of
the file shall not be liable for any damage resulting from the       information supplied by Member States or on the basis of
loss or destruction of data or from unauthorized access if he        other information, that a third country does not have an
proves that he has taken appropriate measures to fulfil the          adequate level of protection and that the resulting situation
requirements of Articles 18 and 22.                                  is likely to harm the interests of the Community or of a
                                                                     Member State, it may enter into negotiations with a view to
                                                                     remedying the situation.
                            Article 22
                                                                     4. The Commission may decide, in accordance with the
                                                                     procedure laid down in Article 30 (2) of this Directive, that
     Processing on behalf of the controller of the file              a third country ensures an adequate level of protection by
                                                                     reason of the international commitments it has entered into
                                                                     or of its domestic law.
1. The Member States shall provide in their law that the
controller of the file must, where processing is carried out
on his behalf, ensure that the necessary security and
                                                                     5. Measures taken pursuant to this Article shall be in
organizational measures are taken and choose a person or
                                                                     keeping with the obligations incumbent on the Community
enterprise who provides sufficient guarantees in that
                                                                     by virtue of international agreements, both bilateral and
respect.
                                                                     multilateral, governing the protection of individuals in
                                                                     relation to the automatic processing of personal data.
2. Any person who collects or processes personal data on
behalf of the controller of the file shall fulfil the obligations
provided for in Article 16 and 18 of this Directive.                                          Article 25
3. The contract shall be in writing and shall stipulate, in
particular, that the personal data may be divulged by the                                    Derogation
person providing the service or his employees only with the
agreement of the controller of the file.
                                                                     1. A Member State may derogate from Article 24 (1) in
                                                                     respect of a given export on submission by the controller of
                                                                     the file of sufficient proof that an adequate level of
                            Article 23                               protection will be provided. The Member State may grant a
                                                                     derogation only after it has informed the Commission and
                                                                     the Member States thereof and in the absence of notice of
                            Sanctions                                opposition given by a Member State or the Commission
                                                                     within a period of 10 days.
Each Member State shall make provision in its law for the
application of dissuasive sanctions in order to ensure               2. Where notice of opposition is given, the Commission
compliance with the measures taken pursuant to this                  shall adopt appropriate measures in accordance with the
Directive.                                                           procedure laid down in Article 30 (2).
 ---pagebreak--- 5. 11. 90                               Official Journal of the European Communities                               No C 277/11
                         CHAPTER IX                                 (a) contribute to the uniform application of the national
   SUPERVISORY AUTHORITIES AND WORKING PARTY                            rules adopted pursuant to this Directive;
       ON THE PROTECTION OF PERSONAL DATA
                                                                    (b) give an opinion on the level of protection in the
                          Article 26                                    Community and in third countries;
                    Supervisory authority
                                                                   (c) advise the Commission on any draft additional or
 1. The Member States shall ensure that an independent                  specific measures to be taken to safeguard the
competent authority supervises the protection of personal               protection of privacy.
data. The authority shall monitor the application of the
national measures taken pursuant to this Directive and             2. If the Working Party on the Protection of Personal
perform all the functions that are entrusted to it by this         Data finds that significant divergences are arising between
Directive.                                                         the laws or practices of the Member States in relation to the
                                                                   protection of personal data which might affect the
2. The authority shall have investigative powers and               equivalence of protection in the Community, it shall inform
effective powers of intervention against the creation and          the Commission accordingly.
exploitation of files which do not conform with this
Directive. To that end, it shall have inter alia the right of      3. The Working Party on the Protection of Personal Data
access to files covered by this Directive and shall be given       may formulate recommendations on any questions con-
the power to gather all the information necessary for the          cerning the protection of individuals in relation to personal
performance of its supervisory duties.                             data in the Community. The recommendations shall be
                                                                   recorded in the minutes and may be transmitted to the
3. Complaints in connection with the protection of                 Advisory Committee referred to in Article 30. The
individuals in relation to personal data may be lodged with        Commission shall inform the Working Party on the
the authority by any individual.                                   Protection of Personal Data of the action it has taken in
                                                                   response to the recommendations.
                          Article 27                               4. The Working Party on the Protection of Personal Data
                                                                   shall draw up an annual report on the situation regarding
                                                                   the protection of individuals in relation to the processing of
    Working Party on the Protection of Personal Data              personal data in the Community and in third countries,
                                                                   which it shall transmit to the Commission.
1. A Working Party on the Protection of Personal Data is
hereby set up. The Working Party, which shall have
advisory status and shall act independently, shall be
composed of representatives of the supervisory authorities                                  CHAPTER X
provided for in Article 26 of all the Member States and
shall be chaired by a representative of the Commission.                  RULE-MAKING POWERS OF THE COMMISSION
                                                                                             Article 29
2. The secretariat of the Working Party on the Protection
of Personal Data shall be provided by the Commission's                           Exercise of rule-making powers
departments.
                                                                  The Commission shall, in accordance with the procedure
3. The Working Party on the Protection of Personal Data           laid down in Article 30 (2), adopt such technical measures
shall adopt its own rules of procedure.                           as are necessary to apply this Directive to the specific
                                                                  characteristics of certain sectors having regard to the state
                                                                  of the art in this field and to the codes of conduct.
4. The Working Party on the Protection of Personal Data
shall examine questions placed on the agenda by its
chairman, either on his own initiative or at the reasoned
request of a representative of the supervisory authorities,                                  Article 30
concerning the application of the provisions of Community
law on the protection of personal data.                                                Advisory Committee
                                                                   1. The Commission shall be assisted by a Committee of
                          Article 28
                                                                  an advisory nature composed of the representatives of the
                                                                  Member States and chaired by a representative of the
     Tasks of the Working Party on the Protection of               Commission.
                        Personal Data
                                                                  2. The representative of the Commission shall submit to
1. The Working Party on the Protection of Personal Data           the Committee of draft of the measures to be taken. The
shall:                                                             Committee shall deliver its opinion on the draft within a
 ---pagebreak--- No C 277/12                                     Official Journal of the European Communities                                                                 5. 11. 90
time limit which the chairman may lay down according to                                       The provisions adopted pursuant to the first subparagraph
the urgency of the matter, if necessary by taking a vote. The                                 shall make express reference to this Directive.
opinion shall be recorded in the minutes; in addition, each
Member State shall have the right to ask to have its position                                 2. The Member States shall communicate to the Commis-
recorded in the minutes. The Commission shall take the                                        sion the texts of the provisions of national law which they
utmost account of the opinion delivered by the Committee.                                     adopt in the field covered by this Directive.
It shall inform the Committee of the manner in which its
opinion has been taken into account.                                                                                                 Article 32
                                                                                              The Commission shall report to the Council and the
                                                                                              European Parliament at regular intervals on the implemen-
                         FINAL PROVISIONS
                                                                                              tation of this Directive, attaching to its report, if necessary,
                                Article 31                                                    suitable proposals for amendments.
1. The Member States shall bring into force the laws,                                                                                Article 33
regulations and administrative provisions necessary for
them to comply with this Directive by 1 January 1993.                                         This Directive is addressed to the Member States.
              P r o p o s a l for a Council Directive concerning the p r o t e c t i o n of p e r s o n a l d a t a a n d privacy in t h e
              c o n t e x t of public digital t e l e c o m m u n i c a t i o n s n e t w o r k s , in p a r t i c u l a r t h e integrated services digital
                                           n e t w o r k (ISDN) a n d public digital mobile n e t w o r k s
                                                            COM(90)            314 final — SYN                 288
                                              (Submitted         by the Commission                   on 27 July             1990)
                                                                             (90/C 277/04)
THE COUNCIL OF THE EUROPEAN COMMUNITIES,                                                      (4)    Whereas the Council, in its resolution of 30 June 1988
                                                                                                     on the development of the common market for
                                                                                                     telecommunications services and equipment up to
Having regard to the Treaty establishing the European                                                 1992 (1), has called for steps to be taken to protect
Economic Community, and in particular Article 100A                                                   personal data, in order to create an appropriate
thereof,                                                                                             environment for the future development of telecom-
                                                                                                     munications in the Community; whereas the Council
Having regard to the proposal from the Commission,                                                   has re-emphasized the importance of the protection of
                                                                                                     personal data and privacy in its resolution of 18 July
                                                                                                      1989 on the strengthening of the coordination for the
In cooperation with the European Parliament,                                                         introduction of the integrated services digital network
                                                                                                      (ISDN) in the European Community ( 2 );
Having regard to the opinion of the Economic and Social
Committee,
                                                                                              (5)    Whereas the European Parliament has underlined the
                                                                                                     importance of the protection of personal data and
(1)  Whereas Council Directive ... concerning the protec-                                            privacy in telecommunications networks, in particular
     tion of individuals in relation to the processing of                                            with regard to the introduction of the integrated
     personal data exhorts Member States to ensure the                                               services digital network (ISDN) (3) (4) ( 5 );
     protection of privacy;
(2)  Whereas currently in the European Community new                                          (6)    Whereas Commission recommendation 81/679/EEC
     advanced digital public telephone networks are                                                  calls for the adoption and ratification by Member
     emerging which give rise to specific requirements
     concerning the protection of personal data and
     privacy of the user;
                                                                                              (!) OJ No C 257, 4. 10. 1988, p. 1.
                                                                                              (2)   OJ  No     C    196, 1. 8. 1989, p. 4.
(3)  Whereas this is the case, in particular, with the                                        (3)   OJ  No     C    7, 12. 1. 1987, p. 334.
     introduction of the integrated services digital network                                  (4)   OJ  No     C    12, 16. 1. 1989, p. 69.
     (ISDN) and public digital mobile networks;                                               (5)   OJ  No     C    12, 16. 1. 1989, p. 66.