CELEX: 51990PC0314(02)
Language: en
Date: 1990-09-13
Title: PROPOSAL FOR A COUNCIL DIRECTIVE CONCERNING THE PROTECTION OF PERSONAL DATA AND PRIVACY IN THE CONTEXT OF PUBLIC DIGITAL TELECOMMUNICATIONS NETWORKS, IN PARTICULAR THE INTEGRATED SERVICES DIGITAL NETWORK (ISDN) AND PUBLIC DIGITAL MOBILE NETWORKS

No C 277/12                                     Official Journal of the European Communities                                                                 5. 11. 90
time limit which the chairman may lay down according to                                       The provisions adopted pursuant to the first subparagraph
the urgency of the matter, if necessary by taking a vote. The                                 shall make express reference to this Directive.
opinion shall be recorded in the minutes; in addition, each
Member State shall have the right to ask to have its position                                 2. The Member States shall communicate to the Commis-
recorded in the minutes. The Commission shall take the                                        sion the texts of the provisions of national law which they
utmost account of the opinion delivered by the Committee.                                     adopt in the field covered by this Directive.
It shall inform the Committee of the manner in which its
opinion has been taken into account.                                                                                                 Article 32
                                                                                              The Commission shall report to the Council and the
                                                                                              European Parliament at regular intervals on the implemen-
                         FINAL PROVISIONS
                                                                                              tation of this Directive, attaching to its report, if necessary,
                                Article 31                                                    suitable proposals for amendments.
1. The Member States shall bring into force the laws,                                                                                Article 33
regulations and administrative provisions necessary for
them to comply with this Directive by 1 January 1993.                                         This Directive is addressed to the Member States.
              P r o p o s a l for a Council Directive concerning the p r o t e c t i o n of p e r s o n a l d a t a a n d privacy in t h e
              c o n t e x t of public digital t e l e c o m m u n i c a t i o n s n e t w o r k s , in p a r t i c u l a r t h e integrated services digital
                                           n e t w o r k (ISDN) a n d public digital mobile n e t w o r k s
                                                            COM(90)            314 final — SYN                 288
                                              (Submitted         by the Commission                   on 27 July             1990)
                                                                             (90/C 277/04)
THE COUNCIL OF THE EUROPEAN COMMUNITIES,                                                      (4)    Whereas the Council, in its resolution of 30 June 1988
                                                                                                     on the development of the common market for
                                                                                                     telecommunications services and equipment up to
Having regard to the Treaty establishing the European                                                 1992 (1), has called for steps to be taken to protect
Economic Community, and in particular Article 100A                                                   personal data, in order to create an appropriate
thereof,                                                                                             environment for the future development of telecom-
                                                                                                     munications in the Community; whereas the Council
Having regard to the proposal from the Commission,                                                   has re-emphasized the importance of the protection of
                                                                                                     personal data and privacy in its resolution of 18 July
                                                                                                      1989 on the strengthening of the coordination for the
In cooperation with the European Parliament,                                                         introduction of the integrated services digital network
                                                                                                      (ISDN) in the European Community ( 2 );
Having regard to the opinion of the Economic and Social
Committee,
                                                                                              (5)    Whereas the European Parliament has underlined the
                                                                                                     importance of the protection of personal data and
(1)  Whereas Council Directive ... concerning the protec-                                            privacy in telecommunications networks, in particular
     tion of individuals in relation to the processing of                                            with regard to the introduction of the integrated
     personal data exhorts Member States to ensure the                                               services digital network (ISDN) (3) (4) ( 5 );
     protection of privacy;
(2)  Whereas currently in the European Community new                                          (6)    Whereas Commission recommendation 81/679/EEC
     advanced digital public telephone networks are                                                  calls for the adoption and ratification by Member
     emerging which give rise to specific requirements
     concerning the protection of personal data and
     privacy of the user;
                                                                                              (!) OJ No C 257, 4. 10. 1988, p. 1.
                                                                                              (2)   OJ  No     C    196, 1. 8. 1989, p. 4.
(3)  Whereas this is the case, in particular, with the                                        (3)   OJ  No     C    7, 12. 1. 1987, p. 334.
     introduction of the integrated services digital network                                  (4)   OJ  No     C    12, 16. 1. 1989, p. 69.
     (ISDN) and public digital mobile networks;                                               (5)   OJ  No     C    12, 16. 1. 1989, p. 66.
 ---pagebreak--- 5. 11. 90                              Official Journal of the European Communities                              No C 277/13
     States of the Council of Europe Convention for the                particular, not be used to give such telecommuni-
     protection of individuals with regard to automatic                cations organization any undue competitive ad-
     processing of personal data which spells out general              vantage over other service providers;
     principles for the protection of personal data;
                                                                  (15) Whereas this Directive should implement in the
                                                                       telecommunications sector the general principles
(7)  Whereas a number of Member States have adopted                    concerning the subscriber's right to inspect the
     and ratified this Convention;                                     personal data stored about him/her, his right to
                                                                       request the rectification or erasure of such data, if
                                                                       necessary, as well as his right to prevent non-
(8)  Whereas Council Decision ... opens negotiations with              authorized disclosure of his personal data;
     a view to the accession of the European Economic
     Community, in the fields in which it is competent, to
     the Convention of the Council of Europe for the              (16) Whereas this Directive must provide for harmoniz-
     protection of individuals with regard to automatic                ation of the Member States' rules concerning the
     processing of personal data;                                      protection of privacy in the field of itemized call
                                                                       statements;
(9)  Whereas Council Directive ... [concerning the protec-        (17) Whereas, it is necessary, as regards the calling line
     tion of individuals in relation to the processing of              identification, to protect both the right of the calling
     personal data implements the adoption of these                    party to remain anonymous and the privacy of the
     general principles in the Community];                             called party with regard to unidentified calls;
                                                                  (18) Whereas safeguards must be provided for the users of
(10) Whereas, in the case of public digital networks,
                                                                       teleshopping and videotex services against unauthor-
     specific legal, regulatory, and technical provisions
                                                                       ized use of their personal data as well as for the
     must be made in order to protect personal data and the
                                                                       subscribers in general against intrusion into their
     privacy of users with regard to the increasing risks
                                                                       privacy by means of unsolicited calls;
     connected with the computerized storage and proces-
     sing of personal data in such networks;
                                                                  (19) Whereas it is necessary to ensure that the introduction
                                                                       of technical features of telecommunications equip-
(11) Whereas Member States are currently developing                    ment for data protection purposes is harmonized in
     divergent provisions in this area;                                order to be compatible with the implementation of the
                                                                       internal market of 1992;
(12) Whereas given the obstacles resulting from these             (20) Whereas the implementation of this Directive with
     divergent legal, regulatory, and technical provisions             regard to third countries must take into account the
     concerning the protection of personal data and                    level of protection of personal data and privacy in
     privacy in the context of the implementation of public            those countries as provided for in the Council
     digital telecommunications networks in the Com-                   Directive [concerning the protection of individuals in
     munity, in particular the integrated services digital             relation to the processing of personal data];
     network (ISDN) and public digital mobile networks,
     the full establishment of a Community-wide market in
     telecommunications services and equipment requires           (21) Whereas all matters concerning protection of personal
     the rapid introduction of harmonized provisions;                  data and privacy in the context of public digital
                                                                       telecommunications networks, which are not covered
                                                                       by the provisions of this specific Directive, the Council
                                                                       Directive mentioned above shall apply;
(13) Whereas this Directive should determine the extent to
     which personal data may be collected, stored and
     processed in connection with the provision of
                                                                  (22) Whereas this Directive does not address issues of
     telecommunications services;
                                                                       protection of personal data and privacy related to
                                                                       national security;
(14) Whereas the collection, storage, and processing of
     personal data by a telecommunications organization is        (23) Whereas it is useful for the preparation of measures
     justified for the purposes of the provision of the                intended to implement or modify this Directive to
     intended service only and may not be used without                 draw on the experience of the Working Party on the
     specific authorization by law or the subscriber's prior           Protection of Personal Data composed of represent-
     consent for any other purpose; whereas such collec-               atives of the supervisory authorities of the Member
     tion, storage, and processing of personal data may, in            States, set up by Article 27 of Council Directive ...
 ---pagebreak--- No C 277/14                             Official Journal of the European Communities                                 5. 11. 90
      [concerning the protection of individuals in relation to     3. 'public telecommunications network' means the public
      the processing of personal data];                                telecommunications infrastructure which permits the
                                                                       conveyance of signals between defined network termi-
 (24) Whereas such measures must be prepared with the                  nation points by wire, by microwave, by optical means
      assistance of the Committee composed of represent-               or by other electromagnetic means;
      atives of the Member States set up by Article 30 of
      Council Directive ... [concerning the protection of          4. 'public telecommunications service' means a telecom-
      individuals in relation to the processing of personal            munications service whose supply Member States have
      data],                                                           specifically entrusted inter alia to one or more
                                                                       telecommunications organizations.
HAS ADOPTED THIS DIRECTIVE:
                                                                                              Article 4
                           Article 1
                                                                   1. Collection, storage and processing of personal data by
                                                                   a telecommunications organization is justified for telecom-
 1. This Directive provides for the harmonization of the           munications purposes only, in particular in order to
provisions required to ensure an equal level of protection of     establish connections for the transmission of voice, data or
privacy in the Community and to provide for the free              image, to produce bills, to compile directories, and for
movement of telecommunications equipment and services             other legitimate operational purposes, for example fault
within and between Member States.                                 clearance, prevention of misuse of the telecommunications
                                                                  organization's equipment, or registration of incoming calls
2. The Member States shall adopt the necessary specific           in accordance with Article 13 (1).
provisions in order to guarantee the protection of personal
data and privacy in the telecommunications sector in
                                                                  2. The telecommunications organization shall not use
accordance with this Directive.
                                                                  such data to set up electronic profiles of the subscribers or
                                                                  classifications of individual subscribers by category.
                           Article 2
                                                                                             Article 5
1. Without prejudice to the general provisions of Council
Directive ... concerning the protection of individuals in
relation to the processing of personal data, this Directive        1. Personal data of the subscriber may be collected and
applies specifically to the collection, storage, and proces-      stored to the extent necessary to conclude, perform, amend
sing of personal data by telecommunications organizations         or terminate the contract with the telecommunications
in connection with the provision of public telecommuni-           organization. After termination of the contract the data are
cations services in public digital telecommunications             to be erased unless and for so long as they are required to
networks in the Community, in particular via the                  deal with complaints, to recover charges or to comply with
integrated services digital network (ISDN) and public             other obligations imposed by the law of the Member State,
digital mobile networks.                                          in conformity with Community law.
2. In case a Member State has not yet implemented the             2. The contents of the information transmitted must not
integrated services digital network (ISDN) or public digital      be stored by the telecommunications organization after the
mobile networks, the provisions of this Directive will be         end of the transmission, except where required by
implemented to the extent that they also apply to services        obligations imposed by the law of the Member State, in
based on analogue networks.                                       conformity with Community law.
                           Article 3                                                         Article 6
For the purposes of this Directive,
                                                                  The subscriber is entitled:
1. 'personal data' means any information relating to an
    identified or identifiable individual;                        — to obtain at reasonable intervals and without excessive
                                                                       delay or expense confirmation of whether personal data
                                                                       relating to him/her are stored as well as communication
2. 'telecommunications organization' means a public or
                                                                       to him/her of such data in an intelligible form,
    private body, to which a Member State grants special or
    exclusive rights for the provision of a public telecom-
    munications network and, where applicable, public             — to obtain, as the case may be, rectification or erasure of
    telecommunications services;                                       such data if they have been processed in breach of the
 ---pagebreak--- 5. 11. 90                                Official Journal of the European Communities                              No C 277/15
    provisions which are imposed by the law of the Member                                      Article 10
    State in conformity with Community la,w.
                                                                     1. Traffic data containing the personal data necessary to
                                                                    establish calls, or required for billing or other operational
                           Article 7                                purposes, such as the telephone number of the calling and
                                                                    of the called subscriber, the time each call started and
                                                                    finished and the telecommunications service used by the
                                                                    subscriber, may be collected, stored and processed as far as
1. In principle, all personal data processed in connection          this is necessary to provide the telecommunications service
with telecommunication networks and services are to be              required.
kept confidential.
                                                                    2. The traffic data stored in the switching centres of the
2. The personal data may not be disclosed outside the               telecommunications organization must be erased after
services or the network of the telecommunications                   termination of the call unless the data are anonymized or
organization without specific authorization by law or the           are required for billing or other legitimate purposes in the
subscriber's prior consent. A subscriber shall be held to           meaning of Article 4.
have given such consent only where it is given by way of a
specific response to a request by the telecommunications
organization. Without the subscriber's prior consent, these
personal data must not be disclosed to persons within the                                      Article 11
telecommunications organization who are not dealing with
the relevant services provided.
                                                                    Upon application of the subscriber an itemized call
                                                                    statement may be produced, containing, among other
3. The telecommunications organization must not make                items, the telephone numbers of the called subscribers
the provision of its service dependent upon such consent.           without the last four digits.
                           Article 8                                                           Article 12
1. The telecommunications organization must provide                 1. With regard to communications between subscribers
adequate, state-of-the-art protection of personal data              linked to digital exchanges, the calling subscriber must
against unauthorized access and use.                                have the possibility to eliminate via a simple technical
                                                                    facility the identification of his/her telephone number on
                                                                    the display of the called subscribers' terminal equipment,
2. In case of particular risk of a breach of the security of        or its recording in a storage facility of this terminal, on a
the network, for example in the field mobile radio                  case-by-case basis.
telephony, the telecommunications organization must
inform the subscribers concerning such risk and offer them          The transmission of the telephone number may also be
an end-to-end encryption service.                                   permanently eliminated by the telecommunications organi-
                                                                    zation upon application of the calling subscriber.
                                                                    2. The called subscriber may apply for permanent
                           Article 9                                elimination of the identification of all incoming calls; he/
                                                                    she must also be able to turn off the display of his/her
                                                                    terminal equipment, or to eliminate the recording in the
1. Billing data containing the telephone number or                  terminal's storage facility, in order to prevent the
identification of the subscriber station, the address of the        identification of the incoming calls, on a case-by-case basis.
subscriber and the type of station, the total number of units
to be charged for the accounting period, the called                 The called subscriber must be able to limit the acceptance
telephone number, the type and duration of the calls made           of incoming calls to those which identify the calling
and/or the data volume transmitted as well as other                 subscriber's number.
information needed for billing such as advance payment by
instalments, disconnection and reminders, may be stored
and processed.                                                      3. With regard to communications between a subscriber
                                                                    linked to an analogue exchange and subscribers linked to
                                                                    digital exchanges, the former subscriber is to be informed
2. Such a general storage of billing data is permissible up         of the identification of his/her telephone number and to be
to the end of the statutory period during which the bill may        offered the permanent elimination of the feature upon
be challenged.                                                      application. This subscriber must also have the possibility
 ---pagebreak--- No C 277/16                              Official Journal of the European Communities                                 5. 11. 90
to eliminate the identification on a case-by-case basis.                                      Article 16
                                                                    1. The telecommunications organization must ensure
                           Article 13
                                                                    that the telephone number as well as other personal data of
                                                                    the subscriber, in particular concerning the quantity and
1. For a limited period of time, the telecommunications             nature of his/her orders when using a teleshopping service
organization may override the elimination of the calling            or concerning the information requested via a videotex
line identification:                                                service, is stored only to the extent strictly necessary to
                                                                    supply the service and is only used by the service provider
                                                                    for purposes authorized by this subscriber.
(a) upon application of a subscriber requesting the tracing
    of malicious calls. In this case, the data containing the
    identification of the calling subscriber will be stored by      2. Subject to the provisions of Article 20, the service
    the telecommunications organization and be made                 provider may not set up electronic profiles of the
    available upon request to the public authority charged          subscribers or classifications of individual subscribers by
    with the prevention or pursuit of criminal offences of          category, without their prior consent.
    the Member State concerned;
(b) upon specific court order, in order to prevent or pursue                                  Article 17
    serious criminal offences.
2. A permanent override function must be made available             1. Subscribers who receive unsolicited calls for advertis-
upon request:                                                       ing purposes or for the purpose of offering the supply or
                                                                    provision of goods and services may notify the telecom-
                                                                    munications organization conveying such messages that
(a) to organizations recognized by a Member State which
                                                                    they do not wish to receive these calls.
    answer and deal with emergency calls; and
(b) to fire brigades operated or recognized by a Member             2. The telecommunications organization must take the
                                                                    steps necessary to terminate the transmission of such
    State.
                                                                    messages to the subscribers concerned. Furthermore, the
                                                                    telecommunications organization must keep a list of the
3. The telecommunications organizations shall take the              notifications in a form specified and available for
necessary steps to ensure that the override function is             inspection by the regulatory authority, in order to prevent
operational on a national and Community-wide basis.                 such calls in future.
                           Article 14
                                                                                              Article 18
1. Calls may be forwarded from the called subscriber to a
third party only if this party has agreed; the third party may      1. In implementing the provisions of this Directive,
limit automatic forwarding to those calls which identify the        Member States shall ensure, subject to paragraphs (2) and
calling subscriber's number; the third party must be                (3) of this Article, that no mandatory requirements for
informed via a specific signal of the message that the call         specific technical features are imposed on terminal or other
has been forwarded.                                                 telecommunications equipment which could impede the
                                                                    placing of equipment on the market and the free circulation
                                                                    of such equipment in and between Member States.
2. The calling subscriber must be informed automatically
during the establishment of the connection that the call is
being forwarded to a third party.                                   2. Where provisions can only be implemented by
                                                                    requiring specific technical features, Member States shall
                                                                    inform the Commission according to the procedures
                                                                    provided for by Council Directive 83/189/EEC (*) which
                           Article 15                               lays down a procedure for the provision of information in
                                                                    the field of technical standards and regulations.
1. If the content of telephone calls is made accessible to
third parties via technical devices, such as loudspeakers or        3. Where required, the Commission will ensure the
other on-hook equipment, or stored on tape for own use or           drawing up of common European standards for the
use by third parties, provision must be made in order that          implementation of specific technical features, in accord-
the parties concerned are informed via an appropriate               ance with Council Directive ... [on the approximation of
procedure of such diffusion or storage before the diffusion         the laws of the Member States concerning telecommuni-
or storage is initiated and for so long as the IT continues.        cations terminal equipment, including the mutual recog-
2. Paragraph 1 does not apply in the cases covered by
Article 13 (1).                                                     (!) OJ No L 109, 26. 4. 1983, p. 8.
 ---pagebreak--- 5. 11. 90                              Official Journal of the European Communities                              No C 277/17
nition of their conformity], and Council Decision 87/95/          approximating certain laws, regulations and adminis-
EEC of 22 December 1986 on standardization in the field of        trative provisions of the Member States concerning the
information technology and telecommunications (1).                protection of individuals in relation to the processing of
                                                                  personal data shall carry out the tasks laid down in
                          Article 19                              Article 28 of the abovementioned Directive also with
                                                                  regard to the data protection measures which are the
1. The provisions of this Directive relating to the               subject of this Directive.
telephone service shall be applied to other public digital
telecommunications services to the extent that these              2. The Working Party will be specifically constituted for
services present similar risks for the privacy of the user.       the purposes of this Directive.
2. The measures necessary for the implementation of
paragraph 1 shall be adopted by the Commission after                                       Article 23
consultation of the Working Party referred to in Article 22
and in accordance with the procedure laid down in                 1. The procedure laid down in Article 30 of Council
Article 23.                                                       Directive ... approximating certain laws, regulations and
                                                                  administrative provisions of the Member States concerning
                           Article 20                             the protection of individuals in relation to the processing of
                                                                  personal data shall apply.
To the extent that the full achievement of the objectives of
this Directive requires the application of its provisions to      2. The Committee established in the framework of that
service providers other than telecommunications organiza-         procedure will be constituted specifically for the purposes
tions, the Commission may adopt the measures necessary            of this Directive.
for the application of this Directive to those service
providers after consultation of the Working Party referred
to in Article 22 and in accordance with the procedure laid                                 Article 24
down in Article 23.
                                                                  1. The Member States shall bring into force the laws,
                           Article 21                             regulations, and administrative provisions necessary for
                                                                  them to comply with this Directive by 1 January 1993 at the
The details of the application of this Directive and the          latest.
modifications necessary to adapt this Directive to new
technical developments shall be determined by the                 The provisions adopted pursuant to the first subparagraph
Commission in accordance with the procedure laid down in          shall make express reference to this Directive.
Article 23.
                                                                  2. The Member States shall communicate to the Commis-
                                                                  sion the texts of the provisions of national law which they
                           Article 22
                                                                  adopt in the field covered by this Directive.
 1. The Working Party on the Protection of Personal Data
established according to Article 27 of Council Directive ...
                                                                                           Article 25
 (!) OJ No L 36, 7. 2. 1987, p. 31.                               This Directive is addressed to the Member States.